Security & Compliance Flashcards
1
Q
DDOS Protection on AWS
A
- AWS Shield Standard: protects against DDOS attack for your website and applications, for all customers at no additional costs
- AWS Shield Advanced: 24/7 premium DDoS protection
- AWS WAF: Filter specific requests based on rules
-
CloudFront and Route 53:
- Availability protection using global edge network
- Combined with AWS Shield, provides attack mitigation at the edge - Be ready to scale – leverage AWS Auto Scaling
2
Q
AWS Shield
A
-
AWS Shield Standard:
- Free service that is activated for every AWS customer
- Provides protection from attacks such as SYN/UDP Floods, Reflection attacks and other layer 3/layer 4 attacks -
AWS Shield Advanced:
- Optional DDoS mitigation service ($3,000 per month per organization)
- Protect against more sophisticated attack on Amazon EC2, Elastic Load Balancing (ELB), Amazon CloudFront, AWS Global Accelerator, and Route 53
- 24/7 access to AWS DDoS response team (DRP)
- Protect against higher fees during usage spikes due to DDoS
3
Q
AWS WAF – Web Application Firewall
A
- Protects your web applications from common web exploits (Layer 7)
- Layer 7 is HTTP (vs Layer 4 is TCP)
- Deploy on Application Load Balancer, API Gateway, CloudFront
- Define Web ACL (Web Access Control List):
- Rules can include IP addresses, HTTP headers, HTTP body, or URI strings
- Protects from common attack - SQL injection and Cross-Site Scripting (XSS)
- Size constraints, geo-match (block countries)
- Rate-based rules (to count occurrences of events) – for DDoS protection
4
Q
AWS Network Firewall
A
- Protect your entire Amazon VPC
- From Layer 3 to Layer 7 protection
- Any direction, you can inspect
- VPC to VPC traffic
- Outbound to internet
- Inbound from internet
- To / from Direct Connect & Siteto-Site VPN
5
Q
Penetration Testing on AWS Cloud
A
- AWS customers are welcome to carry out security assessments or penetration tests against their AWS infrastructure without prior approval for 8 services:
-Amazon EC2 instances, NAT Gateways, and Elastic Load Balancers
-Amazon RDS
-Amazon CloudFront
-Amazon Aurora
-Amazon API Gateways
-AWS Lambda and Lambda Edge functions
-Amazon Lightsail resources
-Amazon Elastic Beanstalk environments - Prohibited Activities
-DNS zone walking via Amazon Route 53 Hosted Zones
-Denial of Service (DoS), Distributed Denial of Service (DDoS), Simulated DoS, Simulated DDoS
-Port flooding
-Protocol flooding
-Request flooding (login request flooding, API request flooding)
6
Q
Data at rest vs. Data in transit
A
- At rest: data stored or archived on a device
-On a hard disk, on a RDS instance, in S3 Glacier Deep Archive, etc. - In transit (in motion): data being moved from one location to another
-Transfer from on-premises to AWS, EC2 to DynamoDB, etc.
-Means data transferred on the network - We want to encrypt data in both states to protect it!
