Baixado 39 vezes
![© 2016, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Reposta a Incidente – Lambda Respond
cloudtrail = boto3.client('cloudtrail')
trail_arn =
event["detail"]["requestParameters"]["name
"]
ct_response = cloudtrail.start_logging(
Name = trail_arn
)](https://image.slidesharecdn.com/escalandocomsegurancanaaws-170704140015/85/Escalando-com-seguranca-na-AWS-38-320.jpg)
![© 2016, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Respota a Incidente – Lambda Notify
sns_topic = "arn:aws:sns:us-east-1:123459227412:reporter-topic"
subject = 'EVENT: ' + event["detail"]["eventName"]
message = "What happened? " + event["detail"]["eventName"] + "n"
"What service? " + event["detail"]["eventSource"] + "n"
"Where? " + event["detail"]["awsRegion"] + "n"
"When? " + event["detail"]["eventTime"] + "n"
"Who? " + str(json.dumps(event["detail"]["userIdentity"], indent=2))
sns = boto3.client('sns')
sns_response = sns.publish(
TopicArn = sns_topic,
Message = message,
Subject = subject,
MessageStructure = 'string'
)](https://image.slidesharecdn.com/escalandocomsegurancanaaws-170704140015/85/Escalando-com-seguranca-na-AWS-39-320.jpg)
Carregado porAmazon Web Services LATAM
Escalando com segurança na AWS
O documento apresenta uma visão geral sobre segurança na nuvem AWS, abordando controles de segurança, um framework de adoção de nuvem e serviços recomendados. Além disso, discute a importância da segurança da informação e proporciona orientações práticas para gerenciamento de identidade, proteção de dados e resposta a incidentes. O resumo finaliza com uma percepção de um case prático de uma empresa que melhorou suas operações utilizando soluções AWS.
Mais conteúdo relacionado
Semelhante a Escalando com segurança na AWS
Escalando com segurança na AWS
- 1. © 2016, AmazonWeb Services, Inc. or its Affiliates. All rights reserved. Gustavo Rozatti – Solutions Architect rozattig@amazon.com Escalando com Segurança na Nuvem
- 2. © 2016, AmazonWeb Services, Inc. or its Affiliates. All rights reserved. Agenda • Controles da AWS que Você não precisa ser preocupar • Framework para ajudar Você a se adaptar mais rapidamente à nuvem • Serviços AWS que Você deveria estar usando • Arquiteturas de referência que Você pode usar
- 3. © 2016, AmazonWeb Services, Inc. or its Affiliates. All rights reserved. Agenda
- 4. © 2016, AmazonWeb Services, Inc. or its Affiliates. All rights reserved. Controles de Segurança AWS
- 5. © 2016, AmazonWeb Services, Inc. or its Affiliates. All rights reserved. Controles de Segurança AWS 2,500+
- 6. Gostaria de serum SSD no Datacenter de outra empresa ...
- 7. © 2016, AmazonWeb Services, Inc. or its Affiliates. All rights reserved. Controles de Segurança AWS
- 8. © 2016, AmazonWeb Services, Inc. or its Affiliates. All rights reserved. Controles de Segurança AWS AWS Foundation Services Compute Storage Database Networking AWS Global Infrastructure Regions Availability Zones Edge Locations Sua própria acreditação Sua próprias certificações Sua próprias auditorias esternasClienteAWS O escopo e esforço do cliente são reduzidos Melhores resultados através de esforços focados Construído sobre os controles consistentes AWS
- 9. © 2016, AmazonWeb Services, Inc. or its Affiliates. All rights reserved. Cloud Adoption Framework • Cada Perspectiva fornece orientação para partes diferentes da organização • Ajuda você a adaptar as práticas existentes ou introduzir novas para computação em nuvem
- 10. © 2016, AmazonWeb Services, Inc. or its Affiliates. All rights reserved. A Jornada de Segurança para a Nuvem Segurança na nuvem é familiar. O aumento de agilidade e a capacidade de realizar ações de forma mais rápida, em escala maior e a menor custo, não invalidam princípios bem estabelecidos de segurança da informação.
