Upload File

cloud, the hard way - information security training · the hard way is easier 3 @__muscles cover...

  • Home
  • Documents
  • Cloud, The Hard Way - Information Security Training · The Hard Way is Easier 3 @__muscles Cover the basics Build on them Run free THE HARD WAY IS EASIER 4 @__muscles. 1. INTRODUCTION
39
Cloud, The Hard Way

Upload: others

Post on 22-May-2020

3 views

Category:

Documents


0 download

Report

TRANSCRIPT

Page 1: Cloud, The Hard Way - Information Security Training · The Hard Way is Easier 3 @__muscles Cover the basics Build on them Run free THE HARD WAY IS EASIER 4 @__muscles. 1. INTRODUCTION

Cloud, The Hard Way

Page 2: Cloud, The Hard Way - Information Security Training · The Hard Way is Easier 3 @__muscles Cover the basics Build on them Run free THE HARD WAY IS EASIER 4 @__muscles. 1. INTRODUCTION

HELLO!I am Will BengtsonI love the cloudYou can find me at @__muscles

2

Page 3: Cloud, The Hard Way - Information Security Training · The Hard Way is Easier 3 @__muscles Cover the basics Build on them Run free THE HARD WAY IS EASIER 4 @__muscles. 1. INTRODUCTION

0.PREFACEThe Hard Way is Easier

3@__muscles

Page 4: Cloud, The Hard Way - Information Security Training · The Hard Way is Easier 3 @__muscles Cover the basics Build on them Run free THE HARD WAY IS EASIER 4 @__muscles. 1. INTRODUCTION

◈ Cover the basics◈ Build on them◈ Run free

THE HARD WAY IS EASIER

4@__muscles

Page 5: Cloud, The Hard Way - Information Security Training · The Hard Way is Easier 3 @__muscles Cover the basics Build on them Run free THE HARD WAY IS EASIER 4 @__muscles. 1. INTRODUCTION

1.INTRODUCTIONGetting started in the cloud

5@__muscles

Page 6: Cloud, The Hard Way - Information Security Training · The Hard Way is Easier 3 @__muscles Cover the basics Build on them Run free THE HARD WAY IS EASIER 4 @__muscles. 1. INTRODUCTION

◈ Challenges◈ Understand Datacenter vs. AWS

GETTING STARTED IN THE CLOUD

6@__muscles

Page 7: Cloud, The Hard Way - Information Security Training · The Hard Way is Easier 3 @__muscles Cover the basics Build on them Run free THE HARD WAY IS EASIER 4 @__muscles. 1. INTRODUCTION

◈ Dynamic environment◈ Huge scale◈ Diverse applications

CHALLENGES

7@__muscles

Page 8: Cloud, The Hard Way - Information Security Training · The Hard Way is Easier 3 @__muscles Cover the basics Build on them Run free THE HARD WAY IS EASIER 4 @__muscles. 1. INTRODUCTION

Datacenter◈ Firewall◈ RBAC◈ Cluster◈ Syslog◈ VLAN◈ Datacenter

DATACENTER VS AWS

AWS◈ Security Group◈ IAM◈ Auto Scaling Group◈ CloudWatch◈ VPC◈ Region / AZ

8@__muscles

Page 9: Cloud, The Hard Way - Information Security Training · The Hard Way is Easier 3 @__muscles Cover the basics Build on them Run free THE HARD WAY IS EASIER 4 @__muscles. 1. INTRODUCTION

MAPS

9@__muscles

Page 10: Cloud, The Hard Way - Information Security Training · The Hard Way is Easier 3 @__muscles Cover the basics Build on them Run free THE HARD WAY IS EASIER 4 @__muscles. 1. INTRODUCTION

MAPS

10@__muscles

Page 11: Cloud, The Hard Way - Information Security Training · The Hard Way is Easier 3 @__muscles Cover the basics Build on them Run free THE HARD WAY IS EASIER 4 @__muscles. 1. INTRODUCTION

