AWS Partner Webcast - Web App Security on AWS: How to Make Shared Security Work for You

Web App Security on AWS: How to Make Shared Security Work for You

Welcome Ryan Holland Solutions Architect Amazon Web Services

Webinar Overview  Submit Your Questions using the Q&A tool.  A copy of today’s presentation will be made available on:  AWS SlideShare Channel@ http://www.slideshare.net/AmazonWebServices/  AWS Webinar Channel on YouTube@ http://www.youtube.com/channel/UCT- nPlVzJI-ccQXlxjSvJmw

Ryan Holland Solutions Architect Amazon Web Services Johnathan Norman Solutions Architect AlertLogic Introducing

 Amazon Web Services security overview  How to access Alert Logic Web Security Manager via AWS Marketplace  How to integrate web application security in your AWS environment  Q&A What We’ll Cover

Ryan Holland Sr Manager, Partner Solution Architects

Foundation Services Compute Storage Database Networking AWS Global Infrastructure Regions Availability Zones Edge Locations Client-side Data Encryption Server-side Data Encryption Network Traffic Protection Platform, Applications, Identity & Access Management Operating System, Network & Firewall Configuration Customer content Customers • Culture of security and continual improvement • Ongoing audits and assurance • Protection of large-scale service endpoints • Customers configure AWS security features • Get access to a mature vendor marketplace • Can implement and manage their own controls • Gain additional assurance above AWS controls Security is a shared responsibility between AWS and our customers

Every customer has access to the same security capabilities AWS maintains a formal control environment • SOC 1 (SSAE 16 & ISAE 3402) Type II (was SAS70) • SOC 2 Security • ISO 27001 Certification • Certified PCI DSS Level 1 Service Provider • FedRAMP (FISMA), ITAR, FIPS 140-2 • HIPAA and MPAA capable Foundation Services Compute Storage Database Networking AWS Global Infrastructure Regions Availability Zones Edge Locations

Let AWS take care of the heavy lifting for you Facilities Physical security Compute infrastructure Storage infrastructure Network infrastructure Virtualization layer (EC2) Hardened service endpoints Rich IAM capabilities Network configuration Security groups OS firewalls Operating systems Applications Proper service configuration AuthN & acct management Authorization policies + = Customer Customers get to choose the right level of security for their business. As an AWS customer you can focus on your business and not be distracted by the muck.

AWS partners can help you build secure solutions Facilities Physical security Compute infrastructure Storage infrastructure Network infrastructure Virtualization layer (EC2) Hardened service endpoints Fine-grained IAM capability + = AWS partner solutions These products and more are available on the AWS marketplace - WAF, VPN, IPS, AV, API gateways, data encryption, user management Your secure AWS solutions

Public Cloud Security - AWS Johnathan Norman Cloud Solutions Architect

The Web Application Attack Threat 12 Web Application Attacks are Prevalent and Dangerous • Half of all environments will be impacted by web application attacks 30 times in a year1 • 83% of websites have at least one serious vulnerability2 • Web-based attacks increased 30% in 20123 • Web application security measures required by PCI DSS Application Vulnerabilities are Common • On average, 12.1 security issues affect every web application4 • The average web site has 56 serious vulnerabilities5 • The application layer is responsible for over 90% of all security vulnerabilities6 1 Alert Logic State of Cloud Security – Spring 2013 2 Frost & Sullivan: The Growing Hacking Threat to Websites 3 Symantec Corporation: Internet Security Threat Report 2013 4 Context Information Security - Web Application Vulnerability Statistics 2013 5 WhiteHat Website Security Report, May 2013 6 Ponemon Institute - The State of Application Security, August 2013

Public Cloud Shared Security Model Cloud Service Provider Responsibility Foundation Services Hosts • Logical network segmentation • Perimeter security services • External DDoS, spoofing, and scanning prevented • Hardened hypervisor • System image library • Root access for customer • Access management • Patch management • Configuration hardening • Security monitoring • Log analysis Apps • Secure coding and best practices • Software and virtual patching • Configuration management • Access management • Application level attack monitoring • Network threat detection • Security monitoring Networks Customer Responsibility Compute Storage DB Network

Example: SQL Injection 14 … /showitem.asp Choose a category: Select an item: Winter Coats Fleece Jacket Group=10 Item=4534 A customer makes selections in a shopping cart application:

