Ce diaporama a bien été signalé.
Nous utilisons votre profil LinkedIn et vos données d’activité pour vous proposer des publicités personnalisées et pertinentes. Vous pouvez changer vos préférences de publicités à tout moment.
© 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Ben Potter
Security Lead, Well-Architected, Amaz...
© 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
What To Expect
Where to Start
The Insider
The In...
© 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Meet Bob
© 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Bob
Responsibilities:
• Security lead for DevOps...
© 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Bob’s Interesting Experiences
1st IAM denied att...
© 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Where To Start
?
© 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
NIST 800-61 Computer Security Incident
Handling ...
© 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
I’ve used these
https://aws.amazon.com/security/...
© 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
I’ve used these
http://bit.ly/2ITNuxF
https://ww...
© 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
All Code From Session
https://github.com/awslabs...
© 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
AWS Well-Architected
• Design Principles
• Imple...
© 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Honeypot Or Indicators?
Honeypot is a deliberate...
© 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
This Is What I Put In Place
• Enabled logging an...
© 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
The Insider
© 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
How I’m Going To Detect Trudy
• Notified on acce...
© 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
IAM Access Denied Responder
Lambda:
Publish
Acce...
© 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Alert!
© 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Demo
© 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
What I Learnt
• Automation is AWSome
• It saved ...
© 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
The Instance
© 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
EC2 Auto Clean Room Forensics
Topic:
Instance ID...
© 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Oh No
© 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Thank You!
© 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Demo
© 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
What We Achieved
• No human interaction needed f...
© 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Lessons I (Bob) Learnt
• Incidents are always ba...
© 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Always Stay Up To Date
Keep an eye on the securi...
© 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Thank You
Prochain SlideShare
Chargement dans…5
×

Automating Incident Response and Forensics in AWS - AWS Summit Sydney 2018

1 715 vues

Publié le

Automating Incident Response and Forensics in AWS

Come and learn the latest and greatest tricks for automating your incident response and forensics in the cloud. This session focuses on automating your cloud incident response processes covering external and insider threats, triggers, canaries, containment, and data loss prevention.

Ben Potter, Security Lead for Well-Architected, Amazon Web Services

  • Soyez le premier à commenter

Automating Incident Response and Forensics in AWS - AWS Summit Sydney 2018

  1. 1. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved. Ben Potter Security Lead, Well-Architected, Amazon Web Services Deenadayaalan Thirugnanasambandam Cloud Architect, Amazon Web Services Automating Incident Response And Forensics In AWS
  2. 2. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved. What To Expect Where to Start The Insider The Instance ?
  3. 3. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved. Meet Bob
  4. 4. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved. Bob Responsibilities: • Security lead for DevOps team • Identify security issues • First level response • Prevention
  5. 5. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved. Bob’s Interesting Experiences 1st IAM denied attempts 2nd Instance compromised Going to talk about !
  6. 6. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved. Where To Start ?
  7. 7. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved. NIST 800-61 Computer Security Incident Handling Guide Preparation Detection & Analysis Containment, Eradication, and Recovery Post-Incident Activity http://bit.ly/2pGqOs6 ?
  8. 8. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved. I’ve used these https://aws.amazon.com/security/ http://aws.amazon.com/well-architected/ http://bit.ly/2pFqBW4 ?
  9. 9. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved. I’ve used these http://bit.ly/2ITNuxF https://www.sleuthkit.org/ http://bit.ly/2G6oZPY ?
  10. 10. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved. All Code From Session https://github.com/awslabs/aws-security-automation ?
  11. 11. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved. AWS Well-Architected • Design Principles • Implement a strong identity foundation • Enable traceability • Apply security at all layers • Automate security best practices • Protect data in transit and at rest • Prepare for security events ?
  12. 12. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved. Honeypot Or Indicators? Honeypot is a deliberately misconfigured system Indicators: • Denies in AWS CloudTrail • Denies to access Amazon S3 buckets • Denies in Amazon VPC Flowlogs • Abnormal behaviour ?
  13. 13. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved. This Is What I Put In Place • Enabled logging and security services • AWS CloudTrail • Amazon GuardDuty • AWS Config • Amazon VPC Flow Logs • App & System Logs in Amazon CloudWatch Logs • Started with most likely scenarios ?
  14. 14. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved. The Insider
  15. 15. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved. How I’m Going To Detect Trudy • Notified on access denied attempt • Who attempted from where? • What user / role was denied? • History of the user / role?
  16. 16. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved. IAM Access Denied Responder Lambda: Publish Access Denied Topic: Access Denied Lambda: Publish User Trails Topic: Security Message Lambda: Publish IAM User History Slack CloudWatch Event AWS CloudTrail Lambda: Publish Slack Lambda: Publish Chime Amazon Chime
  17. 17. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved. Alert!
  18. 18. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved. Demo
  19. 19. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved. What I Learnt • Automation is AWSome • It saved me a lot of time • IAM users should assume IAM roles with MFA enforced • How can we improve? • P4wned ex-employee Trudy … LOL
  20. 20. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved. The Instance
  21. 21. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved. EC2 Auto Clean Room Forensics Topic: Instance ID Step Function: Incident Response Instance Isolate Instance SG2: Remove Auto Scaling (+logic) Snapshot Volumes Record Metadata Apply Tags1: Notify CloudFormation: Clean Room Create Cleanroom3: Run Basic Forensics4: Generate Report5: Topic: Forensics Report Slack Topic: Instance Incident Verify Instance
  22. 22. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved. Oh No
  23. 23. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved. Thank You!
  24. 24. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved. Demo
  25. 25. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved. What We Achieved • No human interaction needed for isolation & investigation • I was automatically given basic forensic info • I have a mechanism to compare • A security system didn’t break anything And then?
  26. 26. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved. Lessons I (Bob) Learnt • Incidents are always badly timed • Security incidents can cause long term damage • Prepare for an incident before it’s too late • Practice through game days
  27. 27. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved. Always Stay Up To Date Keep an eye on the security blog… http://blogs.aws.amazon.com/security
  28. 28. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved. Thank You

×