2.EXERCISE 0Let’s get to the root of things

11@__muscles

Page 12: Cloud, The Hard Way - Information Security Training · The Hard Way is Easier 3 @__muscles Cover the basics Build on them Run free THE HARD WAY IS EASIER 4 @__muscles. 1. INTRODUCTION

◈ First AWS account◈ Highest level of access◈ Sensitive

ROOT ACCOUNT

12@__muscles

Page 13: Cloud, The Hard Way - Information Security Training · The Hard Way is Easier 3 @__muscles Cover the basics Build on them Run free THE HARD WAY IS EASIER 4 @__muscles. 1. INTRODUCTION

◈ Break glass superuser◈ S3 Bucket ACL

USE CASES OF ROOT

13@__muscles

Page 14: Cloud, The Hard Way - Information Security Training · The Hard Way is Easier 3 @__muscles Cover the basics Build on them Run free THE HARD WAY IS EASIER 4 @__muscles. 1. INTRODUCTION

THROW AWAY THE KEY14@__muscles

Page 15: Cloud, The Hard Way - Information Security Training · The Hard Way is Easier 3 @__muscles Cover the basics Build on them Run free THE HARD WAY IS EASIER 4 @__muscles. 1. INTRODUCTION

3.EXERCISE 1Auditing - CloudTrail

15@__muscles

Page 16: Cloud, The Hard Way - Information Security Training · The Hard Way is Easier 3 @__muscles Cover the basics Build on them Run free THE HARD WAY IS EASIER 4 @__muscles. 1. INTRODUCTION

CLOUDTRAIL◈ Logs AWS API activity

◆ Like a credit card statement

◈ AWS API transactions◆ Who / When / What (Call) / Which (Resource)

16@__muscles

Page 17: Cloud, The Hard Way - Information Security Training · The Hard Way is Easier 3 @__muscles Cover the basics Build on them Run free THE HARD WAY IS EASIER 4 @__muscles. 1. INTRODUCTION

17

EXAMPLE: HOW TO CLOUDTRAIL

@__muscles

Page 18: Cloud, The Hard Way - Information Security Training · The Hard Way is Easier 3 @__muscles Cover the basics Build on them Run free THE HARD WAY IS EASIER 4 @__muscles. 1. INTRODUCTION

4.EXERCISE 2Identity and Access Management (IAM)

18@__muscles

Page 19: Cloud, The Hard Way - Information Security Training · The Hard Way is Easier 3 @__muscles Cover the basics Build on them Run free THE HARD WAY IS EASIER 4 @__muscles. 1. INTRODUCTION

◈ Users◈ Groups◈ Roles◈ Policies

IDENTITY AND ACCESS MANAGEMENT (IAM)

19@__muscles

Page 20: Cloud, The Hard Way - Information Security Training · The Hard Way is Easier 3 @__muscles Cover the basics Build on them Run free THE HARD WAY IS EASIER 4 @__muscles. 1. INTRODUCTION

◈ Can log into the console◈ Credentials are static◈ Avoid if you can

IAM USERS

20@__muscles

Page 21: Cloud, The Hard Way - Information Security Training · The Hard Way is Easier 3 @__muscles Cover the basics Build on them Run free THE HARD WAY IS EASIER 4 @__muscles. 1. INTRODUCTION

◈ Used to provide similar permissions to users◈ Think of them like AD groups

IAM GROUPS

21@__muscles

Page 22: Cloud, The Hard Way - Information Security Training · The Hard Way is Easier 3 @__muscles Cover the basics Build on them Run free THE HARD WAY IS EASIER 4 @__muscles. 1. INTRODUCTION

◈ Preferred method for operating in AWS◈ Similar to users, but credentials are

temporary◈ Used throughout all services within AWS◈ Single Sign-On (SSO)

