How to Build a Threat Detection Strategy in the AWS Cloud

How to Build a Threat Detection Strategy
in AWS

How to Build a Threat Detection Strategy in AWS
Instructor Introduction

Instructor Introduction
• Joseph Holbrook
• Consulting Blockchain Solutions Architect/Trainer/Speaker out of Jacksonville, FL
• Certified Blockchain Solutions Architect (CBSA)
• Certified Blockchain Developer Hyperledger (CBDH)
• Certified Corda Developer
• Certified Google Cloud Platform Cloud Architect and Engineer
• AWS Professional Services Partner - Premier
• Certified AWS Solutions Architect, SysOps and Security
• CompTIA SME – Cloud and Security
• Brocade Distinguished Architect (BDA) 2013
• EMC Proven Professional – Expert – Cloud (EMCCE)
• Published Course Author on Pearson Safari, Udemy, Linkedin Learning
• Author “Architecting Enterprise Blockchain Solutions” – Wiley November 2019
• Prior US Navy Veteran

Course Introduction

Course Introduction
By the end of this Course you should be able to understand
 Shared Security Model
 Introduction to Threat Detection
 Intrusion Detection Systems, Advanced Threat Detection Systems and other security
tools that enable a proactive response to threats.
 Building a Threat Reduction Strategy
 Cloud Adoption Framework (CAF) Security Perspective Controls
 AWS GuardDuty Monitoring (Demo)
 AWS Security Specialty Certification
 Course Summary

Did you Know?

Did you know?
Did You Know?
• In a recent eye-opening study, Threat Stack found that 73% of companies have
at least one critical security misconfiguration, such as remote SSH open to the
entire internet.
• That most security incidents actually occur because of credential theft
(according to the 2018 Verizon Data Breach Investigations Report) not
sophisticated zero-day attacks against cloud providers themselves.

Did you know?
Did You Know?
• The AWS S3 bucket name is not a secret and therefore there are many ways for
a hacker to figure it out. Once the attacker figures it out they can steal your data
and expose it to viewers that are unintended.
• VPC Flow log entries can be scanned to detect both specific and anomalous
attack patterns.

Shared Security Model

Introduction and benefits of AWS security
Shared Security Model
• Review the shared responsibility
model and know what the provider
does for security and what the
user is responsible for.

Introduction to Threat Detection

Threat Detection
• Threat detection is the process by which you find threats on your network, your
systems or your applications
• Malware, Virus, Phishing, Trojans, Ransomware, permissioning issues,
backdoors are common
• APT- The enemy could be hidden for months or more.
• Focus on techniques, tactics, and procedures (TTPs)

Understand what the attackers are after.
• Credentials
• Financial Information
• Health Info/PII
• Corporate Secrets
• Ransom
• Revenge or even corporate image harm

Threat Detection Tools
• SIEMs
• IDS
• NGEN Firewalls
• Endpoints
• Cloud Brokers
• Honeypots
• Analytics

Intrusion Detection Systems, Advanced Threat Detection
Systems and other security tools that enable a proactive
response to threats

• SIEM – Security Hub
• Security Service (Uses AI) – Macie
• Security Service –(For EC2) Inspector
• Compliance Tool – Audit Artifacts
• DDoS Protection - Shield
• CloudWatch – Monitoring Tool
• Others such as HSM, FW Manager, Cognito,
etc

Diagram - Fortinet

Diagram - AWS

Building a Threat Reduction Strategy

Identify threats
• Insider
• Outsider
• Kill Chain – 6 Steps
• Kill Chain – 5 Components
Diagram ISC Congress

Cloud Adoption Framework (CAF) Security Perspective Controls

• The AWS CAF provides a framework to help you
structure and plan your cloud adoption journey and
then build a comprehensive approach to cloud
computing throughout the IT lifecycle.
• The CAF provides seven specific areas of focus or
Perspectives: business, platform, maturity, people,
process, operations, and security.
• Security Perspective captures AWS’s experience
working with enterprise customers on their cloud
adoption journey

CAF Security
Controls
• CAF 101

AWS GuardDuty Monitoring

GuardDuty
Analyzes literally billions of events to identify trends, patterns, and anomalies to
find behavior that are recognizable signs that something may be wrong.
Receives Input from multiple data streams.
• Several threat intelligence feeds
• Staying aware of malicious IP addresses and domains

GuardDuty searches customers specified
• Virtual Private Cloud (VPC) Flow Logs
• AWS CloudTrail
• DNS logs
You can also set a whitelist list and a blacklist

GuardDuty searches customers specified
• Virtual Private Cloud (VPC) Flow Logs
• AWS CloudTrail
• DNS logs

Top 7 AWS Security Services
• AWS Security Center
• AWS Guard Duty
• AWS CloudHSM
• Amazon Inspector
• AWS Key Management Service
• AWS Trusted Advisor
• AWS Cloud Trail
AWS Services - Security

AWS Security Specialty Exam

AWS Security Specialization is really focused on best practices, AWS security services
and security controls for workloads on AWS.
Exam info is here. https://aws.amazon.com/certification/certified-security-specialty/

Course Summary

Threat Detection in AWS
Putting it all together
 AWS services can be used in a complementary manner to add capability.
 AWS and Security are complementary. The better your security planning is
the more favorable results you should get out of AWS services.
 AWS has a robust solution set of security related services.

Resources
 AWS Security Products - https://aws.amazon.com/products/security/
 Security Hub - https://aws.amazon.com/security-hub/
 Landing Zone - https://aws.amazon.com/solutions/aws-landing-zone/
 Fortinet - https://www.fortinet.com/products/public-cloud-security/aws.html

QuickStart Resources - AWS

Thank you and
Questions

How to Build a Threat Detection Strategy in the AWS Cloud

Recommended

More Related Content

Similar to How to Build a Threat Detection Strategy in the AWS Cloud (10)

More from Joseph Holbrook, Chief Learning Officer (CLO) (20)

Recently uploaded (20)

How to Build a Threat Detection Strategy in the AWS Cloud

Editor's Notes