Building seamless, consistent security policies across on-premises and cloud IT environments can be challenging without comprehensive workload visibility. Palo Alto Networks provides organizations with the visibility and automation needed to create and update security policies in your cloud environment in real time. Learn how you can gain greater control over your applications, automatically create consistent and uniform security policies, and prevent known and unknown threats within application flows. Michael South, AWS Security Acceleration Business Development Matt McLimans, Public Cloud Consultant Engineer, Palo Alto Networks Mark Nunnikhoven, Vice President of Cloud Research at Trend Micro

1. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Michael South, Americas Regional Leader,
AWS Public Sector Security & Compliance Business Acceleration
Secure and Automate AWS
Deployments with Next Generation
Security
Matthew Mclimans
Palo Alto Public Cloud Consultant Engineer

2. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Why is security traditionally so hard?
Lack of
Visibility
Low degree
of Automation
Lack of
Resiliency
Defense in
Depth

3. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Four Security Benefits of the Cloud
• Increased visibility
• Increased availability and resiliency
• True Defense-in-Depth
• Ability to automate Security and Compliance

4. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Visibility

5. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
AWS Services that provide Operational
Visibility
AWS CloudTrail
Track user activity
and API usage
Amazon
CloudWatch
Monitor resources
and applications
Amazon
Inspector
Analyze OS and
application security
AWS Artifact
Self-service for AWS’
compliance reports
Amazon VPC
Flow Logs
Track network
activity in/out of VPC
Amazon
GuardDuty
Intelligent Threat
Detection
Amazon Macie
Discover, classify, and
protect sensitive data
AWS Trusted
Advisor
Guidance to reduce
cost, increase
performance, and
improve security
AWS WAF Logs
Track application
access/denials

6. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Resiliency

7. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
AWS Global Infrastructure Region & Number of Availability Zones
AWS GovCloud EU
Oregon (3) Ireland (3)
Ohio (3) *Coming Soon Frankfurt (3)
London (3)
US West Paris (3)
Oregon (3)
Northern California (3) Asia Pacific
Singapore (3)
US East Sydney (3)
N. Virginia (6) Tokyo (4)
Ohio (3) Seoul (2)
Mumbai (2)
Canada
Central (2) China
Beijing (2)
South America Ningxia (3)
São Paulo (3)
Announced Regions
Bahrain, Hong Kong, Sweden, AWS GovCloud East
18Regions
55
Availability
Zones
121
Edge
Locations
AWS GovCloud (US)

8. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
- Regions: metropolitan area with independent “cloud”
- Fully Isolated from other Regions (security boundary)
- Customer chooses Region - Data stays within Region
- Regions comprised of multiple Availability Zones
AZ = 1 or more “data centers”
- AZ’s connected through redundant low-latency links
- Physically separated; Separate Low Risk Flood Plains
- Discrete UPS & Onsite backup
- Redundant connections to multiple tier-1 ISP’s
- Built for Continuous Availability
AWS Region and Availability Zone View
Availability Zone Physical Datacenter Fiber
Region

9. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Achieving High Availability in AWS
Customer data center
WEB
APP
DB
WEB
LB
FW
Customer Datacenter AWS Virtual Private Cloud (VPC)
AWS Region
App Subnet
Availability Zone A
Database Subnet
DMZ Subnet
Web
Server
App
Server
DB
Server
primary
Availability Zone B
Database Subnet
DB
Server
secondary
Web
Server
App
Server
App Subnet
DMZ Subnet
auto scaling group
auto scaling group
security groupsecurity group
synchronous
replication

10. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Defense in Depth

11. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Reality of Many On-Prem Network Defenses
Hard Outer Shell
(Perimeter)
Soft and Gooey Middle
(Datacenter/Network)WAF
Firewall
IDS/IPS
DLP
VLANs
ACLs

12. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Defense-in-Depth in AWS at the Perimeter
Web
Server
App
Server
DB
Server
primary
DMZ Subnet
App Subnet
DB Subnet
AWS Shield
DDoS Protection
AWS WAF
Web Application Firewall
VPN Gateway
Secure DevOps Comms
VPC w/ ACLs
Stateless Firewall
Internet Gateway
Path to Public Internet
(Not present by default)
Amazon GuardDuty
Signature & Behavioral-based
Intrusion Detection System
using Machine Learning
AWS Direct Connect
Private Fiber Comms
Partner Solutions
Firewall, IDS/IPS, WAF

13. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Defense-in-Depth in AWS between Workloads
App Security Group
DMZ Security Group
Database Security Group
Web
Server
App
Server
DB
Server
primary
DMZ Subnet
App Subnet
DB Subnet
App Security Group
DMZ Security Group
Database Security Group
Web
Server
App
Server
DB
Server
primary
DMZ Subnet
App Subnet
DB Subnet
VPCs w/ ACLs
Stateless Firewall
Default
No Communications Between VPCs
VPCs w/ ACLs
Stateless Firewall
Internet Gateway
Path to Public Internet
VPN Connection
Secure Communications over Internet
VPN Peering
Private network connection between VPCs

14. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Defense-in-Depth in AWS inside the Workload
App Security Group
DMZ Security Group
Database Security Group
Web
Server
App
Server
DB
Server
secondary
DMZ Subnet
App Subnet
DB Subnet
Security Group
Statefull Firewall between
Each application tier
Amazon GuardDuty
Signature & Behavioral-based
Intrusion Detection System
using Machine Learning
Web
Server
Web
Server
App
Server
App
Server
DB
Server
primary
Security Group
Does NOT allow peer-to-
peer communications by
default
Amazon CloudWatch
Event Management
and Alerting
AWS CloudTrail
API LoggingAmazon Inspector
Security & Compliance
assessment
3rd Party EPS
OS Anti-virus, Firewall,
Host Intrusion
Protection System

15. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Automation

16. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Get the humans away from the data

17. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Amazon GuardDuty Threat Detection

18. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Amazon GuardDuty IDS
• Reconnaissance
• Instance recon:
• Port probe / accepted comm
• Port scan (intra-VPC)
• Brute force attack (IP)
• Drop point (IP)
• Tor communications
• Account recon
• Tor API call (failed)
Instance compromise
• C&C activity
• Malicious domain request
• Amazon EC2 on threat list
• Drop point IP
• Malicious comms (ASIS)
• Bitcoin mining
• Outbound DDoS
• Spambot activity
• Outbound SSH brute force
• Unusual network port
• Unusual traffic volume/direction
• Unusual DNS requests
Account compromise
• Malicious API call (bad IP)
• Tor API call (accepted)
• CloudTrail disabled
• Password policy change
• Instance launch unusual
• Region activity unusual
• Suspicious console login
• Unusual ISP caller
• Mutating API calls (create, update,
delete)
• High volume of describe calls
• Unusual IAM user added
• Detections in gray are signature based, state-less findings
• Detections in blue are behavioral, state-full findings / anomaly detections

19. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Automate with integrated services
Amazon
CloudWatch
Event
CloudWatch Events
Amazon
CloudWatch
Lambda
Lambda Function
AWS Lambda
GuardDuty
Amazon
GuardDuty
Automated threat remediation
Web Application
Firewall
AWS WAF
WAF
Rule
Palo Alto
NGFW

20. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Workloads appropriate for AWS
Web applications
and websites
Backup,
recovery
and archiving
Disaster
recovery
Development
and test
Big data
High-performance
computingEnterprise IT MobileMission critical
applications
Data center
migration
and hybrid
IoT
Security
Operations

21. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Improving security with the cloud
For more details, see Re:Invent 2013 presentations by NASA JPL cyber
security engineer Matt Derenski (http://awsps.com/videos/SEC205E-640px.mp4)
“Based on our experience, I believe that we can be even
more secure in the AWS cloud than in our own
datacenters.”
-Tom Soderstrom, CTO, NASA JPL

22. RaEd Abudayyeh
Cloud Security Lead, Emerging Markets
Secure and Automate AWS
Deployments with Next Generation
Security.

23. PALO ALTO NETWORKS APPS 3rd PARTY APPS CUSTOMER APPS
SECURITY OPERATING PLATFORM
LOGGING SERVICE THREAT INTEL DATA
NETWORK ENDPOINT CLOUD
APPLICATION FRAMEWORK

24. LEADERSHIP IN CYBERSECURITY
63% of the Global 2K
are Palo Alto Networks customers
29% year over year
revenue growth*
85
of Fortune 100
rely on Palo Alto Networks
#1
in Enterprise
Security
54,000+
customers
in 150+ countries
Revenue trend
40% CAGR
FY14 - FY18
FY14 FY15 FY16 FY17 FY18
• Q4FY2018. Fiscal year ends July 31.
• Gartner, Market Share: Enterprise Network Equipment by Market Segment, Worldwide, 1Q18, 14 June 2018

25. CONSISTENT PREVENTION EVERYWHERE
SaaS
PHYSICAL NETWORK
PRIVATE
CLOUD
IaaS
PaaS
MOBILE
25 | © 2018 Palo Alto Networks. All Rights Reserved.

