Amazon AWS Security PurpleBox Cloud Servicesschd.ws/hosted_files/gw2016/40/8-9 NGuven -...

PurpleBox, Incwww.prplbx.com

+1 (770) 421-5808

Pu

rple

Box

, In

c. M

arke

tin

g - C

lou

d -

Sec

uri

ty©

2016

All

Rig

hts

Res

erve

d

PurpleBox Cloud Services

Amazon AWS Security

Geek Week 2016Tuesday, August 9th


+1 (770) 421-5808

Pu

rple

Box

, In

c. M

arke

tin

g - C

lou

d -

Sec

uri

ty©

2016

All

Rig

hts

Res

erve

d

PurpleBox Overview

PurpleBox Cloud

● Consulting and Cloud Migration● Managed Cloud Services● Cloud Security Services● Amazon AWS Consulting Partner● Certifications:

○ AWS Certified Solution Architect○ AWS Certified SysOps Admin

PurpleBox Security

● Vulnerability Management● Security Assessments● PenTesting● Web Application Security● Security Compliance and GRC● Security Monitoring/SIEM/IDS/IPS


+1 (770) 421-5808

Pu

rple

Box

, In

c. M

arke

tin

g - C

lou

d -

Sec

uri

ty©

2016

All

Rig

hts

Res

erve

d

16+ years in IT Security

Big4, Security/Cloud Software Vendor, MSSP

Specialties:

● Security Strategy, Operations, Architecture, and Program Management● Threat and Vulnerability Management● Web Application Security● Amazon AWS Security

Nihat Guven


+1 (770) 421-5808

Pu

rple

Box

, In

c. M

arke

tin

g - C

lou

d -

Sec

uri

ty©

2016

All

Rig

hts

Res

erve

d

● Shared Responsibility Model● Network Security● Identify and Access Management● Encryption● Logging and Monitoring

Agenda


+1 (770) 421-5808

Pu

rple

Box

, In

c. M

arke

tin

g - C

lou

d -

Sec

uri

ty©

2016

All

Rig

hts

Res

erve

d

Shared Responsibility Model

YouYou get to define your controls IN the Cloud

AWS takes care of the security OF the Cloud


+1 (770) 421-5808

Pu

rple

Box

, In

c. M

arke

tin

g - C

lou

d -

Sec

uri

ty©

2016

All

Rig

hts

Res

erve

d

Shared Responsibility Model


+1 (770) 421-5808

Pu

rple

Box

, In

c. M

arke

tin

g - C

lou

d -

Sec

uri

ty©

2016

All

Rig

hts

Res

erve

d

Security OF AWS


+1 (770) 421-5808

Pu

rple

Box

, In

c. M

arke

tin

g - C

lou

d -

Sec

uri

ty©

2016

All

Rig

hts

Res

erve

d

Security OF AWS


+1 (770) 421-5808

Pu

rple

Box

, In

c. M

arke

tin

g - C

lou

d -

Sec

uri

ty©

2016

All

Rig

hts

Res

erve

d

Security OF AWS


+1 (770) 421-5808

Pu

rple

Box

, In

c. M

arke

tin

g - C

lou

d -

Sec

uri

ty©

2016

All

Rig

hts

Res

erve

d

Security IN the cloud

You retain full ownership and control of your content

● Choose the AWS Region and AWS will not replicate it elsewhere unless you choose to do so.

● Control format, accuracy, and encryption any way that you choose.● Control who can access content.● Control content lifecycle and disposal.


+1 (770) 421-5808

Pu

rple

Box

, In

c. M

arke

tin

g - C

lou

d -

Sec

uri

ty©

2016

All

Rig

hts

Res

erve

d

Data Location - You decide


+1 (770) 421-5808

Pu

rple

Box

, In

c. M

arke

tin

g - C

lou

d -

Sec

uri

ty©

2016

All

Rig

hts

Res

erve

d

Network Security Basics - still relevant!

