SlideShare uma empresa Scribd logo

Threat detection and mitigation at AWS

•Transferir como PPTX, PDF•
•
Nathan Case
Nathan Case

In this session, learn how to address threat detection and remediation at AWS. We summarize the challenges of traditional threat-detection efforts and explain how AWS helps you address them in a cloud environment. We also provide an overview of key AWS services that detect and remediate threats, such as Amazon GuardDuty. Be sure to also check out the corresponding Threat Detection chalk talk.

Tecnologia
1 de 65
S U M M I T NE W YORK
© 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T Threat detection and mitigation in AWS Nathan Case Sr. Solutions Architect, Security Specialist Amazon Web Services S E C 2 0 1
© 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T © 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved. AWS IAM AWS Organizations AWS Cognito AWS Directory Service AWS Single Sign-On AWS CloudTrail AWS Config Amazon CloudWatch Amazon GuardDuty VPC Flow Logs Amazon EC2 Systems Manager AWS Shield AWS WAF Amazon Inspector Amazon VPC AWS KMS AWS CloudHSM Amazon Macie AWS Certificate Manager Server-side encryption AWS Config rules AWS Lambda AWS Enterprise Support Identity Detective control Infrastructure security Incident response Data protection AWS security solutions
© 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T AWS securityservicesoverview Protect Detect Respond Automate Investigate RecoverIdentify ArchiveSnapshot
© 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T Why is traditional threat detection so hard? CostSignal to noiseLarge datasets
© 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T Humans and data donʼt mix
S U M M I T © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
© 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T CloudTrail Track user activity and API usage VPC Flow Logs IP traffic to/from network interfaces in your VPC Amazon CloudWatch Logs Monitor apps using log data, store, and access log files DNS logs Log of DNS queries in a VPC when using the VPC DNS resolver Threatdetection: Log datainputs
S U M M I T © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. CloudTrail
S U M M I T © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. DetectwithVPCFlowLogs AWS account Source IP Destination IP Source port Destination port Interface Protocol Packets Bytes Start and end time Accept or reject
S U M M I T © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. • Real-time feed of log events • Delivered to an Lambda function or an Amazon Kinesis data streams • Supports custom processing, analysis, and loading into other systems • Cross-account data sharing for centralized log processing CloudWatchLogs subscriptions
S U M M I T © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
© 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T GuardDuty Intelligent threat detection and continuous monitoring to protect your AWS accounts and workloads AWS Security Hub Security Hub gives you a comprehensive view of your high-priority security alerts and compliance status across AWS accounts. Threatdetection
S U M M I T © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. GuardDuty threatdetection and notification
© 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T SecurityHub overview
© 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T SecurityHubbenefits Managed regional AWS service; aggregates findings across AWS accounts in minutes Manage security and compliance findings in a single location, increasing efficiency of locating relevant data Create custom insights to track issues unique to your environment
© 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T SecurityHubworkflow Enable Security Hub for all your accounts Account 1 Account 2 Account 3 Conduct automated compliance scans and checks Take action based on findings Continuously aggregate and prioritize findings
© 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T Compliance standards • Based on CIS AWS Foundations Benchmark • Findings are displayed on main dashboard for quick access • Best-practices information is provided to help mitigate issues Compliance standards
© 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T SecurityHubinsights Security findings that are correlated and grouped for prioritization • More than 20 prebuilt insights provided by AWS and AWS Partner Network members • Ability to create your own insights • Dashboard provides visibility into the top security findings • Additional details for each finding is available for review EC2 instances that have missing security patches S3 buckets with stored credentials S3 buckets with public read and write permissions
S U M M I T © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. Whatcan youdetectusingAWS services? Infrastructure VPC resources Connectivity On-instance ... Service IAM S3 buckets Billing ... Application Patching Coding hole ... Other?
S U M M I T © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. Availability Zone C Availability Zone B VPC CIDR: 10.0.0.0/16 Availability Zone A 10.0.0.0/19 Public subnet 10.0.32.0/20 Private subnet 10.0.48.0/21 Sensitive subnet Security groups Route table NACLs Internet gateway Instance Amazon S3 Amazon RDS AWS IAM AWS CloudHSM AWS Organizations AWSKMS AWS Directory Service Infrastructure and applicationdomains
S U M M I T © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. Services Domain Availability Zone C Availability Zone B VPC CIDR: 10.0.0.0/16 Availability Zone A 10.0.0.0/19 Public subnet 10.0.32.0/20 Private subnet 10.0.48.0/21 Sensitive subnet Security groups Route table NACLs Internet gateway Instance Amazon S3 Amazon RDS AWS IAM AWS CloudHSM AWS Organizations AWSKMS AWS Directory Service Servicesdomains
S U M M I T © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. All Domains Availability Zone C Availability Zone B VPC CIDR: 10.0.0.0/16 Availability Zone A 10.0.0.0/19 Public subnet 10.0.32.0/20 Private subnet 10.0.48.0/21 Sensitive subnet Security groups Route table NACLs Internet gateway Instance Amazon S3 Amazon RDS AWS IAM AWS CloudHSM AWS Organizations AWSKMS AWS Directory Service Whatcan youdetectusingAWS services?
© 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T Visibilitytoanswerthetoughquestions • What data do I have in the cloud? • Where is it located? • Where does my sensitive data exist? • What’s sensitive about the data? • What PII/PHI is possibly exposed? • How is data being shared and stored? • How and where is my data accessed? • How can I classify data in near-real time? • How do I build workflow remediation for my security and compliance needs?
© 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T Visibilitytoanswerthetoughquestions Amazon Web Services has opened case ******** on your behalf. The details of the case are as follows: Case ID: ******** Subject: Your AWS account ******** is compromised Severity: Urgent Correspondence: Dear AWS Customer, Your AWS Account is compromised! Please review the following notice and take immediate action to secure your account. Your security is important to us. We have become aware that the AWS Access Key ******** along with the corresponding Secret Key is publicly available online at ********…
S U M M I T © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
© 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T Amazon CloudWatch Events Delivers a near-real-time stream of system events that describe changes in AWS resources AWS Config rules Continuously tracks your resource configuration changes and if they violate any of the conditions in your rules Threatdetection:Triggers
© 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T AWSConfig rules A continuous recording and assessment service Changing resources AWS Config AWS Config rules History snapshot Notifications API access Normalized • How are my resources configured over time? • Is a change that just occurred to a resource compliant?
S U M M I T © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. CloudWatchEvents { "source": [ "aws.guardduty" ] } CloudWatch Event GuardDuty findings Lambda function
S U M M I T © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
© 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T AWS Systems Manager Automate patching and proactively mitigate threats at the instance level Lambda Capture info about the IP traffic going to and from network interfaces in your VPC Threatremediation:Automation
S U M M I T © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. High-level playbook Adversary or intern Your environment Lambda responder CloudWatch Events AWS Step Functions
S U M M I T © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. CloudWatch CloudTrail AWS Config Lambda function AWS APIs AWS WAF AWS Shield Detection Alerting Remediation Countermeasures Forensics Team collaboration (Slack, etc.) GuardDuty VPC Flow Logs Step Functions Systems Manager Amazon EC2 Responding tofindings: Remediation
S U M M I T © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
© 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T Hopefully,you'veseenthisalready Developer sandbox Dev Pre-prod Team/group accounts Security Core accounts AWS Organizations Shared services Network Log archive Prod Team shared services Network path Developer accounts Data center Orgs: Account management Log archive: Security logs Security: Security tools, AWS Config rules Shared services: Directory, limit monitoring Network: AWS Direct Connect Dev sandbox: Experiments, learning Dev: Development Pre-prod: Staging Prod: Production Team SS: Team shared services, data lake
© 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T Services Security Core accounts AWS Organizations Shared services Network Log archive Network path Data center Orgs: Account management Log archive: Security logs Security: Security tools, AWS Config rules Shared services: Directory, limit monitoring Network: DX Dev sandbox: Experiments, learning Dev: Development Pre-prod: Staging Prod: Production Team SS: Team shared services, data lake
© 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T Developers Developer sandbox Team/group accounts AWS Organizations Network path Developer accounts Data center Orgs: Account management Log archive: Security logs Security: Security tools, AWS Config rules Shared services: Directory, limit monitoring Network: DX Dev sandbox: Experiments, learning Dev: Development Pre-prod: Staging Prod: Production Team SS: Team shared services, data lake
© 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T Connections toteamaccounts Developer sandbox Team/group accounts AWS Organizations Network path Developer accounts Data center Orgs: Account management Log archive: Security logs Security: Security tools, AWS Config rules Shared services: Directory, limit monitoring Network: DX Dev sandbox: Experiments, learning Dev: Development Pre-prod: Staging Prod: Production Team SS: Team shared services, data lake Core accounts Dev Pre-prod Team/group accounts Prod Team shared services
© 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T Teamversusproduction accounts Dev Prod green Team/group accounts Prod blue Dev pipeline account Network path Data center Orgs: Account management Log archive: Security logs Security: Security tools, AWS Config rules Shared services: Directory, limit monitoring Network: DX Dev sandbox: Experiments, learning Dev: Development Pre-prod: Staging Prod: Production Team SS: Team shared services, data lake Testing account Prod pipeline account Network Prod/group accounts
S U M M I T © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
S U M M I T © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
© 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T © 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved. Lambda + Systems Manager + CloudWatch AWS Systems Manager documents Amazon CloudWatch rule AWS Lambda Lambda function AWS Step Functions Amazon GuardDuty AWS Security Hub
© 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T © 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved. Lambda + Systems Manager + CloudWatch AWS Systems Manager documents Amazon CloudWatch rule AWS Lambda Lambda function AWS Step Functions BACKDOOR:EC2/XORDDOS Amazon GuardDuty AWS Security Hub
© 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T © 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved. Lambda + Systems Manager + CloudWatch AWS Systems Manager documents Amazon CloudWatch rule AWS Lambda Lambda function AWS Step Functions GUARD DUTY FINDINGS Amazon GuardDuty AWS Security Hub
© 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T © 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved. Lambda + Systems Manager + CloudWatch AWS Systems Manager documents Amazon CloudWatch rule AWS Lambda Lambda function AWS Step Functions BACKDOOR:EC2/XORDDOS Amazon GuardDuty AWS Security Hub
© 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T © 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved. Lambda + Systems Manager + CloudWatch AWS Systems Manager documents Amazon CloudWatch rule AWS Lambda Lambda function AWS Step Functions BACKDOOR:EC2/XORDDOS COMMUNITCATIONS MANUAL ACTION Amazon GuardDuty AWS Security Hub
© 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T © 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved. Lambda + Systems Manager + CloudWatch AWS Systems Manager documents Amazon CloudWatch rule AWS Lambda Lambda function AWS Step Functions BACKDOOR:EC2/XORDDOS COMMUNITCATIONS MANUAL ACTION Via Amazon API Gateway* Amazon GuardDuty AWS Security Hub
© 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T © 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved. Lambda + Systems Manager + CloudWatch AWS Systems Manager documents Amazon CloudWatch rule EC2 instance contents Instance:~ ec2-user$ AWS Lambda Lambda function AWS Step Functions BACKDOOR:EC2/XORDDOS elastic network interface Security Group EBS Volume IAM Profile Amazon GuardDuty AWS Security Hub
© 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T © 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved. Lambda + Systems Manager + CloudWatch AWS Systems Manager documents Amazon CloudWatch rule AWS Lambda Lambda function AWS Step Functions BACKDOOR:EC2/XORDDOS Amazon GuardDuty AWS Security Hub
© 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T © 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved. Lambda + Systems Manager + CloudWatch AWS Systems Manager documents Amazon CloudWatch rule EC2 instance contents Instance:~ ec2-user$ AWS Lambda Lambda function AWS Step Functions BACKDOOR:EC2/XORDDOS elastic network interface Security Group EBS Volume IAM Profile EBS SNapshot Amazon GuardDuty AWS Security Hub
© 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T © 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved. Lambda + Systems Manager + CloudWatch AWS Systems Manager documents Amazon CloudWatch rule EC2 instance contents Instance:~ ec2-user$ AWS Lambda Lambda function AWS Step Functions BACKDOOR:EC2/XORDDOS elastic network interface Security Group EBS Volume IAM Profile Amazon S3 bucket AWS CloudTrail EBS Snapshot Amazon GuardDuty AWS Security Hub
© 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T © 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved. Lambda + Systems Manager + CloudWatch AWS Systems Manager documents Amazon CloudWatch rule EC2 instance contents Instance:~ ec2-user$ AWS Lambda Lambda function AWS Step Functions BACKDOOR:EC2/XORDDOS elastic network interface Security Group EBS Volume IAM Profile EBS Snapshot AWS CloudTrail Amazon S3 bucket Forensics Account Amazon GuardDuty AWS Security Hub
© 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T © 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved. Lambda + Systems Manager + CloudWatch AWS Systems Manager documents Amazon CloudWatch rule EC2 instance contents Instance:~ ec2-user$ AWS Lambda Lambda function AWS Step Functions BACKDOOR:EC2/XORDDOS Amazon GuardDuty AWS Security Hub
© 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T © 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved. Lambda + Systems Manager + CloudWatch AWS Systems Manager documents Amazon CloudWatch rule EC2 instance contents Instance:~ ec2-user$ Instance:~ ec2-user$ top Instance:~ ec2-user$ pcap Instance:~ ec2-user$ lime Instance:~ ec2-user$ dd AWS Lambda Lambda function AWS Step Functions BACKDOOR:EC2/XORDDOS EBS Volume IAM Profile Amazon GuardDuty AWS Security Hub
© 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T © 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved. Lambda + Systems Manager + CloudWatch AWS Systems Manager documents Amazon CloudWatch rule EC2 instance contents Instance:~ ec2-user$ Instance:~ ec2-user$ top Instance:~ ec2-user$ pcap Instance:~ ec2-user$ lime Instance:~ ec2-user$ dd AWS Lambda Lambda function AWS Step Functions BACKDOOR:EC2/XORDDOS EBS Volume Forensics EBS IAM Profile Amazon GuardDuty AWS Security Hub
© 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T © 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved. Lambda + Systems Manager + CloudWatch AWS Systems Manager documents Amazon CloudWatch rule AWS Lambda Lambda function AWS Step Functions BACKDOOR:EC2/XORDDOS Forensics EBS EBS Snapshot Amazon S3 bucket Forensics Account Amazon GuardDuty AWS Security Hub
© 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T © 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved. Lambda + Systems Manager + CloudWatch AWS Systems Manager documents Amazon CloudWatch rule AWS Lambda Lambda function AWS Step Functions BACKDOOR:EC2/XORDDOS Forensics EBS EBS Snapshot Amazon S3 bucket Forensics Account Amazon GuardDuty AWS Security Hub
S U M M I T © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. Lambda + Systems Manager + CloudWatch AWS Systems Manager documents Amazon CloudWatch rule AWS Lambda Lambda function AWS Step Functions BACKDOOR:EC2/XORDDOS Forensics EBS EBS Snapshot Amazon S3 bucket Forensics Account EASIER DONE THAN SAID. Amazon GuardDuty AWS Security Hub
S U M M I T © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
© 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T CloudWatch CloudTrail AWS Config Lambda function AWS APIs AWS WAF AWS Shield Detection Alerting Remediation Countermeasures Forensics Team collaboration (Slack, etc.) GuardDuty VPC Flow Logs Step Functions Systems Manager Amazon EC2 Responding tofindings: Remediation
© 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T Remediating threats on EC2 instances • Asynchronously execute commands • No need to SSH/RDP • Commands and output logged Systems Manager – Run command EC2 instances Lambda function Systems Manager Amazon EC2
© 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T Open-source resources Prowler https://github.com/toniblyx/prowler Cloud Custodian https://github.com/capitalone/cloud-custodian Security Monkey https://github.com/Netflix/security_monkey Scout2 https://github.com/nccgroup/Scout2 StreamAlert https://github.com/airbnb/streamalert CIS AWS Foundations Framework https://github.com/awslabs/aws-security-benchmark MozDef https://github.com/mozilla/MozDef
Thank you! S U M M I T © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. Nathan Case Sr. Solutions Architect, Security Specialist Amazon Web Services https://www.linkedin.com/in/nathancase/
S U M M I T © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. Please complete the session survey in the mobile app. 1. Tap the Catalog icon. 2. Filter by Show Past Sessions. 3. Select the session that you attended. 4. Tap Complete an Evaluation to submit your feedback. Complete three surveys, and you’ll receive a gift at the Help Desk.