26. SHARED
RESPONSIBILTY

27. AWS SECURITY = A SHARED RESPONSIBILITY
AWS Foundation Services
Compute Storage Database Networking
AWS Global
Infrastructure Regions
Availability Zones
Edge Locations
Encryption Key
Management
Client & Server
Encryption
Network Traffic
Protection
Platform, Applications, Identity & Access Management
Operating System, Network & Firewall Configuration
Customer content
Customers are
responsible for
their security IN
the Cloud
AWS looks after
the security OF
the platform

28. CLOUD USAGE TYPES
SAASPRIVATE
PHYSICAL
IAA
S
PAAS

29. SECURING THE CLOUD IS HARD
Fragmented
Security
Human
Error
Manual
Security

30. “A Public Cloud Risk Model: Accepting Cloud Risk Is OK, Ignoring Cloud Risk Is Tragic,” Gartner, November 2, 2016
TRIVIA QUESTION!
95%
Through 2020
Of cloud security
failures will be the
customer fault

31. SAASPRIVATE
PHYSICAL
SECURING THE PUBLIC CLOUD
IAAS PAAS

32. HOST
Continuous security
& compliance
INLINE
Protect and segment
cloud workloads
API-BASED
Secure OS & app
within workloads
OURVISION FOR CLOUD SECURITY

33. EV
WEB
Object Storage Caching Database
IaaS
PaaS
Web
Server
APP
App
Server
THREE KEY SECURITY ELEMENTS
INLINE
Protect and
Segment Cloud
Workloads
API
HOST
Secure OS
& App Within
Workloads
API
Continuous
Security &
Compliance
On-Premises
Virtual Private Cloud (VPC)
Evident
Traps
VM-Series
NGFW

34. WEB
Object Storage Caching Database
IaaS
PaaS
Web
Server
APP
App
Server
WEB
Object Storage Caching Database
IaaS
PaaS
Web
Server
APP
App
Server
WEB
Object Storage Caching Database
IaaS
PaaS
Web
Server
APP
App
Server
PROTECT AND SEGMENT CLOUD WORKLOADS
VM-SERIES
On-Premises
Application visibility and
workload segmentation
Auto-scale based
on triggers
Prevent outbound and
inbound attacks
Virtual Private Cloud (VPC)

35. CONTINUOUS MONITORING AND COMPLIANCE
EVIDENT
API
Is MFA Enabled?
Is any sensitive data exposed?
What services are running?
Who has access to this resource?
Evident
Discover and Monitor
Resources
Compliance
Reporting
Secure Storage
Services
EV

36. APP
WORKLOAD
Lightweight
Agent
Real-time Exploit and
Malware Protection
Protects Unpatched
Workloads
WORKLOAD PROTECTION
TRAPS
Multi-method
Attack Prevention
Traps Advanced
Endpoint Protections

37. PLATFORM AUTOMATION
URL
Filtering
CLOUD-
DELIVERED
SECURITY
SERVICES
WEB
Object Storage Caching Database
IaaS
PaaS
Web
Server
APP
App
Server
API
3rd
party
feeds
Customer
data
Amazon
GuardDuty
MineMeld
Threat
Prevention
Malware
Analysis
EV
Evident
Traps
VM-Series
NGFW

38. IAA
S
PAAS
LET’S TALK SAAS SECURITY
PRIVATE
PHYSICAL
SAAS

39. SAAS SECURITY APPROACHES
SaaS Native
Security
Limited Scope
CASB
Vendors
Limited Security
Legacy Content
Security
Limited Context

40. OUR APPROACH TO SAAS SECURITY
Remote Users
Branch
Headquarters
Unmanaged
Devices
Managed
Devices
GlobalProtect
Cloud Service
NGFW
Aperture
A
PI
Sanctioned
Tolerated
Unsanctioned
SaaS application
visibility and granular
enforcement delivered
inline
Monitor in-cloud
activity and protect
data with Aperture

41. PHYSICAL
NETWORK
MOBILE
PRIVATE
CLOUD
CONSISTENT & FRICTIONLESS PREVENTION
EVERYWHERE
IAAS
SAAS
PAAS

42. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Thank you
Rate my session.
https://amzn.to/ottawa-sessions
Track: Management
Session: 9:00 AM - Secure and Automate AWS Deployments
with Next-Generation Security
How did we do?
https://amzn.to/ottawa-summit