- 11. © 2016, AmazonWeb Services, Inc. or its Affiliates. All rights reserved. A perspectiva de segurança do CAF 5 Capacidades Principais Gerenciamento de Identidade e Acesso Controles Detectivos Segurança de Infraestrutura Proteção de Dados Resposta a Incidentes
- 12. © 2016, AmazonWeb Services, Inc. or its Affiliates. All rights reserved. Escalando para >1 Milhão de Usuários RDS DB Instance Active (Multi-AZ) Availability Zone ELB Balancer RDS DB Instance Read Replica RDS DB Instance Read Replica Web Instance Web Instance Web Instance Web Instance Amazon Route 53 User Amazon S3 Amazon CloudFront DynamoDB Amazon SQS ElastiCache Worker Instance Worker Instance Amazon CloudWatch Internal App Instance Internal App Instance Amazon SES Lambda
- 13. © 2016, AmazonWeb Services, Inc. or its Affiliates. All rights reserved. Segurança já é parte da solução… Security Groups são firewalls virtuais que controlam o tráfego de rede para um ou mais recursos. AWS IAM controla o acesso dos seus usuários aos recursos AWS de forma segura
- 14. © 2016, AmazonWeb Services, Inc. or its Affiliates. All rights reserved. Segurança já é parte da solução…
- 15. © 2016, AmazonWeb Services, Inc. or its Affiliates. All rights reserved. Gerenciamento de Identidade e Acesso AWS Organizations AWS IAM AWS Security Token Service
- 16. © 2016, AmazonWeb Services, Inc. or its Affiliates. All rights reserved. Controles Detectivos AWS CloudTrail Amazon CloudWatch AWS Config Amazon Inspector VPC Flow Logs Conta Recursos Rede
- 17. © 2016, AmazonWeb Services, Inc. or its Affiliates. All rights reserved. Controles Detectivos - VPC Flow Logs
- 18. © 2016, AmazonWeb Services, Inc. or its Affiliates. All rights reserved. Controles Detectivos - VPC Flow Logs
- 19. © 2016, AmazonWeb Services, Inc. or its Affiliates. All rights reserved. Segurança de Infraestrutura AWS OpsWorks AWS Shield AWS WAF Recursos Rede AWS Trusted Advisor AWS Config Rules
- 20. © 2016, AmazonWeb Services, Inc. or its Affiliates. All rights reserved. Segurança de Infraestrutura – AWS Config Rules • Amazon CloudTrail deveria estar ativado… • Está? • Todos os volumes EBS criptografados… • Estão? • Todos os security groups não devem ter acesso irrestrito à porta 22. • Têm?
- 21. © 2016, AmazonWeb Services, Inc. or its Affiliates. All rights reserved. Segurança de Infraestrutura – AWS Config Rules • Codifique e automatize suas próprias práticas • Comece com os exemplos em AWS Lambda • Implemente diretrizes para as melhores práticas de segurança e conformidade • Use regras de vários parceiros da AWS • Veja conformidade em um painel único
- 22. © 2016, AmazonWeb Services, Inc. or its Affiliates. All rights reserved. Segurança de Infraestrutura – AWS Config Rules
- 23. © 2016, AmazonWeb Services, Inc. or its Affiliates. All rights reserved. Segurança de Infraestrutura – AWS Config Rules
- 24. © 2016, AmazonWeb Services, Inc. or its Affiliates. All rights reserved. Proteção de Dados AWS CloudHSM AWS Key Management Service AWS Certificate Manager
- 25. © 2016, AmazonWeb Services, Inc. or its Affiliates. All rights reserved. Proteção de Dados – Criptografia Criptografia em trânsito SSL/TLS VPN / IPSEC SSH Criptografia em repouso Objeto Banco de Dados Sistema de Arquivos Disco
- 26. © 2016, AmazonWeb Services, Inc. or its Affiliates. All rights reserved. Proteção de Dados – AWS Certificate Manager • AWS Certificate Manager (AWS ACM) é um serviço que permite provisionar, gerenciar e implantar certificados TLS para uso em Amazon Elastic Load Balancer ou uma distribuição Amazon CloudFront. • Sem taxas adicionais para provisionamento de certificados TLS • Gerencia o processo de renovação de ceriticados TLS • Certificados são verificados pela Autoridade Certificadora (CA) da Amazon, Amazon Trust Services (ATS)
