shared security in aws
Post on 11-Apr-2017
126 Views
Preview:
TRANSCRIPT
Shared Security in AWS
March 2017
Peter GordonCloud Security Architect APAC
Agenda
• Shared Security Model recap• Common threats & consequences• Ransomware and the cloud• Mapping controls to the SSM
Sophos and AWS
• Sophos is a Security Competency Partner• Have had the UTM on the AWS Marketplace since 2011• Solutions that integrate with several AWS services
Auto ScalingAmazon S3CloudFormationElastic Load Balancing
Customer is responsible for security ‘in’ the
Cloud
AWS takes care of the security ‘of’ the Cloud
AWS Shared Security Model overview
Common threats
•Web application attacks, such as SQLi and XSS• DoS and DDoS• Ransomware• Exploits• Brute force attacks
Consequences
• Data breacho User data / passwordso Financial infoo Now mandatory disclosure in Australia (for some)
• Loss of data o Encryption by ransomware
• Hijacked servers o Used as malware delivery serverso Participation in DDoS attackso Stepping stone to bigger target
• Time and cost of restoration of systems and data
7
Servers are critical assets
• Corporate / proprietary data on network shares•Web site content• Higher value targets for ransomware• Performance and availability critical for servers
Ransomware and AWS – really?
• Traditionally an end point problem, but…o Mapped drives get hit tooo Compromised web servers may be used
to spread the malwareo Some attacks encrypt web server fileso Can be delivered through an exploit kito Brute force RDP attacks
Anatomy of a Ransomware Attack
Exploit Kit or Spam with Infection
Command & Control Established
Local Files are Encrypted
Ransomware deleted, Ransom
Instructions delivered
10
Why customers need more security
• Security Groups and NACLso Port or IP filteringo No traffic or application visibilityo Unable to prevent attacks in trusted
portso No malware protection = no
ransomware protection
• Security vendorso Application controlo Forward proxy with filteringo Web Application Firewall*o Stateful Firewall and IPSo Anti-Malwareo Traffic visibility
Security Controls to address Shared Security Model
Application Security
Data Encryption
Access Control
VPC / SG / NACL
AWS Web Services
DatabaseStorageComputeNetworking
Application Updates
HIPSCustomer is expected to add protection layers
WAF
VPN
NGFW Outbound Proxy
Host Hardening
Customer updates OS and Applications
Availability ZonesRegions
Edge Locations
AWS Global Infrastructure
OS Updates NIPS
AV/NG
Customer configures AWS security features
Customer is responsible for security ‘in’ the
Cloud
AWS takes care of the security ‘of’ the Cloud
App Control
Further Mitigations
• Backup, backup, backup…• Block communications to C&C servers• Monitor and block encryption behaviour on servers• Reduce attack surface - Server lockdown / application
whitelisting• Patch your ec2 instances! OS and Applications• DDoS mitigation services (e.g. AWS Shield)• Other regular corporate security controls
• User education and user security controls (email etc)
What is Sophos doing?
• Various deployments of UTM (FW/WAF/IPS/VPN/Proxy)o Standaloneo HAo Auto-scaling
• Server host protection integrates with AWS• Phishing education for users
14
top related