Abstract image of a woman sitting on books and studying on a laptop

DevOops Redux Ken Johnson Chris Gates - AppSec USA 2016

Chris Gates, profile picture
Chris Gates

The document presents insights from Chris Gates and Ken Johnson on security practices related to DevOps and applications, highlighting common flaws in tooling, employee monitoring, and proactive measures for web application security. It emphasizes hardening production environments in AWS, implementing multi-factor authentication, monitoring service usage, and responding to potential breaches through various AWS tools and services. Additionally, it offers recommendations for protecting employee workstations and securing GitHub repositories from accidental data leaks.

1 of 155
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
DevOops, Redux Chris Gates, Ken Johnson AppSec USA 2016
Background: KJ • I’m NOT Kevin Johnson
Background: KJ •I’m NOT Ken Bone
Background: KJ •I AM Ken Johnson •CTO of nVisium - @cktricky •Former US Navy •Topics I’ve talked about: – Rails Security (Railsgoat) – Building an AppSec Program – DevOops: Common Flaws in DevOps Tooling – Exploitation of Web Applications
Background: KJ • I run engineering (product) • I work for a security company • I have some concerns...same as you
Background: CG • Chris Gates, Sr. Security Engineer - Uber • Former Army • Topics I’ve talked about: – Breaking into Oracle, Windows, lots of stuff – Phishing – Low to Pwned – Purple Teaming – DevOops – Common Flaws in DevOps Tooling
Background: CG • Was a full time breaker • Now full-ish time fixer • Currently doing Blue Team stuff - <3 Python + REST APIs - Astonished at # of ppl who can’t Internet
About This Talk • Original talk DevOops was about breaking stuff • We were asked about “Proactive” measures in DevOps/Agile/CI-CD environments – Quick Story • We made a solution focused model based on “Common” architecture and needs
Before We Begin • Buckle up, lots of info coming your way • Q&A will be reserved for hallway discussions • Slides will have all the resources you need and will be available • Sections are broken up between Human, Host, and Infrastructure
Employee Intelligence (Human) Making it difficult (for employees) to allow attackers to walk into our environment
Monitoring External Services • Numerous ways for employees to accidently release data –Pastebin-like sites –Github •Gists •Code • Examples: –Slack tokens in github –AWS configs in .dotfiles back ups –Tokens in logs/dumps/snippets
Monitoring GitHub • How you could tackle the problem: –Use GitLab (internal) –Use gitolite (internal) –Use GitHub Enterprise (internal) –Use Phabricator (internal)
Monitoring GitHub • But you won’t, you’ll set up a private GitHub for you org like everyone else. – Now you need to monitor when people post your private stuff on their personal repo – It happens. A lot.
Monitoring GitHub • How you could tackle the problem: –Have employees join the your GitHub organization –Regularly crawl the list of members –Check out all their repos –Run regex against all files looking for known badness
Monitoring GitHub • Gitrob –https://github.com/michenriksen/gitrob
Monitoring GitHub • Gitrob
Monitoring GitHub
Monitoring GitHub
AWS Access Keys Example
AWS Access Keys Example
AWS Access Keys Example
Monitoring Pastebin* • Pastebin* –https://github.com/jordan-wright/dumpmon –https://github.com/xme/pastemon –https://github.com/cvandeplas/pystemon
Monitoring Goals • DumpMon https://github.com/jordan-wright/dumpmon
Monitoring Goals • For Pay Services
Monitoring Goals • For Pay Services
Monitoring Goals •For Pay Services - https://gitmonitor.com/
Monitoring Goals GitMonitor - Some options they provide
Workstation Protection (Host) Protecting and monitoring employees on their development workstations (and servers too)
Host Protections Developer Laptop Hardening • osquery (OS X/Linux) • Doorman • BlockBlock • Little Snitch • CarbonBlack / Sysmon • Splunk • Simian
Host Protections • osquery (https://osquery.io/) • “osquery is an operating system instrumentation framework for OS X, Linux, and FreeBSD. The tools make low-level operating system analytics and monitoring both performant and intuitive.” • “osquery exposes an operating system as a high-performance relational database. This allows you to write SQL queries to explore operating system data. With osquery, SQL tables represent abstract concepts such as running processes, loaded kernel modules, open network connections, browser plugins, hardware events or file hashes.”
Host Protections osquery • Adhoc • Scheduled • Schedule query • Collect logs • Review change • File Integrity Monitoring • Yara rules • Query packs
Host Protections osquery
Host Protections osquery
Host Protections • Doorman (https://github.com/mwielgoszewski/doorman) • “Doorman is an osquery fleet manager that allows administrators to remotely manage the osquery configurations retrieved by nodes.”
Host Protections
Host Protections • BlockBlock (https://objective-see.com/products/blockblock.html) • Kernel hook to identify any time software wants to persist • Prompt to allow or deny • “The kernel extension tracks process creations, which are consumed by the daemon, which also monitors various persistence locations to detect any new items. Specifically the daemon (currently) watches for new kexts, launch daemon & agents, and new login items via the fsevents device (/dev/fsevents).”
Host Protections
Host Protections • Little Snitch (https://www.obdev.at/products/littlesnitch/index.html) • Host based firewall • Prompt to allow or deny and for how long • “Little Snitch intercepts these unwanted connection attempts, and lets you decide how to proceed.”
Host Protections
Host Protections • CarbonBlack (https://www.carbonblack.com/) • Host based agent • Monitor process create, writes, registry queries, net connections • Create rules/watchlist for known bad behavior –Mimikatz-->company_name:*gentilkiwi* –FileVault Encryption Disabled -->process_name:fdesetup cmdline:disable –Unsigned JAR exec-->process_name:*.jar digsig_result: (digsig_result:"Unsigned") –OSX dump user hashes-->process_name:dscl cmdline:ShadowHashData
Host Protections
Host Protections
Host Protections • Sysmon • https://www.root9b.com/sites/default/files/whitepapers/R9B_blog_005_white paper_01.pdf • https://jon.glass/tag/sysinternals/ • http://www.darkoperator.com/blog/2014/8/8/sysinternals-sysmon • https://www.bsk-consulting.de/2015/03/21/detect-system-file-manipulations- with-sysinternals-sysmon/ • https://www.firemon.com/enhance-windows-anomaly-detection-sysmon/
Host Protections • Splunk
Host Protections
Host Protections • ELK
Host Protections • ELK
Host Protections OSX Patch Management - Simian • “Simian is an enterprise-class Mac OS X software deployment solution.” • Allows you to push munki updates • Free / OSS • Runs on google cloud • Project: https://github.com/google/simian
Host Protections Why do we bring this up? • Some people aren’t aware you can perform free OSX patch management • There are a lot of OSX developer shops without an “enterprise budget” • Patch management is a no-brainer and security 101
Host Protections https://github.com/google/simian
