AWS IoT Device Defender continuously monitors device behavior. You can define behavior profiles that define expected device behavior and trigger alerts when a device violates that profile. In this session, we implement automated responses to AWS IoT Device Defender alerts in order to help you diagnose and remediate violations in your device fleet.

2. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Detect Abnormal Device Behavior with
AWS IoT Device Defender
Dan Miller
Sr SW Dev Engineer
AWS IoT Device Defender Group
AWS
Rob Marano
Principal Consultant
Professional Services
AWS
I O T 3 1 3

3. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Agenda
1. Overview of AWS IoT Device Defender
2. Today’s workshop environment setup
3. Detect, generate event, report
4. “Hands on keyboard”
5. Review & wrap-up

4. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Agenda
1. Overview of AWS IoT Device Defender
2. Today’s workshop environment setup
3. Detect, generate event, report
4. “Hands on keyboard”
5. Review & wrap-up
• Overview of AWS IoT
Device Defender - 300 level
• Setup AWS IoT Device
Defender on a device
• Create behavior profile
• View and respond to alerts,
triggered by simulated
event

5. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Agenda
1. Overview of AWS IoT Device Defender
2. Today’s workshop environment setup
3. Detect, generate event, report
4. “Hands on keyboard”
5. Review & wrap-up
• Instructions on how to use
pre-built environment
• How to get and set up local
Vagrant
• How to use the basic tools

6. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Agenda
1. Overview of AWS IoT Device Defender
2. Today’s workshop environment setup
3. Detect, generate event, report
4. “Hands on keyboard”
5. Review & wrap-up
• Walk-through
• Detection
• Event generation
• Reporting
• Viewing on violations on
the Console
• Using Amazon Simple
Notification Service
(Amazon SNS) to take an
action, like send an email

7. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Agenda
1. Overview of AWS IoT Device Defender
2. Today’s workshop environment setup
3. Detect, generate event, report
4. “Hands on keyboard”
5. Review & wrap-up
• Your turn!
• Code up
• Detection
• Event generation
• Alert reporting

8. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Agenda
1. Overview of AWS IoT Device Defender
2. Today’s workshop environment setup
3. Detect, generate event, report
4. “Hands on keyboard”
5. Review & wrap-up
• Time to ask questions
• What is next for your
journey with AWS IoT
Device Defender

9. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Related breakouts
Wednesday, November 28
Audit Your Device Fleet with AWS IoT Device Defender
2:30 p.m. – 3:30 p.m. | Mirage, Grand Ballroom B, Table 9
Thursday, November 29
Managing Security of Large IoT Fleets
12:15 p.m. – 1:15 p.m. | Aria East, Level 2, Mariposa 8
Friday, November 30
Detect Abnormal Device Behavior with AWS IoT Device Defender
11:30 a.m. – 12:30 p.m. | Mirage, Grand Ballroom B, Table 10

10. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.

11. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
How we think of IoT architecture @ AWS
Endpoints
Fleet onboarding,
management and
SW updates
Fleet
audit and
protection
IoT data analytics
and intelligence
Gateway
Things
Sense & act
Cloud
Storage & compute
Secure local
triggers, actions,
and data sync
Intelligence
Insights & logic → Action
Secure device
connectivity
and messaging
AWS Greengrass
AWS IoT Core
AWS IoT
Device Management
Amazon
FreeRTOS
AWS IoT Device
Defender AWS IoT Analytics

12. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Audit device
configurations, define and monitor
device behavior
Identify drifts in security
settings and detect device
anomalies
Generate alerts Patch security vulnerabilities
AWS IoT Device Defender
Keep your fleet secure
AWS IoT Device Defender is a fully managed IoT security service that
enables you to secure your fleet of connected devices on an ongoing basis

13. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Audit device
configurations
Monitor device
behavior
Generate
alerts
Patch security
vulnerabilities
AWS IoT Device Defender
Keep your fleet secure
Identify
anomalies

14. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.

15. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
GitHub repository
https://github.com/aws-samples/aws-iot-device-defender-workshop.git
Workshop instructions
AWS CloudFormation template
Attack simulation scripts

16. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Workshop
CloudFormation stack
Amazon Elastic Compute Cloud
(Amazon EC2) instances
Simulated device
Attack target
AWS Cloud9 IDE
Run agent and attack scripts
AWS IoT thing
Includes certificates and polices
AWS IoT thing group
“DeviceDefenderWorkshop”
Subnet
AWS IoT
Device
Defender
Agent
AWS
Cloud9
EC2 instance
Target
AWS IoT
EC2 instance

17. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
AWS Cloud9 development environment
We will use AWS Cloud9 as our development and ”device” environment
Run the AWS IoT Device Defender agent
Run attack simulation scripts
Interact with AWS IoT Device Defender APIs through AWS Command Line Interface (AWS CLI)
(optional)

18. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.

19. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
AWS IoT Device Defender Detect key components
Metrics
Device-side and cloud-side
Behavior Profiles
Violations
Alerts

20. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Behavior profile
Defines desired device behavior
Create a behavior profile in AWS IoT Device Defender that defines normal network traffic from
a device
Behavior outside of profile generates a violation
Generate abnormal network traffic on our device, triggering a violation

21. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Alerts
In AWS IoT Device Defender console
View past and current violations
Amazon SNS notifications
We will use Amazon SNS to send an email when violation is detected

22. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.

23. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Walk-through instructions
“Instructions.pdf” in the docs folder of the GitHub repository

24. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.

25. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
What we covered
• Overview of AWS IoT Device Defender
• Today’s workshop environment setup
• Detect, generate event, report
• “Hands on keyboard”

26. Thank you!
© 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Dan Miller
damiller@lab126.com
Rob Marano
maranoro@amazon.com

27. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.