Enable threat detection of unusual user behaviors, identify anomalies, prevent data breaches, and quickly assess your organization’s vulnerabilities.

1. © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Brad Dispensa Solutions Architect – Security
Ben Snively, Solutions Architect – Data and Analytics, AI/ML
Saturday, April 13, 2019
Strengthen Cybersecurity

2. © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Improving security with the cloud
“Based on our experience, I believe that we can be even more secure
in the AWS cloud than in our own datacenters.”
- Tom Soderstrom, CTO, NASA JPL
“It is a true partnership. At the end of the day we’ve asked them to do
things that have made them better, and they’ve certainly done things to
make us better. It’s the best decision we ever made.” “Now through our
C2S cloud, we have infrastructure at the speed of mission…through
AWS and C2S we’re down to minutes. That’s amazing.”
-CIA CIO John Edwards

3. © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
What is provable security?

4. © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Math?
a c
b
a2 + b2 = c2

5. © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
You sure?
not x or ( y and z )
X = false, y = true, z = false
is satisfiable

6. © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
AWS provable security
https://aws.amazon.com/security/provable-security/

7. © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Zelkova

8. © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Security 101
Data
Application
OS
Virtualization
Infrastructure
Physical
Data
Application
OS
Virtualization
Infrastructure
Physical
Data
Application
OS
Virtualization
Infrastructure
Physical
Data
Application
OS
Virtualization
Infrastructure
Physical
On-premises Infrastructure Container Abstract
Your responsibility AWS responsibility

9. © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
AWS ML powered Security
Services

10. © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
AWS ML powered Security Services
Amazon Macie Amazon GuardDuty
Content Classification
• PII and personal data
• Source code
• SSL certificates, private keys
• iOS and Android app signing keys
• Database backups
• OAuth and Cloud SAAS API Keys
Threat detection
• VPC Flowlog analysis
• Unusual API calls.
• Potentially unauthorized
deployments that indicate a
possible account compromise.
• Potentially compromised
instances or reconnaissance by
attackers.

11. © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
VPC Flow Logs
• Agentless
• Enable per ENI, per subnet, or per VPC
• Logged to AWS CloudWatch Logs
• Create CloudWatch metrics from log data
• Alarm on those metrics
AWS
account
Source IP
Destination IP
Source port
Destination port
Interface Protocol Packets
Bytes Start/end time
Accept
or reject

12. © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Logging and Auditing

13. © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Amazon CloudWatch AWS CloudTrail
Core logging services
Full visibility of your AWS environment
• CloudTrail will record access to API calls and save logs in your S3 buckets, no matter how those
API calls were made
Who did what and when and from where (IP address)
• CloudTrail/Config support for many AWS services and growing - includes EC2, EBS, VPC,
RDS, IAM and RedShift
• Edge/CDN, WAF, ELB,VPC/Network FlowLogs
• Easily Aggregate all log information
• CloudWatch Alarms

14. © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Additional logs from external systems and locations:
Gaming IOT sensorsDevices
External
systems
and
applications Web content
Logs, logs, and
more logs …
Databases Servers NetworkingStorage
Internal
systems
and
applications

15. © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Log data analytics

16. © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Cyber Data Lake
Realtime
Application
and Users
activities
On premises
activities
Cyber Data
Lake
AWS
Security
Services
Analytics
Machine/Deep
Learning

17. © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Cyber Data Lake
Realtime
Application
and Users
activities
On premises
activities
Cyber Data
Lake
AWS
Security
Services
Machine/Deep
Learning
Amazon EMR Amazon Athena
Amazon
Elasticsearch Service
AWS Glue

18. © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Amazon Elasticsearch: Analyzing Log Data
Application monitoring & root-cause
analysis
Security Information and Event
Management (SIEM)
IoT & mobile Business & clickstream analytics

19. © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
ElasticSearch VPC flow logs Analysis

20. © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Demonstration

21. © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Data Curation Stages
AWS Glue Data Catalog - a single view
across your data lake
Use AWS Glue ETL jobs or Amazon
EMR to cleanse, transform, and store
processed dataAmazon S3
(Raw data)
Amazon S3
(Staging
data)
Amazon S3
(Processed
data)
AWS Glue Data Catalog
EMR
Glue
EMR
Glue
Original Source
of Record
Query
Optimized
Datasets

22. © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Cyber Data Lake
Realtime
Application
and Users
activities
On premises
activities
Cyber Data
Lake
AWS
Security
Services
Amazon EMR Amazon Athena
Amazon
Elasticsearch Service
AWS Glue
Amazon SageMaker
AWS Deep
Learning AMIs

23. © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Amazon SageMaker: IP Insights
Capture associations between IPv4 addresses and various entities
(user IDs, account numbers, etc..).
Identify a user attempting to log into a web service from an anomalous
IP address
Identify an account that is attempting to create computing resources
from an unusual IP address.

24. © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
IP Insights Algorithm
Amazon SageMaker IP Insights
model gives much higher scores to
malicious events, and there is a
clear separation between the two
distributions.

25. © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Amazon Insights - IP Insights
labelled test case where we artificially inject 1% malicious traffic into a dataset
of legitimate traffic. We then score each event in the dataset using both
methods

26. © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Amazon SageMaker
IP Insights Demonstration
Amazon SageMaker
IP Insights

27. © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
The Amazon ML stack:
Broadest & deepest set of capabilities
Easily add intelligence to applications without machine learning skills
Vision | Documents | Speech | Language | Chatbots | Forecasting | Recommendations
Build, Train, and Deploy machine learning models fast and at scale
Data labeling | Pre-built algorithms & notebooks | One-click training and deployment
Flexibility & choice, highest-performing infrastructure
Support for ML frameworks | Compute options purpose-built for ML
M L F R A M E W O R K S &
I N F R A S T R U C T U R E
A I S E R V I C E S
M L S E R V I C E S

28. © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
2019
M L F R A M E W O R K S &
I N F R A S T R U C T U R E
A I S E R V I C E S
R E K O G N I T I O N
I M A G E
P O L L Y T R A N S C R I B E T R A N S L A T E C O M P R E H E N D &
C O M P R E H E N D
M E D I C A L
L E XR E K O G N I T I O N
V I D E O
Vision Speech Language Chatbots
A M A Z O N
S A G E M A K E R
B U I L D T R A I N
F O R E C A S T
Forecasting
T E X T R A C T
Recommendations
D E P L O Y
Pre-built algorithms
Data labeling (G R O U N D T R U T H )
One-click model training & tuning
Optimization (N E O )
M L S E R V I C E S
F r a m e w o r k s I n t e r f a c e s I n f r a s t r u c t u r e
E C 2 P 3
& P 3 d n
E C 2 C 5 F P G A s G R E E N G R A S S E L A S T I C
I N F E R E N C E
Reinforcement learning
Algorithms & models ( A W S M A R K E T P L A C E
F O R M A C H I N E L E A R N I N G )
I N F E R E N T I A
Notebook Hosting
One-click deployment & hosting
Auto-scaling
Virtual Private Cloud
Private Link
Elastic Inference integration
Hyper Parameter Optimization
P E R S O N A L I Z E

29. © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Amazon SageMaker
Fully managed
hosting with auto-
scaling
One-click
deployment
Pre-built
notebooks for
common
problems
Built-in, high
performance
algorithms
One-click
training
Hyperparameter
optimization
BUILD TRAIN DEPLOY

30. © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Amazon’s fast, scalable algorithms
Built-in Framework Support
Bring your own Container
Hyperparameter optimization
Build DeployTrain
Amazon SageMaker components
IP Insights a built
in algorithm

31. © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Threat hunting
Internal and external data sources

32. © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Corporate data
center
AWS Cloud
Amazon Simple
Storage Service
(S3)
Raw data lake
Amazon EMR
Pre-processed
data
3rd party data
SPARK
Amazon Sagemaker
Amazon Athena
Amazon Elasticsearch
Service

33. © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Corporate data
center
AWS Cloud
Amazon Simple
Storage Service
(S3)
Raw data lake
Amazon EMR
Pre-processed
data
3rd party data
SPARK
Amazon Sagemaker
Amazon GuardDuty
AWS Lambda
https://ml-threat-detection.awssecworkshops.com/

34. © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Next steps
Where do I go with this now?
• Use IP Insight ML model to augment threat detection in your AWS environment
• Use Amazon SageMaker to identify users of your AWS accounts coming from anomalous IP addresses
• Blend anomaly score with findings from Amazon GuardDuty to create an aggregated list of suspicious activity
Putting this into Practice
• Score specific console logins tagged by GuardDuty
• Tuning parameters and training sets
• Use IP Insights on different classes of behavior
• Specific application usage (e.g., monitoring apps, bastion hosts)
Thinking bigger
• Adding additional detectors and models
• Leverage GuardDuty, Macie and Security Hub findings

35. © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Improving your security with AWS…
“From a physical and logical security standpoint, I
believe that, if done right, public cloud computing is
as or more secure than self-hosting.”
– Steve Randich, EVP and CIO, Financial Industry Regulatory Authority, USA
FINRA now deploying multiple Hadoop-based and Redshift-based
analytics apps core to their regulatory mission
• Multi-petabyte clusters growing by terabytes per day
• Core apps in full production since January 2015
• Half way thru 2 year plan to go “all in” to the AWS cloud

36. © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Questions