Slide Heading. Pragmatic Cloud Security A Guided Tour. Brian Genz. October 12, 2016

Transcription

1 Slide Heading Pragmatic Cloud Security A Guided Tour Brian Genz October 12, 2016

2 Agenda Cloud architectures, service and delivery models Overview of core AWS components Review of recent AWS security research New AWS Security Best Practices guide Offensive & defensive research Key focus areas for audit, risk & compliance Defending the Management Plane IAM Policies (and audit tools) Incident Response preparation (and new tools)

3 Cloud Architectures, Service and Delivery Models

4 NIST Cloud Computing Definition Cloud computing is a model for enabling ubiquitous, convenient, on-demand network access to a shared pool of configurable computing resources (e.g., networks, servers, storage, applications, and services) that can be rapidly provisioned and released with minimal management effort or service provider interaction. This cloud model is composed of five essential characteristics, three service models, and four deployment models.

5 NIST Cloud Computing Definition Cloud computing is a model for enabling ubiquitous, convenient, on-demand network access to a shared pool of configurable computing resources (e.g., networks, servers, storage, applications, and services) that can be rapidly provisioned and released with minimal management effort or service provider interaction. This cloud model is composed of five essential characteristics, three service models, and four deployment models.

6 NIST Cloud Computing Reference Architecture NIST SP : NIST Cloud Computing Reference Architecture

7 Cloud Computing: A Visualization (IaaS)

8 Customer vs. Provider Responsibilities

9 Shared Responsibility Model AWS Shared Responsibility Model for Infrastructure Services

10 Shared Responsibility Model Customer Responsibility Network Security IAM Data Protection Key Management Third-Party Security Tools Host Security Logging/Monitoring Compliance Network Design Application Security Audit/Security Assessment API Security AWS Responsibility Networking Compute Storage APIs Defining and Implementing Effective Cloud Security Architecture in Amazon Web Services by Mike Morrato Gartner Technical Professional Advice, Published September 27, 2016

11 Overview of Core AWS Components

12 Understanding the Environment As information security professionals, we face a constant need to understand the context around a particular environment or technology. As rapidly as new technologies emerge, the threat landscape changes at an equally fast pace. While we don t need to become cloud security architects in order to assess AWS risk effectively, we do need to achieve a baseline level of understanding of the technology as it is deployed and configured in the environment we are assessing.

13 Understanding the Environment For example, AWS offers its own acronym soup to describe core components / services.

14 Understanding the Environment We need to be able to establish a foothold of familiarity with the core components / services to be able to start evaluating risk in a meaningful way. We ll narrow our focus to four core services: Amazon VPC (Virtual Private Cloud) Amazon EC2 (Compute Power) Amazon S3 (Storage) Amazon RDS (Database)

15 Core AWS Components

16 Core AWS Services

17 VPC: Virtual Private Cloud VPC Internet Connection Amazon EC2 (Compute) Amazon S3 (Storage) Amazon RDS (Database) Thanks to LinuxAcademy.com for the Facebook / VPC analogy.

18 VPC: Virtual Private Cloud VPC Internet Connection Thanks to LinuxAcademy.com for the Facebook / VPC analogy.

19 VPC: Facebook Analogy Facebook My Homepage Mr. Bean s Homepage Bob s Homepage Internet Connection Thanks to LinuxAcademy.com for the Facebook / VPC analogy.

20 VPC: Facebook Analogy My VPC Mr. Bean s VPC Bob s VPC Amazon EC2 (Compute) Internet Connection Amazon S3 (Storage) Amazon RDS (Database) Thanks to LinuxAcademy.com for the Facebook / VPC analogy.

21 Amazon EC2: Compute For our discussion purposes, when you hear EC2 Compute: Amazon EC2 (Compute) Think of it as A Computer or Server Thanks to LinuxAcademy.com for the Netflix / EC2 analogy.

22 EC2: Netflix Analogy VPC Internet Connection Amazon EC2 (Compute) Thanks to LinuxAcademy.com for the EC2 / Netflix analogy.

23 RDS: Netflix Analogy VPC Internet Connection Amazon EC2 (Compute) Amazon RDS (Database) -Account Details -Movie Inventory Thanks to LinuxAcademy.com for the EC2 / Netflix analogy.

24 S3: Netflix Analogy VPC Internet Connection Amazon EC2 (Compute) Amazon S3 (Storage) Amazon RDS (Database) -Account Details -Movie Inventory Thanks to LinuxAcademy.com for the EC2 / Netflix analogy.

25 Review of Recent Research: AWS Security

26 AWS Security Research

27 AWS Security Research

28 AWS Security Research

29 AWS Security Research And-Lateral-Movement-In-AWS-wp.pdf

30 AWS Security Research

31 AWS Security Research

32 Key Focus Areas for Audit, Risk & Compliance

33 AWS Trusted Advisor

34 AWS Trusted Advisor

35 Prowler

36 Prowler

37 Scout2

38 Summary We need to continue to keep pace with the changing technology (and threat) landscape. We have reviewed AWS core services to develop a foothold of familiarity. We emphasized the need to identify customer vs. AWS roles and responsibilities. We discussed tools at our disposal for auditing key aspects of the environment. Please visit some of the referenced sources for more information about current trends.

39 Questions?