Using Security to Build with Confidence in AWS - Trend Micro Malaysia Sasha Pavlovic Director, Cloud and Datacenter Security | APAC

1. Using Security To Build
With Confidence In AWS
Sasha Pavlovic
Director, Cloud and Datacenter Security | APAC

2. The Story
More at aws.trendmicro.com
2012 re:Invent
SPR203 : Cloud Security is a Shared Responsibility
http://bit.ly/2012-spr203
2013 re:Invent
SEC208: How to Meet Strict Security & Compliance Requirements in the Cloud
http://bit.ly/2013-sec208
SEC307: How Trend Micro Build their Enterprise Security Offering on AWS
http://bit.ly/2013-sec307
2014 re:Invent
SEC313: Updating Security Operations for the Cloud
http://bit.ly/2014-sec313
SEC314: Customer Perspectives on Implementing Security Controls with AWS
http://bit.ly/2014-sec314

3. Shared Responsibility Model
AWS
Physical
Infrastructure
Network
Virtualisation
You
Operating System
Applications
Data
Service Configuration
More at aws.amazon.com/security

4. Shared Responsibility Model
AWS
Physical
Infrastructure
Network
Virtualisation
You
Operating System
Applications
Data
Service Configuration
More at aws.amazon.com/security

5. Vulnerability Respond Repair

6. Vulnerability
©2015, Amazon Web Services, Inc. or its affiliates. All rights reserved

7. by Andreas Lindh (@addelindh)

8. bash is a common command line interpreter

9. a:() { b; } | attack
10 | 10 vulnerability. Widespread & easy to exploit

10. Shellshock Impact
The image cannot be displayed. Your computer may not have enough memory to open the image, or the image may have been corrupted. Restart your computer, and then open the file again. If the red x still appears, you may have to delete the image and then insert it again.

11. 1989
Fantastic summary by David A. Wheeler at http://www.dwheeler.com/essays/shellshock.html#timeline

12. "MicroTAC" by Redrum0486 at English Wikipedia
12.3oz

13. Time Since Last Event Event Action Action Timeline
1989-­‐08-­‐05
8:32
Added
to
codebase
27
days,
10:20:00
Released
to
public
9141
days,
21:18:35
Ini?al
report
React
Clock
starts
1
day,
22:19:13
More
details
React
2 days, 7:30:12 Official patch :: CVE-2014-6271 Patch 4 days, 5:49:25
5
days,
9:16:35
Limited
disclosure
::
CVE-­‐2014-­‐6271
React
2
days,
4:37:25
More
details
React
3:44:00
More
details
React
0:27:51
Public
disclosure
React
0:36:30
More
details
React

14. Important Shellshock Events
Time Since Last Event Event Action Action Timeline
1989-­‐08-­‐05
8:32
Added
to
codebase
27
days,
10:20:00
Released
to
public
9141
days,
21:18:35
Ini?al
report
React
Clock
starts
2 days, 7:30:12 Official patch :: CVE-2014-6271 Patch 4 days, 5:49:25
3:29:09 Official patch :: CVE-2014-7169 Patch 9 days, 19:17:00
3:15:00 Official
patch
::
CVE-­‐2014-­‐7186,
CVE-­‐2014-­‐7187
Patch
4
days,
17:30:00
1 day, 11:55:00 Official
patch
::
CVE-­‐2014-­‐6277
Patch
1
day,
11:55:00

15. Respond
©2015, Amazon Web Services, Inc. or its affiliates. All rights reserved
Day 1

16. aws.amazon.com/architecture : Web application hosting

17. aws.amazon.com/architecture : Web application hosting

18. TCP : 443TCP : 443 TCP : 4433TCP : 4433
Primary workflow for our deployment

19. AWS VPC Review

20. AWS VPC Checklist
Review
IAM roles
Security groups
Network segmentation
Network access control lists (NACL)
More in the Auditing Security Checklist for Use of AWS, media.amazonwebservices.com/AWS_Auditing_Security_Checklist.pdf

21. TCP : 443TCP : 443 TCP : 4433TCP : 4433
Primary workflow for our deployment

22. HTTPSTPS
Intrusion prevention can look at each packet and then take action depending on what it finds

23. aws.amazon.com/architecture : Web application hosting

24. Intrusion Prevention in Action

25. Review
All instances covered
Workload appropriate rules
Centrally managed
Security controls must scale out automatically with the deployment

26. Repair
©2015, Amazon Web Services, Inc. or its affiliates. All rights reserved
Day 2

27. aws.amazon.com/architecture : Web application hosting

28. All instances deployment from task-specific AMI
TCP : 443TCP : 443 TCP : 4433TCP : 4433

29. Workflow should be completely automated
Instantiate DestroyConfigure
AMI Creation Workflow
Bake Instantiate Test

30. AMI Creation

31. aws.amazon.com/architecture : Web application hosting

32. Instances tend to drift from the known good state, monitoring key files & processes is important
AMI Instance
AlertIntegrity Monitoring

33. Integrity Monitoring

34. Keys
Respond
Review configuration
Apply intrusion prevention
Repair
Patch vulnerability in new AMI
Leverage integrity monitoring

35. Keys
Automation

36. aws.trendmicro.com
KUALA LUMPUR

37. KUALA LUMPUR
©2015, Amazon Web Services, Inc. or its affiliates. All rights reserved