Security & Compliance

Customer Compliance Center:

• Contains resources to help you learn more about AWS compliance.

Shared Responsibility Model

AWS has a shared responsibility model with the customer:

• AWS responsibility - Security of the Cloud
  • Protecting infrastructure (hardware, software, facilities, and networking) that runs all the AWS services
  • Managed services like S3, DynamoDB, RDS, etc.
• Customer responsibility - Security in the Cloud
  • For EC2 instance, customer is responsible for management of the guest OS (including security patches and updates), firewall & network configuration, IAM
  • Encrypting application data
• Shared controls:
  • Patch Management, Configuration Management, Awareness & Training

Example, for RDS

• AWS responsibility:
  • Manage the underlying EC2 instance, disable SSH access
  • Automated DB patching
  • Automated OS patching
  • Audit the underlying instance and disks & guarantee it functions
• Your responsibility:
  • Check the ports / IP / security group inbound rules in DB’s SG
  • In-database user creation and permissions
  • Creating a database with or without public access
  • Ensure parameter groups or DB is configured to only allow SSL connections
  • Database encryption setting

Example, for S3

• AWS responsibility:
  • Guarantee you get unlimited storage
  • Guarantee you get encryption
  • Ensure separation of the data between different customers
  • Ensure AWS employees can’t access your data
• Your responsibility:
  • Bucket configuration
  • Bucket policy / public setting
  • IAM user and roles
  • Enabling encryption

Firewalls & DDOS Protection on AWS

Denial-of-service attacks are deliberate attempts to make a website or application unavailable to users. AWS Shield: is a service that protects applications against DDoS attacks. AWS also has AWS WAF (Web Application Firewall) to filter specific requests based on rules.

• AWS Shield Standard: automatically protects all AWS customers at no cost, protects your AWS resources from the most common, frequently occurring types of DDoS attacks. Operates for no additional cost
• AWS Shield Advanced: 24/7 premium DDoS protection. It is a paid service that provides detailed attacks diagnostics and the ability to detect and mitigate sophisticated DDoS attacks.
• AWS WAF: Filter specific requests based on rules
• CloudFront and Route 53:
  • Availability protection using global edge network
  • Combined with AWS Shield, provides attack mitigation at the edge

AWS Shield

• AWS Shield Standard:
  • Free service that is activated for every AWS customer
  • Provides protection from attacks such as SYN/UDP Floods, Reflection attacks and other layer 3/layer 4 attacks
• AWS Shield Advanced:
  • Optional DDoS mitigation service ($3,000 per month per organization)
  • Protect against more sophisticated attack on Amazon EC2, Elastic Load Balancing (ELB), Amazon CloudFront, AWS Global Accelerator, and Route 53
  • 24/7 access to AWS DDoS response team (DRP)
  • Protect against higher fees during usage spikes due to DDoS

AWS Web Application Firewall (WAF)

A web application firewall that lets you monitor network requests that come into your web applications.

• Protects your web applications from common web exploits (Layer 7)
• Layer 7 is HTTP (vs Layer 4 is TCP)
• Deploy on Application Load Balancer, API Gateway, CloudFront
• Define Web ACL (Web Access Control List):
  • Rules can include IP addresses, HTTP headers, HTTP body, or URI strings
  • Protects from common attack - SQL injection and Cross-Site Scripting (XSS)
  • Size constraints, geo-match (block countries)
  • Rate-based rules (to count occurrences of events) - for DDoS protection

Penetration Testing on AWS Cloud

• AWS customers are welcome to carry out security assessments or penetration tests against their AWS infrastructure without prior approval for 8 services:
  • Amazon EC2 instances, NAT Gateways, and Elastic Load Balancers
  • Amazon RDS
  • Amazon CloudFront
  • Amazon Aurora
  • Amazon API Gateways
  • AWS Lambda and Lambda Edge functions
  • Amazon Lightsail resources
  • Amazon Elastic Beanstalk environments
• List can increase over time
• Prohibited Activities
  • DNS zone walking via Amazon Route 53 Hosted Zones
  • Denial of Service (DoS), Distributed Denial of Service (DDoS), Simulated DoS, Simulated DDoS
  • Port flooding
  • Protocol flooding
  • Request flooding (login request flooding, API request flooding)
• For any other simulated events, contact aws-security-simulatedevent@amazon.com
• Read more about penetration testing here (opens in a new tab)