Recomendados

DIY guide to runbooks, incident reports, and incident response
DIY guide to runbooks, incident reports, and incident responseDIY guide to runbooks, incident reports, and incident response
DIY guide to runbooks, incident reports, and incident responseNathan Case
 
Log Analytics with Wyng
Log Analytics with WyngLog Analytics with Wyng
Log Analytics with WyngAmazon Web Services
 
Introduction to Incident Response on AWS
Introduction to Incident Response on AWSIntroduction to Incident Response on AWS
Introduction to Incident Response on AWSAmazon Web Services
 
AWS ReInvent 2020: SEC313 - A security operator’s guide to practical AWS Clou...
AWS ReInvent 2020: SEC313 - A security operator’s guide to practical AWS Clou...AWS ReInvent 2020: SEC313 - A security operator’s guide to practical AWS Clou...
AWS ReInvent 2020: SEC313 - A security operator’s guide to practical AWS Clou...Brian Andrzejewski
 
Incident Response: Eyes Everywhere
Incident Response: Eyes EverywhereIncident Response: Eyes Everywhere
Incident Response: Eyes EverywhereAmazon Web Services
 
Automating Incident Response and Forensics in AWS
Automating Incident Response and Forensics in AWSAutomating Incident Response and Forensics in AWS
Automating Incident Response and Forensics in AWSAmazon Web Services
 
