Web App Security on AWS: How to Make Shared Security Work for You

Welcome

Ryan Holland

Solutions Architect

Amazon Web Services

Webinar Overview Submit Your Questions using the Q&A tool.

A copy of today’s presentation will be made available on:

AWS SlideShare Channel@ http://www.slideshare.net/AmazonWebServices/

AWS Webinar Channel on YouTube@ http://www.youtube.com/channel/UCT-

nPlVzJI-ccQXlxjSvJmw

Ryan Holland Solutions Architect

Amazon Web Services

Johnathan Norman Solutions Architect

AlertLogic

Introducing

Amazon Web Services security overview

How to access Alert Logic Web Security Manager via AWS

Marketplace

How to integrate web application security in your AWS environment

Q&A

What We’ll Cover

Ryan Holland

Sr Manager, Partner Solution Architects

Foundation Services

Compute Storage Database Networking

AWS Global Infrastructure Regions

Availability Zones

Edge Locations

Client-side Data Encryption

Server-side Data Encryption

Network Traffic Protection

Platform, Applications, Identity & Access Management

Operating System, Network & Firewall Configuration

Customer content

Cu

sto

mer

s

• Culture of security and continual improvement

• Ongoing audits and assurance

• Protection of large-scale service endpoints

• Customers configure AWS security features

• Get access to a mature vendor marketplace

• Can implement and manage their own controls

• Gain additional assurance above AWS controls

Security is a shared responsibility between AWS and our customers

Every customer has access to the same security capabilities

AWS maintains a formal control environment

• SOC 1 (SSAE 16 & ISAE 3402) Type II (was SAS70)

• SOC 2 Security

• ISO 27001 Certification

• Certified PCI DSS Level 1 Service Provider

• FedRAMP (FISMA), ITAR, FIPS 140-2

• HIPAA and MPAA capable

Foundation Services

Compute Storage Database Networking

AWS Global Infrastructure Regions

Availability Zones

Edge Locations

Let AWS take care of the heavy lifting for you

Facilities

Physical security

Compute infrastructure

Storage infrastructure

Network infrastructure

Virtualization layer (EC2)

Hardened service endpoints

Rich IAM capabilities

Network configuration

Security groups

OS firewalls

Operating systems

Applications

Proper service configuration

AuthN & acct management

Authorization policies

+ =

Customer

Customers get to choose the right level of security for their business. As an AWS customer you can focus on your business and not be distracted by the muck.

AWS partners can help you build secure solutions

Facilities

Physical security

Compute infrastructure

Storage infrastructure

Network infrastructure

Virtualization layer (EC2)

Hardened service endpoints

Fine-grained IAM capability

+ =

AWS partner solutions

These products and more are available on the AWS marketplace - WAF, VPN, IPS, AV, API gateways, data encryption, user management

Your secure AWS

solutions

Public Cloud Security - AWS

Johnathan Norman

Cloud Solutions Architect

The Web Application Attack Threat

12

Web Application Attacks are

Prevalent and Dangerous • Half of all environments will be impacted by web

application attacks 30 times in a year1

• 83% of websites have at least one serious vulnerability2

• Web-based attacks increased 30% in 20123

• Web application security measures required by PCI DSS

Application Vulnerabilities are Common • On average, 12.1 security issues affect every web

application4

• The average web site has 56 serious vulnerabilities5

• The application layer is responsible for over 90% of all security vulnerabilities6

1 Alert Logic State of Cloud Security – Spring 2013 2 Frost & Sullivan: The Growing Hacking Threat to Websites 3 Symantec Corporation: Internet Security Threat Report 2013 4 Context Information Security - Web Application Vulnerability Statistics 2013 5 WhiteHat Website Security Report, May 2013 6 Ponemon Institute - The State of Application Security, August 2013

Public Cloud Shared Security Model

Cloud

Service

Provider

Responsibility

Foundation

Services

Hosts

• Logical network segmentation

• Perimeter security services

• External DDoS, spoofing, and scanning prevented

• Hardened hypervisor

• System image library

• Root access for customer

• Access management

• Patch management

• Configuration hardening

• Security monitoring

• Log analysis

Apps

• Secure coding and best practices

• Software and virtual patching

• Configuration management

• Access management

• Application level attack monitoring

• Network threat

detection

• Security monitoring

Networks

Customer

Responsibility

Compute Storage DB Network

Example: SQL Injection

14

… /showitem.asp

Choose a category:

Select an item:

Winter Coats

Fleece Jacket

Group=10

Item=4534

A customer makes selections in a shopping cart application:

Example: SQL Injection

15

… /showitem.asp?group=10&item=4534

Choose a category:

Select an item:

Winter Coats

Fleece Jacket

Group=10

Item=4534

User choices

translated into

application input

Example: SQL Injection

16

… /showitem.asp?group=10&item=4534;drop table products

Choose a category:

Select an item:

Winter Coats

Fleece Jacket

An attacker injects harmful code into the URL

Source: Verizon Data Breach Investigation Report, 2013

Result: Downtime, Data Loss

17

Solutions Address Specific Compliance Mandates

Alert Logic

Solution

PCI DSS SOX HIPAA & HITECH

Alert Logic

Web Security

Manager

• 6.5.d Have processes in place to protect applications

from common vulnerabilities such as injection flaws,

buffer overflows and others

• 6.6 Address new threats and vulnerabilities on an

ongoing basis by installing a web application firewall in

front of public-facing web applications.

• DS 5.10 Network Security

• AI 3.2 Infrastructure resource

protection and availability

• 164.308(a)(1) Security

Management Process

• 164.308(a)(6) Security Incident

Procedures

Alert Logic

Log Manager

• 10.2 Automated audit trails

• 10.3 Capture audit trails

• 10.5 Secure logs

• 10.6 Review logs at least daily

• 10.7 Maintain logs online for three months

• 10.7 Retain audit trail for at least one year

• DS 5.5 Security Testing,

Surveillance and

Monitoring

• 164.308 (a)(1)(ii)(D) Information

System Activity Review

• 164.308 (a)(6)(i) Login Monitoring

• 164.312 (b) Audit Controls

Alert Logic

Threat

Manager

• 5.1.1 Monitor zero day attacks not covered by anti-virus

• 6.2 Identify newly discovered security vulnerabilities

• 11.2 Perform network vulnerability scans quarterly by

an ASV or after any significant network change

• 11.4 Maintain IDS/IPS to monitor and alert personnel;

keep engines up to date

• DS5.9 Malicious Software

Prevention, Detection and

Correction

• DS 5.6 Security Incident

Definition

• DS 5.10 Network Security

• 164.308 (a)(1)(ii)(A) Risk

Analysis

• 164.308 (a)(1)(ii)(B) Risk

Management

• 164.308 (a)(5)(ii)(B) Protection

from Malicious Software

• 164.308 (a)(6)(iii) Response &

Reporting

Alert Logic Security Operations Center providing Monitoring, Protection, and Reporting

Alert Logic Web Security Manager WAF

Page 19

Active Protection for Web Applications, Management Included

Positive & Negative Security Active protection using signatures and leading learning engine

Key Compliance Coverage Supports PCI 6.6 and OWASP Top 10 risks

Management Included 24x7 management by experienced security analysts

AWS Auto Scaling Protection scales dynamically with your web apps

Security Where You Need It Works wherever you have your datacenter

20

Engineered for AWS Environments

Engineered for AWS

Supports auto-scaling & role aware

Automatable with APIs and scripts

Available across multiple regions

Manageable at scale

IP address & topology independant

Usage based utility pricing

Marketplace transactable

AMI and agent deployment options

Network and system visibility

Proven reference architectures

Runs on AWS

Web Security

Manager Demo

rep

licatio

n

AWS Infrastructure

Web

Traffic

Web Server

Web Server

Web Server

Web Server

Web Server

Web Server

Web Server

Web Server

Database

Read Replica

Database

Read Replica

Database

Master

rep

lica

tion

VPC

A

B

Elastic

Load

Balancer

Elastic

Load

Balancer

Elastic

Load

Balancer

rep

licatio

n

AWS Infrastructure + Web Security Manager

Amazon S3

Configuration

Master

Auto

Recover

Elastic

Load

Balancer

Web

Traffic

Alert Logic

Managemen

t Web Server

Web Server

Web Server

Web Server

App Server

App Server

App Server

App Server

Database

Database

Database

rep

lica

tion

VPC

A

B

Worker

Worker

Worker

Elastic

Load

Balancer

Elastic

Load

Balancer

Elastic

Load

Balancer

Web Security

Manager Free Trial

WAF Free Trial on AWS Marketplace

VISIT AWS MARKETPLACE FOR FREE

TRIAL: JUNE 10TH – JULY 10TH

Thank You

Johnathan Norman

Cloud Solutions Architect

Contacts and Q&A

Contacts: Alert Logic Info: info@alertlogic.com

AWS Contact: aws.amazon.com/contact-us