Survival Guide Philipp Krenn @xeraa - - PowerPoint PPT Presentation

▶
survival guide
SMART_READER_LITE
LIVE PREVIEW

Survival Guide Philipp Krenn @xeraa - - PowerPoint PPT Presentation

Mar 05, 2023 144 likes •935 views

Survival Guide Philipp Krenn @xeraa Electronic Data Interchange (EDI) ViennaDB Papers We Love Vienna Who uses AWS, Azure,...? Does the cloud solve all your security issues? "We can

slide-1
SLIDE 1

Survival Guide

Philipp Krenn@xeraa

slide-2
SLIDE 2

Electronic Data Interchange (EDI)

slide-3
SLIDE 3

ViennaDB Papers We Love Vienna

slide-4
SLIDE 4

Who uses

AWS, Azure,...?

slide-5
SLIDE 5
slide-6
SLIDE 6

Does the cloud solve all your security issues?

slide-7
SLIDE 7
slide-8
SLIDE 8

"We can operate more securely on AWS than we can in our own data centers" Rob Alexander of CapitalOne #reinvent

— Adrian Cockcroft, https://twitter.com/adrianco/status/ 651788241557942272

slide-9
SLIDE 9

AWS Security Bulletins

https://aws.amazon.com/security/security-bulletins/

Xen, Heartbleed,...

slide-10
SLIDE 10

Securing your

Infrastructure Account

slide-11
SLIDE 11

Infrastructure

slide-12
SLIDE 12

VPC

Virtual Private Cloud

slide-13
SLIDE 13

EC2 Classic

Private and public IP on every instance

slide-14
SLIDE 14
slide-15
SLIDE 15
slide-16
SLIDE 16

Network /16

Production 10.0.*.* Development 10.1.*.* ...

slide-17
SLIDE 17

Availability Zones /18

A 10.*.0.0/18 B 10.*.64.0/18

Spare 10.*.128.0/18 & 10.*.192.0/18

slide-18
SLIDE 18

Subnets /20

A public 10.*.0.0/20 A private 10.*.16.0/20

A spare 10.*.32.0/20 & 10.*.48.0/20

B public 10.*.64.0/20 B private 10.*.80.0/20

B spare 10.*.96.0/20 & 10.*.112.0/20

slide-19
SLIDE 19

PS: Networking

No broadcasts or multicasts No IPv6 yet

slide-20
SLIDE 20

Security Group

Per instance

slide-21
SLIDE 21
slide-22
SLIDE 22

Network ACL

Per subnet (optional)

slide-23
SLIDE 23

Second layer of defense

Default allow incoming & outgoing Allow and deny Order matters Stateless

slide-24
SLIDE 24

IAM

Identity and Access Management

slide-25
SLIDE 25
slide-26
SLIDE 26

Users are managed in Groups AWS services are assigned Roles Policies define permissions

slide-27
SLIDE 27 { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "s3:ListAllMyBuckets", "Resource": "arn:aws:s3:::*" }, { "Effect": "Allow", "Action": [ "s3:ListBucket", "s3:GetBucketLocation" ], "Resource": "arn:aws:s3:::EXAMPLE-BUCKET-NAME" }, { "Effect": "Allow", "Action": [ "s3:PutObject", "s3:GetObject", "s3:DeleteObject" ], "Resource": "arn:aws:s3:::EXAMPLE-BUCKET-NAME/*" } ] }
slide-28
SLIDE 28

Create an IAM user / role for every person, service, and action

slide-29
SLIDE 29

https://awspolicygen.s3.amazonaws.com/ policygen.html

slide-30
SLIDE 30

Encryption

at rest

slide-31
SLIDE 31

S3, EBS, RDS,...

Transparent key management

slide-32
SLIDE 32
slide-33
SLIDE 33

Microservices

Technologies & AWS account per team

OAuth for internal & external communication

slide-34
SLIDE 34

Account

slide-35
SLIDE 35
slide-36
SLIDE 36

[...] our data, backups, machine configurations and

  • ffsite backups were either

partially or completely deleted.

— http://www.codespaces.com

slide-37
SLIDE 37
slide-38
SLIDE 38

The person(s) used our account to order hundreds

  • f expensive servers, likely

to mine Bitcoin or other cryptocurrencies.

— http://blog.drawquest.com

slide-39
SLIDE 39
slide-40
SLIDE 40

This outage was the result of an attack on our systems using a compromised API key.

