Hardening AWS Environments
andAutomating Incident ResponseforAWS Compromises

Hardening AWS Environments and Automating Incident Response for AWS Compromises ­ Andrew Krug and Alex McCormack

Agenda: Preparing for an Incident within AWS
Incident Handling
Automatic Collection ofEvidence
Hardening the AWS
Environment

Hardening AWS Environments and Automating Incident Response for AWS Compromises ­ Andrew Krug and Alex McCormack

AWS Key CompromiseHow are Keys Compromised?
AWS Keys provided byAWS for AWS SDK
Keys may be stored in acode repository
Keys may be stored onanother AWS InstanceMore Serious Attacks

IR­Phases

Where we help

DevSecOps

IR Workflow as it relates to AWS
Locating an InstanceAcross AWSManaging credentials
Understanding where yourconfig is not best practiceAWS Services to Enable Today
CloudWatch Metrics
CloudTrailAWS Config
CloudWatch Events
EC2­Run / IAM

Increasing Visibility with CloudWatch

Increasing Visibility with CloudTrailEC2­Run Example
How to get going with EC2­Command or Simple
Server Management
http://amzn.to/2aiq8kc
Installation is Easy!
#!/bin/bash
cd /tmpcurl https://amazon-ssm-u ... amazon-ssm-agent.rpm -o amazon-ssm-agent.rpm
yum install -y amazon-ssm-agent.rpm

Why would you want to do this?
Can come in useful in asecurity incident.
Out of band management.
IAM Role driven.

Account Access Scenario

Imagine you are completely locked out.

Select Run a CommandFind the instanceInput the commandExecute the command
At the end you can simply click run and you've takenback the instance.

How does it work?

Recommended viewing
AWS re:Invent 2015 | (SEC316) Harden Your
Architecture w/ Security Incident ResponseSimulations
http://bit.ly/2auYsvI

IAM Role Advice1.
2.

Use least privilege roles.
Audit their usage with CloudTrail

How do IAM roles work?

IAM Limits
1.
2.

Instance profiles can't be detached.
Instance profiles can't be added to a runninginstance.

Config is a relatively new service that performs
inventory, tracks changes, and can enforce
compliance.

Config vs Config Rules
AWS Config

Timeline of Changes
Config Rules:

Run periodically andevaluate compliance.

Wizard Driven Setup

Config TimelineConfig Rules

Evaluation

This is Config running the first evaluation of the rule.

ReportThis is Config reporting on non­compliance.

Config and Lambda

Security improves with automated response.

CloudWatchEvents and Lambda

Recommended Viewing
There's also a great presentation about this:AWS re:Invent 2015 | (SEC308) Wrangling Security
Events in The Cloud
http://amzn.to/2aN6Js5

Access Advisor

Great tutorial on getting going with access advisor:
http://amzn.to/2aN6Js5

Advice to take away
Use custom policies
Audit them using access Advisor
Revoke permissions you don't need

Tool GapsMission
Be a free open source incident response toolkit
tailored for Amazon Web Services. Help first
responders by automating workflows using Amazon'svery own boto3 pip module.

The Question?
Can we leverage the AWS API to perform incident
response?

Host BasedvsKey BasedKey CompromiseIn key compromise we always want to disable thekey.

Key Compromise Demo

00:00

Now to host based compromises with AWS_IRAWS_IR Usage[krug@bb-8 lots_of_haxx ]$ aws_ir
aws_ir host_compromise
usage:
aws_ir host_compromise
ip user ssh_key_file

00:00

Step 1

Step 2

Step 3

Step 4

Step 5

Step 6

Step 7

The whole pictureMargarita Shotgun

00:00

Kernel warehouse is a ruby gem that builds all themodules for all support AWS linux variants.

You can host your own or use ours.

ThreatResponse Workstation

Starting ThreatResponse Workstation

ThreatResponse Dashboard

ThreatResponse AcquireAnalyze ­ Memory

ThreatResponse Analyze ­ Disk

ThreatResponse Analyze ­ Disk
Snapshot ofcompromised hostThreatResponse

TimeSketch

1.

6

Original

Processing
Instance

EC2

3.

2.

4.

5.

Case Bucket.plasoClone

Video Tour ThreatResponse Disk Analysis

AdviceS3 Checks
VersioningLogging
Open Permissions

IAM Checks
MFA
Rotated Credentials
Administrator Access Policy

Other Checks
VPCs: Flow Logging
CloudTrail: MultiRegion &validation

Other Checks
Disable access keys on theroot account
Ensures an IAM role exists
Cloudwatch Billing Alerts

AWS Trusted Advisor

AWS Config
AWS Config ­ $.003 perconfiguration itemAWS Config Rules ­ $2 perrule per month for $20,000
evaluations.

Review of Tools

Brief: What's going on in Open Cloud Security

Evolve your understanding throughexperimentation!

Dont!
Wait to try out some ofthese tools
Do!
Have a test environment
Security simulations
IR Game Days

What does that even mean?
Test environments

Build a Continuous
Integration Culture
Have separate AWS
accounts for Dev, Test,
etc...
Use consolidated billing.

Mixed EnvironmentSeparation

What do all these engineers have in common?

About Security Simulation
1.
2.
3.
4.

Basically you fake a hack or two.
Some percentage of employees know.
Some percentage don't know.
Process it like a real exercise.

PSA : Tell Amazon if you do these.
AWS Policies do allow for security simulation and IR
game days. They just ask that you let them know inadvance.

Other Projects in the Space

Simian Army

Captiol One Cloud Custodian
https://github.com/capitalone/cloud­custodian
Rule Engine
Can create lambda
functions for you
Around since April 2016

Feature Comparison

Future of the Tools

Thanks Amazon Web Services
Don Bailey
Zack GlickHenrik Johansson

Where to get the software?
http://www.threatresponse.cloudReleasing soon!
Signup for a notification.

Q&A

http://www.threatresponse.cloud