Host Protections Simian Consists of 2 parts: • Client – Private and Public SSL Keys used to authenticate – Configuration unique per OSX client • Web Application/Server – Runs on Google Cloud – Keep in mind its free but… not for long (eventually costs a little for storage) Takes about a week to learn and get setup
Host Protections Web Application used to Manage Updates
Host Protections Client - DMG File
Host Protections Simian Recap: • Learning curve is moderately difficult IMO • Free-ish (eventually storage costs but still very minimal) • Useful for patch updates and monitoring clients systems for low disk space, uptime, etc.
Production Protection (Infra) Protecting and monitoring production environments (AWS)
My AWS Goals • Harden – Make it difficult to reach your AWS environment • Monitor – If your AWS environment is breached, you need to know and alert yourselves • Restore – Have the ability to reconstruct data/configs after a “hack”
AWS’s Plan • Took the AWS Security Fundamentals Course and… – Fortunately, our strategy lines up with AWS recommendations – You are responsible for leveraging the tools AWS provides (financially) – Your configuration… that is on you – https://aws.amazon.com/training/course-descriptions/security- fundamentals/
AWS Hardening Basics Making it difficult (for attackers) to reach our environment
Hardening Checklist 1. Don’t Use The Root Account! 2. Disable Access Keys for Root Account 3. Multi-Factor Authentication 4. API + MFA 5. Strong Password Policy
Don’t Use Root Account • Every AWS env has a root account, only necessary to use for very specific circumstances • When these circumstances arise, notify your team that the account will be used • We will discuss why this is important when we talk about CloudWatch metrics
Disable/Delete Root Account Access Keys • Just delete them if they exist – Disable the access keys in the event you are unable to delete them completely for some reason • Make sure your admins have a (verbal/written) policy that states “we don’t create access keys for the root account”
MFA • If credentials are stolen or guessed, we want a second layer of protection • You can use apps or hardware to do this – Google Authenticator (Apps) – Gemalto (Hardware) • Find the full list of MFA devices here: https://aws.amazon.com/iam/details/mfa/ • This is so ridiculously easy to do, everyone should do it
MFA See the published slide deck for step by step instructions
MFA • At this point, it's worth mentioning that non- administrators or those without IAM privileges cannot enable MFA on their own account • Why is this a problem? Well, they need to be able to enable MFA on their own device… not the administrator’s • Fortunately, we have a solution!
MFA
MFA • Okay so that wasn’t the easiest to read, so here is the link: http://docs.aws.amazon.com/IAM/latest/UserGuide/id_c redentials_delegate-permissions_examples.html#creds- policies-mfa-console • Basically this IAM policy allows a user to manage their *OWN* MFA device
MFA (for Root Account) • Need a shared MFA for root? TOTP! • Recommend using something like 1password for teams, can share the TOTP code: https://support.1password.com/guides/mac/totp.html https://www.youtube.com/watch?v=eZyb-ArMK9g
API + MFA • You have the ability to place a restriction where resources can only be interacted with if the user has authenticated with MFA • This helps prevent (ab)use should someone steal access keys or credentials
API + MFA • This entry enforces MFA for Web/API • Do this for Admin & Power-User groups at a minimum
API + MFA • Truth be told, doing this can be painful at first • Things that used to work, might not (via the API) • Fortunately, we have some answers for you • Firstly, let’s discuss STS or SecurityToken Service
API + MFA • Leverage STS in order to interact with the AWS API should this MFA restriction be placed on resources (and it should ☺ ) • Example of using STS: https://gist.github.com/cktricky/127be4e431563a986f0f
API + MFA Output of script
API + MFA Use the creds to leverage tools like ec2-api-tools (-O <access key id>–W <secret> and –T <session token>)
API + MFA And in case you don’t like Ruby… https://github.com/jimbrowne/aws-sts-helpers
API + MFA • ElasticBeanstalk does not work with STS. Le Terrible. • However, there is a workaround, use CodePipeline • Very simple process to setup but only works with: – GitHub – AWS CodeCommit – Amazon S3
Password Policy • Password policies are important because historically people do not choose complex passwords • MFA should help, but we’re talking about a layered approach • Again, making our AWS environment harder to reach
Example Password Policy
Hardening Recap • Make credentials hard to guess • If guessed or stolen, we still have MFA • Remember MFA only protects against the web and NOT the API… unless you change your policies and use STS • Root account is King, protect your King
Hardening Recap • Things we did not (and won’t discuss) – S3 bucket policies – Security Group configurations – SSH Key Management – Encrypting Data (Volumes, S3 buckets) • Trusted Advisor – Use it, because it catches a lot of “low hanging fruit” style issues
Hardening Recap • Links to resources that discuss the items we’re not covering: – https://d0.awsstatic.com/whitepapers/compliance/AWS_Auditing_Securi ty_Checklist.pdf – http://aws-de-media.s3.amazonaws.com/images/Produktblaetter/AWS- Security-Check-List_eng.pdf – http://www.slideshare.net/AmazonWebServices/masterclass-advanced- security-best-practices • Frankly you can’t throw a rock without hitting some basic info regarding AWS Security Checklists
AWS Monitoring Detecting malicious activity
AWS Monitoring • Assuming hardening (prevention) has failed, how would we know? • Luckily, AWS provides several services which alert to anomalies • We will walk through examples of using these services, but ultimately decide what is right for you • Fair warning, some of these services will provide a lot of noise
AWS Monitoring 4 important services: • CloudTrail – Logs • SNS – Notifications • Config – Alerts for modifications & noncompliance • CloudWatch – Alerts for specific types of behavior
AWS Monitoring
AWS Monitoring
AWS CloudTrail
AWS Monitoring (CloudTrail) • CloudTrail is primarily used for log collection • Other services like CloudWatch, for example, use those logs to filter relevant data
AWS Monitoring (CloudTrail) Pretty easy, first turn it on..
AWS Monitoring (CloudTrail) Configure the log group
AWS Monitoring (CloudTrail) Allow the creation of an IAM role by CloudTrail
AWS Monitoring (CloudTrail) • At this point you have cloudtrail enabled • Next step, BEFORE moving to CloudWatch or Config, is configuring SNS topics
AWS SNS
AWS Monitoring (SNS) • Fantastic offering, <3 it – Examples of ways to be notified by SNS • SMS • Email • JSON Post to your Application’s API endpoint
AWS Monitoring (SNS) • Receive SMS/Email/Slack notifications for important events • ^ This is so you get immediate notifications • You can have multiple subscribers, I’d suggest you use that functionality • Basic gist? Receive immediate updates for things you want to see… immediately ☺
AWS Monitoring (SNS) Create a topic
AWS Monitoring (SNS) Create Subscription
AWS Monitoring (SNS) Create SMS (or whatever, but in this case, SMS)
AWS Monitoring (SNS) Example of creating email subscription… bottom line you can have multiple ways of notifying people