— http://status.bonsai.io/incidents/qt70mqtjbf0s

slide-41
SLIDE 41
slide-42
SLIDE 42

1001 easy steps

slide-43
SLIDE 43

0000

Lock away your root account and never use it

slide-44
SLIDE 44

0001

Always use an IAM account

slide-45
SLIDE 45

0010

Only allow what is necessary

Principle of the least access

slide-46
SLIDE 46

{ "Statement": [ { "Effect": "Allow", "Action": "*", "Resource": "*" }, { "Effect": "Deny", "Action": [ "ec2:ReleaseAddress", "route53:DeleteHostedZone" ], "Resource": "*" } ] }

slide-47
SLIDE 47

0011

Use strong passwords

slide-48
SLIDE 48
slide-49
SLIDE 49

0100

Use Multi Factor Authentication (MFA)

slide-50
SLIDE 50
slide-51
SLIDE 51
slide-52
SLIDE 52

0101

Never commit your credentials

slide-53
SLIDE 53

Where to keep your secrets?

slide-54
SLIDE 54
  • 1. Environment variables
  • 2. Encrypted files in SCM
  • 3. Fancy tools
slide-55
SLIDE 55

http://ejohn.org /blog/keeping-passwords-in-source-control/

slide-56
SLIDE 56
slide-57
SLIDE 57

#!/bin/sh FILE=$1 FILENAME=$(basename "$FILE") EXTENSION="${FILENAME##*.}" NAME="${FILENAME%.*}" if [[ "$EXTENSION" != "aes256" ]] then echo "Encrypting $FILENAME and removing the plaintext file"

  • penssl aes-256-cbc -e -a -in $FILENAME -out ${FILENAME}.aes256

rm $FILENAME else then echo "Decrypting $FILENAME"

  • penssl aes-256-cbc -d -a -in $FILENAME -out $NAME

fi

slide-58
SLIDE 58

$ ls truststore.jks.aes256 $ encrypt-decrypt.sh truststore.jks.aes256 Contact operations@ecosio.com for the password Decrypting truststore.jks.aes256 enter aes-256-cbc decryption password: $ ls truststore.jks truststore.jks.aes256

slide-59
SLIDE 59

Tools

Ansible Vault, HashiCorp Vault,...

slide-60
SLIDE 60

Check your code

https://github.com/michenriksen/gitrob

slide-61
SLIDE 61

0110

Enable IP restrictions

slide-62
SLIDE 62

{ "Statement": [ { "Effect": "Allow", "Action": "*", "Resource": "*" }, { "Effect": "Deny", "Action": "*", "Resource": "*", "Condition": { "NotIpAddress": { "aws:SourceIp": ["1.2.3.4/24", "5.6.7.8/28"] } } } ] }

slide-63
SLIDE 63
slide-64
SLIDE 64

0111

Enable billing alerts

slide-65
SLIDE 65
slide-66
SLIDE 66

1000

Enable CloudTrail

slide-67
SLIDE 67 { "Records": [ { "eventVersion": "1.0", "userIdentity": { "type": "IAMUser", "principalId": "EX_PRINCIPAL_ID", "arn": "arn:aws:iam::123456789012:user/Alice", "accountId": "123456789012", "accessKeyId": "EXAMPLE_KEY_ID", "userName": "Alice" }, "eventTime": "2015-09-09T19:01:59Z", "eventSource": "ec2.amazonaws.com", "eventName": "StopInstances", "awsRegion": "eu-west-1", "sourceIPAddress": "205.251.233.176", "userAgent": "ec2-api-tools 1.6.12.2", "requestParameters": { "instancesSet": { "items": [ { "instanceId": "i-ebeaf9e2" } ] }, "force": false }, ... }, ... ] }
slide-68
SLIDE 68

1001

Check Your Security Status

slide-69
SLIDE 69
slide-70
SLIDE 70

Bonus

Premium Support: Trusted Advisor Security

slide-71
SLIDE 71
slide-72
SLIDE 72

Conclusion

slide-73
SLIDE 73

No Magic

Just do your homework

slide-74
SLIDE 74

140 servers running on my AWS account. What? How? I

  • nly had S3 keys on my

GitHub and they where gone within 5 minutes!

— http://www.devfactor.net/2014/12/30/2375-amazon- mistake/

slide-75
SLIDE 75

If a key is compromised, rotate it!

slide-76
SLIDE 76

How a bug in Visual Studio 2015 exposed my source code on GitHub and cost me $6,500 in a few hours

— https://www.humankode.com/security/how-a-bug- in-visual-studio-2015-exposed-my-source-code-on- github-and-cost-me-6500-in-a-few-hours

slide-77
SLIDE 77

And never commit your credentials!

slide-78
SLIDE 78

Thank you!

Questions?

@xeraa