Updates, Security & MonitoringScott Paddock - Security Solutions Architect

Preface

• Healthcare and Life Sciences are highly regulated

• Success in compliance efforts involves focused architecture

• AWS has resources to help support you.

• This deck focuses on security and monitoring, but there are

more tools to enable success.

• Please feel free to connect with us for more information

Agenda

• What’s new• Services that help security monitoring• What to look out for• Building upon each other• This just in…

Agenda

• What’s new• Services that help security monitoring• What to look out for• Building upon each other• This just in…

AWS Key Management Server (KMS)

New! Thick client for encryption using KMS• Description: A thick client in Java that enables customers to encrypt data

locally in their applications using keys in KMS• Customer Value: Currently, customers have to use their own encryption client

to encrypt data in their applications using keys in KMS. With this client, customers will have an end-to-end encryption and key management solution using KMS.

[Just in case] What is AWS Config?

AWS Config is a fully managed service that provides you with an inventory of your AWS resources, lets you audit the resource configuration history and notifies you of resource configuration changes

Continuous ChangeRecordingChanging Resources History

Stream

Snapshot (ex. 2014-11-05)AWS Config

AWS Config New Features

Region Expansion - Launched • Description: Availability in public regions PDX, DUB, NRT, FRA

Special Regions  - Description: Availability in special regions, such as Gov Cloud, BJS,…

Selective Resources -• Description: Select a subset of AWS resources for AWS Config to track• Customer Value: Customers can monitor (and pay for) only a subset of

resources in the account

AWS CloudTrail Roadmap

Turn on CloudTrail in all regions from one region – Description: Turning on CloudTrail in one region will ensure that activity in all regions will be delivered to one bucket and one CloudWatch Logs log group optionally.

Support for log file attestation - Description: Customers can receive a log digest file and answer whether a log file has been modified or deleted

AWS Identity & Access Management (IAM)

Preview of SMS Multi-Factor Authentication (MFA) – Description: This release enables customers to use the text messaging functionality of a mobile phone to verify the identity of IAM users using MFA.

Customer Value: SMS MFA provides an easy-to-use, easy-to-administer, and familiar option that works on all devices that can receive a text message.

Policy Simulator Enhancements – Description: Policy simulator APIs, support of resource-level policies within the policy simulator, and service-specific simulations (for example, enhanced EC2 simulations).

Customer Value: Enable executing the policy simulator programmatically through CLI or SDK to provide an easier way to audit IAM settings. Improved understanding and testing of permissions.

IAM – Even MoreService Last Accessed Data – Description: The IAM console now displays service last accessed data that shows the hour when an IAM entity (a user, group, or role) last accessed an AWS service.

Customer Value: Knowing if and when an IAM entity last exercised a permission can help you remove unnecessary rights and tighten your IAM policies with less effort.

IAM Console Search – Description: Search for users, groups, roles, policies, identity providers, help topics, etc. Also search for users by access key ID.

Customer Value: A single place to find the IAM object you are looking for in the console.

AWS STS Active by Default in All AWS Regions – Description: AWS Security Token Service (STS) is now active by default in all AWS regions, which means that applications and services can call AWS STS in a region geographically closer to you.

Customer Value: Optimized latencies, availability, and performance for applications using AWS STS.

CloudWatch CloudWatch Dashboards - Description: Customers can compose and save collections of graphs, alarms, and metrics. Dashboards can be shared with other users. Templates available for common use cases.

Customer Value: Provides operational view on a single screen to increase visibility and speed troubleshooting by summarizing data and allowing users to focus on what’s important. Templates make it easier to get started; customization adds flexibility and control

On-Instance Software Agent – Description: Customers can install and run a software agent that publishes system and application metrics to CloudWatch, including OS performance/utilization and metrics for popular applications. Customers can also create plugins to send additional data

Customer Value: Provides a simple tool to publish data not available in logs

AWS Virtual Private Cloud (VPC)

S3 Endpoints in VPC - • Description: Ability to access S3 from their VPC through a private endpoint, eliminating the

need of internet gateway. This also limits S3 bucket accessibility only from a certain VPC• Customer Value: Allows customers more secure access to S3 without the need of internet

gateway

VPC Flow Logging - • Description: Allows users to log traffic that is accepted, denied, or all, by security groups or

network ACLs. They can apply this logging to an interface, a subnet, or a VPC• Customer Value: Allows customers to create records for auditing purposes as well as providing

a tool for trouble shooting and attack detection

AWS VPC (continued)

Managed Network Address Translation (NAT) -• Description: Users will have access to a managed NAT service that will allow backend servers

to connect to the internet or other AWS services• Customer Value: Allows customers secure access as the backend servers don’t need a public

IP address, allowing for unlimited bandwidth. This is also built with redundancy, so there are no concerns of a single point of failure

Agenda

• What’s new• Services that help security monitoring• What to look out for• Building upon each other• This just in…

AWS CloudTrail & CloudWatch

AWSCloudTrail

Amazon CloudWatch

Enable globally for all AWS Regions Encryption & Integrity Validation Archive & Forward

