Building Security into AWS with Trend Micro
•
1 like•1,486 views
This document discusses building applications securely on AWS. It outlines the shared responsibility model between AWS and customers, with AWS responsible for security of the cloud infrastructure and customers responsible for their applications and data. It describes the Shellshock vulnerability timeline and impact. It provides recommendations for reviewing VPC configuration, network access controls, and security groups. It also recommends automating deployment from known good AMIs, applying intrusion prevention, and using integrity monitoring to maintain the known good state.
Recommended
Recommended
More Related Content
What's hot
What's hot (20)
Viewers also liked
Viewers also liked (20)
Similar to Building Security into AWS with Trend Micro
Similar to Building Security into AWS with Trend Micro (20)
More from Amazon Web Services
More from Amazon Web Services (20)
Recently uploaded
Recently uploaded (20)
Building Security into AWS with Trend Micro
- 1. ©2015, Amazon Web Services, Inc. or its affiliates. All rights reserved Using Security to Build with Confidence in AWS Mark Nunnikhoven for Trend Micro @marknca
- 3. The Story More at aws.trendmicro.com 2012 re:Invent SPR203: Cloud Security Is a Shared Responsibility http://bit.ly/2012-spr203 2013 re:Invent SEC208: How to Meet Strict Security and Compliance Requirements in the Cloud http://bit.ly/2013-sec208 SEC307: How Trend Micro Built Their Enterprise Security Offering on AWS http://bit.ly/2013-sec307 2014 re:Invent SEC313: Updating Security Operations for the Cloud http://bit.ly/2014-sec313 SEC314: Customer Perspectives on Implementing Security Controls with AWS http://bit.ly/2014-sec314
- 4. Shared Responsibility Model AWS Physical Infrastructure Network Virtualization You Operating system Applications Data Service configuration More at aws.amazon.com/security
- 5. Shared Responsibility Model AWS Physical Infrastructure Network Virtualization You Operating system Applications Data Service configuration More at aws.amazon.com/security
- 7. Vulnerability ©2015, Amazon Web Services, Inc. or its affiliates. All rights reserved
- 8. by Andreas Lindh (@addelindh)
- 9. bash is a common command line interpreter
- 10. a:() { b; } | attack 10 | 10 vulnerability. Widespread and easy to exploit
- 12. 1989 Fantastic summary by David A. Wheeler at http://www.dwheeler.com/essays/shellshock.html#timeline
- 13. "MicroTAC" by Redrum0486 at English Wikipedia 12.3oz
- 14. Time Since Last Event Event Action Action Timeline 1989-08-05 8:32 Added to codebase 27 days, 10:20:00 Released to public 9141 days, 21:18:35 Initial report React Clock starts 1 day, 22:19:13 More details React 2 days, 7:30:12 Official patch :: CVE-2014-6271 Patch 4 days, 5:49:25 5 days, 9:16:35 Limited disclosure :: CVE-2014-6271 React 2 days, 4:37:25 More details React 3:44:00 More details React 0:27:51 Public disclosure React 0:36:30 More details React
- 15. Important Shellshock Events Time Since Last Event Event Action Action Timeline 1989-08-05 8:32 Added to codebase 27 days, 10:20:00 Released to public 9141 days, 21:18:35 Initial report React Clock starts 2 days, 7:30:12 Official patch :: CVE-2014-6271 Patch 4 days, 5:49:25 3:29:09 Official patch :: CVE-2014-7169 Patch 9 days, 19:17:00 3:15:00 Official patch :: CVE-2014-7186, CVE-2014-7187 Patch 4 days, 17:30:00 1 day, 11:55:00 Official patch :: CVE-2014-6277 Patch 1 day, 11:55:00
- 16. Respond ©2015, Amazon Web Services, Inc. or its affiliates. All rights reserved Day 1
- 17. aws.amazon.com/architecture: Web application hosting
- 18. aws.amazon.com/architecture : Web application hosting
- 19. TCP : 443TCP: 443 TCP: 4433TCP: 4433 Primary workflow for our deployment
- 20. AWS VPC Review
- 21. AWS VPC Checklist Review AWS Identity and Access Management (IAM) roles Security groups Network segmentation Network access control lists (NACL) More in the Auditing Security Checklist for Use of AWS, media.amazonwebservices.com/AWS_Auditing_Security_Checklist.pdf
- 22. TCP: 443TCP: 443 TCP: 4433TCP: 4433 Primary workflow for our deployment
- 23. HTTPSTPS Intrusion prevention can look at each packet and then take action depending on what it finds
- 24. aws.amazon.com/architecture: Web application hosting
- 25. Intrusion Prevention in Action
- 26. Review All instances covered Workload appropriate rules Centrally managed Security controls must scale out automatically with the deployment
- 27. Repair ©2015, Amazon Web Services, Inc. or its affiliates. All rights reserved Day 2
- 28. aws.amazon.com/architecture: Web application hosting
- 29. All instances deployment from task-specific AMI TCP: 443TCP: 443 TCP: 4433TCP: 4433
- 30. Workflow should be completely automated Instantiate DestroyConfigure AMI Creation Workflow Bake Instantiate Test
- 31. AMI Creation
- 32. aws.amazon.com/architecture: Web application hosting
- 33. Instances tend to drift from the known good state; monitoring key files and processes is important AMI Instance AlertIntegrity Monitoring
- 35. Keys Respond Review configuration Apply intrusion prevention Repair Patch vulnerability in new AMI Leverage integrity monitoring
- 36. Keys Automation
- 38. SAN FRANCISCO