Encryption on AWS

Data at Rest vs. Data in transit

• At rest: data stored or archived on a device
  • On a hard disk, on a RDS instance, in S3 Glacier Deep Archive, etc.
• In transit (in motion): data being moved from one location to another
  • Transfer from on-premises to AWS, EC2 to DynamoDB, etc.
  • Means data transferred on the network
• We want to encrypt data in both states to protect it!
• For this we leverage encryption keys

AWS Key Management Service (KMS)

• Enables you to perform encryption operations through the use of cryptographic keys.
• You can use KMS to create, manage and use cryptographic keys.
• You can also control the use of keys across a wide range of services and in your applications.
• Anytime you hear "encryption" for an AWS service, it’s most likely KMS
• KMS means AWS manages the encryption keys for us
• Encryption Opt-in:
  • EBS volumes: encrypt volumes
  • S3 buckets: Server-side encryption of objects
  • Redshift database: encryption of data
  • RDS database: encryption of data
  • EFS drives: encryption of data
• Encryption Automatically enabled:
  • CloudTrail Logs
  • S3 Glacier
  • Storage Gateway

CloudHSM

• KMS $\rightarrow$ AWS manages the software for encryption
• CloudHSM $\rightarrow$ AWS provisions encryption hardware
• Dedicated Hardware (HSM = Hardware Security Module)
• You manage your own encryption keys entirely (not AWS)
• HSM device is tamper resistant, FIPS 140-2 Level 3 compliance

Types of Customer Master Keys (CMK)

Customer Managed CMK

• Create, manage and used by the customer, can enable or disable
• Possibility of rotation policy (new key generated every year, old key preserved)
• Possibility to bring-your-own-key

AWS managed CMK

• Created, managed and used on the customer’s behalf by AWS
• Used by AWS services (aws/s3, aws/ebs, aws/redshift)

AWS owned CMK

• Collection of CMKs that an AWS service owns and manages to use in multiple accounts
• AWS can use those to protect resources in your account (but you can’t view the keys)

CloudHSM Keys (custom keystore)

• Keys generated from your own CloudHSM hardware device
• Cryptographic operations are performed within the CloudHSM cluster

AWS Certificate Manager (ACM)

• Let’s you easily provision, manage, and deploy SSL/TLS Certificates
• Used to provide in-flight encryption for websites (HTTPS)
• Supports both public and private TLS certificates
• Free of charge for public TLS certificates
• Automatic TLS certificate renewal
• Integrations with (load TLS certificates on)
  • Elastic Load Balancers
  • CloudFront Distributions
  • APIs on API Gateway

AWS Secrets Manager

• Newer service, meant for storing secrets
• Capability to force rotation of secrets every X days
• Automate generation of secrets on rotation (uses Lambda)
• Integration with Amazon RDS (MySQL, PostgreSQL, Aurora)
• Secrets are encrypted using KMS
• Mostly meant for RDS integration

AWS Artifact (not really a service)

AWS Artifacts Agreement: you can review, accept, and manage agreements for an individual account and for all your accounts in AWS Organizations. AWS Artifacts Reports provide compliance reports from third-party auditors.

• Portal that provides customers with on-demand access to AWS compliance documentation and AWS agreements
• Artifact Reports - Allows you to download AWS security and compliance documents from third-party auditors, like AWS ISO certifications, Payment Card Industry (PCI), and System and Organization Control (SOC) reports
• Artifact Agreements - Allows you to review, accept, and track the status of AWS agreements such as the Business Associate Addendum (BAA) or the Health Insurance Portability and Accountability Act (HIPAA) for an individual account or in your organization
• Can be used to support internal audit or compliance

Amazon GuardDuty

A service that provides intelligent threat detection for your AWS infrastructure and resources. Identifies threats by continuously monitoring the network activity and account behaviour within your AWS environment.

• Intelligent Threat discovery to Protect AWS Account
• Uses Machine Learning algorithms, anomaly detection, 3rd party data
• One click to enable (30 days trial), no need to install software
  • Input data includes:
  • CloudTrail Events Logs - unusual API calls, unauthorized deployments
    • CloudTrail Management Events - create VPC subnet, create trail, …
    • CloudTrail S3 Data Events - get object, list objects, delete object, …
  • VPC Flow Logs - unusual internal traffic, unusual IP address
  • DNS Logs - compromised EC2 instances sending encoded data within DNS queries
  • Kubernetes Audit Logs - suspicious activities and potential EKS cluster compromises
• Can setup CloudWatch Event rules to be notified in case of findings
• CloudWatch Events rules can target AWS Lambda or SNS
• Can prtect against CryptoCurrency attacks (has a dedicatedmeans"finding" for it)

Amazon Inspector

Helps to improve security and compliance of applications by running automated security assessments. It checks applications for security vulnerabilities and deviations from security best practices. Provides you with a list of security findings prioritized by severity level, including a detailed description of each security issue and a recommendation for how to fix it.

