Public-Cloud Kunden, haben Multi-Account Architekturen (z.B. Landing Zone), um den DevOps-Teams Autonomie und Geschwindigkeit zu geben. In diesem Umfeld zentrale Security Anforderungen im Bezug Governance und Compliance zu erfüllen, ist eine Herausforderung. Nuvibit Semper unterstützt die Reise vom DevOps- zum DevSecOps-Team, indem es erlaubt, Security Anforderungen durch das Applikations-Team zu spezifizieren und direkt zu applizieren. Unterschiedliche Anforderungen für z.B. Dev, Test, Prod können mit Policies spezifiziert werden. Die Lösung zeigt, was mit AWS nativen Security Services erreicht werden kann.

1. © 2022, Amazon Web Services, Inc. or its affiliates. All rights reserved.
DevSecOps-Teams das
Security-Steuer überlassen
B A T B E R N 4 7 Z U " S H I F T L E F T E V E R Y T H I N G "

2. © 2022, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Introduction

3. © 2022, Amazon Web Services, Inc. or its affiliates. All rights reserved.
AWS global infrastructure
26 geographical regions, 84 availability zones, 310+ POPs
Region & number of Availability Zones (AZs)
GovCloud (U.S.) Europe
U.S.-East (3), US-West (3) Frankfurt (3), Paris (3),
Ireland (3), Stockholm (3),
U.S. West London (3), Milan (3)
Oregon (4)
Northern California (3)
U.S. East
N. Virginia (6), Ohio (3)
Middle East
Bahrain (3)
Canada Asia Pacific
Central (3) Singapore (3), Sydney (3), Jakarta (3),
Tokyo (4), Osaka (3)
South America
São Paulo (3)
Seoul (4), Mumbai (3), Hong Kong (3)
Africa China
Cape Town (3) Beijing (2), Ningxia (3)
Announced Regions
8 Regions and 24 AZs in Australia, Canada, India, Israel, Australia, Switzerland,
Spain, and United Arab Emirates (UAE)

4. © 2022, Amazon Web Services, Inc. or its affiliates. All rights reserved.
AWS region design
AWS Regions are comprised of multiple AZs for high availability, high scalability, and
high fault tolerance. Applications and data are replicated in real time and consistent
in the different AZs.
AWS Availability Zone (AZ)
A Region is a physical location in the world
where we have multiple Availability Zones.
Availability Zones consist of one or more discrete data
centers, each with redundant power, networking, and
connectivity, housed in separate facilities.
AZ
AZ
AZ AZ
Transit
Transit
Datacenter
Datacenter
Datacenter
AWS Region

5. © 2022, Amazon Web Services, Inc. or its affiliates. All rights reserved.
What is an AWS account?
Each AWS account:
• Is a resource container/isolation boundary for
AWS services
• Is an explicit security boundary
• Is a container for cost tracking and billing
Security tooling
Templates & Images
Workload
AWS account
AWS account
AWS account

6. © 2022, Amazon Web Services, Inc. or its affiliates. All rights reserved.
With one account…
Workload Workload Workload
Workload Workload Workload
VPC 1 VPC 2
Private subnet
Public subnet
VPC 3
AWS account

7. © 2022, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Benefits of a multi-account environment
Centrally provision accounts and
resources
Share resources and control access
Optimize costs
Secure and audit your environment
for compliance
Benefits
Many teams
Business
process
Billing
Simplify billing
Isolation
& security
Tight security boundaries
Innovate with exclusive resources
for each team
Organize AWS accounts
Use cases

8. © 2022, Amazon Web Services, Inc. or its affiliates. All rights reserved.
With multiple accounts…
Workload
Sec tooling
Templates & images Workload
Workload
Workload
Dev VPC
Management account
AWS account AWS account
AWS account AWS account
AWS account AWS account

9. © 2022, Amazon Web Services, Inc. or its affiliates. All rights reserved.
A Is for “Alice” and B Is for “Bob”
Alice follows best practices Bob does NOT follow best practices

10. © 2022, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Bill’s
Bad
Day
AWS Account
Internal
Data Service
S3 Bucket
“Data Backup”
S3 Bucket
“Website
Images”
Web Server
Instance
AWS Cloud
VPC
Internet
Internet
Gateway
Bob

11. © 2022, Amazon Web Services, Inc. or its affiliates. All rights reserved.
AWS Account
Internal
Data Service
S3 Bucket
“Data Backup”
Intruder
S3 Bucket
“Website
Images”
Web Server
Instance
1 2
3 4
5
Bill’s
Bad
Day
1
Access the
vulnerable web
application
2 Pivot to the data
service
3
Delete the website
image files
4 Change
permissions to the
data backup
5 Download the data
backup
AWS Cloud
VPC
Internet
Internet
Gateway
Bob