AWS Config
AWS Monitoring (Config) • Config: – AWS resource inventory, configuration history, and configuration change notifications – Can either design custom Config rules or use managed (pre-packaged) AWS Config rules – Discovery -Change Management – Compliance -Incident Response
AWS Monitoring (Config) • Pre-packaged “Managed” AWS Rules – CLOUD_TRAIL_ENABLED – EIP_ATTACHED – ENCRYPTED_VOLUMES – INCOMING_SSH_DISABLED – INSTANCES_IN_VPC – REQUIRED_TAGS – RESTRICTED_INCOMING_TRAFFIC https://docs.aws.amazon.com/config/latest/developerguide/evaluate-config_use-managed-rules.html
AWS Monitoring (Config) • Examples of things you can have alerts set for: – Change in Firewall (Security Group) ports – Changes in VPC – Any change… at all
AWS Monitoring (Config) Go to the Config service and choose resources to track
AWS Monitoring (Config) Or choose to track everything
AWS Monitoring (Config) Create a bucket, create an SNS topic (…we’ll discuss next)
AWS Monitoring (Config) Allow the role to be created and you’re all set!
AWS CloudWatch
AWS Monitoring (CloudWatch) • We can be very particular here about what it is we want to see • Some very interesting things you can monitor • Some examples: – Billing Alerts (Important for detection of abuse or mistakes) – Track Root Account Usage – Failed login attempts
Billing Alarm
AWS Monitoring (CloudWatch - Billing) • Used to prevent abuse or mistakes from costing your organization money • Analyze and approximate your monthly spend • Configure via CloudWatch • Use SNS for instantaneous alerting
AWS Monitoring (CloudWatch - Billing) Navigate to billing & cost management; enable billing alerts
AWS Monitoring (CloudWatch - Billing) Create an SNS topic
AWS Monitoring (CloudWatch - Billing) Subscribe to Topic
AWS Monitoring (CloudWatch - Billing) Navigate to CloudWatch -> Metrics -> Billing
AWS Monitoring (CloudWatch - Billing) Choose USD/Estimate Charges -> Create Alarm
AWS Monitoring (CloudWatch - Billing) Set price point, SNS topic, and create alarm
AWS Monitoring (CloudWatch - Billing) Exact steps to enable can be found here: http://docs.aws.amazon.com/awsaccountbilling/latest/about v2/free-tier-alarms.html
Root Login Alarm
AWS Monitoring (CloudWatch – Root Login) • Remember how I said don’t use the Root account routinely? • BUT… if this account is used, you should know about it • This is the reason you’ll want to notify others (who receive SNS alerts) of the fact you are about to use the account
AWS Monitoring (CloudWatch – Root Login) Choose log group, create metric
AWS Monitoring (CloudWatch – Root Login) Define Logs Metric Filter
AWS Monitoring (CloudWatch – Root Login) Assign/Create Filter
AWS Monitoring (CloudWatch – Root Login) Click “Create Alarm”
AWS Monitoring (CloudWatch – Root Login) Define Alarm and you’re good…
AWS Monitoring (CloudWatch – Root Login) Exact steps (with pics) exist here: https://blogs.aws.amazon.com/security/post/Tx3PSPQSN8 374D/How-to-Receive-Notifications-When-Your-AWS- Account-s-Root-Access-Keys-Are-Used
Failed Login Alarm
AWS Monitoring (CloudWatch – Failed Logins) • In the event someone is trying to break in, let’s alert ourselves to this! • Failed logins typically suggest either someone forgot their password or… someone is trying to guess yours
AWS Monitoring (CloudWatch – Failed Logins) • In the interest of time… the steps are pretty much the same as the root login alarm • The Regex Filter however, is different
AWS Monitoring (CloudWatch – Failed Logins) Relevant filter pattern
AWS Monitoring (CloudWatch – Failed Logins) • Exact steps exist here: http://docs.aws.amazon.com/awscloudtrail/la test/userguide/cloudwatch-alarms-for- cloudtrail.html#cloudwatch-alarms-for- cloudtrail-signin
Unauthorized Activity Alarm
AWS Monitoring (Unauthorized Activity) • Remember the aws-interrogate tool? • This alarm is the antidote • Alerts us when someone is trying to access something in AWS, and does not have permissions
AWS Monitoring (Unauthorized Activity) • Again, in the interest of time, steps are same as root login • Regex is of course, different
AWS Monitoring (Unauthorized Activity) Set up regular expression
AWS Monitoring (Unauthorized Activity) What happens when we run interrogate
AWS Monitoring (Unauthorized Activity) The result of doing that is a nice nifty email to the engineering & security team
AWS Monitoring (CloudWatch) – Filter Patterns • If you’d like to create your own custom filter patterns, here is a resource for that: http://docs.aws.amazon.com/AmazonCloudWatch/latest/De veloperGuide/FilterAndPatternSyntax.html
AWS + Splunk
AWS + Splunk • Splunk is a pretty great resource for monitoring activity – Two separate plugins: • Splunk App for AWS – https://splunkbase.splunk.com/app/1274/ • Splunk Add-On – https://splunkbase.splunk.com/app/1876/
AWS + Splunk • Examples of things you can view: – Billing – Topology – Usage – IAM Activity – SSH Key Pair Activity – User Activity – Network ACL(s) – VPC Activity – and a lot more…
AWS + Splunk
AWS + Splunk
AWS + Splunk
AWS + Splunk • Splunk will need an AWS account in order to retrieve data • Create account(s) for Splunk, grab the necessary permission policy from here: http://docs.splunk.com/Documentation/AddOns/released/A WS/ConfigureAWSpermissions
AWS + Splunk Configure AWS App for Splunk, add account(s), configure each input accordingly:
AWS + Splunk •To view things like IAM Activity… –Subscribe to a cloudtrail log via SNS –Utilize SQS and subscribe SQS to an SNS Topic
Monitoring Recap • Alert yourself when things change • This will get noisy, find a way to filter that which is important – If it’s a high risk event, send an SMS/Slack/Email blast • At a minimum, alert yourself when odd things occur… like: – Billing increases past your normal spend – When somebody authenticates as Root – When someone has a login failure
Monitoring Recap • Interesting Quora thread: – https://www.quora.com/My-AWS-account-was-hacked-and-I-have-a-50-000-bill-how-can-I- reduce-the-amount-I-need-to-pay • Highlights from the article: – AWS has “a review board of sorts” to determine if you should be refunded – Bots are scouring GitHub searching for exposed access keys – One of the more AWS-seasoned responders mentioned doing part of what we discussed here today to avoid it – A decent number of the people posting on this thread said “Yes, happened to me too”
AWS Restoration & Recovery Plan to fail, just don’t fail to plan
AWS Restoration & Recovery • Do not USE AWS TO BACKUP YOUR AWS • Offsite backups (meaning, off AWS site) • Common things to back-up: – Databases/ Snapshots – S3 Buckets – EBS Volumes – CloudFormation Templates
AWS Restoration & Recovery • Resources: – http://stackoverflow.com/questions/17087542/backup- solutions-for-aws-ec2-instances – https://github.com/Scalr/installer-ng – http://www.n2ws.com/blog/3-ways-ec2-windows- backup-and-recovery.html
AWS Incident Response Plan to fail, just don’t fail to plan
AWS Incident Response • Could be its own talk • Scout 2 -- https://github.com/nccgroup/Scout2 •Andrew Krug & Alex McCormack – Hardening AWS Environments and Automating Incident Response – https://www.youtube.com/watch?v=cmEUxxYFjK8
Contact Chris Gates Twitter: @carnal0wnage Blog: https://carnal0wnage.attackresearch.com Ken Johnson Twitter: @cktricky