- 27. © 2016, AmazonWeb Services, Inc. or its Affiliates. All rights reserved. Proteção de Dados – AWS Certificate Manager
- 28. © 2016, AmazonWeb Services, Inc. or its Affiliates. All rights reserved. Proteção de Dados – AWS KMS Data key 1 S3 object EBS volume Amazon Redshift cluster Data key 2 Data key 3 Data key 4 Custom application Customer Master Keys
- 29. © 2016, AmazonWeb Services, Inc. or its Affiliates. All rights reserved. Resposta a Incidentes Amazon CloudWatch Amazon Lambda
- 30. © 2016, AmazonWeb Services, Inc. or its Affiliates. All rights reserved. Resposta a Incidentes – AWS CloudWatch Events
- 31. © 2016, AmazonWeb Services, Inc. or its Affiliates. All rights reserved. Resposta a Incidentes– AWS CloudWatch Events
- 32. © 2016, AmazonWeb Services, Inc. or its Affiliates. All rights reserved. Resposta a Incidentes – AWS CloudWatch Events
- 33. © 2016, AmazonWeb Services, Inc. or its Affiliates. All rights reserved. Resposta a Incidentes – AWS CloudWatch Events
- 34. © 2016, AmazonWeb Services, Inc. or its Affiliates. All rights reserved. Resposta a Incidentes – AWS CloudWatch Events
- 35. © 2016, AmazonWeb Services, Inc. or its Affiliates. All rights reserved. Resposta a Incidentes – AWS CloudWatch Events
- 36. © 2016, AmazonWeb Services, Inc. or its Affiliates. All rights reserved. Resposta a Incidente – Lambda Log from __future__ import print_function import json def lambda_handler(event, context): print(json.dumps(event, indent=2))
- 37. © 2016, AmazonWeb Services, Inc. or its Affiliates. All rights reserved. Resposta a Incidentes – AWS CloudWatch Events
- 38. © 2016, AmazonWeb Services, Inc. or its Affiliates. All rights reserved. Reposta a Incidente – Lambda Respond cloudtrail = boto3.client('cloudtrail') trail_arn = event["detail"]["requestParameters"]["name "] ct_response = cloudtrail.start_logging( Name = trail_arn )
- 39. © 2016, AmazonWeb Services, Inc. or its Affiliates. All rights reserved. Respota a Incidente – Lambda Notify sns_topic = "arn:aws:sns:us-east-1:123459227412:reporter-topic" subject = 'EVENT: ' + event["detail"]["eventName"] message = "What happened? " + event["detail"]["eventName"] + "n" "What service? " + event["detail"]["eventSource"] + "n" "Where? " + event["detail"]["awsRegion"] + "n" "When? " + event["detail"]["eventTime"] + "n" "Who? " + str(json.dumps(event["detail"]["userIdentity"], indent=2)) sns = boto3.client('sns') sns_response = sns.publish( TopicArn = sns_topic, Message = message, Subject = subject, MessageStructure = 'string' )
- 40. © 2016, AmazonWeb Services, Inc. or its Affiliates. All rights reserved. Resposta a Incidente – Amazon SNS Notification
- 41. © 2016, AmazonWeb Services, Inc. or its Affiliates. All rights reserved. Resposta a Incidente – Completo
- 42. © 2016, AmazonWeb Services, Inc. or its Affiliates. All rights reserved. Escalando para >1 Milhão de Usuários RDS DB Instance Active (Multi-AZ) Availability Zone ELB Balancer RDS DB Instance Read Replica RDS DB Instance Read Replica Web Instance Web Instance Web Instance Web Instance Amazon Route 53 User Amazon S3 Amazon CloudFront DynamoDB Amazon SQS ElastiCache Worker Instance Worker Instance Amazon CloudWatch Internal App Instance Internal App Instance Amazon SES Lambda
