Free AI web copilot to create summaries, insights and extended knowledge, download it at here

Abstract

ils due <span class="hljs-keyword">to</span> loss <span class="hljs-keyword">of</span> network connectivity</pre></div><div id="a2b0"><pre><span class="hljs-number">3</span>. VPC flow logs - captures <span class="hljs-built_in">IP</span> traffic going in <span class="hljs-keyword">and</span> out of your network interfaces <span class="hljs-keyword">and</span> subnets</pre></div><div id="6871"><pre><span class="hljs-number">4.</span> GuardDuty - tool <span class="hljs-keyword">that</span> uses machine learning <span class="hljs-keyword">to</span> detect anomalies</pre></div><div id="d23e"><pre><span class="hljs-number">5.</span> SecurityHub - single page glass <span class="hljs-keyword">view</span> <span class="hljs-keyword">of</span> high priority <span class="hljs-keyword">security</span> alerts</pre></div><div id="7843"><pre><span class="hljs-number">6.</span> AWS Config - continuous monitoring <span class="hljs-keyword">and</span> assessment service <span class="hljs-keyword">to</span> help detect non-compliance configurations <span class="hljs-keyword">in</span> almost <span class="hljs-built_in">real</span> <span class="hljs-built_in">time</span></pre></div><h2 id="aa68">Infrastructure Protection</h2><p id="fa45">Usually, the most important service for a business is the EC2 instance. The protection of the EC2 instance is done in 3 layers. The <b>first layer</b> is the <b>Security Groups </b>which act as a built-in firewall to control traffic. The <b>second layer </b>is the <b>Network ACLs</b> (Access Control Lists) and the <b>third layer</b> is the<b> Subnet Routing </b>which is used to group instances and AWS resources based on security and operational needs.</p><p id="2ce4">The most important tools here are the following:</p><div id="2b4d"><pre><span class="hljs-number">1</span>. AWS System Manager - used for deploying automation <span class="hljs-keyword">scripts </span>for <span class="hljs-keyword">instances </span></pre></div><div id="1aac"><pre><span class="hljs-number">2</span>. <span class="hljs-keyword">CloudFormation </span>- automates <span class="hljs-keyword">and </span>simplifies the task of repeatedly creating <span class="hljs-keyword">and </span>deploying AWS resources</pre></div><div id="02cb"><pre><span class="hljs-number">3.</span> <span class="hljs-keyword">Direct</span> Connect - tool used for establishing <span class="hljs-keyword">private</span> connection between AWS service and the <span class="hljs-keyword">data</span> center</pre></div><h2 id="3d66">Data Protection</h2><p id="e782">Data, for any business, is the most important currency. In AWS there are several tools that provide data protection:</p><div id="adc4"><pre><span class="hljs-number">1</span>. KMS - service for creating <span class="hljs-keyword">and</span> controlling encryption keys.</pre></div><div id="6007"><pre><span class="hljs-bullet">2.</span> Certificate Manager - for managing SSL/TLS certificates</pre></div><div id="256c"><pre><span class="hljs-number">3.</span> Macie - tool that uses machine learning <span class="hljs-keyword">to</span> classify, discover <span class="hljs-literal">and</span> <span class="hljs-keyword">protect</span> sensitive <span class="hljs-built_in">data</span></pre></div><div id="1694"><pre><span class="hljs-number">4</span>. <span class="hljs-type">Glacier</span> - infrequently used <span class="hljs-class"><span class="hljs-keyword">data</span> storage device, also called cold <span class="hljs-keyword">data</span></span></pre></div><div id="0325"><pre><span class="hljs-number">5.</span> Amazon S3 - storage <span class="hljs-keyword">for</span> data, where <span class="hljs-keyword">the</span> data stored can have client-side encryption (<span class="hljs-built_in">encrypt</span> data <span class="hljs-keyword">before</span> sending) <span class="hljs-keyword">or</span> server-side encryption (<span class="hljs-built_in">encrypt</span> data <span class="hljs-keyword">after</span> <span class="hljs-keyword">it</span> has been received <span class="hljs-keyword">by</span> <span class="hljs-keyword">the</span> service)</pre></div><h2 id="d18f">Incident Response</h2><p id="eb08">Besides all the efforts of protecting data, an incident still might happen, so every business should have an incident response plan to be able to take action at any time. AWS provides several tools and methods to keep you prepared:</p><div id="8201"><pre><span class="hljs-number">1.</span> API <span class="hljs-keyword">for</span> Automation - automate <span class="hljs-keyword">routine</span> tasks <span class="hljs-keyword">to</span> be performed <span class="hljs-