More Related Content

PDF
Containerizing your Security Operations Center
Jimmy Mesta
 
PDF
Lares from LOW to PWNED
Chris Gates
 
PDF
DevOops & How I hacked you DevopsDays DC June 2015
Chris Gates
 
PPTX
DevOOPS: Attacks and Defenses for DevOps Toolchains
Chris Gates
 
PDF
Big Bang Theory: The Evolution of Pentesting High Security Enviroments IT Def...
Chris Gates
 
PDF
Appsec DC - wXf -2010
Chris Gates
 
PPTX
AWS Survival Guide
Ken Johnson
 
PDF
Exploiting XPC in AntiVirus
Csaba Fitzl
 
Containerizing your Security Operations Center
Jimmy Mesta
 
Lares from LOW to PWNED
Chris Gates
 
DevOops & How I hacked you DevopsDays DC June 2015
Chris Gates
 
DevOOPS: Attacks and Defenses for DevOps Toolchains
Chris Gates
 
Big Bang Theory: The Evolution of Pentesting High Security Enviroments IT Def...
Chris Gates
 
Appsec DC - wXf -2010
Chris Gates
 
AWS Survival Guide
Ken Johnson
 
Exploiting XPC in AntiVirus
Csaba Fitzl
 

What's hot(20)

PPTX
Devoops: DoJ Annual Cybersecurity Training Symposium Edition 2015
Chris Gates
 
PDF
LasCon 2014 DevOoops
Chris Gates
 
PDF
DevSecCon London 2017: Hands-on secure software development from design to de...
DevSecCon
 
PDF
Open Canary - novahackers
Chris Gates
 
PDF
Mitigating Exploits Using Apple's Endpoint Security
Csaba Fitzl
 
PDF
DevSecCon Singapore 2019: Workshop - Burp extension writing workshop
DevSecCon
 
PDF
From 0 to 0xdeadbeef - security mistakes that will haunt your startup
Diogo Mónica
 
PDF
Security in serverless world (get.net)
Yan Cui
 
PDF
OWASP SF - Reviewing Modern JavaScript Applications
Lewis Ardern
 
PDF
DevSecCon London 2017 - MacOS security, hardening and forensics 101 by Ben Hu...
DevSecCon
 
PPTX
InSpec Workshop DevSecCon 2017
Mandi Walls
 
PDF
Csaba fitzl - Mount(ain) of Bugs
Csaba Fitzl
 
PDF
20+ ways to bypass your mac os privacy mechanisms
Csaba Fitzl
 
PDF
Tw noche geek quito webappsec
Thoughtworks
 
PDF
[Wroclaw #7] Why So Serial?
OWASP
 
PPTX
Web & Cloud Security in the real world
Madhu Akula
 
PDF
Attacking AWS: the full cyber kill chain
SecuRing
 
PPTX
Security Testing with Zap
Soluto
 
PDF
My tryst with sourcecode review
Anant Shrivastava
 
PDF
You wouldn't build a toast, would you?
Yan Cui
 
Devoops: DoJ Annual Cybersecurity Training Symposium Edition 2015
Chris Gates
 
LasCon 2014 DevOoops
Chris Gates
 
DevSecCon London 2017: Hands-on secure software development from design to de...
DevSecCon
 
Open Canary - novahackers
Chris Gates
 
Mitigating Exploits Using Apple's Endpoint Security
Csaba Fitzl
 
DevSecCon Singapore 2019: Workshop - Burp extension writing workshop
DevSecCon
 
From 0 to 0xdeadbeef - security mistakes that will haunt your startup
Diogo Mónica
 
Security in serverless world (get.net)
Yan Cui
 
OWASP SF - Reviewing Modern JavaScript Applications
Lewis Ardern
 
DevSecCon London 2017 - MacOS security, hardening and forensics 101 by Ben Hu...
DevSecCon
 
InSpec Workshop DevSecCon 2017
Mandi Walls
 
Csaba fitzl - Mount(ain) of Bugs
Csaba Fitzl
 
20+ ways to bypass your mac os privacy mechanisms
Csaba Fitzl
 
Tw noche geek quito webappsec
Thoughtworks
 
[Wroclaw #7] Why So Serial?
OWASP
 
Web & Cloud Security in the real world
Madhu Akula
 
Attacking AWS: the full cyber kill chain
SecuRing
 
Security Testing with Zap
Soluto
 
My tryst with sourcecode review
Anant Shrivastava
 
You wouldn't build a toast, would you?
Yan Cui
 

Viewers also liked(12)

PDF
Going Purple : From full time breaker to part time fixer: 1 year later
Chris Gates
 
PPTX
Running Splunk on AWS
Alan Williams
 
PPTX
Travis Perkins: Building a 'Lean SOC' over 'Legacy SOC'
Splunk
 
PDF
hackcon2013-Dirty Little Secrets They Didn't Teach You In Pentesting Class v2
Chris Gates
 
PDF
Windows attacks - AT is the new black
Chris Gates
 
PDF
Top Security Challenges Facing Credit Unions Today
Chris Gates
 
PPTX
Dirty Little Secrets They Didn't Teach You In Pentest Class v2
Chris Gates
 
PDF
MSF Auxiliary Modules
Chris Gates
 
PDF
Building a Successful Internal Adversarial Simulation Team - Chris Gates & Ch...
Chris Gates
 
PPTX
Home Arcade setup (NoVA Hackers)
Chris Gates
 
PDF
ColdFusion for Penetration Testers
Chris Gates
 
PDF
Purple Teaming the Cyber Kill Chain: Practical Exercises for Everyone Sector...
Chris Gates
 
Going Purple : From full time breaker to part time fixer: 1 year later
Chris Gates
 
Running Splunk on AWS
Alan Williams
 
Travis Perkins: Building a 'Lean SOC' over 'Legacy SOC'
Splunk
 
hackcon2013-Dirty Little Secrets They Didn't Teach You In Pentesting Class v2
Chris Gates
 
Windows attacks - AT is the new black
Chris Gates
 
Top Security Challenges Facing Credit Unions Today
Chris Gates
 
Dirty Little Secrets They Didn't Teach You In Pentest Class v2
Chris Gates
 
MSF Auxiliary Modules
Chris Gates
 
Building a Successful Internal Adversarial Simulation Team - Chris Gates & Ch...
Chris Gates
 
Home Arcade setup (NoVA Hackers)
Chris Gates
 
ColdFusion for Penetration Testers
Chris Gates
 
Purple Teaming the Cyber Kill Chain: Practical Exercises for Everyone Sector...
Chris Gates
 

Similar to DevOops Redux Ken Johnson Chris Gates - AppSec USA 2016(20)

PPTX
LASCON 2016 - It's 10PM Do You Know Where Your Access Keys Are?
Ken Johnson
 
PPTX
It's 10pm, Do You Know Where Your Access Keys Are?
Ken Johnson
 
PPTX
RVASec AWS Survival Guide 2.0
Ken Johnson
 
PPTX
Blackhat 2014 Conference and Defcon 22
dandb-technology
 
PPTX
Threat Modeling a Batch Job System - AWS Security Community Day
2nd Sight Lab
 
PPT
Aws training in bangalore
apponix123
 
PPTX
Ple18 web-security-david-busby
David Busby, CISSP
 
PPTX
"Cryptography, Data Protection, and Security For Start-Ups In The Post Snowde...
HackIT Ukraine
 
PDF
Introducing DevSecOps by Madhu Akula - Software Security Bangalore - May 27 2...
SecureSoftwareDevOn SecureSoftwareDevOn
 
PPTX
How to implement DevSecOps on AWS for startups
Aleksandr Maklakov
 
PPTX
In the Cloud, nobody can hear you scream: AWS Cloud Security for DevOps
Garth Boyd
 
PPTX
Blue Teaming on a Budget of Zero
Kyle Bubp
 
PPTX
Move Fast and Fix Things
Dan Kaminsky
 
PDF
DevOpsDays - DevOps: Security 干我何事？
smalltown
 
PPTX
Cloud Security or: How I Learned to Stop Worrying & Love the Cloud
MarkAnnati
 
PPTX
Securing Open Source Databases
Gazzang
 
PDF
Security As Code Devsecops Patterns With Aws 1st Bk Sarthak Das
moyoyavilek
 
PDF
Security as Code: DevSecOps Patterns with AWS Bk Sarthak Das
bauenhegbom
 
PDF
XP Days 2019: First secret delivery for modern cloud-native applications
Vlad Fedosov
 