- 43. © 2016, AmazonWeb Services, Inc. or its Affiliates. All rights reserved. Escalando para >1 Milhão de Usuários RDS DB Instance Active (Multi-AZ) Availability Zone ELB Balancer RDS DB Instance Read Replica RDS DB Instance Read Replica Web Instance Web Instance Web Instance Web Instance Amazon Route 53 User Amazon S3 Amazon CloudFront DynamoDB Amazon SQS ElastiCache Worker Instance Worker Instance Amazon CloudWatch Internal App Instance Internal App Instance Amazon SES Lambda AWS WAF AWS Shield AWS Organizations AWS CloudTrail AWS Config VPC Flow Logs Amazon Inspector AWS OpsWorks 307200 12441,6
- 44. © 2016, AmazonWeb Services, Inc. or its Affiliates. All rights reserved. Implemente Rapidamente Onde Você Quiser 16 Regions – 42 Availability Zones – 68 Edge Locations Regiões e Zonas de Disponibilidade AWS GovCloud (2) EU Ireland (3) US West Frankfurt (2) Oregon (3) London (2) Northern California (3) Asia Pacific US East Singapore (2) N. Virginia (5), Ohio (3) Sydney (2), Tokyo (3), Seoul (2), Mumbai (2) Canada Central (2) China Beijing (2) South America São Paulo (3)
- 45. © 2016, AmazonWeb Services, Inc. or its Affiliates. All rights reserved. Parceiros de Segurança no AWS Marketplace Infrastructure Security Logging & Monitoring Identity & Access Control Configuration & Vulnerability Analysis Data Protection
- 46. © 2016, AmazonWeb Services, Inc. or its Affiliates. All rights reserved. Resumo • Benefícios de Segurança AWS: • Conformidade e Segurança integradas • Resiliência Global, Visibilidade e Controle • Mantém Sua Privacidade e Propriedade dos Dados • Agilidade Através da Automação de Segurança • Inovações de Seguranca em Escala • Várias Parceiros de Segurança e Soluções de Marketplace
- 47. “A AWS permitiua nossa empresa automatizar o uso da infraestrutura, e conhecer o real custo de infra para a Rede” • Redecard é a 6a maior adquirente do mundo e 2a maior empresa de captura de transações de cartões do Brasil. • Atualmente possuimos 18 milhões de transações capturadas por dia e estamos focando em melhorar os serviços de canais digitais utilizando a AWS. “Além do valor da automação e identificação do custo da infraestrutura conseguimos atender melhor o Time to Market e redução do lead time dos produtos” - Marcos Rodrigues, Coordenador de Cloud e Devops REDE
- 48. O Desafio • Escalaro ambiente de forma ágil e com segurança • Manter monitoração de segurança em tempo real • Atender os picos de uso • Manter o sistema em compliance check.
- 49. Solução Amazon VPC Amazon EC2 Amazon CloudFront Elastic Load Balancing Amazon S3 Amazon CloudWatch Amazon Route 53 Amazon RDS Amazon SQS AWSElastic Beanstalk AWS Lambda Amazon API Gateway* Auto ScalingAWS CloudFormation AWS CloudTrail AWS Config AWS Shield AWS WAF AWSKMS
- 50. Ainda não temo App oficial do AWS Summit São Paulo? http://amzn.to/2rOcsVy Não deixe de avaliar as sessões no app!
Notas do Editor
- #4 Seriously… this is all about helping YOU make smarter decisions when adopting AWS and removing speedbumps from your adoption path.
- #6 AWS has over 1,800 security and compliance controls that we continually monitor and validate for you!
- #7 [picture of a shredded hard drive] We have a set of very clear rules, they're implement across our data centers, on how to dispose things like harddrives. Going back to a lot of Amazon design philosophy, simplicity is one of the most important precursors for success in implementing controls. Controls are complicated, people get confused and make mistakes. So what we have done with our data centers is make a rule that says no hard drive shall leave our facilities intact.