Intro to Threat Detection and Remediation on AWS
Intro to Threat Detection and Remediation on AWSIntro to Threat Detection and Remediation on AWS
Intro to Threat Detection and Remediation on AWSAmazon Web Services
 
Adding the Sec to Your DevOps Pipelines
Adding the Sec to Your DevOps PipelinesAdding the Sec to Your DevOps Pipelines
Adding the Sec to Your DevOps PipelinesAmazon Web Services
 

Recomendados

DIY guide to runbooks, incident reports, and incident response
DIY guide to runbooks, incident reports, and incident responseDIY guide to runbooks, incident reports, and incident response
DIY guide to runbooks, incident reports, and incident responseNathan Case
 
Log Analytics with Wyng
Log Analytics with WyngLog Analytics with Wyng
Log Analytics with WyngAmazon Web Services
 
Introduction to Incident Response on AWS
Introduction to Incident Response on AWSIntroduction to Incident Response on AWS
Introduction to Incident Response on AWSAmazon Web Services
 
AWS ReInvent 2020: SEC313 - A security operator’s guide to practical AWS Clou...
AWS ReInvent 2020: SEC313 - A security operator’s guide to practical AWS Clou...AWS ReInvent 2020: SEC313 - A security operator’s guide to practical AWS Clou...
AWS ReInvent 2020: SEC313 - A security operator’s guide to practical AWS Clou...Brian Andrzejewski
 
Incident Response: Eyes Everywhere
Incident Response: Eyes EverywhereIncident Response: Eyes Everywhere
Incident Response: Eyes EverywhereAmazon Web Services
 
Automating Incident Response and Forensics in AWS
Automating Incident Response and Forensics in AWSAutomating Incident Response and Forensics in AWS
Automating Incident Response and Forensics in AWSAmazon Web Services
 
Intro to Threat Detection and Remediation on AWS
Intro to Threat Detection and Remediation on AWSIntro to Threat Detection and Remediation on AWS
Intro to Threat Detection and Remediation on AWSAmazon Web Services
 
Adding the Sec to Your DevOps Pipelines
Adding the Sec to Your DevOps PipelinesAdding the Sec to Your DevOps Pipelines
Adding the Sec to Your DevOps PipelinesAmazon Web Services
 
GDPR and Automation Overview
GDPR and Automation OverviewGDPR and Automation Overview
GDPR and Automation OverviewAmazon Web Services
 
Secure Configuration and Automation Overview
Secure Configuration and Automation OverviewSecure Configuration and Automation Overview
Secure Configuration and Automation OverviewAmazon Web Services
 
Meetup Protect from Ransomware Attacks
Meetup Protect from Ransomware AttacksMeetup Protect from Ransomware Attacks
Meetup Protect from Ransomware AttacksCloudHesive
 
Incident Response on AWS - A Practical Look.pdf
Incident Response on AWS - A Practical Look.pdfIncident Response on AWS - A Practical Look.pdf
Incident Response on AWS - A Practical Look.pdfAmazon Web Services
 
Incident Response - Eyes Everywhere
Incident Response - Eyes EverywhereIncident Response - Eyes Everywhere
Incident Response - Eyes EverywhereAmazon Web Services
 
Best Practices in Secure Cloud Migration
Best Practices in Secure Cloud MigrationBest Practices in Secure Cloud Migration
Best Practices in Secure Cloud MigrationCloudHesive
 
A Case Study on Insider Threat Detection
A Case Study on Insider Threat DetectionA Case Study on Insider Threat Detection
A Case Study on Insider Threat DetectionAmazon Web Services
 
Incident Response - Finding a Needle in a Stack of Needles
Incident Response - Finding a Needle in a Stack of NeedlesIncident Response - Finding a Needle in a Stack of Needles
Incident Response - Finding a Needle in a Stack of NeedlesAmazon Web Services
 
Foundations - Understanding the Critical Building Blocks of AWS Identity & Go...
Foundations - Understanding the Critical Building Blocks of AWS Identity & Go...Foundations - Understanding the Critical Building Blocks of AWS Identity & Go...
Foundations - Understanding the Critical Building Blocks of AWS Identity & Go...Amazon Web Services
 
Managing Security with AWS | AWS Public Sector Summit 2017
Managing Security with AWS | AWS Public Sector Summit 2017Managing Security with AWS | AWS Public Sector Summit 2017
Managing Security with AWS | AWS Public Sector Summit 2017Amazon Web Services
 
A DIY Guide to Runbooks, Security Incident Reports, & Incident Response: AWS ...
A DIY Guide to Runbooks, Security Incident Reports, & Incident Response: AWS ...A DIY Guide to Runbooks, Security Incident Reports, & Incident Response: AWS ...
A DIY Guide to Runbooks, Security Incident Reports, & Incident Response: AWS ...Amazon Web Services
 
AWS Security Best Practices in a Zero Trust Security Model - DEM06 - Atlanta ...
AWS Security Best Practices in a Zero Trust Security Model - DEM06 - Atlanta ...AWS Security Best Practices in a Zero Trust Security Model - DEM06 - Atlanta ...
AWS Security Best Practices in a Zero Trust Security Model - DEM06 - Atlanta ...Amazon Web Services
 
Security@Scale
Security@ScaleSecurity@Scale
Security@ScaleAmazon Web Services
 
Aws security best practices
Aws security best practicesAws security best practices
Aws security best practicesSundeep Roxx
 
A Tale of Security & Ops Teamwork for Rapid Security Incident Resolution
A Tale of Security & Ops Teamwork for Rapid Security Incident ResolutionA Tale of Security & Ops Teamwork for Rapid Security Incident Resolution
A Tale of Security & Ops Teamwork for Rapid Security Incident ResolutionAmazon Web Services
 
Become a Cloud Security Ninja - RedLock Lab
Become a Cloud Security Ninja - RedLock LabBecome a Cloud Security Ninja - RedLock Lab
Become a Cloud Security Ninja - RedLock LabAmazon Web Services
 
ThreatResponse
ThreatResponseThreatResponse
ThreatResponseAmazon Web Services
 
CI/CD Pipeline Security: Advanced Continuous Delivery Recommendations
CI/CD Pipeline Security: Advanced Continuous Delivery RecommendationsCI/CD Pipeline Security: Advanced Continuous Delivery Recommendations
CI/CD Pipeline Security: Advanced Continuous Delivery RecommendationsAmazon Web Services
 
Automating Incident Response and Forensics in AWS - AWS Summit Sydney 2018
Automating Incident Response and Forensics in AWS - AWS Summit Sydney 2018Automating Incident Response and Forensics in AWS - AWS Summit Sydney 2018
Automating Incident Response and Forensics in AWS - AWS Summit Sydney 2018Amazon Web Services
 
Journey Through the Cloud - Security Best Practices on AWS
Journey Through the Cloud - Security Best Practices on AWSJourney Through the Cloud - Security Best Practices on AWS
Journey Through the Cloud - Security Best Practices on AWSAmazon Web Services
 
Threat detection and mitigation at AWS - SEC201 - New York AWS Summit
Threat detection and mitigation at AWS - SEC201 - New York AWS SummitThreat detection and mitigation at AWS - SEC201 - New York AWS Summit
Threat detection and mitigation at AWS - SEC201 - New York AWS SummitAmazon Web Services
 
Detecting and mitigating threats with AWS - SEC301 - Chicago AWS Summit
Detecting and mitigating threats with AWS - SEC301 - Chicago AWS SummitDetecting and mitigating threats with AWS - SEC301 - Chicago AWS Summit
Detecting and mitigating threats with AWS - SEC301 - Chicago AWS SummitAmazon Web Services
 

Mais conteúdo relacionado

Mais procurados

Secure Configuration and Automation Overview
Secure Configuration and Automation OverviewSecure Configuration and Automation Overview
Secure Configuration and Automation OverviewAmazon Web Services
 
Meetup Protect from Ransomware Attacks
Meetup Protect from Ransomware AttacksMeetup Protect from Ransomware Attacks
Meetup Protect from Ransomware AttacksCloudHesive
 
Incident Response on AWS - A Practical Look.pdf
Incident Response on AWS - A Practical Look.pdfIncident Response on AWS - A Practical Look.pdf
Incident Response on AWS - A Practical Look.pdfAmazon Web Services
 
Incident Response - Eyes Everywhere
Incident Response - Eyes EverywhereIncident Response - Eyes Everywhere
Incident Response - Eyes EverywhereAmazon Web Services
 
Best Practices in Secure Cloud Migration
Best Practices in Secure Cloud MigrationBest Practices in Secure Cloud Migration
Best Practices in Secure Cloud MigrationCloudHesive
 
A Case Study on Insider Threat Detection
A Case Study on Insider Threat DetectionA Case Study on Insider Threat Detection
A Case Study on Insider Threat DetectionAmazon Web Services
 