PPTX
Sec285 final presentation_joshua_brown
JoshuaBrown233
 
LASCON 2016 - It's 10PM Do You Know Where Your Access Keys Are?
Ken Johnson
 
It's 10pm, Do You Know Where Your Access Keys Are?
Ken Johnson
 
RVASec AWS Survival Guide 2.0
Ken Johnson
 
Blackhat 2014 Conference and Defcon 22
dandb-technology
 
Threat Modeling a Batch Job System - AWS Security Community Day
2nd Sight Lab
 
Aws training in bangalore
apponix123
 
Ple18 web-security-david-busby
David Busby, CISSP
 
"Cryptography, Data Protection, and Security For Start-Ups In The Post Snowde...
HackIT Ukraine
 
Introducing DevSecOps by Madhu Akula - Software Security Bangalore - May 27 2...
SecureSoftwareDevOn SecureSoftwareDevOn
 
How to implement DevSecOps on AWS for startups
Aleksandr Maklakov
 
In the Cloud, nobody can hear you scream: AWS Cloud Security for DevOps
Garth Boyd
 
Blue Teaming on a Budget of Zero
Kyle Bubp
 
Move Fast and Fix Things
Dan Kaminsky
 
DevOpsDays - DevOps: Security 干我何事？
smalltown
 
Cloud Security or: How I Learned to Stop Worrying & Love the Cloud
MarkAnnati
 
Securing Open Source Databases
Gazzang
 
Security As Code Devsecops Patterns With Aws 1st Bk Sarthak Das
moyoyavilek
 
Security as Code: DevSecOps Patterns with AWS Bk Sarthak Das
bauenhegbom
 
XP Days 2019: First secret delivery for modern cloud-native applications
Vlad Fedosov
 
Sec285 final presentation_joshua_brown
JoshuaBrown233
 

More from Chris Gates(12)

PDF
Reiki 101 - Defcon29 MHHV
Chris Gates
 
PDF
WeirdAAL (Awesome Attack Library) CactusCon 2018
Chris Gates
 
PPTX
WeirdAAL (AWS Attack Library)
Chris Gates
 
PDF
PENETRATION TESTING FROM A HOT TUB TIME MACHINE
Chris Gates
 
PDF
Adversarial Simulation Nickerson/Gates Wild West Hacking Fest Oct 2017
Chris Gates
 
PDF
Open Source Information Gathering Brucon Edition
Chris Gates
 
PDF
The Dirty Little Secrets They Didn’t Teach You In Pentesting Class
Chris Gates
 
PDF
Big Bang Theory: The Evolution of Pentesting High Security Environments
Chris Gates
 
PDF
SOURCE Boston --Attacking Oracle Web Applications with Metasploit & wXf
Chris Gates
 
PDF
Hacking Oracle Web Applications With Metasploit
Chris Gates
 
PDF
Attacking Oracle with the Metasploit Framework
Chris Gates
 
PDF
Client-Side Penetration Testing Presentation
Chris Gates
 
Reiki 101 - Defcon29 MHHV
Chris Gates
 
WeirdAAL (Awesome Attack Library) CactusCon 2018
Chris Gates
 
WeirdAAL (AWS Attack Library)
Chris Gates
 
PENETRATION TESTING FROM A HOT TUB TIME MACHINE
Chris Gates
 
Adversarial Simulation Nickerson/Gates Wild West Hacking Fest Oct 2017
Chris Gates
 
Open Source Information Gathering Brucon Edition
Chris Gates
 
The Dirty Little Secrets They Didn’t Teach You In Pentesting Class
Chris Gates
 
Big Bang Theory: The Evolution of Pentesting High Security Environments
Chris Gates
 
SOURCE Boston --Attacking Oracle Web Applications with Metasploit & wXf
Chris Gates
 
Hacking Oracle Web Applications With Metasploit
Chris Gates
 
Attacking Oracle with the Metasploit Framework
Chris Gates
 
Client-Side Penetration Testing Presentation
Chris Gates
 

Recently uploaded(20)

PPTX
LiFi Technology an effective way of Communication
Juliet Thessalonica
 
PPTX
MAIN PARTS OF COMPUTER- COMPUTER SYSTEM.pptx
rachelannpayumo2
 
PPTX
Hartpury电子版毕业证哈特伯瑞大学成绩单激光标100%复刻Hartpury学生证
斯文本科技大学学位证书快速办理【Q微号:1954 292 140】
 
PPT
SEMOGA BERMANFAAT MATERI DASAR KOMPUTER.ppt
BKMMASTIM
 
PDF
1.-WORLD-WIDE-WEB the internet evolution and slang
g54193694
 
PPTX
Git Presentation with diagram that show the main functionality
alfreale744677
 
PDF
karuna yoga vidya peetham school Unique Lineage.pdfTTC
KarunaYogaVidyaPeeth1
 
PPT
Expect The Impossiblesssssssssssssss.ppt
LAWRENCEJEREMYBRIONE
 
PPTX
Internet_Addiction_Presentation_2025.pptx
anilrajps17
 
PDF
B2B Marketing mba class material for study
um24025
 
PDF
Salesforce-Proxy-Statement-Supplement-May-2025.pdf
pgunzenhauser
 
PDF
Cybersecurity: Understanding Threats, Attacks, and Protective Measures in the...
Riwaz Mahat
 
PPTX
weathering-final for grade 12 students in any kind of school
KleivsonNeldridgeAsu
 
PPTX
materi minggu ke 5.ppt mata kuliah mobile
NikenPermata4
 
PPTX
Information and Network Security Introduction
smitgandhi0703
 
PDF
Role of Data & Analytics in Modern Shopify App Development.pdf
CartCoders
 
PDF
Associate Degree Programmers for Allama Iqbal University
jebewa6384
 
PPTX
DAT602-Database Design and Development-AT4).pptx
saxenautkarshus
 
PPTX
DAY 1 - Introduction to Git.pptxttttttttttttttttttttttttttttt
sanskritig1705
 
PPT
Debate Adjudication Semijjjjjjjjjjjjjjjjjjjjjjjjnar.ppt
mohammadhayat01
 
LiFi Technology an effective way of Communication
Juliet Thessalonica
 
MAIN PARTS OF COMPUTER- COMPUTER SYSTEM.pptx
rachelannpayumo2
 
Hartpury电子版毕业证哈特伯瑞大学成绩单激光标100%复刻Hartpury学生证
斯文本科技大学学位证书快速办理【Q微号:1954 292 140】
 
SEMOGA BERMANFAAT MATERI DASAR KOMPUTER.ppt
BKMMASTIM
 
1.-WORLD-WIDE-WEB the internet evolution and slang
g54193694
 
Git Presentation with diagram that show the main functionality
alfreale744677
 
karuna yoga vidya peetham school Unique Lineage.pdfTTC
KarunaYogaVidyaPeeth1
 
Expect The Impossiblesssssssssssssss.ppt
LAWRENCEJEREMYBRIONE
 
Internet_Addiction_Presentation_2025.pptx
anilrajps17
 
B2B Marketing mba class material for study
um24025
 
Salesforce-Proxy-Statement-Supplement-May-2025.pdf
pgunzenhauser
 
Cybersecurity: Understanding Threats, Attacks, and Protective Measures in the...
Riwaz Mahat
 
weathering-final for grade 12 students in any kind of school
KleivsonNeldridgeAsu
 