- #9 You benefit from an environment built for the most security sensitive organizations You get to define the right security controls for your workload sensitivity You always have full ownership and control of your data
- #10 We don’t just create these frameworks for fun. We spend countless hours/days/weeks/months working with customers like all of you to understand how they are adopting AWS. We look to understand what has worked for them, and what didn’t. We then distil that information down to stories and epics that you can then use to gain the agility of the cloud.
- #12 Identity and Access Management: NOT AWS IAM enables you to create multiple access control mechanisms and manage the permissions for each of these. Detective Controls: provides you the capability for native logging and visibility into the service Infrastructure Security: provides you with the ability to shape your security controls to fit your requirements Data Protection: capability for maintaining visibility and control over data Incident Response: capability to respond, manage, reduce harm, and restore operations during and after an incident
- #16 AWS Organizations allows for policy-based management for multiple AWS accounts AWS IAM securely controls access to AWS services and resources for your users. AWS STS allows you to federate your existing identity provider with AWS IAM.
- #17 AWS CloudTrail tracks user activity and API usage AWS Config allows you to view AWS resource inventory and configuration history and drive change notifications Amazon CloudWatch provides monitoring for AWS cloud resources and the applications you run on AWS. Amazon Inspector is an automated security assessment service to help improve the security and compliance of applications. VPC Flow logs capture information about the IP traffic going to and from network interfaces in your VPC.
- #18 Agentless, Enable per ENI, per subnet, or per VPC Create CloudWatch metrics from log data and alert on them as you see here
- #19 OR roll your own real time network dashboard with the Amazon Elasticsearch Service This is where it gets more interesting! You can even push the VPC Flow Logs into Machine Learning to then be able to more easily identify what should NOT be happening!
- #20 Concentrate on what AWS Shield and WAF provide to our customers AWS Shield is a DDoS protection service that safeguards web applications running on AWS – Standard is no additional cost AWS WAF protects your web applications from common web exploits AWS Trusted Advisor provides real time guidance to help you provision your resources following AWS best practices. AWS Config Rules enables you to create rules that automatically check the configuration of AWS resources recorded by AWS Config. AWS OpsWorks automates how servers are configured, deployed, and managed.
- #23 Tenancy Enforcement Example
- #24 Tenancy Enforcement Example
- #25 AWS CloudHSM is a dedicated HSM to meet corporate, contractual and regulatory compliance requirements AWS KMS is an AWS managed service that allows you to easily create and manage keys to encrypt your data AWS CM is a service that lets you easily provision, manage and deploy SSL certs for use with AWS
- #28 Best part… IT IS SUPER EASY!
- #29 You get the flexibility you need in a key management system while also not having to worry about availability and management of the system itself. The CMK never leave AWS’s HSA in clear text, complete integration with AWS IAM and CloudTrail for AuthZ and visibility into the use of the keys. In a mutli-account architecture you can deploy AWS KMS within each of the environments or based upon the data classification within an account. Additionally, you can import your own key material for the CMKs to have even additional control over the keys. Best part… is the cost! Fraction of the cost of dedicated or virtualized appliances.
- #30 Amazon CloudWatch Events delivers a near real-time stream of system events that describe AWS resource changes Amazon Lambda lets you run code without provisioning or managing servers
- #31 Incident Response should NOT just be a manual process! Lets walk through how to quickly respond to someone disabling CloudTrail without ANY human interaction.
- #32 Incident Response should NOT just be a manual process!
- #33 Incident Response should NOT just be a manual process!
- #34 Incident Response should NOT just be a manual process!
- #35 Incident Response should NOT just be a manual process!
- #36 Incident Response should NOT just be a manual process!
- #37 Simple lambda function that logs events
- #38 Incident Response should NOT just be a manual process!
- #39 Simple lambda function that logs events
- #40 Simple lambda function that logs events
- #41 Incident Response should NOT just be a manual process!
- #42 Incident Response should NOT just be a manual process!
- #48 30 segundos para apresentar a empresa, rapidamente
- #49 Os 4 (máximo) maiores desafios do projeto, que foram resolvidos pela utilização da nuvem da AWS
- #50 Diagrama de solução, e explicar a solução, vantagens, etc