Incident Response - Finding a Needle in a Stack of Needles
Incident Response - Finding a Needle in a Stack of NeedlesIncident Response - Finding a Needle in a Stack of Needles
Incident Response - Finding a Needle in a Stack of NeedlesAmazon Web Services
 
Foundations - Understanding the Critical Building Blocks of AWS Identity & Go...
Foundations - Understanding the Critical Building Blocks of AWS Identity & Go...Foundations - Understanding the Critical Building Blocks of AWS Identity & Go...
Foundations - Understanding the Critical Building Blocks of AWS Identity & Go...Amazon Web Services
 
Managing Security with AWS | AWS Public Sector Summit 2017
Managing Security with AWS | AWS Public Sector Summit 2017Managing Security with AWS | AWS Public Sector Summit 2017
Managing Security with AWS | AWS Public Sector Summit 2017Amazon Web Services
 
A DIY Guide to Runbooks, Security Incident Reports, & Incident Response: AWS ...
A DIY Guide to Runbooks, Security Incident Reports, & Incident Response: AWS ...A DIY Guide to Runbooks, Security Incident Reports, & Incident Response: AWS ...
A DIY Guide to Runbooks, Security Incident Reports, & Incident Response: AWS ...Amazon Web Services
 
AWS Security Best Practices in a Zero Trust Security Model - DEM06 - Atlanta ...
AWS Security Best Practices in a Zero Trust Security Model - DEM06 - Atlanta ...AWS Security Best Practices in a Zero Trust Security Model - DEM06 - Atlanta ...
AWS Security Best Practices in a Zero Trust Security Model - DEM06 - Atlanta ...Amazon Web Services
 
Aws security best practices
Aws security best practicesAws security best practices
Aws security best practicesSundeep Roxx
 
A Tale of Security & Ops Teamwork for Rapid Security Incident Resolution
A Tale of Security & Ops Teamwork for Rapid Security Incident ResolutionA Tale of Security & Ops Teamwork for Rapid Security Incident Resolution
A Tale of Security & Ops Teamwork for Rapid Security Incident ResolutionAmazon Web Services
 
Become a Cloud Security Ninja - RedLock Lab
Become a Cloud Security Ninja - RedLock LabBecome a Cloud Security Ninja - RedLock Lab
Become a Cloud Security Ninja - RedLock LabAmazon Web Services
 
CI/CD Pipeline Security: Advanced Continuous Delivery Recommendations
CI/CD Pipeline Security: Advanced Continuous Delivery RecommendationsCI/CD Pipeline Security: Advanced Continuous Delivery Recommendations
CI/CD Pipeline Security: Advanced Continuous Delivery RecommendationsAmazon Web Services
 
Automating Incident Response and Forensics in AWS - AWS Summit Sydney 2018
Automating Incident Response and Forensics in AWS - AWS Summit Sydney 2018Automating Incident Response and Forensics in AWS - AWS Summit Sydney 2018
Automating Incident Response and Forensics in AWS - AWS Summit Sydney 2018Amazon Web Services
 
Journey Through the Cloud - Security Best Practices on AWS
Journey Through the Cloud - Security Best Practices on AWSJourney Through the Cloud - Security Best Practices on AWS
Journey Through the Cloud - Security Best Practices on AWSAmazon Web Services
 

Mais procurados (20)

GDPR and Automation Overview
GDPR and Automation OverviewGDPR and Automation Overview
GDPR and Automation Overview
 
Secure Configuration and Automation Overview
Secure Configuration and Automation OverviewSecure Configuration and Automation Overview
Secure Configuration and Automation Overview
 
Meetup Protect from Ransomware Attacks
Meetup Protect from Ransomware AttacksMeetup Protect from Ransomware Attacks
Meetup Protect from Ransomware Attacks
 
Incident Response on AWS - A Practical Look.pdf
Incident Response on AWS - A Practical Look.pdfIncident Response on AWS - A Practical Look.pdf
Incident Response on AWS - A Practical Look.pdf
 
Incident Response - Eyes Everywhere
Incident Response - Eyes EverywhereIncident Response - Eyes Everywhere
Incident Response - Eyes Everywhere
 
Best Practices in Secure Cloud Migration
Best Practices in Secure Cloud MigrationBest Practices in Secure Cloud Migration
Best Practices in Secure Cloud Migration
 
A Case Study on Insider Threat Detection
A Case Study on Insider Threat DetectionA Case Study on Insider Threat Detection
A Case Study on Insider Threat Detection
 
Incident Response - Finding a Needle in a Stack of Needles
Incident Response - Finding a Needle in a Stack of NeedlesIncident Response - Finding a Needle in a Stack of Needles
Incident Response - Finding a Needle in a Stack of Needles
 
Foundations - Understanding the Critical Building Blocks of AWS Identity & Go...
Foundations - Understanding the Critical Building Blocks of AWS Identity & Go...Foundations - Understanding the Critical Building Blocks of AWS Identity & Go...
Foundations - Understanding the Critical Building Blocks of AWS Identity & Go...
 
Managing Security with AWS | AWS Public Sector Summit 2017
Managing Security with AWS | AWS Public Sector Summit 2017Managing Security with AWS | AWS Public Sector Summit 2017
Managing Security with AWS | AWS Public Sector Summit 2017
 
A DIY Guide to Runbooks, Security Incident Reports, & Incident Response: AWS ...
A DIY Guide to Runbooks, Security Incident Reports, & Incident Response: AWS ...A DIY Guide to Runbooks, Security Incident Reports, & Incident Response: AWS ...
A DIY Guide to Runbooks, Security Incident Reports, & Incident Response: AWS ...
 
AWS Security Best Practices in a Zero Trust Security Model - DEM06 - Atlanta ...
AWS Security Best Practices in a Zero Trust Security Model - DEM06 - Atlanta ...AWS Security Best Practices in a Zero Trust Security Model - DEM06 - Atlanta ...
AWS Security Best Practices in a Zero Trust Security Model - DEM06 - Atlanta ...
 
Security@Scale
Security@ScaleSecurity@Scale
Security@Scale
 
Aws security best practices
Aws security best practicesAws security best practices
Aws security best practices
 
A Tale of Security & Ops Teamwork for Rapid Security Incident Resolution
A Tale of Security & Ops Teamwork for Rapid Security Incident ResolutionA Tale of Security & Ops Teamwork for Rapid Security Incident Resolution
A Tale of Security & Ops Teamwork for Rapid Security Incident Resolution
 
Become a Cloud Security Ninja - RedLock Lab
Become a Cloud Security Ninja - RedLock LabBecome a Cloud Security Ninja - RedLock Lab
Become a Cloud Security Ninja - RedLock Lab
 
ThreatResponse
ThreatResponseThreatResponse
ThreatResponse
 
CI/CD Pipeline Security: Advanced Continuous Delivery Recommendations
CI/CD Pipeline Security: Advanced Continuous Delivery RecommendationsCI/CD Pipeline Security: Advanced Continuous Delivery Recommendations
CI/CD Pipeline Security: Advanced Continuous Delivery Recommendations
 
Automating Incident Response and Forensics in AWS - AWS Summit Sydney 2018
Automating Incident Response and Forensics in AWS - AWS Summit Sydney 2018Automating Incident Response and Forensics in AWS - AWS Summit Sydney 2018
Automating Incident Response and Forensics in AWS - AWS Summit Sydney 2018
 
Journey Through the Cloud - Security Best Practices on AWS
Journey Through the Cloud - Security Best Practices on AWSJourney Through the Cloud - Security Best Practices on AWS
Journey Through the Cloud - Security Best Practices on AWS
 

Semelhante a Threat detection and mitigation at AWS

Threat detection and mitigation at AWS - SEC201 - New York AWS Summit
Threat detection and mitigation at AWS - SEC201 - New York AWS SummitThreat detection and mitigation at AWS - SEC201 - New York AWS Summit
Threat detection and mitigation at AWS - SEC201 - New York AWS SummitAmazon Web Services
 
Detecting and mitigating threats with AWS - SEC301 - Chicago AWS Summit
Detecting and mitigating threats with AWS - SEC301 - Chicago AWS SummitDetecting and mitigating threats with AWS - SEC301 - Chicago AWS Summit
Detecting and mitigating threats with AWS - SEC301 - Chicago AWS SummitAmazon Web Services
 
Threat detection and mitigation at AWS - SEC301 - Santa Clara AWS Summit
Threat detection and mitigation at AWS - SEC301 - Santa Clara AWS SummitThreat detection and mitigation at AWS - SEC301 - Santa Clara AWS Summit
Threat detection and mitigation at AWS - SEC301 - Santa Clara AWS SummitAmazon Web Services
 
Sicurezza in AWS automazione e best practice
Sicurezza in AWS automazione e best practiceSicurezza in AWS automazione e best practice
Sicurezza in AWS automazione e best practiceAmazon Web Services
 
Find all the threats: AWS threat detection and mitigation - SEC302 - Santa Cl...
Find all the threats: AWS threat detection and mitigation - SEC302 - Santa Cl...Find all the threats: AWS threat detection and mitigation - SEC302 - Santa Cl...
Find all the threats: AWS threat detection and mitigation - SEC302 - Santa Cl...Amazon Web Services
 
