Continuous security monitoring

© 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.

Continuous security monitoring and threat detection with AWS

S E C 3 2 1 - R

Ross Warren

Security Specialist

AWS WWCS Geo Solutions Architect

Amazon Web Services

Brandon Baxter

Solutions Architect, ESS Security Specialist

Amazon Web Services

Ice breakers

Is this your first re:Invent?

Is security in your job title?

Whose job is security?

Have you been to a chalk talk before?

What to expect?

Questions from YOU!

Lots of talking

Great whiteboard drawings!

And possibly some bad jokes

Ross and Brandon You

Attacker lifecycle: Stages

ReconnaissanceEstablish foothold

Escalate privileges

Internal reconnaissance

Maintain persistence

Attacker lifecycle: Attacker actions

RDP brute force

RAT installed

Exfiltrate data over

DNS

Probe API with temp

creds

Attempt to compromise

account

Attacker lifecycle: Amazon GuardDuty findings

RDP brute force

RAT installed

Exfiltrate data over

DNS

Probe API with temp

creds

Attempt to compromise

account

Malicious or

suspicious IP

Unusual ports

DNS exfiltration

Unusual traffic volume

Connect to blacklisted site

Recon:EC2/PortProbeUnprotectedPort

Anonymizing proxy

Temp credentials

used off-instance

Unusual ISP caller

Bitcoin activity

Unusual instance launch

You have lots of findings. What are we going to do?

Best practices for initial GuardDuty deployment

• Whitelist approved ASN for AWS Security Token Service (STS) findings

• Whitelist approved vulnerability scanners for brute force findings

• Whitelist approved recon-based findings based on port (VPC flow-based)

• Change the Amazon CloudWatch Events update time to 15 minutes

• Creating filters for high-fidelity findings

• In the console for initial visibility

• Create custom Amazon CloudWatch Event rules

• Create notifications (Amazon Simple Notification Service (SNS)) from events

Lessons learned from incident responseUse a strong tagging strategy

Lessons learned from incident response

Questions to ask during the investigation• Is this finding a true positive?

• Is the event an unusual activity or more?

• Where did the incident occur?

• Who reported or discovered the incident?

• How was it discovered?

• Are there any other areas that have been compromised by the incident? If so what are they and when were they discovered?

• What is the scope of the impact?

• What is the business impact?

• Have the source(s) of the incident been located? If so, where, when, and what are they?

Lessons learned from incident response

Enrich findings and get the full picture of your environment• Network intrusion detection

• Firewall alerts

• AWS WAF alerts

• Identity - user behaviors

• Endpoint and compute events (AV, EDR)

• OS-level Information

• Application level logs

Centralize findings into a SIEM

Educate

Prepare

Simulate

Iterate


30+ free digital courses cover topics related to cloud security, including Introduction to Amazon GuardDuty and Deep Dive on Container Security

Learn security with AWS Training and Certification

Visit aws.amazon.com/training/paths-specialty/

Classroom offerings, like AWS Security Engineering on AWS, feature AWS expert instructors and hands-on activities

Validate expertise with the AWS Certified Security - Specialty exam

Resources created by the experts at AWS to help you build and validate cloud security skills

Thank you!


Best practices for Amazon GuardDuty

1. Apply trusted IP list to corp owned IP space or auto archive (whitelist based on filter) by ASN

2. To ensure faster updates to findings, change the finding update time to 15 minutes.


3. Create filter for high fidelity findings


4. Create filter for high fidelity findings using CloudWatch Events.


Best practices for operational Amazon GuardDuty

• Machine learning findings filter (behavior-based findings)

• Network port unusual (VPC Flow based)

• Unusual console logins

• Suspicious recon based findings (CloudTrail based)

• Persistence based findings (CloudTrail based)

AWS CloudTrail AWS Lambda

(post processor)

