AWS security monitoring and compliance validation from Adobe.
4 likes1,918 views
The document outlines a security engineering presentation focused on AWS security monitoring and compliance at Adobe, emphasizing the necessity for improved visibility and data sources in handling security incidents. It details the use of Splunk for log aggregation and analysis from various AWS components and provides insights into the setup and management of these data sources. The presentation also touches on AWS account management, data collection practices, and automation of security policy audits to enhance operational security.
![The
Background
3
Digital
MarkeFng
&
AnalyFcs
55k
hosts
across
30
sites
CollecFon
of
~20
admin
teams.
– Different
tech
stacks,
but
mostly
*nix
Monitoring
Toolset:
– Ne]low,
FPC,
IDS,
Network
TransacFon](https://image.slidesharecdn.com/you-cant-protect-what-you-cant-see-aws-security-monitoring-and-compliance-validation-from-adobe-161111002137/85/AWS-security-monitoring-and-compliance-validation-from-Adobe-3-320.jpg)
![Splunk
Gotchas:
24
Kinesis
Modular
Input
– Can
chew
up
memory
– Increase
what
it
gets:
ê /opt/splunk/etc/apps/kinesis_ta/bin
java_args
=
[
JAVA_EXECUTABLE,
"-‐classpath",CLASSPATH,"-‐Xms512m","-‐
Xmx512m",
"-‐Dsplunk.securetransport.protocol="+SECURE_TRANSPORT,JAVA_MAIN_CLASS]
Config
Snapshots
are
jsonormous
– Use
lambda
to
split
up
the
resources](https://image.slidesharecdn.com/you-cant-protect-what-you-cant-see-aws-security-monitoring-and-compliance-validation-from-adobe-161111002137/85/AWS-security-monitoring-and-compliance-validation-from-Adobe-24-320.jpg)
![DynamoDB:
Account
RegistraFon
Item
{ [-]
DevPhaseOutput: Yep
InspectorRoleARN: arn:aws:iam::555555555555:role/InfoSec-InspectorIamRole-1WPVBFHJ3CQM1
ProdPhaseOutput: Yep
StagePhaseOutput: Yep
account_id: 55555555555
config_pull_enable: true
config_role_arn: arn:aws:iam::555555555555:role/InfoSec-ConfigIamRole-1CCXRZ8SN2IL5
description: CampaignOps
elb_access_log_enable: true
flowlogs_role_arn: arn:aws:iam::555555555555:role/InfoSec-FlowLogsIamRole-7R1QLDHRXS1F
jira_queue: CPGNTEAM
role_arn: arn:aws:iam::555555555555:role/InfoSec-SecEngRole-9W6HAJ8SNOEK
trusted_advisor_collect: true
vpc_flow_logs: true
}
30](https://image.slidesharecdn.com/you-cant-protect-what-you-cant-see-aws-security-monitoring-and-compliance-validation-from-adobe-161111002137/85/AWS-security-monitoring-and-compliance-validation-from-Adobe-30-320.jpg)
AWS security monitoring and compliance validation from Adobe.
- 1. Copyright © 2016 Splunk Inc. Sco8 Pack Security Engineer, Adobe AWS Security Monitoring & Compliance ValidaFon From Adobe
- 2. Presenter 2 • Sco8 Pack – Security Engineer @ Adobe – SLC, UT – 4 Year Splunker – Proudly DQd at 3 Pinewood Derbies • Agenda – Background – AWS Security Data Sources – AggregaFon & Ingest – Bit of Analysis
- 3. The Background 3 Digital MarkeFng & AnalyFcs 55k hosts across 30 sites CollecFon of ~20 admin teams. – Different tech stacks, but mostly *nix Monitoring Toolset: – Ne]low, FPC, IDS, Network TransacFon
- 4. Security OperaFons At Adobe 4 Splunk as a Core Service – Used for all logs: applicaFon, network, host, etc Security Engineering: Own the data sources – Set up systems that feed Splunk Security OperaFons: SplunkES Analysis & InvesFgaFon – Consume the data
- 5. Shi`ing To AWS 5 Lots of accounts … > 200 Dozens of teams, thousands of instances Missing data to: – Detect/respond to incidents – Making assurances to Compliance We received a mandate: Fix this – Get whatever visibility you can – Minimize risk of operaFons impact – Be cost sensiFve
- 6. AWS Security Incidents? Wut? 6 AWS Account Compromise: – Baddie interacts w/ AWS as an authenFcated user Host compromise – Baddie has some control of a host
- 7. Make Our Lives Easier: Follow the same model: Data -‐> Splunk ES -‐> SOC Don’t juggle hundreds of AWS API keys Out-‐of-‐band monitoring Quick setup Reduce future need to redeploy Keep it to AWS NaFve data sources 7
- 8. Data Sources 8 CloudTrail API Usage & Logging VPC FlowLogs Virtual Interface ConnecFvity Config Account ConfiguraFon & Inventory ELB Access Logs Load Balancer Logging Trusted Advisor Security PracFce Checks IdenFty & Access Management CredenFal Report
- 9. Data Examples 9 CloudTrail VPC Flows ELB Access Logs Config CredenFal Report
- 10. OK, So This? 10 • Has input types for: – Config Snapshots – Config Rules – CloudTrail – CloudWatch Logs – ELB Access Logs – S3 Buckets • But… – Input Stanza Explosion ê Account x sourcetype x (region) ê ~ 28 Inputs per account – API Keys for each account