Proteggere applicazioni e dati nel cloud AWS
Proteggere applicazioni e dati nel cloud AWSProteggere applicazioni e dati nel cloud AWS
Proteggere applicazioni e dati nel cloud AWSAmazon Web Services
 
Security at Scale: Security Hub and the Well Architected Framework - AWS Summ...
Security at Scale: Security Hub and the Well Architected Framework - AWS Summ...Security at Scale: Security Hub and the Well Architected Framework - AWS Summ...
Security at Scale: Security Hub and the Well Architected Framework - AWS Summ...Amazon Web Services
 
AWS Technical Day Riyadh Nov 2019 - Scaling threat detection and response in aws
AWS Technical Day Riyadh Nov 2019 - Scaling threat detection and response in awsAWS Technical Day Riyadh Nov 2019 - Scaling threat detection and response in aws
AWS Technical Day Riyadh Nov 2019 - Scaling threat detection and response in awsAWS Riyadh User Group
 
Introduction to Threat Detection and Remediation on AWS
Introduction to Threat Detection and Remediation on AWSIntroduction to Threat Detection and Remediation on AWS
Introduction to Threat Detection and Remediation on AWSAmazon Web Services
 
Continuous security monitoring and threat detection with AWS services - SEC20...
Continuous security monitoring and threat detection with AWS services - SEC20...Continuous security monitoring and threat detection with AWS services - SEC20...
Continuous security monitoring and threat detection with AWS services - SEC20...Amazon Web Services
 
Threat detection - SEC207 - New York AWS Summit
Threat detection - SEC207 - New York AWS SummitThreat detection - SEC207 - New York AWS Summit
Threat detection - SEC207 - New York AWS SummitAmazon Web Services
 
Lock it Down: How to Secure your AWS Account and your Organization's Accounts
Lock it Down: How to Secure your AWS Account and your Organization's AccountsLock it Down: How to Secure your AWS Account and your Organization's Accounts
Lock it Down: How to Secure your AWS Account and your Organization's AccountsAmazon Web Services
 
AWS SSA Webinar 11 - Getting started on AWS: Security
AWS SSA Webinar 11 - Getting started on AWS: SecurityAWS SSA Webinar 11 - Getting started on AWS: Security
AWS SSA Webinar 11 - Getting started on AWS: SecurityCobus Bernard
 
Find all the threats - AWS threat detection and remediation - SEC202 - Atlant...
Find all the threats - AWS threat detection and remediation - SEC202 - Atlant...Find all the threats - AWS threat detection and remediation - SEC202 - Atlant...
Find all the threats - AWS threat detection and remediation - SEC202 - Atlant...Amazon Web Services
 
So You've Got ATO - Are You Sure You are Secure?
So You've Got ATO - Are You Sure You are Secure?So You've Got ATO - Are You Sure You are Secure?
So You've Got ATO - Are You Sure You are Secure?Amazon Web Services
 
Using AWS Lambda as a Security Team (SEC322-R1) - AWS re:Invent 2018
Using AWS Lambda as a Security Team (SEC322-R1) - AWS re:Invent 2018Using AWS Lambda as a Security Team (SEC322-R1) - AWS re:Invent 2018
Using AWS Lambda as a Security Team (SEC322-R1) - AWS re:Invent 2018Amazon Web Services
 
An Active Case Study on Insider Threat Detection in your Applications
An Active Case Study on Insider Threat Detection in your ApplicationsAn Active Case Study on Insider Threat Detection in your Applications
An Active Case Study on Insider Threat Detection in your ApplicationsAmazon Web Services
 
Monitorización de seguridad y detección de amenazas con AWS
Monitorización de seguridad y detección de amenazas con AWSMonitorización de seguridad y detección de amenazas con AWS
Monitorización de seguridad y detección de amenazas con AWSjavier ramirez
 

Semelhante a Threat detection and mitigation at AWS (20)

Threat detection and mitigation at AWS - SEC201 - New York AWS Summit
Threat detection and mitigation at AWS - SEC201 - New York AWS SummitThreat detection and mitigation at AWS - SEC201 - New York AWS Summit
Threat detection and mitigation at AWS - SEC201 - New York AWS Summit
 
Detecting and mitigating threats with AWS - SEC301 - Chicago AWS Summit
Detecting and mitigating threats with AWS - SEC301 - Chicago AWS SummitDetecting and mitigating threats with AWS - SEC301 - Chicago AWS Summit
Detecting and mitigating threats with AWS - SEC301 - Chicago AWS Summit
 
Threat detection and mitigation at AWS - SEC301 - Santa Clara AWS Summit
Threat detection and mitigation at AWS - SEC301 - Santa Clara AWS SummitThreat detection and mitigation at AWS - SEC301 - Santa Clara AWS Summit
Threat detection and mitigation at AWS - SEC301 - Santa Clara AWS Summit
 
Sicurezza in AWS automazione e best practice
Sicurezza in AWS automazione e best practiceSicurezza in AWS automazione e best practice
Sicurezza in AWS automazione e best practice
 
Find all the threats: AWS threat detection and mitigation - SEC302 - Santa Cl...
Find all the threats: AWS threat detection and mitigation - SEC302 - Santa Cl...Find all the threats: AWS threat detection and mitigation - SEC302 - Santa Cl...
Find all the threats: AWS threat detection and mitigation - SEC302 - Santa Cl...
 
Proteggere applicazioni e dati nel cloud AWS
Proteggere applicazioni e dati nel cloud AWSProteggere applicazioni e dati nel cloud AWS
Proteggere applicazioni e dati nel cloud AWS
 
Security at Scale: Security Hub and the Well Architected Framework - AWS Summ...
Security at Scale: Security Hub and the Well Architected Framework - AWS Summ...Security at Scale: Security Hub and the Well Architected Framework - AWS Summ...
Security at Scale: Security Hub and the Well Architected Framework - AWS Summ...
 
AWS Technical Day Riyadh Nov 2019 - Scaling threat detection and response in aws
AWS Technical Day Riyadh Nov 2019 - Scaling threat detection and response in awsAWS Technical Day Riyadh Nov 2019 - Scaling threat detection and response in aws
AWS Technical Day Riyadh Nov 2019 - Scaling threat detection and response in aws
 
Introduction to Threat Detection and Remediation on AWS
Introduction to Threat Detection and Remediation on AWSIntroduction to Threat Detection and Remediation on AWS
Introduction to Threat Detection and Remediation on AWS
 
Continuous security monitoring and threat detection with AWS services - SEC20...
Continuous security monitoring and threat detection with AWS services - SEC20...Continuous security monitoring and threat detection with AWS services - SEC20...
Continuous security monitoring and threat detection with AWS services - SEC20...
 
Threat detection - SEC207 - New York AWS Summit
Threat detection - SEC207 - New York AWS SummitThreat detection - SEC207 - New York AWS Summit
Threat detection - SEC207 - New York AWS Summit
 
Lock it Down: How to Secure your AWS Account and your Organization's Accounts
Lock it Down: How to Secure your AWS Account and your Organization's AccountsLock it Down: How to Secure your AWS Account and your Organization's Accounts
Lock it Down: How to Secure your AWS Account and your Organization's Accounts
 
AWS SSA Webinar 11 - Getting started on AWS: Security
AWS SSA Webinar 11 - Getting started on AWS: SecurityAWS SSA Webinar 11 - Getting started on AWS: Security
AWS SSA Webinar 11 - Getting started on AWS: Security
 
Find all the threats - AWS threat detection and remediation - SEC202 - Atlant...
Find all the threats - AWS threat detection and remediation - SEC202 - Atlant...Find all the threats - AWS threat detection and remediation - SEC202 - Atlant...
Find all the threats - AWS threat detection and remediation - SEC202 - Atlant...
 
So You've Got ATO - Are You Sure You are Secure?
So You've Got ATO - Are You Sure You are Secure?So You've Got ATO - Are You Sure You are Secure?
So You've Got ATO - Are You Sure You are Secure?
 