PutEvent triggers

Lambda function

Amazon DynamoDB

Pull in metadata

Amazon

S3 Bucket

CloudTrail delivers logs to

S3 bucket

Amazon

Elasticsearch

Push post processed logs to

Elasticsearch

Security Team

Analysis Logs

Detection and response at scaleEnriching AWS CloudTrail logs

Amazon VPC

Flow LogsAWS Lambda

(ingester function)

Logs are streamed

to Lambda

Amazon

CloudWatch Logs

VPC Flow Logs deliver logs

to CloudWatch

Logs are passed

to Kinesis Data Firehose

Amazon Kinesis

Data Firehose

Amazon Elasticsearch Service

Push post processed

logs to Elasticsearch

Security Team

Analysis Logs

AWS Lambda

(ingestor function)

Data enrichment

3rd Party Data

Pull in additional

metadata

https://github.com/aws-samples/aws-vpc-flow-log-appender/

Detection and response at scale

Enriching VPC Flow Logs

Amazon MacieAmazon

CloudWatch

Event Rule

Macie alert triggers a

CloudWatch Event Rule

Event Pattern

{"source": [

"aws.macie"],"detail": [

“Macie Alert”]

}

CloudWatch Event rule

triggers Lambda Function

Lambda Function

removes global

read rights

AWS Lambda

Function

Amazon S3

Bucket


https://github.com/aws-samples/amazon-guardduty-waf-acl/

Amazon GuardDuty Amazon

CloudWatch

Event rule

SSH brute force finding triggers


AWS Lambda

CloudWatch Event Rule triggers

Lambda function

AWS WAF

AWS WAF IP condition is created

and added to an active Web ACL

Amazon DynamoDB

IP List is added

to tables

Amazon VPC

Network access

control list (ACL)

Network ACL rule is added to block

IP

Amazon SNS Topic

Publishes to a

SNS topic

Security team is notified


GuardDuty response with AWS Lambda

https://scaling-threat-detection.awssecworkshops.com/


CloudWatch

Event rule

SSH brute force finding triggers


AWS Lambda

CloudWatch Event Rule triggers

Lambda function

Slack Channel

Publishes to a

Slack Channel

Security team

is notified

Amazon VPC

Network Access

Control List

Network ACL rule is added

to block IP

AWS Lambda

AWS Lambda Amazon EC2

Instance

Function adds a unique

tag to the EC2 instance

Function creates and

initiates an Amazon Inspector scan Amazon Inspector scans

EC2 instance

Amazon Inspector

Detection and response at scale: GuardDuty response with AWS Lambda


CloudWatch

Event rule

Cryptocurrency finding triggers


AWS Systems

Manager Run

Command


triggers targetsShutdown services and

capture memory

Amazon EC2

instance

Remove instance from

Auto Scaling group and

snapshot EBS

AWS Systems

Manager

Automation

AWS Lambda

Push memory and

Amazon EBS snapshot to

a separate account

Forensics

AWS Account

Detection and response at scale:GuardDuty response with different targets

Amazon GuardDuty

Publish Event

START

Finding Type

EC2/C&Cactivity.B!DNS IAM/InstanceCredentialExfiltrationEC2/TorIPCaller

END

Publish Remediation

Amazon

CloudWatch

Event Rule

GuardDuty finding triggers


AWS Step FunctionsCloudWatch Event Rule triggers

State Machine

Detection and response at scale: GuardDuty response with AWS Step Functions

Attackers

Valid UsersApplication

Load

Balancer

CloudFront

Distribution

Web Application ResourcesApplication Requests (Static/Dynamic)

