How to stop dreaming about security and start implementing
0 likes308 views
This document provides an overview of how to improve AWS security. It discusses common AWS security problems like publicly accessible buckets and stolen credentials. It recommends starting with a consulting company or security tools to audit compliance. The document then reviews the CIS AWS Benchmark for best practices and configurations. It explains how to implement continuous security monitoring versus periodic auditing. AWS security services like CloudTrail, GuardDuty, and SecurityHub are outlined. Best practices architecture and common lessons learned are also recapped. Estimated costs for implementing these security measures on an AWS account are provided.
How to stop dreaming about security and start implementing
- 1. How to stop dreaming about security and start implementing 2019 Kromtech
- 2. Agenda - AWS Security problems - Options to start with … - AWS Security tools - AWS CIS Implementation - Q&A
- 3. Intro & speakers Aleksandr Maklakov CIO at ZEO Alliance/Kromtech 14 years in IT MBA ISO 27001 Internal Auditor AWS Certified Solutions Architect - Associate Nazariy Uniyat IT Security Engineer at Kromtech 8 years in IT
- 4. Data breach security trends in cloud #1 - publicly accessible buckets #2 - open ports(especially in databases) #3 - stolen/leaked credentials (access/secret keys) - cryprominers
- 5. Options to start with ... - Find consulting company - Find some tools for audit and compliance check - Find framework/controls
- 6. CIS Amazon Web Services Benchmark Center for Internet Security (CIS) - nonprofit organization. Its mission is to "identify, develop, validate, promote, and sustain best practice solutions for cyber defense and build and lead communities to enable an environment of trust in cyberspace" Recommended for use by many security vendor and PCI DSS
- 7. CIS Amazon Web Services Benchmark © Sift Security Inc
- 8. CIS Amazon Web Services Benchmark
- 9. Continuous audit vs monitoring Audit - Owned by External Company or Internal Auditor - Conduct annually (or often) - More formal Monitoring - Owned by management team - On-going process to ensure processes are working as intended - Easely implement continuous approach
- 10. Services
- 11. CloudTrail
- 12. AWS Config
- 15. GuardDuty
- 17. Macie
- 22. Security Hub
- 28. Security Hub Data Sources
- 29. Enable Them All
- 31. CloudTrail
- 36. CloudWatch Logs in Trail
- 38. AWS Config
- 46. Aggregator
- 55. Guard Duty
- 59. 111111111111
- 60. Macie
- 65. 111111111111
- 67. Security Hub
- 72. Lessons - Lambda Logs - Encryption S3 logs - SCP policy only for working regions - Architecture!
- 73. SUMMARY
- 74. RECAP - AWS CIS Benchmark as starting point - AWS Security Services overview (CloudTrail, Macie, Guard Duty, SecurityHub, etc) - Best Practices Architecture - Lessons & Bugs
- 75. COST ~ $600/month ~ 200Gb of Logs ~ 17M Events
- 76. Links AWS Security Best Practices AWS CIS Benchmark AWS CIS Benchmark Quick Start AWS CloudTrail AWS Organizations Amazon GuardDuty AWS Security Hub
- 77. Next Steps
- 79. More services Inspector WAF Shield
- 80. Q&A