AWS Security Best Practices - CLOUDSEC A - 1600... · © 2019, Amazon Web Services, Inc. or its...
Transcript of AWS Security Best Practices - CLOUDSEC A - 1600... · © 2019, Amazon Web Services, Inc. or its...
© 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved.© 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
AWS Security Best PracticesFor the Three Layers of Compute
Osemeke Isibor
Partner Solutions Architect, AWS
© 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Three Layers of Compute..
Virtual server instances
in the cloud
© 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Three Layers of Compute..
Virtual server instances
in the cloud
Services for running Docker
containers
© 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Three Layers of Compute..
Virtual server instances
in the cloud
Services for running Docker
containers
Serverless execution in response to
events
© 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
AWS Shield
AWS Identity and
Access Management
AWS Well-Architected
Tool AWS WAF
AWS Key Management
Service
AWS Security Services (Preventative)
AWS Control Tower
© 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
AWS Shield AWS Well-Architected
Tool AWS WAF
AWS Security Services (Preventative)
AWS Identity and
Access Management
AWS Control Tower AWS Key Management
Service
© 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
AWS Well-Architected
Tool AWS Shield AWS WAF
AWS Security Services (Preventative)
AWS Identity and
Access Management
AWS Control Tower AWS Key Management
Service
© 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
AWS Well-Architected
Tool AWS Shield AWS WAF
AWS Security Services (Preventative)
AWS Identity and
Access Management
AWS Control Tower AWS Key Management
Service
© 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
AWS Trusted Advisor
AWS CloudTrail
AWS Config
Amazon CloudWatch
Amazon GuardDuty
AWS Security Services (Detective)
AWS Security Hub
© 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
AWS Trusted AdvisorAmazon GuardDuty AWS Config
AWS Security Services (Detective)
AWS Security Hub AWS CloudTrail Amazon CloudWatch
© 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
AWS Trusted AdvisorAWS Config
AWS Security Services (Detective)
AWS Security Hub
Amazon GuardDuty
AWS CloudTrail Amazon CloudWatch
© 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
AWS Trusted Advisor
AWS Security Services (Detective)
AWS Security Hub
Amazon GuardDuty
AWS CloudTrail
AWS Config
Amazon CloudWatch
© 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
AWS Security Services (Detective)
AWS Security Hub
AWS Trusted AdvisorAmazon GuardDuty
AWS CloudTrail
AWS Config
Amazon CloudWatch
© 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Other Security Activities (App Layer)
What? Why?
Solution design review Ensure application design adequately protects valuable
resources and information
Threat modeling Understand attacker & impact of control failures
Security unit tests Ensure expected security functionality operates as expected
Code review (manual peer review) Look for malicious code, style and standards
Code scan (static/dynamic) Look for code vulnerabilities
Penetration testing Make sure nothing obvious has been missed
Manage risks and vulnerabilities Ensure that known issues are resolved in a timely manner
Operate solution Manage and monitor application to identify technical and
business anomalies
© 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Securing the Compute Layers
© 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Virtual server instances
in the cloud
Infrastructure Services
© 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
AWS Global
Infrastructure
Customer Data
Platform & Application Management
Operating System, Network & Firewall Configuration
Client-side encryption
Data integrity
Authentication
Server-side encryption
File system and/or dataNetwork traffic protectionEncryption, integrity, identity
(Optional) Opaque Data: 0s and 1s
Foundation
Services
AWS Endpoints
Compute Storage Databases Networking
RegionsAvailability
ZonesEdge Locations
Customer IAM
AWS IAM
Managed By AWS
Customers
Managed By Amazon
Web Services
Shared Security Model (Infra Services)Example: Amazon EC2
© 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Infrastructure Services
Select, install, configure, harden, patch, monitor, perform
break/fix, upgrade and eventually decommission:
• Operating system
• Operating system components (example: sshd)
• Operating system permissions (example: sudo)
• Application container (example: Jboss)
• Application dependencies (example: NodeJS packages)
• Business application
© 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Infrastructure Services
© 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Achieve Security for Infrastructure
Amazon EC2 Auto Scaling
AWS Systems Manager
AWS OpsWorks
AWS Well-Architected Tool
Amazon GuardDuty
AWS Config
+
Scan machines
© 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Container Services
Services for running Docker
containers
© 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
AWS Global
Infrastructure
Customer Data
Application Management
Operating System, Network & Platform Management
Client-side encryption
Data integrity
Authentication
Server-side encryption
File system and/or dataNetwork traffic protectionEncryption, integrity, identity
(Optional) Opaque Data: 0s and 1s
Foundation
Services
AWS Endpoints
Compute Storage Databases Networking
RegionsAvailability
ZonesEdge Locations
Customer IAM
AWS IAM
Managed By AWS
Customers
Managed By Amazon
Web Services
Firewall Configuration
Shared Security Model (Container Services)Examples: Amazon ECS, Amazon EKS
© 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Container Services
Select, install, configure, harden, patch, monitor, perform
break/fix, upgrade and eventually decommission:
• Container assembly
• Application dependencies (example: NodeJS packages)
• Business application
© 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Container Services
© 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Achieve Security for Containers
Amazon EC2 Auto Scaling AWS OpsWorks
AWS Well-Architected Tool
Amazon GuardDutyAWS Config
+
Scan Images
© 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Abstract / Serverless Services
Serverless execution in response to
events
© 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Shared Security Model (Serverless Services)
Customer Data
(Optional) Opaque Data: 0s
and 1s
Operating System, Network & Firewall Configuration
Foundation
Services
AWS Global
Infrastructure
AWS Endpoints
Compute Storage Databases Networking
RegionsAvailability
ZonesEdge Locations
AWS IAM
Managed By AWS
Customers
Managed By Amazon
Web Services
Platform & Application Management
Client-side encryption, data integrity and authentication
Server-side encryption provided by the platform
Network traffic protection provided by the platform
Example: AWS Lambda
© 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Serverless Services
© 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
AWS Security Services for Serverless
AWS Well-Architected Tool
Amazon GuardDuty AWS Config
+
Scan code
© 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
High-level Services Are Better
Serverless
Containers
Infrastructure
© 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
AWS Identity & Access
Management (IAM)
AWS Organizations
AWS Cognito
AWS Directory Service
AWS Single Sign-On
AWS Security Hub
AWS CloudTrail
AWS Config
Amazon
CloudWatch
Amazon GuardDuty
VPC Flow Logs
AWS Control Tower
Amazon EC2
Systems Manager
AWS Shield
AWS Web Application
Firewall (WAF)
Amazon Inspector
Amazon Virtual Private
Cloud (VPC)
AWS Key Management
Service (KMS)
AWS CloudHSM
Amazon Macie
Certificate Manager
Server Side Encryption
AWS Config Rules
AWS Lambda
IdentityDetective
control
Infrastructure
security
Incident
response
Data
protection
AWS Security Solutions
© 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved.© 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Thank you
https://trendmicro.com/aws
https://aws.amazon.com/security/