Security Flashcards
What is a DDOS attack?
Attack that tries to make your service unavailable.
What are 3 types of DDOS attacks and at what layers?
- Syn Ack flood attack layer 4
- NTP Amplification attack layer 4
- HTTP/HTTPS flood attack layer 7
What is CloudTrail?
CloudTrail is a service that logs AWS API calls for ip address, time, and api call (request params, metadata, response)
Would CloudTrail be able to log SSH/RDP into EC2?
No it would not as it needs to be an API call.
Where are CloudTrail Logs stored?
S3
What is AWS Shield?
It is free DDOS Protection for CloudFront, ELB, Route 53 against layer 3/4 attacks
What is AWS Shield Advanced? What are 3
- Enhanced protection for CloudFront, ELB, Route 53
2 Provides a dedicated 24/7 AWS response team - Near realtime monitoring of DDOS attacks
How much is AWS Shield Advanced?
3k a month
What Layer does AWS Shield protect? What about WAF?
AWS Shield protects against layer3/4
WAF protects against layer 7
What is WAF?
Web Application Firewall provides monitoring and access control for HTTP/HTTPS to ELB,Route 53,CloudFront
What kinds of attacks does WAF protect against?
SQL Injection, Cross site scripting, DDOS layer 7
What can WAF look at in requests that go through it?
It can look at
- IP addresses
- Request parameters
- string search patterns
- country originating
- if there is sql code or scripts
What returns if WAF blocks access?
It will return a 403
What are the 3 behvious of WAF?
- allow all content you specify
- block all content you specify
- count requests meeting the properties you specify
What is AWS Guard Duty? What can be triggered from it?
Threat detection Service that monitors your AWS account for malicious behavior using machine learning AI (taking a baseline)
External db of known threats
Can trigger lambda from Cloudwatch events if threat detected
What does AWS Guard Duty monitor?
DNS Logs, Cloudtrail logs, VPC Flow logs
What is AWS Macie?
Uses Machine learning to find PII/sensitive data in S3 and alerts you through EventBridge (which you can then automate remediation)
What is AWS Inspector?
A security assessment service that inspects for vulnerabilities and best practices
What are the 2 types of scanning AWS Inspector does? How do they differ?
- Network Assesment of configurations in VPC
- Host Assessment of EC2
One does not need an agent installed while the other does
What is KMS? What are CMK?
KMS is a service that lets you manage and create encryption keys.
CMK are customer master keys, the actual encryption key itself.
What is CloudHSM?
A dedicated hardware security module in the cloud that generates your CMK
What are 3 ways to generate a CMK?
- Use AWS HSM
- Use your own HSM
- Rent a cloud HSM from AWS
What are 3 ways to control access to CMKs?
- Key policies (who can manage and use keys)
- IAM policies
- Grants with key policies (for delegation)
What are 3 ways to control access to CMKs?
- Key policies (who can manage and use keys)
- IAM policies
- Grants with key policies (for delegation)
What is AWS Secrets Manager?
Service that lets you store encrypted credentials and retrieve/rotate them. e.g. RDS
What is AWS Parameter Store?
Service that lets you store your parameters in a hierarchy.
What is the difference between Secrets Manager and Parameter store?
Secrets Manager can handle secrets at scale, but costs money
Parameter Store is free but can only handle 10k secrets, and doesn’t have key rotation
What should you watch out for with Secrets Manager rotation?
When rotation is enabled, it will immediately attempt to rotate credentials once
What is the encryption like for Secrets Manager?
Automatically encrypted in transit and at rest
When should you use Presigned URL’s over Presigned Cookies?
Use Presigned URLs with you have a single resource needing public access
Use presigned cookies if there are multiple resources needing to be shared
How do you share a video in a private S3 bucket?
Use a presigned url
What is a presigned url?
A url generated with a time duration giving access to a private S3 bucket using the object owners credentials
Why do we need presigned urls?
By default all objects in S3 are private and only object owner has permission to access
How is a not explicitly allowed permission treated in IAM policy?
It is implicitly denied if it is not defined
How is an explicit denied permission treated?
IAM will take the denial over everything else
How does AWS treat multiple policies on attached to the same role?
The union of all permissions is taken.
What is AWS Certificate Manager? What is the cost? What services does it work with?
Service that lets create/manage SSL certificates. Certificates are free and automatically renews/deploys for ELB, CLoudfront,APi Gateway