Amazon CloudWatch Logs Metrics & Filters Alarms & Notifications

VPC Flow Logs• Agentless• Enable per ENI, per subnet, or per VPC• Logged to AWS CloudWatch Logs• Create CloudWatch metrics from log data• Alarm on those metrics

AWSaccount

Source IP

Destination IP

Source port

Destination port

Interface Protocol Packets

Bytes Start/end time

Accept or reject

Flow Log Record Structure

Event-Version

Account Number

ENI-ID

Source-IP

Destination-IP

SourcePort

Destination-Port

Protocol Number

Number of Packets

Number of Bytes

Start-Time Window

End-Time Window

Action

State

2 123456789 eni-31607853 172.16.0.10 172.16.0.172 80 41707 6 1 40 1440402534 1440402589

ACCEPT OK

VPC Flow Logs

• Amazon Elasticsearch Service

• Amazon CloudWatch Logs subscriptions

VPC Flow Logs – CloudWatch Alarms

AWS Config & Config Rules

AWSConfig

Amazon Config Rules

Record configuration changes continuously

Time-series view of resource changes

Archive & Compare

Enforce best practices Automatically roll-back unwanted

changes Trigger additional workflow

AWS Config – VPC Example

AWS Config Rules – Tenancy Enforcement Example

AWS Config Rules – Tenancy Enforcement Example

AWS Config Rules – Tenancy Enforcement Example

AWS Config Partners

Agenda

• What’s new• Services that help security monitoring• What to look out for• Building upon each other• This just in…

What are we looking for?

Billing

API activity

Changes to resources

Application activity

Network activity

Detailed Billing

Billing Information logged Daily in S3

Also Visible in the Billing Console

Alarms can be set on Billing Info to Alert on Unexpected Activity

Sample Records

ItemDescriptionUsageStartDate

UsageEndDate

UsageQuantity

CurrencyCode

CostBeforeTax

Credits

TaxAmount

TaxType

TotalCost

$0.000 per GB - regional data transfer under the monthly global free tier

01.04.14 00:00

30.04.14 23:59

0.00000675 USD 0.00 0.0

0.000000

None

0.000000

$0.05 per GB-month of provisioned storage - US West (Oregon)

01.04.14 00:00

30.04.14 23:59

1.126.666.554 USD 0.56 0.0

0.000000

None

0.560000

First 1,000,000 Amazon SNS API Requests per month are free

01.04.14 00:00

30.04.14 23:59 10.0 USD 0.00 0.0

0.000000

None

0.000000

First 1,000,000 Amazon SQS Requests per month are free

01.04.14 00:00

30.04.14 23:59 4153.0 USD 0.00 0.0

0.000000

None

0.000000

$0.00 per GB - EU (Ireland) data transfer from US West (Northern California)

01.04.14 00:00

30.04.14 23:59

0.00003292 USD 0.00 0.0

0.000000

None

0.000000

$0.000 per GB - data transfer out under the monthly global free tier

01.04.14 00:00

30.04.14 23:59 0.02311019USD 0.00 0.0

0.000000

None

0.000000

First 1,000,000 Amazon SNS API Requests per month are free

01.04.14 00:00

30.04.14 23:59 88.0 USD 0.00 0.0

0.000000

None

0.000000

$0.000 per GB - data transfer out under the monthly global free tier

01.04.14 00:00

30.04.14 23:59 3.3E-7 USD 0.00 0.0

0.000000

None

0.000000

Agenda

• What’s new• Services that help security monitoring• What to look out for• Building upon each other• This just in…

AWS CloudTrail

CloudTrail can help you achieve many tasks

Security analysisTrack changes to AWS resources, for example VPC security groups and NACLsCompliance – log and understand AWS API call historyProve that you did not:

Use the wrong regionUse services you don’t want

Troubleshoot operational issues – quickly identify the most recent changes to your environment

AWS CloudTrail logs can be delivered cross-account

CloudTrail can help achieve many tasksAccounts can send their trails to a central account

Central account can then do analytics

Central account can:‣ Redistribute the trails‣ Grant access to the trails‣ Filter and reformat Trails (to meet privacy

requirements)

Where is the evidence?Many compliance audits require access to the state of your systems at arbitrary times (i.e. PCI, HIPAA)

A complete inventory of all resources and their configuration attributes at AWS API level is available for any point in time

AWS Config Resources

A resource is an AWS object you can create, update or delete on AWS

Examples include Amazon EC2 instances, Security Groups, Network ACLs, VPCs and subnets

Amazon EC2Instance, ENI...

Amazon EBSVolumes

AWS CloudTrailLog

Amazon VPCVPC, Subnet...