- For this we leverage encryption keys
7
Q
AWS KMS (Key Management Service)
A
-
KMS = AWS manages the encryption keys for us (AWS manages the software
for encryption) -
Encryption Opt-in:
-EBS volumes: encrypt volumes
-S3 buckets: Server-side encryption of objects
-Redshift database: encryption of data
-RDS database: encryption of data
-EFS drives: encryption of data -
Encryption Automatically enabled:
-CloudTrail Logs
-S3 Glacier
-Storage Gateway
8
Q
CloudHSM
A
- CloudHSM => AWS provisions encryption hardware
- Dedicated Hardware (HSM = Hardware Security Module)
- You manage your own encryption keys entirely (not AWS)
- HSM device is tamper resistant, FIPS 140-2 Level 3 compliance
9
Q
Types of Customer Master Keys: CMK
A
-
Customer Managed CMK:
-Create, manage and used by the customer, can enable or disable
-Possibility of rotation policy (new key generated every year, old key preserved)
-Possibility to bring-your-own-key -
AWS managed CMK:
-Created, managed and used on the customer’s behalf by AWS
-Used by AWS services (aws/s3, aws/ebs, aws/redshift) -
AWS owned CMK:
-Collection of CMKs that an AWS service owns and manages to use in multiple accounts
-AWS can use those to protect resources in your account (but you can’t view the keys) -
CloudHSM Keys (custom keystore):
-Keys generated from your own CloudHSM hardware device
-Cryptographic operations are performed within the CloudHSM cluster
10
Q
AWS Certificate Manager (ACM)
A
- Let’s you easily provision, manage, and deploy SSL/TLS Certificates
- Used to provide in-flight encryption for websites (HTTPS)
- Supports both public and private TLS certificates
- Free of charge for public TLS certificates
- Automatic TLS certificate renewal
- Integrations with (load TLS certificates on)
-Elastic Load Balancers
-CloudFront Distributions
-APIs on API Gateway
11
Q
AWS Secrets Manager
A
- Newer service, meant for storing secrets
- Capability to force rotation of secrets every X days
- Automate generation of secrets on rotation (uses Lambda)
- Integration with Amazon RDS (MySQL, PostgreSQL, Aurora)
- Secrets are encrypted using KMS
- Mostly meant for RDS integration
12
Q
AWS Artifact
(not really a service)
A
- Portal that provides customers with on-demand access to AWS compliance documentation and AWS agreements
- Artifact Reports - Allows you to download AWS security and compliance documents from third-party auditors, like AWS ISO certifications, Payment Card Industry (PCI), and System and Organization Control (SOC) reports
- Artifact Agreements - Allows you to review, accept, and track the status of AWS agreements such as the Business Associate Addendum (BAA) or the Health Insurance Portability and Accountability Act (HIPAA) for an individual account or in your organization
- Can be used to support internal audit or compliance
13
Q
Amazon GuardDuty
A
- Intelligent Threat discovery to protect your AWS Account
- Uses Machine Learning algorithms, anomaly detection, 3rd party data
- One click to enable (30 days trial), no need to install software
- Input data includes:
-CloudTrail Events Logs – unusual API calls, unauthorized deployments
–CloudTrail Management Events – create VPC subnet, create trail, …
–CloudTrail S3 Data Events – get object, list objects, delete object, …
-VPC Flow Logs – unusual internal traffic, unusual IP address
-DNS Logs– compromised EC2 instances sending encoded data within DNS queries
-Optional Features – EKS Audit Logs, RDS & Aurora, EBS, Lambda, S3 Data Events… - Can setup EventBridge rules to be notified in case of findings
- EventBridge rules can target AWS Lambda or SNS
- Can protect against CryptoCurrency attacks (has a dedicated “finding” for it)
14
Q
Amazon Inspector
A
- Automated Security Assessments
-
For EC2 instances
- Leveraging the AWS System Manager (SSM) agent
- Analyze against unintended network accessibility
- Analyze the running OS against known vulnerabilities
-
For Container Images push to Amazon ECR
- Assessment of Container Images as they are pushed
-
For Lambda Functions
- Identifies software vulnerabilities in function code and package dependencies
- Assessment of functions as they are deployed
- Reporting & integration with AWS Security Hub
- Send findings to Amazon Event Bridge
- Remember: only for EC2 instances, Container Images & Lambda functions
- Continuous scanning of the infrastructure, only when needed
- Package vulnerabilities (EC2, ECR & Lambda) – database of CVE
- Network reachability (EC2)
- A risk score is associated with all vulnerabilities for prioritization
15
Q
AWS Config
A
- Helps with auditing and recording compliance of your AWS resources
- Helps record configurations and changes over time
- Possibility of storing the configuration data into S3 (analyzed by Athena)
- Questions that can be solved by AWS Config:
- Is there unrestricted SSH access to my security groups?
- Do my buckets have any public access?
- How has my ALB configuration changed over time?
- You can receive alerts (SNS notifications) for any changes
- AWS Config is a per-region service
- Can be aggregated across regions and accounts