https://aws.amazon.com/answers/security/aws-waf-security-automations/

Cross-site scripting protection

SQL injection protection

Bad bot and scraper

protection

IP address whitelist/blacklist

Scanner and probe protection

HTTP flood protection

Known-attacker protection

X

AWS WAF

Requests to the Honeypot Endpoint

AWS Lambda

Access

Handler

Amazon API

Gateway

AWS Lambda

IP List Parser

Amazon

CloudWatch

Event Rule

3rd Party IP

Reputation

lists

Hourly

New Access Log Files

AWS Lambda

Log Parser

Amazon S3

Bucket

Detection and response at scale:Active AWS WAF response

Use case 1: Centralized security and compliance workspace

GoalHave a single pane of glass to view, triage, and take action on AWS

security and compliance issues across accounts

PersonasSecOps, compliance, and/or DevSecOps teams focused on AWS,

Cloud Centers of Excellence, the first security hire

Key processes

example

1. Ingest findings from finding providers

2. High volume and well-known findings are programmatically

routed to remediation workflows, which include updating the

status of the finding

3. Remaining findings are routed to analysts via an on-call

management system, and they use ticketing and chat systems to

resolve them

“Taking action”

integrationsTicketing systems, chat systems, on-call management systems, SOAR

platforms, customer-built remediation playbooks

Use case 2: Centralized routing to a SIEM

GoalEasily route all AWS security and compliance findings in a normalized

format to a centralized SIEM or log management tool

Personas SecOps, compliance, and/or DevSecOps teams

Key processes

example

1. Ingest findings from finding providers

2. All findings are routed via Amazon CloudWatch Events to a

central SIEM that stores AWS and on-premises security and

compliance data

3. Analyst workflows are linked to the central SIEM

“Taking action”

integrationsSIEM

Threat response: A playbook outline

Amazon

CloudWatch

Events

AWS

CloudTrail

AWS Config

Lambda

function

AWS

APIs

Detect

Investigate

Respond

Team

collaboration

(Slack, etc.)

Amazon

GuardDuty

VPC Flow

Logs

Amazon

Inspector

Amazon

Macie

AWS Security Hub

Custom actions in AWS Security Hub

Taking action on all findings

Event pattern examples{

“source”: [

“aws.securityhub”

],

“detail-type”: [

“Security Hub Findings”

],

“detail”: {

“findings”: {

“Resources”: {

“Tags”: {

“Environment”: [

“PCI”

]

}

}

}

}

}

Filter by tags

Event pattern examples

Filter by severity

{

“source”: [

“aws.securityhub”

],

“detail-type”: [

“Security Hub Findings”

],

“detail”: {

“findings”: {

“Severity”: {

“Normalized”: [

95,

96,

97,

98,

99,

100

]

}}}}


RuleEvent

{

"source": [

"aws.securityhub"

],

"resources": [

"arn:aws:securityhub:us-west-

2:xxxxxxxxxxxx:action/custom/send_to_email"

]

}


RuleEvent

RuleEvent

RuleEvent

Run

command

AWS Identity & Access

Management (IAM)

AWS Single Sign-On

AWS Directory Service

Amazon Cognito

AWS Organizations

AWS Secrets Manager

AWS Resource Access

Manager

AWS Security Hub

Amazon GuardDuty

AWS Config

AWS CloudTrail

Amazon

CloudWatch

VPC Flow Logs

AWS Systems Manager

AWS Shield

AWS WAF

AWS Firewall Manager

Amazon Inspector

Amazon Virtual Private

Cloud (Amazon VPC)

AWS Key Management

Service (AWS KMS)

AWS CloudHSM

AWS Certificate Manager

Amazon Macie

Server-Side Encryption

AWS Config Rules

AWS Lambda

AWS Systems Manager

Identity DetectInfrastructure

protectionRespond

Data

protection

Deep set of security tools


30+ free digital courses cover topics related to cloud security, including Introduction to Amazon GuardDuty and Deep Dive on Container Security

Learn security with AWS Training and Certification

Visit aws.amazon.com/training/paths-specialty/

Classroom offerings, like AWS Security Engineering on AWS, feature AWS expert instructors and hands-on activities

Validate expertise with the AWS Certified Security - Specialty exam

Resources created by the experts at AWS to help you build and validate cloud security skills

Thank you!


Continuous security monitoring

Documents

Transcript of Continuous security monitoring