AWS Config Resources (continued)Resource Type Resource Elements

Amazon EC2 EC2 InstanceEC2 Elastic IP (VPC only)EC2 Security GroupEC2 Network Interface

Amazon EBS EBS Volume

Amazon VPC VPCsNetwork ACLsRoute TableSubnetVPN ConnectionInternet GatewayCustomer GatewayVPN Gateway

AWS CloudTrail Trail

Relationships

Bi-directional map of dependencies automatically assigned

Change to a resource propagates to create Configuration Items for related resources

Example: Security Group sg-10dk8ej and EC2 instance i-123a3d9 are “associated with” each other

Relationships

Resource Relationship Related ResourceCustomerGateway is attached to VPN ConnectionElastic IP (EIP) is attached to Network Interface  is attached to InstanceInstance contains Network Interface  is attached to ElasticIP (EIP)  is contained in Route Table  is associated with Security Group  is contained in Subnet  is attached to Volume  is contained in Virtual Private Cloud (VPC)InternetGateway is attached to Virtual Private Cloud (VPC)… …. …..

Component Description Contains

Metadata Information about this configuration item

Version ID, Configuration item ID, Time when the configuration item was captured, State ID indicating the ordering of the configuration items of a resource, MD5Hash, etc.

Common Attributes Resource attributes Resource ID, tags, Resource type. Amazon Resource Name (ARN)Availability Zone, etc.

Relationships How the resource is related to other resources associated with the account

EBS volume vol-1234567 is attached to an EC2 instance i-a1b2c3d4

Current Configuration Information returned through a call to the Describe or List API of the resource

e.g. for EBS VolumeState of DeleteOnTermination flagType of volume. For example, gp2, io1, or standard

Related Events The AWS CloudTrail events that are related to the current configuration of the resource

AWS CloudTrail event ID

AWS Config Configuration Items

Essentially, “Lambda Integration for Config”Apply detailed checks to the state of your configuration, at the point when it changesRaise alerts if anything is outside compliance with your defined policy

‣ Eg if there’s unencrypted non-root EBS volumes‣ …or eg if any taggable resources aren’t tagged appropriately

We have a library of pre-built rules – or build your ownSee also Re:Invent (SEC308) “Wrangling Security Events in the Cloud” (https://www.youtube.com/watch?v=uc1Q0XCcCv4)Feature is available right now

AWS Config Rules

Full visibility of your AWS environmentCloudTrail will record access to API calls and save logs in your S3 buckets, no matter how those API calls were made

Who did what and when and from where (IP address)CloudTrail support for many AWS services and growing - includes EC2, EBS, VPC, RDS, IAM and RedShiftEasily Aggregate all instance log information – CloudWatch Logs agent scrapes files from EC2 instances and sends them to S3Also enables alerting with SNS on “strings of interest”, just like regular CloudWatchCloudWatch Logs used as delivery mechanism for Flow Logging

Out of the box integration with log analysis tools from AWS partners including Splunk, AlertLogic and SumoLogic

Monitoring: Get consistent visibility of logs

Elasticsearch, Kibana and CloudWatch Logs integration• Push CloudTrail to CloudWatch Logs:

http://docs.aws.amazon.com/awscloudtrail/latest/userguide/send-cloudtrail-events-to-cloudwatch-logs.html

• Push CloudWatch Logs to Elasticsearch: http://docs.aws.amazon.com/AmazonCloudWatch/latest/DeveloperGuide/CWL_ES_Stream.html

• Put a Kibana front-end on it: https://aws.amazon.com/blogs/aws/cloudwatch-logs-subscription-consumer-elasticsearch-kibana-dashboards/

Examples

Agenda

• What’s new• Services that help security monitoring• What to look out for• Building upon each other• This just in…

Or should that be…

AWS Inspector

• What is Inspector?• Vulnerability Assessment Service• Built from the ground up to support

Dev/Ops Model• Automatable via API’s• AWS Context Aware• Integrated with CI/CD tools• CVE & CIS Rules Packages

Why?Securing infrastructure is often expensive and hard to do effectively.

• Inspector is automated, repeatable, and designed to reduce cost.

• Use AWS security knowledge to strengthen customer servers, services, and infrastructure.

• Delivery of actionable findings that are carefully explained and help their resolution.

AWS Inspector

Rule packages• CVE (common vulnerabilities and exposures)

• 1000+ Rules Evaluated• CIS (Center for Internet Security Benchmarks)

• OS Hardening• Vulnerability• Patch• Inventory• Compliance

• AWS Security Best Practices• App Sec Learnings

AWS Inspector

How?1. Install as a service on your Amazon EC2 instances.2. Tag the instances with application-specific information.3. Configure Inspector application and assessment.4. Start Inspector.5. Exercise and test your service.6. Stop Inspector or wait for the configurable timeout.7. Look at findings and fix as appropriate.

AWS Inspector

More: https://aws.amazon.com/inspector/

Logs→metrics→alerts→actions

AWS Config

CloudWatch / CloudWatch Logs

CloudWatch alarms

AWS CloudTrail

Amazon EC2 OS logs

Amazon VPC Flow Logs

Amazon SNS

email notification

HTTP/S notification

SMS notifications

Mobile push notifications

API calls from most services

Monitoring data from

AWS services

Custom metrics

Thank you!