- 11. Cross-‐Account AuthenFcaFon 11 IAM Users – Use API Keys directly Roles – AWS Security Token Service – Can be “Assumed” by a specified Principal ê Principal: AWS User, Account, Service, Other Role – AuthenFcate to an AggregaFon Account user ê Assume the cross-‐account role ê Retrieve temporary access keys ê Make calls with temporary keys h8p://docs.aws.amazon.com/IAM/latest/UserGuide/tutorial_cross-‐account-‐with-‐roles.html
- 12. 12 AggregaFon 12 CloudTrail VPC FlowLogs Config ELB Access Logs Trusted Advisor IAM AWS S3 Per Region CloudWatch Kinesis Per Region CloudWatch DesFnaFon Lambda Schedule Each Monitored Account AggregaFon Account
- 13. CollecFon Plumbing: S3 S3 Buckets: – ELB (1 per region) ê Permit PutObject from AWS ELB IAM Roles – Config ê Permit PutObject from config.amazonaws.com – Config Parsed – CloudTrail ê Permit PutObject from cloudtrail.amazonaws.com – Trusted Advisor Results ê Permit PutObject from Lambda ExecuFon IAM role 13 AWS ELB Account IDs for Log Delivery: h8p://docs.aws.amazon.com/elasFcloadbalancing/latest/classic/enable-‐access-‐logs.html#a8ach-‐bucket-‐policy
- 14. CollecFon Plumbing: Rest of it AggregaFon AWS Account Kinesis Stream: – 1 Per region CloudWatch LogDesFnaFons – 1 Per region – Directs to region-‐local kinesis stream 14
- 15. RegistraFon 15
- 16. 16 CloudFormaFon Resources: Config Role FlowLogs Role SecEng Role SNS NoFficaFon Role’s Done! Inputs: DescripFon Jira Queue RegistraFon Lambda RegistraFon DynamoDB RegistraFon Setup & Retrieval Daily Setup FuncFons RegistraFon DynamoDB Assumed Role
- 17. Enrollment Via Web UI – Describes all permissions, documents WebUI use 17
- 18. CollecFon + Analysis 18
- 19. Splunk App – Input Methods: S3 – Input Sourcetypes: CloudTrail, VPC Flows, ELB Access Logs – Parsing Handler: GZIPMessageHandler (Thanks Damien!) 19 AggregaFon reduces amount of Splunk inputs: 26 Total Inputs • S3: 14 • Kinesis Inputs: 10 • AddiFonal Logging: 2 Currently running on a dedicated Heavy Forwarder. • If needed, split regions to different forwarders.
- 20. Sourcetypes, Lookups, And Other Fun 20 Sourcetypes: Cheated off the Splunk App for AWS. – Set json KV format and check line-‐breaks Use HTTP Event Collector to dump DynamoDB account registraFons – Scheduled lookup-‐generaFng search – Every event has the account ID somewhere in it (Almost). Tagging into Enterprise Security data models – ELB Access Logs & VPC Flows right out of the box
- 21. Ge{ng Dashboard Approval GETTING DASHBOARD APPROVAL 21
- 22. “Gotchas” 22
- 23. Data Frequency/Latency • Daily Snapshots Config • Daily Snapshots Trusted Advisor • 5-‐8 minute latency CloudTrail • 5-‐10 minute latency ELB Access Logs • 5-‐10 minute latency VPC Flow Logs 23
- 24. Splunk Gotchas: 24 Kinesis Modular Input – Can chew up memory – Increase what it gets: ê /opt/splunk/etc/apps/kinesis_ta/bin java_args = [ JAVA_EXECUTABLE, "-‐classpath",CLASSPATH,"-‐Xms512m","-‐ Xmx512m", "-‐Dsplunk.securetransport.protocol="+SECURE_TRANSPORT,JAVA_MAIN_CLASS] Config Snapshots are jsonormous – Use lambda to split up the resources
- 25. AWS Gotchas: SFll no packet-‐level visibility ELB Permission Granularity RestricFons – ModifyA8ributes Keep an eye on capacity. Watch: – DynamoDB Reads – Kinesis Shard Usage 25
- 26. Where We’re At Right Now – 40 AWS accounts currently enrolled – 500-‐800 GB/day – Haven’t broken any accounts yet! – Finding more data sources ê Config Rules ê Inspector – Automated our AWS security policy audit – Wri8en a handful of Splunk Enterprise correlaFon rules ê AcFoned by SOC – Automated Jira FckeFng for remediaFon 26
- 27. QuesFons? 27 Contact: [email protected] github.com/sco8jpack Twi8er: @sco8jpack
- 28. THANK YOU
- 29. Permissions 29
- 30. DynamoDB: Account RegistraFon Item { [-] DevPhaseOutput: Yep InspectorRoleARN: arn:aws:iam::555555555555:role/InfoSec-InspectorIamRole-1WPVBFHJ3CQM1 ProdPhaseOutput: Yep StagePhaseOutput: Yep account_id: 55555555555 config_pull_enable: true config_role_arn: arn:aws:iam::555555555555:role/InfoSec-ConfigIamRole-1CCXRZ8SN2IL5 description: CampaignOps elb_access_log_enable: true flowlogs_role_arn: arn:aws:iam::555555555555:role/InfoSec-FlowLogsIamRole-7R1QLDHRXS1F jira_queue: CPGNTEAM role_arn: arn:aws:iam::555555555555:role/InfoSec-SecEngRole-9W6HAJ8SNOEK trusted_advisor_collect: true vpc_flow_logs: true } 30