12. © 2022, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Bill’s
Bad
Day
No web application
protection
2 No segmentation
3 One account
4
All permissions
granted
5
Sensitive data not
encrypted
1
6
No logging,
monitoring,
alerting
… now let’s help Alice
have a great day!
Alice
AWS Account
Internal
Data Service
S3 Bucket
“Data Backup”
S3 Bucket
“Website
Images”
Web Server
Instance
AWS Cloud
VPC
Internet
Internet
Gateway
Bob

13. © 2021, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Best-of-the-Best Practices: Logging and Monitoring
1) Turn on logging in all accounts, for
all services, in all regions
The AWS API history in CloudTrail enables security
analysis, resource change tracking, and compliance
auditing. GuardDuty provides managed threat
intelligence and findings.
2) Use the AWS platform’s built-in
monitoring and alerting features
Monitoring a broad range of sources will ensure that
unexpected occurrences are detected. Establish
alarms and notifications for anomalous or sensitive
account activity.
Amazon
GuardDuty
AWS
CloudTrail
AWS Config
AWS Security
Hub

14. © 2022, Amazon Web Services, Inc. or its affiliates. All rights reserved.
What is AWS Config?
AWS Config = Continuous configuration auditor
Changing resources AWS Config
Normalized
AWS Config rules
Notifications
API access
History, snapshot

15. © 2022, Amazon Web Services, Inc. or its affiliates. All rights reserved.
CloudTrail provides audit logs for AWS
An audit log of an AWS account’s
authenticated request to perform an action
with an AWS service and its resources

16. © 2022, Amazon Web Services, Inc. or its affiliates. All rights reserved.
How Amazon GuardDuty works?
VPC flow logs
DNS Logs
CloudTrail Events
Findings
Data Sources
Threat
intelligence
Anomaly
Detection
(ML)
AWS Security
Hub
• Alert
• Remediate
• Partner Solutions
• Send to SIEM
CloudWatch Event
Finding Types
Examples
Bitcoin
Mining
C&C
Activity
Unusual User behavior
Example:
• Launch instance
• Change Network Permissions
Amazon GuardDuty
Threat Detection
Types
HIGH
MEDIUM
LOW
Unusual traffic patterns
Example:
• Unusual ports and volume
Amazon Detective
S3 Data Plane Events
EKS control plane logs

17. © 2022, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Security Hub overview
AWS Identity and
Access Management
Access Analyzer

18. © 2022, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Many AWS accounts and many Security Finding
Workload
Dev VPC
AWS account
Workload
Dev VPC
AWS account
Workload
Dev VPC
AWS account
Workload
Dev VPC
AWS account
Workload
Dev VPC
AWS account

19. © 2022, Amazon Web Services, Inc. or its affiliates. All rights reserved.

20. © 2022, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Thank you!

21. Shift Left AWS Security
17.06.2022, Michael Ullrich

22. Who is Nuvibit?
• Nuvibit AG
• Founded in 2021 in Switzerland
• 100% Focus on AWS
• Focus large AWS Multi-Account
Environments and Security
• Addicted to Everything as Code

23. Discover your Security Findings

24. AWS has cool native Services
Fully integrated Security Standards:
• AWS Foundational Security Best Practices v1.0.0:
143 controls per account
• CIS AWS Foundations Benchmark v1.2.0:
43 controls per account
• PCI DSS v3.2.1: 45 controls per account
More than 100 threat-detections for:
• EC2
• IAM
• S3
• Kubernetes
AWS Security Hub
Amazon GuardDuty
Amazon CloudWatch Logs Insights

25. • 3.1 Monitor for unauthorized API calls
• 3.2 Monitor for AWS Management Console sign-in without MFA
• 3.3 Monitor for usage of root account
• 3.5 Monitor for CloudTrail configuration changes
• 3.6 Monitor for AWS Management Console authentication failures
• 3.7 Monitor for disabling or scheduled deletion of customer created CMKs
• 3.8 Monitor for S3 bucket policy changes
• 3.9 Monitor for AWS Config configuration changes
• 3.10 Monitor for security group changes
• 3.11 Monitor for changes to Network Access Control Lists (NACL)
• 3.12 Monitor for changes to network gateways
• 3.13 Monitor for route table changes
• 3.14 Monitor for VPC changes
Control Details
Nuvibit Blog Post
How do you monitor the CIS AWS 3.x controls?