● Segmentation● Least Privileges● Defense in Depth● Minimize Attack Surface


+1 (770) 421-5808

Pu

rple

Box

, In

c. M

arke

tin

g - C

lou

d -

Sec

uri

ty©

2016

All

Rig

hts

Res

erve

d

VPC-East (us-east-1) 10.10.0.0/16

AZ A AZ DAZ B

10.10.1.0/24

10.10.2.0/24

10.10.3.0/24

SG-DMZ

SG-Internal

SG-Internal

RT-DefaultRT-Internet

IGW

NAT Gateway

10.10.11.0/24

10.10.12.0/24

10.10.13.0/24

SG-DMZ

SG-Internal

SG-Internal

NAT Gateway

10.10.21.0/24

10.10.22.0/24

10.10.23.0/24

SG-DMZ

SG-Internal

SG-Internal

NAT Gateway

Example


+1 (770) 421-5808

Pu

rple

Box

, In

c. M

arke

tin

g - C

lou

d -

Sec

uri

ty©

2016

All

Rig

hts

Res

erve

d

Example

Segmentation- Multiple AWS Accounts- Single AWS Account with VPC- Subnets- Routing Tables- ACL- VPC Peering across Regions

Least Privileges- Security Groups at each level- Internet to IGW / Elastic Load Balancer- IGW/ELB to DMZ- DMZ to Internal Subnets- Only specific ports allowed

Defense in Depth- Network Level (VPC, SG, ACL)- OS level (Windows/Linux) - Service Level (Policies)- Monitoring

Minimize Attack Surface- Console Access- API/CLI Access- Single dns name/ip - Inbound HTTP/HTTPS Only- Management through Bastion Host - SSH only


+1 (770) 421-5808

Pu

rple

Box

, In

c. M

arke

tin

g - C

lou

d -

Sec

uri

ty©

2016

All

Rig

hts

Res

erve

d

AWS Identity and Access Management (IAM)

▪ Enables you to control who can do what in your AWS account

▪ Splits into users, groups, roles, and permissions

▪ Control▪ Centralized

▪ Fine-grained - APIs, resources, and AWS Management Console

▪ Security▪ Secure (deny) by default


+1 (770) 421-5808

Pu

rple

Box

, In

c. M

arke

tin

g - C

lou

d -

Sec

uri

ty©

2016

All

Rig

hts

Res

erve

d

AWS IAM Best Practices

1. Create individual users. Benefits▪ Unique credentials▪ Individual credential rotation▪ Individual permissions▪ Simplifies forensics


+1 (770) 421-5808

Pu

rple

Box

, In

c. M

arke

tin

g - C

lou

d -

Sec

uri

ty©

2016

All

Rig

hts

Res

erve

d


1. Create individual users.

2. Grant least privilege.Benefits▪ Less chance of people making mistakes▪ Easier to relax than tighten up▪ More granular control


+1 (770) 421-5808

Pu

rple

Box

, In

c. M

arke

tin

g - C

lou

d -

Sec

uri

ty©

2016

All

Rig

hts

Res

erve

d



2. Grant least privilege.

3. Manage permissions with groups.

Benefits▪ Easier to assign the same permissions to

multiple users▪ Simpler to reassign permissions based on

change in responsibilities▪ Only one change to update permissions for

multiple users


+1 (770) 421-5808

Pu

rple

Box

, In

c. M

arke

tin

g - C

lou

d -

Sec

uri

ty©

2016

All

Rig

hts

Res

erve

d





4. Restrict privileged access further with conditions.

Benefits▪ Additional granularity when defining

permissions▪ Can be enabled for any AWS service API▪ Minimizes chances of accidentally

performing privileged actions


+1 (770) 421-5808

Pu

rple

Box

, In

c. M

arke

tin

g - C

lou

d -

Sec

uri

ty©

2016

All

Rig

hts

Res

erve

d

What if you wanted to restrict access to a time frame and IP address range?

Allows a user to access a resource under the following conditions:▪ The time is after 12:00 P.M. on 10/8/2015 AND▪ The time is before 3:00 P.M. on 10/8/2015 AND▪ The request comes from an IP address in the 192.0.2.0 /24 OR 203.0.113.0 /24

range

All of these conditions must be met in order for the statement to evaluate to TRUE.