IAM ROLES

22@__muscles

Page 23: Cloud, The Hard Way - Information Security Training · The Hard Way is Easier 3 @__muscles Cover the basics Build on them Run free THE HARD WAY IS EASIER 4 @__muscles. 1. INTRODUCTION

◈ Permissions that can be applied to anything◈ Managed Policies◈ Inline policies

POLICIES

23@__muscles

Page 24: Cloud, The Hard Way - Information Security Training · The Hard Way is Easier 3 @__muscles Cover the basics Build on them Run free THE HARD WAY IS EASIER 4 @__muscles. 1. INTRODUCTION

Works EVERYWHERE!24@__muscles

Page 25: Cloud, The Hard Way - Information Security Training · The Hard Way is Easier 3 @__muscles Cover the basics Build on them Run free THE HARD WAY IS EASIER 4 @__muscles. 1. INTRODUCTION

{

"Version": "2012-10-17",

"Statement": [

{

"Action": [

"s3:GetObject"

],

"Effect": "Allow",

"Resource": "arn:aws:s3:::sans-sj"

}

]}

25@__muscles

Page 26: Cloud, The Hard Way - Information Security Training · The Hard Way is Easier 3 @__muscles Cover the basics Build on them Run free THE HARD WAY IS EASIER 4 @__muscles. 1. INTRODUCTION

5.EXERCISE 3Simple Storage Service (S3)

26@__muscles

Page 27: Cloud, The Hard Way - Information Security Training · The Hard Way is Easier 3 @__muscles Cover the basics Build on them Run free THE HARD WAY IS EASIER 4 @__muscles. 1. INTRODUCTION

◈ It is like a folder on the internet◈ Can be used to store your data on AWS◈ Cheap

S3

27@__muscles

Page 28: Cloud, The Hard Way - Information Security Training · The Hard Way is Easier 3 @__muscles Cover the basics Build on them Run free THE HARD WAY IS EASIER 4 @__muscles. 1. INTRODUCTION

◈ Buckets◆ Globally unique◆ Can make files (objects) public

◈ Objects◆ Contain data and metadata◆ Can be public even though bucket is not!

S3

28@__muscles

Page 29: Cloud, The Hard Way - Information Security Training · The Hard Way is Easier 3 @__muscles Cover the basics Build on them Run free THE HARD WAY IS EASIER 4 @__muscles. 1. INTRODUCTION

6.EXERCISE 4Base AMI

29@__muscles

Page 30: Cloud, The Hard Way - Information Security Training · The Hard Way is Easier 3 @__muscles Cover the basics Build on them Run free THE HARD WAY IS EASIER 4 @__muscles. 1. INTRODUCTION

◈ Immutability◆ No SSH◆ Config change == new build

◈ Every application has the same base layer◆ Logging◆ Security◆ Secrets Management

BASE AMI

30@__muscles

Page 31: Cloud, The Hard Way - Information Security Training · The Hard Way is Easier 3 @__muscles Cover the basics Build on them Run free THE HARD WAY IS EASIER 4 @__muscles. 1. INTRODUCTION

7.EXERCISE 5Lambda

31@__muscles

Page 32: Cloud, The Hard Way - Information Security Training · The Hard Way is Easier 3 @__muscles Cover the basics Build on them Run free THE HARD WAY IS EASIER 4 @__muscles. 1. INTRODUCTION

◈ Someone else’s container◈ Highly scalable◈ Pay for what you use◈ Multiple languages

◆ Bring your own runtime

Lambda A.K.A Serverless

32@__muscles

Page 33: Cloud, The Hard Way - Information Security Training · The Hard Way is Easier 3 @__muscles Cover the basics Build on them Run free THE HARD WAY IS EASIER 4 @__muscles. 1. INTRODUCTION

◈ Deploy in VPC◈ Configurable memory and runtime

◆ More memory ~= more power◈ Easy to get started◈ Be careful with versions

Lambda A.K.A Serverless

33@__muscles

Page 34: Cloud, The Hard Way - Information Security Training · The Hard Way is Easier 3 @__muscles Cover the basics Build on them Run free THE HARD WAY IS EASIER 4 @__muscles. 1. INTRODUCTION