26. Customer Challenges we faced
• General Security Controls are not applicable for all workloads
(i.e. sandbox accounts)
• Some workloads require custom Security Controls
• Large amounts of false positives / accepted findings clutter our
monitoring
• Transparent Security Control and -Finding customization
• Fast rollout of new Security Controls (in a large set of accounts)
• From Paper Policies to reproducible Results (Security as Code)

27. Your AWS Accounts are heterogeneous!
You need good Tailoring!
1. AWS Foundational Security Best Practices standard
2. CIS AWS Foundations Benchmark controls
3. PCI DSS controls

28. Cluster your AWS Accounts
AWS Account comes with:
• Account ID
• OU-ID
• Account Tags
Security /
Foundation Team
Workload A Team

29. Use Case - Root Login In Production & Core
• CIS AWS 3.3 Benchmark: Monitor for usage of root account
• Security Team: In Production- & Core Accounts the security control must generate an alarm
Security /
Compliance Team

30. Use Case - Security Group
Security /
Compliance Team
Workload A Team
Workload X Team
• CIS AWS 3.10: Monitor for Security Group changes
• Security Team: Only in Production accounts monitor for Security Group changes
• Workload A Team: For Production Workload A filter out inbound TCP port 80 / 443 rules
• Workload X Team: For Production Workload X alarm on inbound TCP port 22 (SSH) rules

31. Examples of raw
Security Finding
Messages

32. Use Case - Security Group
Security / Compliance Team
Detect
Condition
• Only in Production accounts monitor
for Security Group changes

33. Use Case - Security Group
Workload A Team
Drop
Condition
• For Production Workload A filter out
inbound TCP port 80 / 443 rules

34. Use Case - Security Group
Workload X Team
Response
Instruction
Condition
Response-Examples:
• Notification
• Alarming
• Ticket
• Auto-Remediation
• For Production Workload X alarm on
inbound TCP port 22 (SSH) rules

35. Let’s dive slightly deeper

36. Use Case - Security Group - Demo
Security /
Compliance Team
Workload A Team
Workload X Team
• CIS AWS 3.10: Monitor for Security Group changes
• Security Team: Only in Production accounts monitor for Security Group changes
• Workload A Team: For Production Workload A filter out inbound TCP port 80 / 443 rules
• Workload X Team: For Production Workload X alarm on inbound TCP port 22 (SSH) rules

37. SEMPER in a nutshell
1. Detect YOUR findings
2. Enrich YOUR findings with context
3. Filter out unnecessary findings
4. Manage YOUR Response to findings
Shift Left AWS Security with Security as Code

38. Thank
You!

39. Nuvibit AG
Nuvibit AG
Loonstrasse 36
5452 Oberrohrdorf
Switzerland
+41 56 511 24 20
hello@nuvibit.com
https://nuvibit.com
https://ch.linkedin.com/company/nuvibit

40. Appendix

41. Cloud Security Frameworks
CIS Critical Security Controls v8
BSI C5:2020
NIST CYBERSECURITY FRAMEWORK v1.1

42. A solid AWS Foundation helps – a lot
Foundation Team
Workload Team
Workload Team
• Nuvibit Cloud Foundation Map
• Nuvibvit Reference architecture for AWS Multi-Account Customers
• AWS Landing Zone
Security Team

44. Discover your Security Findings

46. Sample of Processed Finding
Normalization
Response Instruction
Original Message

47. Nuvibit SEMPER
AWS Native Security Finding Management
Link to Product-Page

48. SEMPER Deployment

49. Our Paradigm: Security as Code
• McKinsey - Security as code: The best (and maybe only) path to securing cloud applications and systems
Because it is the most effective approach to
secure cloud workloads with speed and agility!
Context-Driven
Configuration and
Processing
• Gartner - Using Cloud-Native ‘Policy as Code’ to Secure Deployments at Scale

50. SEMPER Policy Types
Demo SEMPER – Policy-Scope
Account-Clusters via Policy-Scope
Configure Policies
Filtering-Exclude Policies
Response Policies

52. SEMPER Demo – Use Case IAM
Use Case – Observe IAM Roles
• Security Team: In the whole AWS Organization monitor for IAM Role changes
• Workload A Team: In Production Workload A account IAM Roles must have a Boundary Policy attached
Security /
Compliance Team
Workload A Team

53. SEMPER Demo – Use Case IAM
Security / Compliance Team Workload A Team