Advanced Security Automation Made Simple Mark Nunnikhoven Vice - - PowerPoint PPT Presentation

▶
advanced security automation made simple
SMART_READER_LITE
LIVE PREVIEW

Advanced Security Automation Made Simple Mark Nunnikhoven Vice - - PowerPoint PPT Presentation

Sep 04, 2022 371 likes •830 views

Advanced Security Automation Made Simple Mark Nunnikhoven Vice President, Cloud Research at Trend Micro @marknca The goal of cybersecurity Make sure that systems work as intended The goal of cybersecurity Make sure that systems work as

slide-1
SLIDE 1

Advanced Security Automation Made Simple

Mark Nunnikhoven

Vice President, Cloud Research at Trend Micro @marknca

slide-2
SLIDE 2

Make sure that systems work as intended

The goal of cybersecurity

slide-3
SLIDE 3
  • nly as intended

…and only as intended Make sure that systems work as intended

The goal of cybersecurity

slide-4
SLIDE 4

Data Application OS Virtualization Infrastructure Physical

On-premises


(Traditional)

Data Application OS Virtualization Infrastructure Physical

Infrastructure

(IaaS)

Data Application OS Virtualization Infrastructure Physical

Container

(PaaS)

Data Application OS Virtualization Infrastructure Physical

Abstract

(SaaS)

The Shared Responsibility Model

AWS’ responsibility Your responsibility

Service configuration

slide-5
SLIDE 5

Security Development Operations

slide-6
SLIDE 6

Solving Problems
 For Customers

slide-7
SLIDE 7
slide-8
SLIDE 8

Operational Excellence Reliability Performance Efficiency Security Cost Optimization

The Well-Architected Framework

slide-9
SLIDE 9
slide-10
SLIDE 10
slide-11
SLIDE 11

Automate

slide-12
SLIDE 12

Restrict Permissions

slide-13
SLIDE 13

Grant only those privileges which are essential to perform the intended function

The principle of least privilege

slide-14
SLIDE 14

User Permission Role Aurora S3 Bucket Notebook MQ

slide-15
SLIDE 15
slide-16
SLIDE 16
  • 1. In an isolated test environment, apply a FullAccess

policy or the permissions you believe are required

  • 2. Complete the desired tasks
  • 3. Compare against CloudTrail logs to verify actual

permissions used

  • 4. Use new policy to enforce the principle of least privilege
  • 5. Repeat as code changes

The steps

slide-17
SLIDE 17
slide-18
SLIDE 18
slide-19
SLIDE 19
slide-20
SLIDE 20

Many approaches…

CloudTrail Console

slide-21
SLIDE 21

Many approaches…

Policy CloudTrail Console Lambda

slide-22
SLIDE 22

Many approaches…

Slack GitHub Policy CloudTrail S3 Bucket Athena Console Lambda Lambda CloudWatch Event

slide-23
SLIDE 23

Monitor S3 Exposure

slide-24
SLIDE 24

Do not make that which is secure, insecure

The principle of the face palm

slide-25
SLIDE 25

{

Amazon S3 AWS IAM Amazon Macie AWS Trusted Advisor AWS Well-Architected Tool

Service Warnings

slide-26
SLIDE 26

S3 Bucket * ACL CloudWatch Event Lambda

slide-27
SLIDE 27
slide-28
SLIDE 28

Track Production Logins

slide-29
SLIDE 29

Systems, not users access production systems

The DevOps principle

slide-30
SLIDE 30

Instance CloudWatch
 Logs User Lambda Slack

slide-31
SLIDE 31
  • 1. Push critical system and application

events to CloudWatch Logs

  • 2. Subscribe to various log filters via AWS

Lambda

  • 3. Run security playbook automatically

The steps

slide-32
SLIDE 32

Forensic Isolation

slide-33
SLIDE 33

If something unknown is happening, quarantine until you figure it out

The Crichton principle

slide-34
SLIDE 34

Instance SNS Topic User Lambda

slide-35
SLIDE 35
  • 1. Security controls on instance alert on issue
  • 2. Lambda triggered by alert
  • 3. Change security group to make system inaccessible
  • 4. Open security incident
  • 5. Create forensic instance to analyze infected instance
  • 6. …

The steps

slide-36
SLIDE 36

What’s Next?

slide-37
SLIDE 37
  • 1. Custom application logs to AWS Config (via rules) for centre

compliance log

  • 2. Correlate auto-scaling alerts with backend data to detect possible

DDoS attacks

  • 3. Detect unauthorized drift from applications & infrastructure

CloudFormation templates

  • 4. Streamline the incident response process, including restoring

production to full capacity

  • 5. Automatically find & mitigate vulnerabilities before deployment

Sample ideas

slide-38
SLIDE 38

Don’t over complicate security

slide-39
SLIDE 39

1.Start manually 2.Determine risk tolerance 3.Lambda all the things

Simple steps to automated success

slide-40
SLIDE 40

Use two lanes

Trigger Result

slide-41
SLIDE 41

Use two lanes

Trigger Result CloudWatch Event Lambda CloudTrail Lambda Slow lane Fast lane

slide-42
SLIDE 42
  • nly as intended

…and only as intended Make sure that systems work as intended

The goal of cybersecurity

slide-43
SLIDE 43

markn.ca/2019/aws-reinvent

slide-44
SLIDE 44

Thank you!

Mark Nunnikhoven

Vice President, Cloud Research at Trend Micro

@marknca

markn.ca/2019/aws-reinvent

slide-45
SLIDE 45

Please complete the session survey in the mobile app

40