Introduction to AWS Security
Introduction to AWS SecurityIntroduction to AWS Security
Introduction to AWS Security
 
Using AWS Lambda as a Security Team (SEC322-R1) - AWS re:Invent 2018
Using AWS Lambda as a Security Team (SEC322-R1) - AWS re:Invent 2018Using AWS Lambda as a Security Team (SEC322-R1) - AWS re:Invent 2018
Using AWS Lambda as a Security Team (SEC322-R1) - AWS re:Invent 2018
 
An Active Case Study on Insider Threat Detection in your Applications
An Active Case Study on Insider Threat Detection in your ApplicationsAn Active Case Study on Insider Threat Detection in your Applications
An Active Case Study on Insider Threat Detection in your Applications
 
Fundamentals of AWS Security
Fundamentals of AWS SecurityFundamentals of AWS Security
Fundamentals of AWS Security
 
Monitorización de seguridad y detección de amenazas con AWS
Monitorización de seguridad y detección de amenazas con AWSMonitorización de seguridad y detección de amenazas con AWS
Monitorización de seguridad y detección de amenazas con AWS
 

Último

Take control of your SAP testing with UiPath Test Suite
Take control of your SAP testing with UiPath Test SuiteTake control of your SAP testing with UiPath Test Suite
Take control of your SAP testing with UiPath Test SuiteDianaGray10
 
Advanced Computer Architecture – An Introduction
Advanced Computer Architecture – An IntroductionAdvanced Computer Architecture – An Introduction
Advanced Computer Architecture – An IntroductionDilum Bandara
 
Tampa BSides - Chef's Tour of Microsoft Security Adoption Framework (SAF)
Tampa BSides - Chef's Tour of Microsoft Security Adoption Framework (SAF)Tampa BSides - Chef's Tour of Microsoft Security Adoption Framework (SAF)
Tampa BSides - Chef's Tour of Microsoft Security Adoption Framework (SAF)Mark Simos
 
SIP trunking in Janus @ Kamailio World 2024
SIP trunking in Janus @ Kamailio World 2024SIP trunking in Janus @ Kamailio World 2024
SIP trunking in Janus @ Kamailio World 2024Lorenzo Miniero
 
Unraveling Multimodality with Large Language Models.pdf
Unraveling Multimodality with Large Language Models.pdfUnraveling Multimodality with Large Language Models.pdf
Unraveling Multimodality with Large Language Models.pdfAlex Barbosa Coqueiro
 
WordPress Websites for Engineers: Elevate Your Brand
WordPress Websites for Engineers: Elevate Your BrandWordPress Websites for Engineers: Elevate Your Brand
WordPress Websites for Engineers: Elevate Your Brandgvaughan
 
"Debugging python applications inside k8s environment", Andrii Soldatenko
"Debugging python applications inside k8s environment", Andrii Soldatenko"Debugging python applications inside k8s environment", Andrii Soldatenko
"Debugging python applications inside k8s environment", Andrii SoldatenkoFwdays
 
Transcript: New from BookNet Canada for 2024: Loan Stars - Tech Forum 2024
Transcript: New from BookNet Canada for 2024: Loan Stars - Tech Forum 2024Transcript: New from BookNet Canada for 2024: Loan Stars - Tech Forum 2024
Transcript: New from BookNet Canada for 2024: Loan Stars - Tech Forum 2024BookNet Canada
 
A Deep Dive on Passkeys: FIDO Paris Seminar.pptx
A Deep Dive on Passkeys: FIDO Paris Seminar.pptxA Deep Dive on Passkeys: FIDO Paris Seminar.pptx
A Deep Dive on Passkeys: FIDO Paris Seminar.pptxLoriGlavin3
 
Training state-of-the-art general text embedding
Training state-of-the-art general text embeddingTraining state-of-the-art general text embedding
Training state-of-the-art general text embeddingZilliz
 
TrustArc Webinar - How to Build Consumer Trust Through Data Privacy
TrustArc Webinar - How to Build Consumer Trust Through Data PrivacyTrustArc Webinar - How to Build Consumer Trust Through Data Privacy
TrustArc Webinar - How to Build Consumer Trust Through Data PrivacyTrustArc
 
Time Series Foundation Models - current state and future directions
Time Series Foundation Models - current state and future directionsTime Series Foundation Models - current state and future directions
Time Series Foundation Models - current state and future directionsNathaniel Shimoni
 
TeamStation AI System Report LATAM IT Salaries 2024
TeamStation AI System Report LATAM IT Salaries 2024TeamStation AI System Report LATAM IT Salaries 2024
TeamStation AI System Report LATAM IT Salaries 2024Lonnie McRorey
 
Digital Identity is Under Attack: FIDO Paris Seminar.pptx
Digital Identity is Under Attack: FIDO Paris Seminar.pptxDigital Identity is Under Attack: FIDO Paris Seminar.pptx
Digital Identity is Under Attack: FIDO Paris Seminar.pptxLoriGlavin3
 
What's New in Teams Calling, Meetings and Devices March 2024
What's New in Teams Calling, Meetings and Devices March 2024What's New in Teams Calling, Meetings and Devices March 2024
What's New in Teams Calling, Meetings and Devices March 2024Stephanie Beckett
 
From Family Reminiscence to Scholarly Archive .
From Family Reminiscence to Scholarly Archive .From Family Reminiscence to Scholarly Archive .
From Family Reminiscence to Scholarly Archive .Alan Dix
 
DevEX - reference for building teams, processes, and platforms
DevEX - reference for building teams, processes, and platformsDevEX - reference for building teams, processes, and platforms
DevEX - reference for building teams, processes, and platformsSergiu Bodiu
 
What is Artificial Intelligence?????????
What is Artificial Intelligence?????????What is Artificial Intelligence?????????
What is Artificial Intelligence?????????blackmambaettijean
 
Anypoint Exchange: It’s Not Just a Repo!
Anypoint Exchange: It’s Not Just a Repo!Anypoint Exchange: It’s Not Just a Repo!
Anypoint Exchange: It’s Not Just a Repo!Manik S Magar
 
unit 4 immunoblotting technique complete.pptx
unit 4 immunoblotting technique complete.pptxunit 4 immunoblotting technique complete.pptx
unit 4 immunoblotting technique complete.pptxBkGupta21
 

Último (20)

Take control of your SAP testing with UiPath Test Suite
Take control of your SAP testing with UiPath Test SuiteTake control of your SAP testing with UiPath Test Suite
Take control of your SAP testing with UiPath Test Suite
 
Advanced Computer Architecture – An Introduction
Advanced Computer Architecture – An IntroductionAdvanced Computer Architecture – An Introduction
Advanced Computer Architecture – An Introduction
 
Tampa BSides - Chef's Tour of Microsoft Security Adoption Framework (SAF)
Tampa BSides - Chef's Tour of Microsoft Security Adoption Framework (SAF)Tampa BSides - Chef's Tour of Microsoft Security Adoption Framework (SAF)
Tampa BSides - Chef's Tour of Microsoft Security Adoption Framework (SAF)
 
SIP trunking in Janus @ Kamailio World 2024
SIP trunking in Janus @ Kamailio World 2024SIP trunking in Janus @ Kamailio World 2024
SIP trunking in Janus @ Kamailio World 2024
 
Unraveling Multimodality with Large Language Models.pdf
Unraveling Multimodality with Large Language Models.pdfUnraveling Multimodality with Large Language Models.pdf
Unraveling Multimodality with Large Language Models.pdf
 
WordPress Websites for Engineers: Elevate Your Brand
WordPress Websites for Engineers: Elevate Your BrandWordPress Websites for Engineers: Elevate Your Brand
WordPress Websites for Engineers: Elevate Your Brand
 
"Debugging python applications inside k8s environment", Andrii Soldatenko
"Debugging python applications inside k8s environment", Andrii Soldatenko"Debugging python applications inside k8s environment", Andrii Soldatenko
"Debugging python applications inside k8s environment", Andrii Soldatenko
 
Transcript: New from BookNet Canada for 2024: Loan Stars - Tech Forum 2024
Transcript: New from BookNet Canada for 2024: Loan Stars - Tech Forum 2024Transcript: New from BookNet Canada for 2024: Loan Stars - Tech Forum 2024
Transcript: New from BookNet Canada for 2024: Loan Stars - Tech Forum 2024
 
A Deep Dive on Passkeys: FIDO Paris Seminar.pptx
A Deep Dive on Passkeys: FIDO Paris Seminar.pptxA Deep Dive on Passkeys: FIDO Paris Seminar.pptx
A Deep Dive on Passkeys: FIDO Paris Seminar.pptx
 
Training state-of-the-art general text embedding
Training state-of-the-art general text embeddingTraining state-of-the-art general text embedding
Training state-of-the-art general text embedding
 
TrustArc Webinar - How to Build Consumer Trust Through Data Privacy
TrustArc Webinar - How to Build Consumer Trust Through Data PrivacyTrustArc Webinar - How to Build Consumer Trust Through Data Privacy
TrustArc Webinar - How to Build Consumer Trust Through Data Privacy
 
Time Series Foundation Models - current state and future directions
Time Series Foundation Models - current state and future directionsTime Series Foundation Models - current state and future directions
Time Series Foundation Models - current state and future directions
 
TeamStation AI System Report LATAM IT Salaries 2024
TeamStation AI System Report LATAM IT Salaries 2024TeamStation AI System Report LATAM IT Salaries 2024
TeamStation AI System Report LATAM IT Salaries 2024
 
Digital Identity is Under Attack: FIDO Paris Seminar.pptx
Digital Identity is Under Attack: FIDO Paris Seminar.pptxDigital Identity is Under Attack: FIDO Paris Seminar.pptx
Digital Identity is Under Attack: FIDO Paris Seminar.pptx
 
What's New in Teams Calling, Meetings and Devices March 2024
What's New in Teams Calling, Meetings and Devices March 2024What's New in Teams Calling, Meetings and Devices March 2024
What's New in Teams Calling, Meetings and Devices March 2024
 
From Family Reminiscence to Scholarly Archive .
From Family Reminiscence to Scholarly Archive .From Family Reminiscence to Scholarly Archive .
From Family Reminiscence to Scholarly Archive .
 