Condition example

"Condition" : { "DateGreaterThan" : {"aws:CurrentTime" : "2015-10-08T12:00:00Z"}, "DateLessThan": {"aws:CurrentTime" : "2015-10-08T15:00:00Z"}, "IpAddress" : {"aws:SourceIp" : ["192.0.2.0/24", "203.0.113.0/24"]}}

AND

OR


+1 (770) 421-5808

Pu

rple

Box

, In

c. M

arke

tin

g - C

lou

d -

Sec

uri

ty©

2016

All

Rig

hts

Res

erve

d

Policy variables

▪ Predefined variables based on service request context• Existing keys (aws:SourceIP, aws:CurrentTime, etc.)• Principal-specific keys (aws:username, aws:userid, aws:principaltype)• Provider-specific keys (graph.facebook.com:id, www.amazon.com:user_id)• SAML keys (saml:aud, saml:iss)• And more

▪ Benefits• Simplifies policy management• Reduces the need for hard-coded, user-specific policies

▪ Use case• Easily set up user access to “home folder” in Amazon S3


+1 (770) 421-5808

Pu

rple

Box

, In

c. M

arke

tin

g - C

lou

d -

Sec

uri

ty©

2016

All

Rig

hts

Res

erve

d

{ "Version": "2012-10-17", "Statement": [{ "Effect": "Allow", "Action": ["s3:ListBucket"], "Resource": ["arn:aws:s3:::myBucket"], "Condition":

{"StringLike": {"s3:prefix":["home/${aws:username}/*"]}

} }, { "Effect":"Allow", "Action":["s3:*"], "Resource": ["arn:aws:s3:::myBucket/home/${aws:username}", "arn:aws:s3:::myBucket/home/${aws:username}/*"] } ]}

The anatomy of a policy with variablesVersion is required

Variable in conditions

Variable in resource ARNs

Grants a user access to a home directory in Amazon S3 that can be accessed programmatically


+1 (770) 421-5808

Pu

rple

Box

, In

c. M

arke

tin

g - C

lou

d -

Sec

uri

ty©

2016

All

Rig

hts

Res

erve

d


+1 (770) 421-5808

Pu

rple

Box

, In

c. M

arke

tin

g - C

lou

d -

Sec

uri

ty©

2016

All

Rig

hts

Res

erve

d





4. Restrict privileged access further with conditions.

5. Enable AWS CloudTrail to get logs of API calls.

Benefits▪ Visibility into your user activity by

recording AWS API calls to an Amazon S3 bucket


+1 (770) 421-5808

Pu

rple

Box

, In

c. M

arke

tin

g - C

lou

d -

Sec

uri

ty©

2016

All

Rig

hts

Res

erve

d


6. Configure a strong password policy.

7. Rotate security credentials regularly.

8. Enable multi-factor authentication(MFA) for privileged users.

Benefits▪ Ensures your users and your data are

protected▪ Protect API/CLI access▪ Supplements username and password to

require a one-time code during authentication


+1 (770) 421-5808

Pu

rple

Box

, In

c. M

arke

tin

g - C

lou

d -

Sec

uri

ty©

2016

All

Rig

hts

Res

erve

d


+1 (770) 421-5808

Pu

rple

Box

, In

c. M

arke

tin

g - C

lou

d -

Sec

uri

ty©

2016

All

Rig

hts

Res

erve

d


+1 (770) 421-5808

Pu

rple

Box

, In

c. M

arke

tin

g - C

lou

d -

Sec

uri

ty©

2016

All

Rig

hts

Res

erve

d


9. Use IAM roles to share access.

10. Use IAM roles for Amazon EC2 instances.

11. Reduce or remove use of root.

Benefits▪ No need to share security credentials▪ No need to store long-term credentials▪ Use cases

▪ Cross-account access▪ Intra-account delegation▪ Federation

▪ Assign least privilege to the application▪ AWS SDKs/CLI fully integrated▪ Reduce potential for misuse of credentials


+1 (770) 421-5808

Pu

rple

Box

, In

c. M

arke

tin

g - C

lou

d -

Sec

uri

ty©

2016

All

Rig

hts

Res

erve

d

Top 11 IAM best practices

1. Users – Create individual users.

2. Permissions – Grant least privilege.

3. Groups – Manage permissions with groups.

4. Conditions – Restrict privileged access further with conditions.

5. Auditing – Enable AWS CloudTrail to get logs of API calls.

6. Password – Configure a strong password policy.

7. Rotate – Rotate security credentials regularly.

8. MFA – Enable MFA for privileged users.

9. Sharing – Use IAM roles to share access.

10. Roles – Use IAM roles for Amazon EC2 instances.

11. Root – Reduce or remove use of root.


+1 (770) 421-5808

Pu

rple

Box

, In

c. M

arke

tin

g - C

lou

d -

Sec

uri

ty©

2016

All

Rig

hts

Res

erve

d

Encrypt your sensitive information

Native encryption across services for free▪ Amazon S3, Amazon EBS, Amazon RDS, Amazon Redshift▪ End-to-end SSL/TLS

Scalable key management▪ AWS Key Management Service (KMS) ▪ AWS CloudHSM

Third-party encryption options▪ Trend Micro, SafeNet, Vormetric, HyTrust, Sophos, etc.