materi minggu ke 5.ppt mata kuliah mobile
NikenPermata4
 
Information and Network Security Introduction
smitgandhi0703
 
Role of Data & Analytics in Modern Shopify App Development.pdf
CartCoders
 
Associate Degree Programmers for Allama Iqbal University
jebewa6384
 
DAT602-Database Design and Development-AT4).pptx
saxenautkarshus
 
DAY 1 - Introduction to Git.pptxttttttttttttttttttttttttttttt
sanskritig1705
 
Debate Adjudication Semijjjjjjjjjjjjjjjjjjjjjjjjnar.ppt
mohammadhayat01
 

DevOops Redux Ken Johnson Chris Gates - AppSec USA 2016

  • 1.
    DevOops, Redux Chris Gates,Ken Johnson AppSec USA 2016
  • 2.
    Background: KJ • I’mNOT Kevin Johnson
  • 3.
  • 4.
    Background: KJ •I AMKen Johnson •CTO of nVisium - @cktricky •Former US Navy •Topics I’ve talked about: – Rails Security (Railsgoat) – Building an AppSec Program – DevOops: Common Flaws in DevOps Tooling – Exploitation of Web Applications
  • 5.
    Background: KJ • Irun engineering (product) • I work for a security company • I have some concerns...same as you
  • 6.
    Background: CG • ChrisGates, Sr. Security Engineer - Uber • Former Army • Topics I’ve talked about: – Breaking into Oracle, Windows, lots of stuff – Phishing – Low to Pwned – Purple Teaming – DevOops – Common Flaws in DevOps Tooling
  • 7.
    Background: CG • Wasa full time breaker • Now full-ish time fixer • Currently doing Blue Team stuff - <3 Python + REST APIs - Astonished at # of ppl who can’t Internet
  • 8.
    About This Talk •Original talk DevOops was about breaking stuff • We were asked about “Proactive” measures in DevOps/Agile/CI-CD environments – Quick Story • We made a solution focused model based on “Common” architecture and needs
  • 9.
    Before We Begin •Buckle up, lots of info coming your way • Q&A will be reserved for hallway discussions • Slides will have all the resources you need and will be available • Sections are broken up between Human, Host, and Infrastructure
  • 10.
    Employee Intelligence (Human) Making itdifficult (for employees) to allow attackers to walk into our environment
  • 11.
    Monitoring External Services •Numerous ways for employees to accidently release data –Pastebin-like sites –Github •Gists •Code • Examples: –Slack tokens in github –AWS configs in .dotfiles back ups –Tokens in logs/dumps/snippets
  • 12.
    Monitoring GitHub • Howyou could tackle the problem: –Use GitLab (internal) –Use gitolite (internal) –Use GitHub Enterprise (internal) –Use Phabricator (internal)
  • 13.
    Monitoring GitHub • Butyou won’t, you’ll set up a private GitHub for you org like everyone else. – Now you need to monitor when people post your private stuff on their personal repo – It happens. A lot.
  • 14.
    Monitoring GitHub • Howyou could tackle the problem: –Have employees join the your GitHub organization –Regularly crawl the list of members –Check out all their repos –Run regex against all files looking for known badness
  • 15.
  • 16.
  • 17.
  • 18.
  • 19.
  • 20.
  • 21.
  • 22.
  • 23.
    Monitoring Goals • DumpMonhttps://github.com/jordan-wright/dumpmon
  • 24.
  • 25.
  • 26.
    Monitoring Goals •For PayServices - https://gitmonitor.com/
  • 27.
    Monitoring Goals GitMonitor -Some options they provide
  • 28.
    Workstation Protection (Host) Protecting andmonitoring employees on their development workstations (and servers too)
  • 29.
    Host Protections Developer LaptopHardening • osquery (OS X/Linux) • Doorman • BlockBlock • Little Snitch • CarbonBlack / Sysmon • Splunk • Simian
  • 30.
    Host Protections • osquery(https://osquery.io/) • “osquery is an operating system instrumentation framework for OS X, Linux, and FreeBSD. The tools make low-level operating system analytics and monitoring both performant and intuitive.” • “osquery exposes an operating system as a high-performance relational database. This allows you to write SQL queries to explore operating system data. With osquery, SQL tables represent abstract concepts such as running processes, loaded kernel modules, open network connections, browser plugins, hardware events or file hashes.”
  • 31.
    Host Protections osquery • Adhoc •Scheduled • Schedule query • Collect logs • Review change • File Integrity Monitoring • Yara rules • Query packs
  • 32.
  • 33.
  • 34.
    Host Protections • Doorman(https://github.com/mwielgoszewski/doorman) • “Doorman is an osquery fleet manager that allows administrators to remotely manage the osquery configurations retrieved by nodes.”
  • 35.
  • 36.
    Host Protections • BlockBlock(https://objective-see.com/products/blockblock.html) • Kernel hook to identify any time software wants to persist • Prompt to allow or deny • “The kernel extension tracks process creations, which are consumed by the daemon, which also monitors various persistence locations to detect any new items. Specifically the daemon (currently) watches for new kexts, launch daemon & agents, and new login items via the fsevents device (/dev/fsevents).”
  • 37.
  • 38.
    Host Protections • LittleSnitch (https://www.obdev.at/products/littlesnitch/index.html) • Host based firewall • Prompt to allow or deny and for how long • “Little Snitch intercepts these unwanted connection attempts, and lets you decide how to proceed.”
  • 39.
  • 40.
    Host Protections • CarbonBlack(https://www.carbonblack.com/) • Host based agent • Monitor process create, writes, registry queries, net connections • Create rules/watchlist for known bad behavior –Mimikatz-->company_name:*gentilkiwi* –FileVault Encryption Disabled -->process_name:fdesetup cmdline:disable –Unsigned JAR exec-->process_name:*.jar digsig_result: (digsig_result:"Unsigned") –OSX dump user hashes-->process_name:dscl cmdline:ShadowHashData
  • 41.
  • 42.
  • 43.
    Host Protections • Sysmon •https://www.root9b.com/sites/default/files/whitepapers/R9B_blog_005_white paper_01.pdf • https://jon.glass/tag/sysinternals/ • http://www.darkoperator.com/blog/2014/8/8/sysinternals-sysmon • https://www.bsk-consulting.de/2015/03/21/detect-system-file-manipulations- with-sysinternals-sysmon/ • https://www.firemon.com/enhance-windows-anomaly-detection-sysmon/
  • 44.
  • 45.
  • 46.
  • 47.
  • 48.
    Host Protections OSX PatchManagement - Simian • “Simian is an enterprise-class Mac OS X software deployment solution.” • Allows you to push munki updates • Free / OSS • Runs on google cloud • Project: https://github.com/google/simian
  • 49.
    Host Protections Why dowe bring this up? • Some people aren’t aware you can perform free OSX patch management • There are a lot of OSX developer shops without an “enterprise budget” • Patch management is a no-brainer and security 101
  • 50.
  • 51.
    Host Protections Simian Consistsof 2 parts: • Client – Private and Public SSL Keys used to authenticate – Configuration unique per OSX client • Web Application/Server – Runs on Google Cloud – Keep in mind its free but… not for long (eventually costs a little for storage) Takes about a week to learn and get setup
  • 52.
    Host Protections Web Applicationused to Manage Updates
  • 53.
  • 54.
    Host Protections Simian Recap: •Learning curve is moderately difficult IMO • Free-ish (eventually storage costs but still very minimal) • Useful for patch updates and monitoring clients systems for low disk space, uptime, etc.