DevEX - reference for building teams, processes, and platforms
DevEX - reference for building teams, processes, and platformsDevEX - reference for building teams, processes, and platforms
DevEX - reference for building teams, processes, and platforms
 
What is Artificial Intelligence?????????
What is Artificial Intelligence?????????What is Artificial Intelligence?????????
What is Artificial Intelligence?????????
 
Anypoint Exchange: It’s Not Just a Repo!
Anypoint Exchange: It’s Not Just a Repo!Anypoint Exchange: It’s Not Just a Repo!
Anypoint Exchange: It’s Not Just a Repo!
 
unit 4 immunoblotting technique complete.pptx
unit 4 immunoblotting technique complete.pptxunit 4 immunoblotting technique complete.pptx
unit 4 immunoblotting technique complete.pptx
 

Threat detection and mitigation at AWS

  • 1. S U M M I T NE W YORK
  • 2. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T Threat detection and mitigation in AWS Nathan Case Sr. Solutions Architect, Security Specialist Amazon Web Services S E C 2 0 1
  • 3. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T © 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved. AWS IAM AWS Organizations AWS Cognito AWS Directory Service AWS Single Sign-On AWS CloudTrail AWS Config Amazon CloudWatch Amazon GuardDuty VPC Flow Logs Amazon EC2 Systems Manager AWS Shield AWS WAF Amazon Inspector Amazon VPC AWS KMS AWS CloudHSM Amazon Macie AWS Certificate Manager Server-side encryption AWS Config rules AWS Lambda AWS Enterprise Support Identity Detective control Infrastructure security Incident response Data protection AWS security solutions
  • 4. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T AWS securityservicesoverview Protect Detect Respond Automate Investigate RecoverIdentify ArchiveSnapshot
  • 5. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T Why is traditional threat detection so hard? CostSignal to noiseLarge datasets
  • 6. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T Humans and data donʼt mix
  • 7. S U M M I T © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
  • 8. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T CloudTrail Track user activity and API usage VPC Flow Logs IP traffic to/from network interfaces in your VPC Amazon CloudWatch Logs Monitor apps using log data, store, and access log files DNS logs Log of DNS queries in a VPC when using the VPC DNS resolver Threatdetection: Log datainputs
  • 9. S U M M I T © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. CloudTrail
  • 10. S U M M I T © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. DetectwithVPCFlowLogs AWS account Source IP Destination IP Source port Destination port Interface Protocol Packets Bytes Start and end time Accept or reject
  • 11. S U M M I T © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. • Real-time feed of log events • Delivered to an Lambda function or an Amazon Kinesis data streams • Supports custom processing, analysis, and loading into other systems • Cross-account data sharing for centralized log processing CloudWatchLogs subscriptions
  • 12. S U M M I T © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
  • 13. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T GuardDuty Intelligent threat detection and continuous monitoring to protect your AWS accounts and workloads AWS Security Hub Security Hub gives you a comprehensive view of your high-priority security alerts and compliance status across AWS accounts. Threatdetection
  • 14. S U M M I T © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. GuardDuty threatdetection and notification
  • 15. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T SecurityHub overview
  • 16. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T SecurityHubbenefits Managed regional AWS service; aggregates findings across AWS accounts in minutes Manage security and compliance findings in a single location, increasing efficiency of locating relevant data Create custom insights to track issues unique to your environment
  • 17. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T SecurityHubworkflow Enable Security Hub for all your accounts Account 1 Account 2 Account 3 Conduct automated compliance scans and checks Take action based on findings Continuously aggregate and prioritize findings
  • 18. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T Compliance standards • Based on CIS AWS Foundations Benchmark • Findings are displayed on main dashboard for quick access • Best-practices information is provided to help mitigate issues Compliance standards
  • 19. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T SecurityHubinsights Security findings that are correlated and grouped for prioritization • More than 20 prebuilt insights provided by AWS and AWS Partner Network members • Ability to create your own insights • Dashboard provides visibility into the top security findings • Additional details for each finding is available for review EC2 instances that have missing security patches S3 buckets with stored credentials S3 buckets with public read and write permissions
  • 20. S U M M I T © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. Whatcan youdetectusingAWS services? Infrastructure VPC resources Connectivity On-instance ... Service IAM S3 buckets Billing ... Application Patching Coding hole ... Other?
  • 21. S U M M I T © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. Availability Zone C Availability Zone B VPC CIDR: 10.0.0.0/16 Availability Zone A 10.0.0.0/19 Public subnet 10.0.32.0/20 Private subnet 10.0.48.0/21 Sensitive subnet Security groups Route table NACLs Internet gateway Instance Amazon S3 Amazon RDS AWS IAM AWS CloudHSM AWS Organizations AWSKMS AWS Directory Service Infrastructure and applicationdomains
  • 22. S U M M I T © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. Services Domain Availability Zone C Availability Zone B VPC CIDR: 10.0.0.0/16 Availability Zone A 10.0.0.0/19 Public subnet 10.0.32.0/20 Private subnet 10.0.48.0/21 Sensitive subnet Security groups Route table NACLs Internet gateway Instance Amazon S3 Amazon RDS AWS IAM AWS CloudHSM AWS Organizations AWSKMS AWS Directory Service Servicesdomains
  • 23. S U M M I T © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. All Domains Availability Zone C Availability Zone B VPC CIDR: 10.0.0.0/16 Availability Zone A 10.0.0.0/19 Public subnet 10.0.32.0/20 Private subnet 10.0.48.0/21 Sensitive subnet Security groups Route table NACLs Internet gateway Instance Amazon S3 Amazon RDS AWS IAM AWS CloudHSM AWS Organizations AWSKMS AWS Directory Service Whatcan youdetectusingAWS services?
  • 24. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T Visibilitytoanswerthetoughquestions • What data do I have in the cloud? • Where is it located? • Where does my sensitive data exist? • What’s sensitive about the data? • What PII/PHI is possibly exposed? • How is data being shared and stored? • How and where is my data accessed? • How can I classify data in near-real time? • How do I build workflow remediation for my security and compliance needs?
  • 25. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T Visibilitytoanswerthetoughquestions Amazon Web Services has opened case ******** on your behalf. The details of the case are as follows: Case ID: ******** Subject: Your AWS account ******** is compromised Severity: Urgent Correspondence: Dear AWS Customer, Your AWS Account is compromised! Please review the following notice and take immediate action to secure your account. Your security is important to us. We have become aware that the AWS Access Key ******** along with the corresponding Secret Key is publicly available online at ********…
  • 26. S U M M I T © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
  • 27. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T Amazon CloudWatch Events Delivers a near-real-time stream of system events that describe changes in AWS resources AWS Config rules Continuously tracks your resource configuration changes and if they violate any of the conditions in your rules Threatdetection:Triggers
  • 28. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T AWSConfig rules A continuous recording and assessment service Changing resources AWS Config AWS Config rules History snapshot Notifications API access Normalized • How are my resources configured over time? • Is a change that just occurred to a resource compliant?
  • 29. S U M M I T © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. CloudWatchEvents { "source": [ "aws.guardduty" ] } CloudWatch Event GuardDuty findings Lambda function
  • 30. S U M M I T © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
  • 31. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T AWS Systems Manager Automate patching and proactively mitigate threats at the instance level Lambda Capture info about the IP traffic going to and from network interfaces in your VPC Threatremediation:Automation
  • 32. S U M M I T © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. High-level playbook Adversary or intern Your environment Lambda responder CloudWatch Events AWS Step Functions
  • 33. S U M M I T © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. CloudWatch CloudTrail AWS Config Lambda function AWS APIs AWS WAF AWS Shield Detection Alerting Remediation Countermeasures Forensics Team collaboration (Slack, etc.) GuardDuty VPC Flow Logs Step Functions Systems Manager Amazon EC2 Responding tofindings: Remediation
  • 34. S U M M I T © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
  • 35. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T Hopefully,you'veseenthisalready Developer sandbox Dev Pre-prod Team/group accounts Security Core accounts AWS Organizations Shared services Network Log archive Prod Team shared services Network path Developer accounts Data center Orgs: Account management Log archive: Security logs Security: Security tools, AWS Config rules Shared services: Directory, limit monitoring Network: AWS Direct Connect Dev sandbox: Experiments, learning Dev: Development Pre-prod: Staging Prod: Production Team SS: Team shared services, data lake
