Shared Security in AWS
Download as PPTX, PDF0 likes467 views
The document outlines AWS's shared security model, emphasizing that customers are responsible for security 'in' the cloud while AWS handles security 'of' the cloud. It details common threats such as ransomware, web application attacks, and denial-of-service, along with their consequences like data breaches and system restoration challenges. Sophos's role as a security competency partner is also highlighted, showcasing solutions that enhance security across various AWS services.
Shared Security in AWS
- 1. Shared Security in AWS March 2017 Peter Gordon Cloud Security Architect APAC
- 2. Agenda • Shared Security Model recap • Common threats & consequences • Ransomware and the cloud • Mapping controls to the SSM
- 3. Sophos and AWS • Sophos is a Security Competency Partner • Have had the UTM on the AWS Marketplace since 2011 • Solutions that integrate with several AWS services Auto ScalingAmazon S3CloudFormationElastic Load Balancing
- 4. Customer is responsible for security ‘in’ the Cloud AWS takes care of the security ‘of’ the Cloud AWS Shared Security Model overview
- 5. Common threats • Web application attacks, such as SQLi and XSS • DoS and DDoS • Ransomware • Exploits • Brute force attacks
- 6. Consequences • Data breach o User data / passwords o Financial info o Now mandatory disclosure in Australia (for some) • Loss of data o Encryption by ransomware • Hijacked servers o Used as malware delivery servers o Participation in DDoS attacks o Stepping stone to bigger target • Time and cost of restoration of systems and data
- 7. Servers are critical assets 7 • Corporate / proprietary data on network shares • Web site content • Higher value targets for ransomware • Performance and availability critical for servers
- 8. Ransomware and AWS – really? • Traditionally an end point problem, but… o Mapped drives get hit too o Compromised web servers may be used to spread the malware o Some attacks encrypt web server files o Can be delivered through an exploit kit o Brute force RDP attacks
- 9. Anatomy of a Ransomware Attack Exploit Kit or Spam with Infection Command & Control Established Local Files are Encrypted Ransomware deleted, Ransom Instructions delivered
- 10. Why customers need more security 10 • Security Groups and NACLs o Port or IP filtering o No traffic or application visibility o Unable to prevent attacks in trusted ports o No malware protection = no ransomware protection • Security vendors o Application control o Forward proxy with filtering o Web Application Firewall* o Stateful Firewall and IPS o Anti-Malware o Traffic visibility
- 11. Security Controls to address Shared Security Model Application Security Data Encryption Access Control VPC / SG / NACL AWS Web Services DatabaseStorageComputeNetworking Application Updates HIPS Customer is expected to add protection layers WAF VPN NGFW Outbound Proxy Host Hardening Customer updates OS and Applications Availability ZonesRegions Edge Locations AWS Global Infrastructure OS Updates NIPS AV/NG Customer configures AWS security features Customer is responsible for security ‘in’ the Cloud AWS takes care of the security ‘of’ the Cloud App Control
- 12. Further Mitigations • Backup, backup, backup… • Block communications to C&C servers • Monitor and block encryption behaviour on servers • Reduce attack surface - Server lockdown / application whitelisting • Patch your ec2 instances! OS and Applications • DDoS mitigation services (e.g. AWS Shield) • Other regular corporate security controls • User education and user security controls (email etc)
- 13. What is Sophos doing? • Various deployments of UTM (FW/WAF/IPS/VPN/Proxy) o Standalone o HA o Auto-scaling • Server host protection integrates with AWS • Phishing education for users
- 14. 14
Editor's Notes
- #12: The main reason that customers need security solutions in the Public Cloud is that the major platforms use what’s called a shared security model. What this simply means is that the provider such as AWS, will ensure security of the platform itself which leaving security for anything you (the customer) installs up to the customers.