Security ideas to help you operate more securely in the cloud. Use the AWS platform and CICD as a mechanism to monitor security of what is being deployed. Limit risk with proper security controls, network implementation and logging mechanisms.

1. © 2016, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Teri Radichel | @teriradichel
11/28/2016
AWS Security Ideas
Leverage The Platform - Enhance Security

2. Many companies have gotten past
the belief that the cloud is not secure...
But you still have to secure it.
Here are some ideas for a more secure cloud.
@teriradichel

3. Architect Systems For Security First
If system is designed by security professionals,
Security is built in from the ground up.
@teriradichel

4. Centralize and Automate Security Functions
Manage security via trained professionals.
Limit mistakes due to lack of knowledge.
@teriradichel

5. Build System as Gatekeeper
If changes have to go through gatekeeper…
Every change can be monitored.
@teriradichel

6. Build System as Security Training System
Automate security checks at deployment…
Train developers at the point of action.
@teriradichel

7. Leverage Event Driven Security Automation
Monitor for unwanted behavior…
Automatically respond.
@teriradichel

8. Separation of Duties by Design
If it takes multiple people to make a mistake…
Chances are someone will catch the problem.
@teriradichel

9. Immutable Infrastructure
If it cannot change once it has been deployed…
Malware cannot be installed after deployment.
@teriradichel

10. Eliminate Published CVEs
According to 2016 Verizon Data Breach Report:
Known CVEs cause majority of breaches.
@teriradichel

11. A Key is a Password
Keys: brute forced, lost, shared, stolen.
RBAC may be more easily managed.
@teriradichel

12. Use Key Hierarchies
Limit use of each key to subset of data.
If one key is stolen, limits the damage.
@teriradichel

13. Make It Easy For Developers
Automate common security related functions.
Simplify: authenticate, log, encrypt, deploy.
@teriradichel

14. Consider Process vs. Technical Controls
Think encrypting data in memory.
May be more feasible to secure via process.
@teriradichel

15. Think About Who Can Change Controls
If the control can be changed by lots of people…
It is not an effective control.
@teriradichel

16. Understand Reconnaissance
Network scans look for vulnerabilities to attack.
Secure all endpoints.
@teriradichel

17. The Benefit of Network Security
A kernel mode root kit makes machines lie.
The network doesn’t lie.
@teriradichel

18. Most Developers != Network Professionals
Implementing is not the same as securing.
One hole in the fence enables intrusion.
@teriradichel

19. Secure Your Logs
Write once, read only, replicated.
Ensure logs are not missing or deceiving.
@teriradichel

20. Thank you!
Teri Radichel | WatchGuard Technologies | @teriradichel