+1 (770) 421-5808

Pu

rple

Box

, In

c. M

arke

tin

g - C

lou

d -

Sec

uri

ty©

2016

All

Rig

hts

Res

erve

d

Log and Monitor

What can you answer using a CloudTrail event?

▪ Who made the API call?

▪ When was the API call made?

▪ What was the API call?

▪ Which resources were acted upon in the API call?

▪ Where was the API call made from and made to?


+1 (770) 421-5808

Pu

rple

Box

, In

c. M

arke

tin

g - C

lou

d -

Sec

uri

ty©

2016

All

Rig

hts

Res

erve

d

AWS CloudTrail best practices

1. Enable in all regions Benefits▪ Also tracks unused regions▪ Can be done in single configuration step


+1 (770) 421-5808

Pu

rple

Box

, In

c. M

arke

tin

g - C

lou

d -

Sec

uri

ty©

2016

All

Rig

hts

Res

erve

d


1. Enable in all regions

2. Enable log file validation

Benefits▪ Ensure log-file integrity▪ Validated log files are invaluable in security

and forensic investigations▪ Built using industry standard algorithms:

SHA-256 for hashing and SHA-256 with RSA for digital signing

▪ AWS CloudTrail will start delivering digest files on an hourly basis

▪ Digest files contain hash values of log files delivered and are signed by CloudTrail


+1 (770) 421-5808

Pu

rple

Box

, In

c. M

arke

tin

g - C

lou

d -

Sec

uri

ty©

2016

All

Rig

hts

Res

erve

d




3. Encrypted logs

Benefits▪ By default, CloudTrail encrypts log files

using S3 server-side encryption (SSE-S3)▪ You can choose to encrypt using AWS KMS

(SSE-KMS)▪ S3 will decrypt on your behalf if your

credentials have decrypt permissions


+1 (770) 421-5808

Pu

rple

Box

, In

c. M

arke

tin

g - C

lou

d -

Sec

uri

ty©

2016

All

Rig

hts

Res

erve

d


1. Enable in all regions2. Enable log file

validation3. Encrypted logs4. Integrate with Amazon

CloudWatch Logs

Benefits▪ Simple search▪ Configure alerting on events


+1 (770) 421-5808

Pu

rple

Box

, In

c. M

arke

tin

g - C

lou

d -

Sec

uri

ty©

2016

All

Rig

hts

Res

erve

d




3. Encrypted logs

4. Integrate with Amazon CloudWatch Logs

5. Centralize logs from all accounts

Benefits▪ Configure all accounts to send logs to a

central security account▪ Reduce risk for log tampering▪ Can be combined with S3 CRR▪ Include dev/stage accounts!


+1 (770) 421-5808

Pu

rple

Box

, In

c. M

arke

tin

g - C

lou

d -

Sec

uri

ty©

2016

All

Rig

hts

Res

erve

d

Resources

● https://aws.amazon.com/security/● https://aws.amazon.com/compliance/● https://d0.awsstatic.com/whitepapers/AWS_CAF_Security_Perspective.pdf● https://d0.awsstatic.com/whitepapers/aws-security-whitepaper.pdf

https://aws.amazon.com/security/

https://aws.amazon.com/security/

https://aws.amazon.com/compliance/



https://d0.awsstatic.com/whitepapers/AWS_CAF_Security_Perspective.pdf

https://d0.awsstatic.com/whitepapers/AWS_CAF_Security_Perspective.pdf

https://d0.awsstatic.com/whitepapers/aws-security-whitepaper.pdf

https://d0.awsstatic.com/whitepapers/aws-security-whitepaper.pdf


+1 (770) 421-5808

Pu

rple

Box

, In

c. M

arke

tin

g - C

lou

d -

Sec

uri

ty©

2016

All

Rig

hts

Res

erve

d

Nihat GuvenCloud and Security Services

[email protected]

Thank You!

mailto:[email protected]

mailto:[email protected]

Date post:	31-Mar-2018
Category:	Documents
Upload:	dangnhu
View:	220 times
Download:	3 times

Amazon AWS Security PurpleBox Cloud Servicesschd.ws/hosted_files/gw2016/40/8-9 NGuven -...

Documents