  • 55.
    Production Protection (Infra) Protecting andmonitoring production environments (AWS)
  • 56.
    My AWS Goals •Harden – Make it difficult to reach your AWS environment • Monitor – If your AWS environment is breached, you need to know and alert yourselves • Restore – Have the ability to reconstruct data/configs after a “hack”
  • 57.
    AWS’s Plan • Tookthe AWS Security Fundamentals Course and… – Fortunately, our strategy lines up with AWS recommendations – You are responsible for leveraging the tools AWS provides (financially) – Your configuration… that is on you – https://aws.amazon.com/training/course-descriptions/security- fundamentals/
  • 58.
    AWS Hardening Basics Makingit difficult (for attackers) to reach our environment
  • 59.
    Hardening Checklist 1. Don’tUse The Root Account! 2. Disable Access Keys for Root Account 3. Multi-Factor Authentication 4. API + MFA 5. Strong Password Policy
  • 60.
    Don’t Use RootAccount • Every AWS env has a root account, only necessary to use for very specific circumstances • When these circumstances arise, notify your team that the account will be used • We will discuss why this is important when we talk about CloudWatch metrics
  • 61.
    Disable/Delete Root AccountAccess Keys • Just delete them if they exist – Disable the access keys in the event you are unable to delete them completely for some reason • Make sure your admins have a (verbal/written) policy that states “we don’t create access keys for the root account”
  • 62.
    MFA • If credentialsare stolen or guessed, we want a second layer of protection • You can use apps or hardware to do this – Google Authenticator (Apps) – Gemalto (Hardware) • Find the full list of MFA devices here: https://aws.amazon.com/iam/details/mfa/ • This is so ridiculously easy to do, everyone should do it
  • 63.
    MFA See the publishedslide deck for step by step instructions
  • 64.
    MFA • At thispoint, it's worth mentioning that non- administrators or those without IAM privileges cannot enable MFA on their own account • Why is this a problem? Well, they need to be able to enable MFA on their own device… not the administrator’s • Fortunately, we have a solution!
  • 65.
  • 66.
    MFA • Okay sothat wasn’t the easiest to read, so here is the link: http://docs.aws.amazon.com/IAM/latest/UserGuide/id_c redentials_delegate-permissions_examples.html#creds- policies-mfa-console • Basically this IAM policy allows a user to manage their *OWN* MFA device
  • 67.
    MFA (for RootAccount) • Need a shared MFA for root? TOTP! • Recommend using something like 1password for teams, can share the TOTP code: https://support.1password.com/guides/mac/totp.html https://www.youtube.com/watch?v=eZyb-ArMK9g
  • 68.
    API + MFA •You have the ability to place a restriction where resources can only be interacted with if the user has authenticated with MFA • This helps prevent (ab)use should someone steal access keys or credentials
  • 69.
    API + MFA •This entry enforces MFA for Web/API • Do this for Admin & Power-User groups at a minimum
  • 70.
    API + MFA •Truth be told, doing this can be painful at first • Things that used to work, might not (via the API) • Fortunately, we have some answers for you • Firstly, let’s discuss STS or SecurityToken Service
  • 71.
    API + MFA •Leverage STS in order to interact with the AWS API should this MFA restriction be placed on resources (and it should ☺ ) • Example of using STS: https://gist.github.com/cktricky/127be4e431563a986f0f
  • 72.
  • 73.
    API + MFA Usethe creds to leverage tools like ec2-api-tools (-O <access key id>–W <secret> and –T <session token>)
  • 74.
    API + MFA Andin case you don’t like Ruby… https://github.com/jimbrowne/aws-sts-helpers
  • 75.
    API + MFA •ElasticBeanstalk does not work with STS. Le Terrible. • However, there is a workaround, use CodePipeline • Very simple process to setup but only works with: – GitHub – AWS CodeCommit – Amazon S3
  • 76.
    Password Policy • Passwordpolicies are important because historically people do not choose complex passwords • MFA should help, but we’re talking about a layered approach • Again, making our AWS environment harder to reach
  • 77.
  • 78.
    Hardening Recap • Makecredentials hard to guess • If guessed or stolen, we still have MFA • Remember MFA only protects against the web and NOT the API… unless you change your policies and use STS • Root account is King, protect your King
  • 79.
    Hardening Recap • Thingswe did not (and won’t discuss) – S3 bucket policies – Security Group configurations – SSH Key Management – Encrypting Data (Volumes, S3 buckets) • Trusted Advisor – Use it, because it catches a lot of “low hanging fruit” style issues
  • 80.
    Hardening Recap • Linksto resources that discuss the items we’re not covering: – https://d0.awsstatic.com/whitepapers/compliance/AWS_Auditing_Securi ty_Checklist.pdf – http://aws-de-media.s3.amazonaws.com/images/Produktblaetter/AWS- Security-Check-List_eng.pdf – http://www.slideshare.net/AmazonWebServices/masterclass-advanced- security-best-practices • Frankly you can’t throw a rock without hitting some basic info regarding AWS Security Checklists
  • 81.
  • 82.
    AWS Monitoring • Assuminghardening (prevention) has failed, how would we know? • Luckily, AWS provides several services which alert to anomalies • We will walk through examples of using these services, but ultimately decide what is right for you • Fair warning, some of these services will provide a lot of noise
  • 83.
    AWS Monitoring 4 importantservices: • CloudTrail – Logs • SNS – Notifications • Config – Alerts for modifications & noncompliance • CloudWatch – Alerts for specific types of behavior
  • 84.
  • 85.
  • 86.
  • 87.
    AWS Monitoring (CloudTrail) •CloudTrail is primarily used for log collection • Other services like CloudWatch, for example, use those logs to filter relevant data
  • 88.
    AWS Monitoring (CloudTrail) Prettyeasy, first turn it on..
  • 89.
  • 90.
    AWS Monitoring (CloudTrail) Allowthe creation of an IAM role by CloudTrail
  • 91.
    AWS Monitoring (CloudTrail) •At this point you have cloudtrail enabled • Next step, BEFORE moving to CloudWatch or Config, is configuring SNS topics
  • 92.
  • 93.
    AWS Monitoring (SNS) •Fantastic offering, <3 it – Examples of ways to be notified by SNS • SMS • Email • JSON Post to your Application’s API endpoint
  • 94.
    AWS Monitoring (SNS) •Receive SMS/Email/Slack notifications for important events • ^ This is so you get immediate notifications • You can have multiple subscribers, I’d suggest you use that functionality • Basic gist? Receive immediate updates for things you want to see… immediately ☺
  • 95.
  • 96.
  • 97.
    AWS Monitoring (SNS) CreateSMS (or whatever, but in this case, SMS)
  • 98.
    AWS Monitoring (SNS) Exampleof creating email subscription… bottom line you can have multiple ways of notifying people
  • 99.
  • 100.
    AWS Monitoring (Config) •Config: – AWS resource inventory, configuration history, and configuration change notifications – Can either design custom Config rules or use managed (pre-packaged) AWS Config rules – Discovery -Change Management – Compliance -Incident Response
  • 101.