• Automated Security Assessments
• For EC2 instances
  • Leveraging the AWS System Manager (SSM) agent
  • Analyze against unintended network accessibility
  • Analyze the running OS against known vulnerabilities
• For Containers push to Amazon ECR
  • Assessment of containers as they are pushed
• Reporting & integration with AWS Security Hub
• Send findings to Amazon Event Bridge

What does AWS Inspector evaluate?

• Remember: only for EC2 instances and container infrastructure
• Continuous scanning of the infrastructure, only when needed
• Package vulnerabilities (EC2 & ECR) - database of CVE
• Network reachability (EC2)
• A risk score is associated with all vulnerabilities for prioritization

AWS Config

• Helps with auditing and recording compliance of your AWS resources
• Helps record configurations and changes over time
• Possibility of storing the configuration data into S3 (analyzed by Athena)
• Questions that can be solved by AWS Config:
  • Is there unrestricted SSH access to my security groups?
  • Do my buckets have any public access?
  • How has my ALB configuration changed over time?
• You can receive alerts (SNS notifications) for any changes
• AWS Config is a per-region service
• Can be aggregated across regions and accounts
• View compliance of a resource over time
• View configuration of a resource over time
• View CloudTrail API calls if enabled

Amazon Macie

• Amazon Macie is a fully managed data security and data privacy service that uses machine learning and pattern matching to discover and protect your sensitive data in AWS.
• Macie helps identify and alert you to sensitive data, such as personally identifiable information (PII)

AWS Security Hub

• Central security tool to manage security across several AWS accounts and automate security checks
• Integrated dashboards showing current security and compliance status to quickly take actions
• Automatically aggregates alerts in predefined or personal findings formats from various AWS services & AWS partner tools:
  • GuardDuty
  • Inspector
  • Macie
  • IAM Access Analyzer
  • AWS Systems Manager
  • AWS Firewall Manager
  • AWS Partner Network Solutions
• Must first enable the AWS Config Service

Amazon Detective

• GuardDuty, Macie, and Security Hub are used to identify potential security issues, or findings
• Sometimes security findings require deeper analysis to isolate the root cause and take action - it’s a complex process
• Amazon Detective analyzes, investigates, and quickly identifies the root cause of security issues or suspicious activities (using ML and graphs)
• Automatically collects and processes events from VPC Flow Logs, CloudTrail, GuardDuty and create a unified view

AWS Abuse

• Report suspected AWS resources used for abusive or illegal purposes
• Abusive & prohibited behaviors are:
  • Spam - receiving undesired emails from AWS-owned IP address, websites & forums spammed by AWS resources
  • Port scanning - sending packets to your ports to discover the unsecured ones
  • DoS or DDoS attacks - AWS-owned IP addresses attempting to overwhlem or crash your servers/softwares
  • Intrusion attempts - logging in on your resources
  • Hosting objectionable or copyrighted content - distributing illegal or copyrighted content without consent
  • Distributing malware - AWS resources distributing softwares to harm computers or machines
• Contact the AWS Abuse team: AWS abuse form, or abuse@amazonaws.com

Summary

• Shield: Automatic DDoS Protection + 24/7 support for advanced
• WAF: Firewall to filter incoming requests based on rules
• KMS: Encryption keys managed by AWS
• CloudHSM: Hardware encryption, we manage encryption keys
• AWS Certificate Manager: provision, manage, and deploy SSL/TLS Certificates
• Artifact: Get access to compliance reports such as PCI, ISO, etc…
• GuardDuty: Find malicious behavior with VPC, DNS & CloudTrail Logs
• Inspector: For EC2 only, install agent and find vulnerabilities
• Config: Track config changes and compliance against rules
• Macie: Find sensitive data (ex: PII data) in Amazon S3 buckets
• CloudTrail: Track API calls made by users within account
• AWS Security Hub: gather security findings from multiple AWS accounts
• Amazon Detective: find the root cause of security issues or suspicious activities
• AWS Abuse: Report AWS resources used for abusive or illegal purposes
• Root user privileges:
  • Change account settings
  • Close your AWS account
  • Change or cancel your AWS Support plan
  • Register as a seller in the Reserved Instance Marketplace