While security is a top concern in every organization these days, it often gets a bad rap. In many minds, security has the reputation of the bothersome villain who attempts to hinder performance or restrain agility. In this session we will outline four strategies to protect your valuable workloads, without falling into traditional security traps. We will walk through three stories of EC2 security superheroes who saved the day by overcoming compliance and design challenges, using a (not so) secret arsenal of AWS and Trend Micro security tools. Andrew Watts-Curnow, Solutions Architect, Amazon Web Services, ASEAN Justin Foster, CISSP Head of Cloud Workload Security, Trend Micro

1. © 2016, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Paul Hidalgo
Solutions Architect, ASEAN
Trend Micro
3 secrets to becoming a
cloud security superhero

2. This is you…

3. Shapeshift
Design a workload-centric
security architecture
Superpower #1

4. Cloud

5. Before
Firewall IPS Load
Balancer
Web
Tier
App
Tier
DB
Tier
On-premises

6. S3
DynamoDB
RDS
…
After
Firewall IPS
AWS
Web
Tier
on
EC2
App
Tier
on
EC2
Elastic
Load
Balancer
VPC
&
Security
Groups
Load
Balancer
DB
Tier
Web
Tier
App
Tier
IAM CloudTrail

7. Traditional Responsibility Model
You
Physical
Infrastructure
Network
Virtualization
Operating System
Applications
Data
Service Configuration

8. Shared Responsibility Model
AWS
Physical
Infrastructure
Network
Virtualization
You
Operating System
Applications
Data
Service Configuration
More at aws.amazon.com/security

9. Hybrid IT

11. Crypt-o

13. Crypt-o

14. EC2

15. 24h
48h
72h
Attack Source IP – CVE-2014-6271, 7169, 6277, 6278
Disclosure

16. 24h
48h
72h
Attack Source IP – CVE-2014-6271, 7169, 6277, 6278
Disclosure

17. 24h
48h
72h
Disclosure
Attack Source IP – CVE-2014-6271, 7169, 6277, 6278

18. Don’t Replicate…
Warning:
Single Point of
Failure
Limited
Throughput

19. Shapeshift
Mission Accomplished:
No Single Point
of Failure
UN-Limited
Throughput

20. VPC
&
Security
Groups
S3
DynamoDB
RDS
…
AWS
Web
Tier
on
EC2
App
Tier
on
EC2
Elastic
Load
Balancer
IAM CloudTrail

21. Shapeshift for Amazon Web Services
• Security inside each workload
• Protect instance-to-instance
traffic
• Make it context sensitive (fast and
low false-positive)
• No bottleneck
• No single point of failure
= CLOUD FRIENDLY
IPS

22. Invisibility
Automate and blend in,
don’t bolt on
Superpower #2

25. Creating an audit trail, before
Servers
Storage Area Network
On-premises
Firewall
IPS
Central logging
Change
Records
Report

26. Payment
Client Data
On-premises
AWS
Amazon CloudTrail
EC2 instances
Central management
Amazon S3
Amazon CloudFrontAmazon RDS
Creating an audit trail, after
Report

27. Audit-o
CloudTrail
& AWS Config
Security Tools

28. Make Security Invisible for Amazon Web Services
• Build it in, not bolt on
• Fully automate security
• Automate record keeping for
auditors
= SECURITY
DESIGNED FOR AWS

29. X-Ray Vision
Improve visibility of AWS
and hybrid environments
Superpower #3

31. Integrity Monitoring

32. Use X-ray vision on Amazon Web Services
• Use Integrity Monitoring and
Log monitoring to see inside
instances
• Detect suspicious changes that
are indicators of compromise
and unintended changes
= Total visibility

33. AWS is continuously independently audited
GxP
ISO 13485
AS9100
ISO/TS 16949
AWS Foundation Services
Compute Storage Database Networking
AWS Global Infrastructure
Regions
Availability Zones
Edge
Locations
AWS is
responsible for
the security OF
the Cloud

34. AWS Foundation Services
Compute Storage Database Networking
AWS Global Infrastructure
Regions
Availability Zones
Edge
Locations
Client-side Data
Encryption
Server-side Data
Encryption
Network Traffic
Protection
Platform, Applications,
Identity & Access
Management
Operating System, Network, & Firewall Configuration
Customer applications & content
Customers have
their choice of
security
configurations IN
the Cloud
AWS is
responsible for
the security OF
the Cloud
Security is shared betweenAWS and customers
Customers
Partner solutions – including
Trend Micro

35. SANS/CIS TOP 20 CRITICAL SECURITY CONTROLS
1. Inventory of Authorized & Unauthorized Devices 11. Secure Configurations for Network Devices
2. Inventory of Authorized & Unauthorized Software 12. Boundary Defense
3. Secure Configurations for Hardware & Software on
Mobile Devices, Laptops, Workstations, & Servers
13. Data Protection
4. Continuous Vulnerability Assessment & Remediation 14. Controlled Access Base on the Need to Know
5. Controlled Use of Administrative Privileges 15. Wireless Access Control
6. Maintenance, Monitoring, & Analysis of Audit Logs 16. Account Monitoring & Control
7. Email and Web Browser Protections
17. Security Skills Assessment & Appropriate Training
to Fill Gaps
8. Malware Defenses 18. Application Software Security
9. Limitation and Control of Network Ports, Protocols,
and Services
19. Incident Response Management
10. Data Recovery Capability 20. Penetration Tests & Red Team Exercises

36. Better Security

37. Your new superpowers…
Shapeshifting X-ray VisionInvisibility

38. Inspired by real-life Security Superheros

39. Gartner Best Practices
Best Practices for
Securing Workloads
in Amazon Web
Services
http://bit.ly/1pxaFTL

41. trendmicro.com/aws