Example: SQL Injection 15 … /showitem.asp?group=10&item=4534 Choose a category: Select an item: Winter Coats Fleece Jacket Group=10 Item=4534 User choices translated into application input

Example: SQL Injection 16 … /showitem.asp?group=10&item=4534;drop table products Choose a category: Select an item: Winter Coats Fleece Jacket An attacker injects harmful code into the URL

Source: Verizon Data Breach Investigation Report, 2013 Result: Downtime, Data Loss 17

Solutions Address Specific Compliance Mandates Alert Logic Solution PCI DSS SOX HIPAA & HITECH Alert Logic Web Security Manager • 6.5.d Have processes in place to protect applications from common vulnerabilities such as injection flaws, buffer overflows and others • 6.6 Address new threats and vulnerabilities on an ongoing basis by installing a web application firewall in front of public-facing web applications. • DS 5.10 Network Security • AI 3.2 Infrastructure resource protection and availability • 164.308(a)(1) Security Management Process • 164.308(a)(6) Security Incident Procedures Alert Logic Log Manager • 10.2 Automated audit trails • 10.3 Capture audit trails • 10.5 Secure logs • 10.6 Review logs at least daily • 10.7 Maintain logs online for three months • 10.7 Retain audit trail for at least one year • DS 5.5 Security Testing, Surveillance and Monitoring • 164.308 (a)(1)(ii)(D) Information System Activity Review • 164.308 (a)(6)(i) Login Monitoring • 164.312 (b) Audit Controls Alert Logic Threat Manager • 5.1.1 Monitor zero day attacks not covered by anti-virus • 6.2 Identify newly discovered security vulnerabilities • 11.2 Perform network vulnerability scans quarterly by an ASV or after any significant network change • 11.4 Maintain IDS/IPS to monitor and alert personnel; keep engines up to date • DS5.9 Malicious Software Prevention, Detection and Correction • DS 5.6 Security Incident Definition • DS 5.10 Network Security • 164.308 (a)(1)(ii)(A) Risk Analysis • 164.308 (a)(1)(ii)(B) Risk Management • 164.308 (a)(5)(ii)(B) Protection from Malicious Software • 164.308 (a)(6)(iii) Response & Reporting Alert Logic Security Operations Center providing Monitoring, Protection, and Reporting

Alert Logic Web Security Manager WAF Page 19 Active Protection for Web Applications, Management Included Positive & Negative Security Active protection using signatures and leading learning engine Key Compliance Coverage Supports PCI 6.6 and OWASP Top 10 risks Management Included 24x7 management by experienced security analysts AWS Auto Scaling Protection scales dynamically with your web apps Security Where You Need It Works wherever you have your datacenter

20 Engineered for AWS Environments Engineered for AWS  Supports auto-scaling & role aware  Automatable with APIs and scripts  Available across multiple regions  Manageable at scale  IP address & topology independant  Usage based utility pricing  Marketplace transactable  AMI and agent deployment options  Network and system visibility  Proven reference architectures Runs on AWS

Web Security Manager Demo

replicatio n AWS Infrastructure Web Traffic Web Server Web Server Web Server Web Server Web Server Web Server Web Server Web Server Database Read Replica Database Read Replica Database Master replica tion VPC A B Elastic Load Balancer Elastic Load Balancer Elastic Load Balancer

replicatio n AWS Infrastructure + Web Security Manager Amazon S3 Configuration Master Auto Recover Elastic Load Balancer Web Traffic Alert Logic Managemen t Web Server Web Server Web Server Web Server App Server App Server App Server App Server Database Database Database replica tion VPC A B Worker Worker Worker Elastic Load Balancer Elastic Load Balancer Elastic Load Balancer

Web Security Manager Free Trial

WAF Free Trial on AWS Marketplace VISIT AWS MARKETPLACE FOR FREE TRIAL: JUNE 10TH – JULY 10TH

Thank You Johnathan Norman Cloud Solutions Architect

Contacts and Q&A Contacts: Alert Logic Info: [email protected] AWS Contact: aws.amazon.com/contact-us

AWS Partner Webcast - Web App Security on AWS: How to Make Shared Security Work for You

by Amazon Web Services

on Jun 16, 2014

Statistics

Views

Actions

0 Embeds 0

Accessibility

Categories

Upload Details

Usage Rights

Report content

AWS Partner Webcast - Web App Security on AWS: How to Make Shared Security Work for You Presentation Transcript