There are many ways to improve your security controls in AWS accounts. In this session, we'll cover how to leverage guidelines from the Center of Internet Security (CIS), how to augment security checks, and how to build and secure AWS resources with additional tools.  Armed with the information in this session,  you will be able to harden new AWS accounts and implement security best practices from Day One.

2. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Improve your security posture with
AWS CloudFormation
Luis Colon
Sr Developer Advocate
AWS CloudFormation
D E V 3 4 1 R 2
Anuradha Garg
Sw Development Engineer
AWS CloudFormation
Sam Hennessy
Solutions Architect
AWS

3. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Agenda
Improving your security posture
Guidelines from the
Center of Internet Security
Demo: CLI tool to
run checks
Demo: Use CloudFormation
to deploy equivalent
AWS Config Rules
AWS CloudFormation

4. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Before We Start…
Be aware of a few basic things…
What are the typical vulnerabilities?
Are you writing secure code?
How’s your monitoring game?

5. What are typical vulnerabilities?

6. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Common Vulnerabilities: OWASP Top 10

7. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Common Vulnerabilities: PureSec Top 10

8. Are you writing secure code?

9. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Avoiding Injection

10. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Avoiding Injection

12. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
3rd Party Dependencies

13. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
3rd Party Dependencies
2 Direct
19 Indirect
~191k LOC

14. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Flow Manipulation

15. How’s your monitoring game?

16. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.

17. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Monitoring & Logging
• AWS CloudWatch
• AWS CloudTrail
• AWS Config
• AWS ConfigRules
• AWS X-Ray
• Amazon Macie
• Dashbird
• …noneed towrite your own

18. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Monitoring & Logging
• AWS CloudWatch
• AWS CloudTrail
• AWS Config
• AWS ConfigRules
• AWS X-Ray
• Amazon Macie
• Dashbird
• …noneed towrite your own

19. Automating Controls

20. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.

21. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
CIS AWS Foundations

22. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
CIS Rules
• Prowler
• Checks CIS
• Adds otherrules
• Check per account/region

23. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
CIS Benchmark on AWS
https://aws.amazon.com/quickstart/architecture/compliance-cis-benchmark/

24. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
CIS Benchmark on AWS
https://aws.amazon.com/quickstart/architecture/compliance-cis-benchmark/
Delivered to
AWS CloudWatch Logs
S3 Bucket encrypted
with AWS KMS
Alarms
Events Rules Custom Lambda
Functions
AWS Lambda
Functions
Custom
AWS Config Rules
AWS Config Rules
Email
Notifications
• Somecontrols
implementedascustom
AWSConfigrules
• AWSCloudWatchalarms
andcustomlogmetric
filtersforcontinuous
monitoring
• CloudWatcheventrules
• AWSLambdafunctions
backallcustomAWSConfig
andCloudWatchevents
• CloudWatchrulesand
eventsdependonAWS
CloudTrail

25. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
CIS Benchmark: Deploying with CloudFormation
• SelectProfileLevel (1or2)
• EnableCloudWatchand
CloudTrail
• Implementedasanested
stack
• Requiresemailfor
CloudWatchnotifications
• over90resourcesare
implemented

26. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
CIS Benchmark: Deploying with CloudFormation

27. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Generated AWS CloudWatch Rules

28. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Generated AWS Config Rules

29. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
AWS Lambda Functions for Rules
• Inspectthe
code
• Customizeit!

30. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Additional Advice
• Reuseexisting authentication systems
• AWSCognito, Auth0, JWT
• Least Privilege
• No*in IAM policies
• Noindividual permissions(use roles/groups)
• Make policies perfunction, not aglobal one
• Protect secrets
• Don’t exposein logs,code oralerts
• Extract parameters -useAWSSystemsManager
Parameter Store
• Encryption
• Rotate keystomitigate events
• Use AWSSecrets Manager
• Usethe toolsatyourdisposal
• Don'tcreatenewtoolsifyoudon’thaveto!
• Yourownaudits
• Loglogins,failedlogins,accountchanges(password
changes,emailchanges),confirmdbtransactions…
• havethresholdsonloginsfroman address,db
connections,queriesper second
• DoSbecomesDoW
• Rotatecredentials
• Separatecredentialsandpoliciesfordifferent
functions
• Hardenaccountsandenvironments
• Automate yourcontrols

31. Thank you!
© 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Luis Colon
Sr Developer Advocate
AWS CloudFormation
Anuradha Garg
Sw Development Engineer
AWS CloudFormation
Sam Hennessy
Solutions Architect
AWS

32. Please complete the session
survey in the mobile app.
!
© 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.