Cloudten: SIEM in the AWS Cloud

©opyright 2015Cloudten Industries

Copyright 2015Cloudten Industries

Copyrightstatement:

ThisdocumentcontainsapresentationgiventotheAWSSydneyUserGroupinNovember2015.Ithasbeenmadeavailablefreelyforeducationalpurposes.Nopartofthisdocumentmaybereproducedormodifiedwithouttheexpresswrittenconsentoftheauthor.


SecurityInformation&EventManagement


• Centralised collectionandmanagementofsecuritylogs.

• Aggregatesdatafromawidevarietyofsources(firewalls,IDS,WAF,anti-virusetc )

• Analysesandcorrelateseventstoprovidestatisticalinformationandreal-timemonitoring.


• ThreatDetection(beforeanevent)

• IncidentManagement(postevent)

• AuditingandReporting

• Compliance


• Hardwareorvirtualappliances

• VariousLicensingModels:• EPS– EventsPerSecond• FPM– FlowsPerMinute• Numberof logsources• Logsizeperday

• VariousLogCollectionMethods• Agent(Logforwarders,probeconnectors…)• Agentless(viaSSH,syslog,WindowsEventCollector)


Appliances

Software


• Thebasicpremiseisthesame.

• Canbeeasier,cheaperandquickertosetup.

• It’sjustas(ifnotmore)important.

• Potentiallymuchgreater“blastradius”


…aaaaandlostitin2


• MakeSecurity“JobZero”

• Don’tmakesecurityanafterthought.

• Architectsecurityintothefoundations


• AWSprovideanumberofreallyusefulsecuritytoolsandservices“outofthebox”

• NearlyallofAWSserviceshaveAPIsthatintegratewiththesecurityservices.

• Thisprovidescentralised inputsintoeitheracustombuiltSIEMor3rd partysolution.


• Useraccounts,groupsandroles

• Createandmapfinegrainedaccesspolicies

• Providesauthenticatedandauditableaccesstoallresources.

• Federatetoanexternaldirectory


• awebservicethatrecordsallkindsofAPIcallsmadebyAWSresources.

• Eg.Changestosecuritygroups,modifyIAMpermissionsetc.

• StoreslogsinasecureS3bucket

• OneofthemostimportantservicesfromaSIEMandauditingperspective.


• Trackandcompareinfrastructurechangesovertime

• Theabilitytorestoreenvironmentconfigurations

• AbletosnapshotanenvironmentintoCloudFormationtemplatesinS3

• IntegrateswithCloudTrail


• Definerulesforhowresourcesarecreated(eg.AllEBSvolumesmustbeencrypted)

• Canmonitorconfig changesandprovideadashboardtocheckcompliancestatus’

• Makesiteasytoseewhenandhowaresourcebecamenoncompliant.


• Notjustbasicperformancemetricsanymore

• Agentbasedlogcollection

• Filteringlanguagetomonitorandalert

• IngestslogsfromCloudTrail


• EssentiallygivestheabilitytomonitornetworktrafficwithinaVPC

• Alsologsdroppedpackets(firewalllogs)

• OutputstoCloudWatchLogs

• “Free”


• CanblockmaliciousHTTP/Srequests

• SitsinfrontofCloudFront

• GeneratesCloudWatchmetrics


{"Records": [

{"eventVersion": "1.0","userIdentity": {

"type": "IAMUser","principalId": "EXAMPLE_PRINCIPAL_ID","arn": "arn:aws:iam::123456789012:user/Jeff","accountId": "123456789012","accessKeyId": "EXAMPLE_KEY_ID","userName": "Jeff","sessionContext": {

"attributes": {"mfaAuthenticated": "false","creationDate": "2015-08-25T04:04:11Z"

}}

},"eventTime": "2015-08-25T04:12:22Z","eventSource": "iam.amazonaws.com","eventName": "AddUserToGroup","awsRegion": "ap-southeast-2","sourceIPAddress": "127.0.0.1","userAgent": "AWSConsole","requestParameters": {

"userName": “Bob","groupName": "admin"

},"responseElements": null

}]

}


• Youhaveallthelogsbutwhatdoyoudowiththem?

• CloudWatch/Logsisgood…but

• ThereareanumberofspecialistlogmanagementvendorswhohaveadaptedtheirproductstoworkasaSIEM.

• Theyprovidecompliance,auditingandpro-activemonitoringcapabilities.


Collect&Aggregate• Manyandvariedsources• Acrossenvironments• Safe,secure&fast

Visualize&Alert• Real-timedashboards• Proactivealerting• Out-of-theboxapps

Investigate&TakeAction• Searchandtroubleshoot• Identifyunknowns• Analyze,triageandisolate

Monitor&Optimize• Detectanomalies• Predictandpreemptissues• Streamlineandimproveprocesses


• Securityisafulltimejob

• Manycompaniesdon’thavetime/resourcestokeepontopofeverything

• Skilledsecurityresourcesareexpensive.

• Manyhighprofileorganisations choosetooutsourceSIEMresponsibilities.


• SecurityfocusedAWSconsultingpartner

• AWSCertifiedtothehighestlevel

• Consulting/ManagedServices

• Comeandtalktous!

Cloudten: SIEM in the AWS Cloud

Technology

Transcript of Cloudten: SIEM in the AWS Cloud