  • 36. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T Services Security Core accounts AWS Organizations Shared services Network Log archive Network path Data center Orgs: Account management Log archive: Security logs Security: Security tools, AWS Config rules Shared services: Directory, limit monitoring Network: DX Dev sandbox: Experiments, learning Dev: Development Pre-prod: Staging Prod: Production Team SS: Team shared services, data lake
  • 37. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T Developers Developer sandbox Team/group accounts AWS Organizations Network path Developer accounts Data center Orgs: Account management Log archive: Security logs Security: Security tools, AWS Config rules Shared services: Directory, limit monitoring Network: DX Dev sandbox: Experiments, learning Dev: Development Pre-prod: Staging Prod: Production Team SS: Team shared services, data lake
  • 38. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T Connections toteamaccounts Developer sandbox Team/group accounts AWS Organizations Network path Developer accounts Data center Orgs: Account management Log archive: Security logs Security: Security tools, AWS Config rules Shared services: Directory, limit monitoring Network: DX Dev sandbox: Experiments, learning Dev: Development Pre-prod: Staging Prod: Production Team SS: Team shared services, data lake Core accounts Dev Pre-prod Team/group accounts Prod Team shared services
  • 39. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T Teamversusproduction accounts Dev Prod green Team/group accounts Prod blue Dev pipeline account Network path Data center Orgs: Account management Log archive: Security logs Security: Security tools, AWS Config rules Shared services: Directory, limit monitoring Network: DX Dev sandbox: Experiments, learning Dev: Development Pre-prod: Staging Prod: Production Team SS: Team shared services, data lake Testing account Prod pipeline account Network Prod/group accounts
  • 40. S U M M I T © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
  • 41.
  • 42. S U M M I T © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
  • 43. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T © 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved. Lambda + Systems Manager + CloudWatch AWS Systems Manager documents Amazon CloudWatch rule AWS Lambda Lambda function AWS Step Functions Amazon GuardDuty AWS Security Hub
  • 44. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T © 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved. Lambda + Systems Manager + CloudWatch AWS Systems Manager documents Amazon CloudWatch rule AWS Lambda Lambda function AWS Step Functions BACKDOOR:EC2/XORDDOS Amazon GuardDuty AWS Security Hub
  • 45. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T © 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved. Lambda + Systems Manager + CloudWatch AWS Systems Manager documents Amazon CloudWatch rule AWS Lambda Lambda function AWS Step Functions GUARD DUTY FINDINGS Amazon GuardDuty AWS Security Hub
  • 46. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T © 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved. Lambda + Systems Manager + CloudWatch AWS Systems Manager documents Amazon CloudWatch rule AWS Lambda Lambda function AWS Step Functions BACKDOOR:EC2/XORDDOS Amazon GuardDuty AWS Security Hub
  • 47. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T © 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved. Lambda + Systems Manager + CloudWatch AWS Systems Manager documents Amazon CloudWatch rule AWS Lambda Lambda function AWS Step Functions BACKDOOR:EC2/XORDDOS COMMUNITCATIONS MANUAL ACTION Amazon GuardDuty AWS Security Hub
  • 48. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T © 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved. Lambda + Systems Manager + CloudWatch AWS Systems Manager documents Amazon CloudWatch rule AWS Lambda Lambda function AWS Step Functions BACKDOOR:EC2/XORDDOS COMMUNITCATIONS MANUAL ACTION Via Amazon API Gateway* Amazon GuardDuty AWS Security Hub
  • 49. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T © 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved. Lambda + Systems Manager + CloudWatch AWS Systems Manager documents Amazon CloudWatch rule EC2 instance contents Instance:~ ec2-user$ AWS Lambda Lambda function AWS Step Functions BACKDOOR:EC2/XORDDOS elastic network interface Security Group EBS Volume IAM Profile Amazon GuardDuty AWS Security Hub
  • 50. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T © 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved. Lambda + Systems Manager + CloudWatch AWS Systems Manager documents Amazon CloudWatch rule AWS Lambda Lambda function AWS Step Functions BACKDOOR:EC2/XORDDOS Amazon GuardDuty AWS Security Hub
  • 51. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T © 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved. Lambda + Systems Manager + CloudWatch AWS Systems Manager documents Amazon CloudWatch rule EC2 instance contents Instance:~ ec2-user$ AWS Lambda Lambda function AWS Step Functions BACKDOOR:EC2/XORDDOS elastic network interface Security Group EBS Volume IAM Profile EBS SNapshot Amazon GuardDuty AWS Security Hub
  • 52. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T © 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved. Lambda + Systems Manager + CloudWatch AWS Systems Manager documents Amazon CloudWatch rule EC2 instance contents Instance:~ ec2-user$ AWS Lambda Lambda function AWS Step Functions BACKDOOR:EC2/XORDDOS elastic network interface Security Group EBS Volume IAM Profile Amazon S3 bucket AWS CloudTrail EBS Snapshot Amazon GuardDuty AWS Security Hub
  • 53. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T © 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved. Lambda + Systems Manager + CloudWatch AWS Systems Manager documents Amazon CloudWatch rule EC2 instance contents Instance:~ ec2-user$ AWS Lambda Lambda function AWS Step Functions BACKDOOR:EC2/XORDDOS elastic network interface Security Group EBS Volume IAM Profile EBS Snapshot AWS CloudTrail Amazon S3 bucket Forensics Account Amazon GuardDuty AWS Security Hub
  • 54. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T © 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved. Lambda + Systems Manager + CloudWatch AWS Systems Manager documents Amazon CloudWatch rule EC2 instance contents Instance:~ ec2-user$ AWS Lambda Lambda function AWS Step Functions BACKDOOR:EC2/XORDDOS Amazon GuardDuty AWS Security Hub
  • 55. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T © 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved. Lambda + Systems Manager + CloudWatch AWS Systems Manager documents Amazon CloudWatch rule EC2 instance contents Instance:~ ec2-user$ Instance:~ ec2-user$ top Instance:~ ec2-user$ pcap Instance:~ ec2-user$ lime Instance:~ ec2-user$ dd AWS Lambda Lambda function AWS Step Functions BACKDOOR:EC2/XORDDOS EBS Volume IAM Profile Amazon GuardDuty AWS Security Hub
  • 56. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T © 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved. Lambda + Systems Manager + CloudWatch AWS Systems Manager documents Amazon CloudWatch rule EC2 instance contents Instance:~ ec2-user$ Instance:~ ec2-user$ top Instance:~ ec2-user$ pcap Instance:~ ec2-user$ lime Instance:~ ec2-user$ dd AWS Lambda Lambda function AWS Step Functions BACKDOOR:EC2/XORDDOS EBS Volume Forensics EBS IAM Profile Amazon GuardDuty AWS Security Hub
  • 57. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T © 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved. Lambda + Systems Manager + CloudWatch AWS Systems Manager documents Amazon CloudWatch rule AWS Lambda Lambda function AWS Step Functions BACKDOOR:EC2/XORDDOS Forensics EBS EBS Snapshot Amazon S3 bucket Forensics Account Amazon GuardDuty AWS Security Hub
  • 58. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T © 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved. Lambda + Systems Manager + CloudWatch AWS Systems Manager documents Amazon CloudWatch rule AWS Lambda Lambda function AWS Step Functions BACKDOOR:EC2/XORDDOS Forensics EBS EBS Snapshot Amazon S3 bucket Forensics Account Amazon GuardDuty AWS Security Hub
  • 59. S U M M I T © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. Lambda + Systems Manager + CloudWatch AWS Systems Manager documents Amazon CloudWatch rule AWS Lambda Lambda function AWS Step Functions BACKDOOR:EC2/XORDDOS Forensics EBS EBS Snapshot Amazon S3 bucket Forensics Account EASIER DONE THAN SAID. Amazon GuardDuty AWS Security Hub
  • 60. S U M M I T © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
  • 61. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T CloudWatch CloudTrail AWS Config Lambda function AWS APIs AWS WAF AWS Shield Detection Alerting Remediation Countermeasures Forensics Team collaboration (Slack, etc.) GuardDuty VPC Flow Logs Step Functions Systems Manager Amazon EC2 Responding tofindings: Remediation
  • 62. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T Remediating threats on EC2 instances • Asynchronously execute commands • No need to SSH/RDP • Commands and output logged Systems Manager – Run command EC2 instances Lambda function Systems Manager Amazon EC2
  • 63. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T Open-source resources Prowler https://github.com/toniblyx/prowler Cloud Custodian https://github.com/capitalone/cloud-custodian Security Monkey https://github.com/Netflix/security_monkey Scout2 https://github.com/nccgroup/Scout2 StreamAlert https://github.com/airbnb/streamalert CIS AWS Foundations Framework https://github.com/awslabs/aws-security-benchmark MozDef https://github.com/mozilla/MozDef
  • 64. Thank you! S U M M I T © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. Nathan Case Sr. Solutions Architect, Security Specialist Amazon Web Services https://www.linkedin.com/in/nathancase/
  • 65. S U M M I T © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. Please complete the session survey in the mobile app. 1. Tap the Catalog icon. 2. Filter by Show Past Sessions. 3. Select the session that you attended. 4. Tap Complete an Evaluation to submit your feedback. Complete three surveys, and you’ll receive a gift at the Help Desk.