    AWS Monitoring (Config) •Pre-packaged “Managed” AWS Rules – CLOUD_TRAIL_ENABLED – EIP_ATTACHED – ENCRYPTED_VOLUMES – INCOMING_SSH_DISABLED – INSTANCES_IN_VPC – REQUIRED_TAGS – RESTRICTED_INCOMING_TRAFFIC https://docs.aws.amazon.com/config/latest/developerguide/evaluate-config_use-managed-rules.html
  • 102.
    AWS Monitoring (Config) •Examples of things you can have alerts set for: – Change in Firewall (Security Group) ports – Changes in VPC – Any change… at all
  • 103.
    AWS Monitoring (Config) Goto the Config service and choose resources to track
  • 104.
    AWS Monitoring (Config) Orchoose to track everything
  • 105.
    AWS Monitoring (Config) Createa bucket, create an SNS topic (…we’ll discuss next)
  • 106.
    AWS Monitoring (Config) Allowthe role to be created and you’re all set!
  • 107.
  • 108.
    AWS Monitoring (CloudWatch) •We can be very particular here about what it is we want to see • Some very interesting things you can monitor • Some examples: – Billing Alerts (Important for detection of abuse or mistakes) – Track Root Account Usage – Failed login attempts
  • 109.
  • 110.
    AWS Monitoring (CloudWatch- Billing) • Used to prevent abuse or mistakes from costing your organization money • Analyze and approximate your monthly spend • Configure via CloudWatch • Use SNS for instantaneous alerting
  • 111.
    AWS Monitoring (CloudWatch- Billing) Navigate to billing & cost management; enable billing alerts
  • 112.
    AWS Monitoring (CloudWatch- Billing) Create an SNS topic
  • 113.
    AWS Monitoring (CloudWatch- Billing) Subscribe to Topic
  • 114.
    AWS Monitoring (CloudWatch- Billing) Navigate to CloudWatch -> Metrics -> Billing
  • 115.
    AWS Monitoring (CloudWatch- Billing) Choose USD/Estimate Charges -> Create Alarm
  • 116.
    AWS Monitoring (CloudWatch- Billing) Set price point, SNS topic, and create alarm
  • 117.
    AWS Monitoring (CloudWatch- Billing) Exact steps to enable can be found here: http://docs.aws.amazon.com/awsaccountbilling/latest/about v2/free-tier-alarms.html
  • 118.
  • 119.
    AWS Monitoring (CloudWatch– Root Login) • Remember how I said don’t use the Root account routinely? • BUT… if this account is used, you should know about it • This is the reason you’ll want to notify others (who receive SNS alerts) of the fact you are about to use the account
  • 120.
    AWS Monitoring (CloudWatch– Root Login) Choose log group, create metric
  • 121.
    AWS Monitoring (CloudWatch– Root Login) Define Logs Metric Filter
  • 122.
    AWS Monitoring (CloudWatch– Root Login) Assign/Create Filter
  • 123.
    AWS Monitoring (CloudWatch– Root Login) Click “Create Alarm”
  • 124.
    AWS Monitoring (CloudWatch– Root Login) Define Alarm and you’re good…
  • 125.
    AWS Monitoring (CloudWatch– Root Login) Exact steps (with pics) exist here: https://blogs.aws.amazon.com/security/post/Tx3PSPQSN8 374D/How-to-Receive-Notifications-When-Your-AWS- Account-s-Root-Access-Keys-Are-Used
  • 126.
  • 127.
    AWS Monitoring (CloudWatch– Failed Logins) • In the event someone is trying to break in, let’s alert ourselves to this! • Failed logins typically suggest either someone forgot their password or… someone is trying to guess yours
  • 128.
    AWS Monitoring (CloudWatch– Failed Logins) • In the interest of time… the steps are pretty much the same as the root login alarm • The Regex Filter however, is different
  • 129.
    AWS Monitoring (CloudWatch– Failed Logins) Relevant filter pattern
  • 130.
    AWS Monitoring (CloudWatch– Failed Logins) • Exact steps exist here: http://docs.aws.amazon.com/awscloudtrail/la test/userguide/cloudwatch-alarms-for- cloudtrail.html#cloudwatch-alarms-for- cloudtrail-signin
  • 131.
  • 132.
    AWS Monitoring (UnauthorizedActivity) • Remember the aws-interrogate tool? • This alarm is the antidote • Alerts us when someone is trying to access something in AWS, and does not have permissions
  • 133.
    AWS Monitoring (UnauthorizedActivity) • Again, in the interest of time, steps are same as root login • Regex is of course, different
  • 134.
    AWS Monitoring (UnauthorizedActivity) Set up regular expression
  • 135.
    AWS Monitoring (UnauthorizedActivity) What happens when we run interrogate
  • 136.
    AWS Monitoring (UnauthorizedActivity) The result of doing that is a nice nifty email to the engineering & security team
  • 137.
    AWS Monitoring (CloudWatch)– Filter Patterns • If you’d like to create your own custom filter patterns, here is a resource for that: http://docs.aws.amazon.com/AmazonCloudWatch/latest/De veloperGuide/FilterAndPatternSyntax.html
  • 138.
  • 139.
    AWS + Splunk •Splunk is a pretty great resource for monitoring activity – Two separate plugins: • Splunk App for AWS – https://splunkbase.splunk.com/app/1274/ • Splunk Add-On – https://splunkbase.splunk.com/app/1876/
  • 140.
    AWS + Splunk •Examples of things you can view: – Billing – Topology – Usage – IAM Activity – SSH Key Pair Activity – User Activity – Network ACL(s) – VPC Activity – and a lot more…
  • 141.
  • 142.
  • 143.
  • 144.
    AWS + Splunk •Splunk will need an AWS account in order to retrieve data • Create account(s) for Splunk, grab the necessary permission policy from here: http://docs.splunk.com/Documentation/AddOns/released/A WS/ConfigureAWSpermissions
  • 145.
    AWS + Splunk ConfigureAWS App for Splunk, add account(s), configure each input accordingly:
  • 146.
    AWS + Splunk •Toview things like IAM Activity… –Subscribe to a cloudtrail log via SNS –Utilize SQS and subscribe SQS to an SNS Topic
  • 147.
    Monitoring Recap • Alertyourself when things change • This will get noisy, find a way to filter that which is important – If it’s a high risk event, send an SMS/Slack/Email blast • At a minimum, alert yourself when odd things occur… like: – Billing increases past your normal spend – When somebody authenticates as Root – When someone has a login failure
  • 148.
    Monitoring Recap • InterestingQuora thread: – https://www.quora.com/My-AWS-account-was-hacked-and-I-have-a-50-000-bill-how-can-I- reduce-the-amount-I-need-to-pay • Highlights from the article: – AWS has “a review board of sorts” to determine if you should be refunded – Bots are scouring GitHub searching for exposed access keys – One of the more AWS-seasoned responders mentioned doing part of what we discussed here today to avoid it – A decent number of the people posting on this thread said “Yes, happened to me too”
  • 149.
    AWS Restoration &Recovery Plan to fail, just don’t fail to plan
  • 150.
    AWS Restoration &Recovery • Do not USE AWS TO BACKUP YOUR AWS • Offsite backups (meaning, off AWS site) • Common things to back-up: – Databases/ Snapshots – S3 Buckets – EBS Volumes – CloudFormation Templates
  • 151.
    AWS Restoration &Recovery • Resources: – http://stackoverflow.com/questions/17087542/backup- solutions-for-aws-ec2-instances – https://github.com/Scalr/installer-ng – http://www.n2ws.com/blog/3-ways-ec2-windows- backup-and-recovery.html
  • 152.
    AWS Incident Response Planto fail, just don’t fail to plan
  • 153.
    AWS Incident Response •Could be its own talk • Scout 2 -- https://github.com/nccgroup/Scout2 •Andrew Krug & Alex McCormack – Hardening AWS Environments and Automating Incident Response – https://www.youtube.com/watch?v=cmEUxxYFjK8
  • 155.