8.TOOLSSome awesome open source

34@__muscles

Page 35: Cloud, The Hard Way - Information Security Training · The Hard Way is Easier 3 @__muscles Cover the basics Build on them Run free THE HARD WAY IS EASIER 4 @__muscles. 1. INTRODUCTION

35

STREAMALERT

@__muscles

Page 36: Cloud, The Hard Way - Information Security Training · The Hard Way is Easier 3 @__muscles Cover the basics Build on them Run free THE HARD WAY IS EASIER 4 @__muscles. 1. INTRODUCTION

36

REPOKID

@__muscles

Page 37: Cloud, The Hard Way - Information Security Training · The Hard Way is Easier 3 @__muscles Cover the basics Build on them Run free THE HARD WAY IS EASIER 4 @__muscles. 1. INTRODUCTION

CLOUD INQUISITOR

37@__muscles

Page 38: Cloud, The Hard Way - Information Security Training · The Hard Way is Easier 3 @__muscles Cover the basics Build on them Run free THE HARD WAY IS EASIER 4 @__muscles. 1. INTRODUCTION

CLOUD CUSTODIAN

38@__muscles

Page 39: Cloud, The Hard Way - Information Security Training · The Hard Way is Easier 3 @__muscles Cover the basics Build on them Run free THE HARD WAY IS EASIER 4 @__muscles. 1. INTRODUCTION

39

THANKS!Any questions?@__muscles


an easier tomorrow powerpoint there is a better way an easier tomorrow Music: Kevin MacLeod incompetech.com

9.4 the hard way

PRODUCT CATALOG 2016 MAKING HARD WORK EASIER

Tips to make Blogging Way Easier

An Easier Way to Track our Tree Maintenance

Learning the Hard Way from IEDs

Making the Hard Decisions Easier

JSHint: Learning JavaScript the Hard Way

Sales lessons learned the hard way

Learning Perl The Hard Way

Learn to manage your tasks the easier way!

An Easier Way to Collect & Review Applications Onlint

Finding it hard to prioritise? Three ways to make prioritisation easier

An Easier Way to Better Golf

An Easier Way to Get Your Website

Web Apps Made Way Easier

Learn Ruby - The Hard Way

20 Quick Tips to Make Blogging Way Easier

Entrepreneurial Lessons Learned the Hard Way

Cloud, The Hard Way · 2020. 1. 17. · I love the cloud You can find me at @__muscles 2. 0. PREFACE The Hard Way is Easier 3 @__muscles Cover the basics Build on them Run free THE

Lessons learnt the hard way

MAKING HARD WORK EASIER PRODUCT CATALOG 2016 · PRODUCT CATALOG 2016 MAKING HARD WORK EASIER. 4270 Ivy Pointe Blvd. Cincinnati, OH 45245 800-543-4596 Customers around the world have

Leadership the hard way frohman

Marketing Is Hard. Systems Make It Easier

Short Sale No Thanks.com - There is an Easier Way

Learn python the hard way

Funding Open Source, The Hard Way

Learn Ruby The Hard Way - The BIRNmedia.thebirn.com/webteam/LearnRubyTheHardWay.pdf · Welcome to Learn Ruby the hard way. This is a translation of “Learn Python The Hard Way”

HR Data Management: The Hard Way vs The Easy Way

Hdmv Animated Buttons An Easier Way

[Itpub.net]Learn c the Hard Way

Mobile Banking- an easier way to bank

SIMPLE WAY to make life easier

Learn Vimscript the Hard Way - Leanpub

Why Learn the Hard Way? - Association of Boards of ... - Why Learn the Hard Way - Red... · 11 Why Learn the Hard Way? Converting Hindsight into Foresight ABC January 2016 – Innovation