Options

keyword">when</span> incident response should take action</pre></div><div id="78d8"><pre><span class="hljs-number">2</span>. Forensics <span class="hljs-keyword">on</span> Data Volume - EBS snapshots <span class="hljs-keyword">to</span> see the <span class="hljs-keyword">state</span> of the disk</pre></div><div id="14a3"><pre><span class="hljs-number">3.</span> Cloud Formation - <span class="hljs-keyword">to</span> quickly <span class="hljs-keyword">create</span> <span class="hljs-built_in">new</span>, <span class="hljs-keyword">trusted</span> environment <span class="hljs-keyword">in</span> which <span class="hljs-keyword">to</span> conduct a deeper investigation, deploy pre-configured instances <span class="hljs-keyword">in</span> this isolated environment that contains <span class="hljs-keyword">all</span> the necessary tools forensic teams need <span class="hljs-keyword">to</span> determine the cause <span class="hljs-keyword">of</span> the incident</pre></div><div id="85ce"><pre><span class="hljs-number">4.</span> Step <span class="hljs-keyword">Functions</span> - <span class="hljs-keyword">to</span> coordinate multiple AWS services <span class="hljs-keyword">into</span> <span class="hljs-keyword">server</span>-less workflows <span class="hljs-keyword">to</span> build <span class="hljs-keyword">and</span> <span class="hljs-keyword">update</span> applications quickly</pre></div><h2 id="08e9">DDoS Mitigation</h2><p id="8493">AWS provides a defense-in-depth model against DDoS attacks. This can be done with 3 tools:</p><div id="7b23"><pre><span class="hljs-number">1.</span> Route <span class="hljs-number">53</span> - connects user requests <span class="hljs-keyword">to</span> infrastructure <span class="hljs-built_in">running</span> <span class="hljs-keyword">on</span> AWS</pre></div><div id="55bc"><pre><span class="hljs-number">2</span>. CloudFront - <span class="hljs-selector-tag">a</span> web service that speeds up distribution of your static and dynamic web <span class="hljs-attribute">content</span>, such as . <span class="hljs-selector-tag">html</span>, . css, . js, and image files, <span class="hljs-selector-tag">to</span> your users. It delivers your <span class="hljs-attribute">content</span> through <span class="hljs-selector-tag">a</span> worldwide network of data centers called edge locations.</pre></div><div id="ce12"><pre><span class="hljs-number">3.</span> AWS Shield - which <span class="hljs-keyword">is</span> a DDoS protection service <span class="hljs-keyword">that</span> safeguards applications <span class="hljs-keyword">that</span> <span class="hljs-built_in">run</span> <span class="hljs-keyword">on</span> AWS</pre></div><p id="a220">Another very important tool in DDoS mitigation is:</p><div id="6515"><pre>AWS WAF - which <span class="hljs-keyword">is</span> tool <span class="hljs-keyword">that</span> helps protect web applications <span class="hljs-keyword">from</span> common web exploits <span class="hljs-keyword">that</span> could affect <span class="hljs-built_in">application</span> availability. Web App Firewall gives control <span class="hljs-keyword">on</span> which traffic <span class="hljs-keyword">to</span> allow <span class="hljs-keyword">or</span> block <span class="hljs-keyword">by</span> defining customizable web security rules.</pre></div><p id="7fe5">This is a quick overview of the kind of security you can implement in AWS and the tools and resources provided.</p><p id="6927">More information on AWS Security can be found on their official page.</p><figure id="1ef4"><img src="https://cdn-images-1.readmedium.com/v2/resize:fit:800/0*Piks8Tu6xUYpF4DU"><figcaption></figcaption></figure><p id="e5d4"><b>Subscribe to <a href="https://www.faun.dev/join?utm_source=medium.com/faun&utm_medium=medium&utm_campaign=faunmediumprebanner">FAUN topics</a> and get your weekly curated email of the must-read tech stories, news, and tutorials </b>🗞️</p><p id="9b5e"><b>Follow us on <a href="https://twitter.com/joinfaun">Twitter</a> </b>🐦<b> and <a href="https://www.facebook.com/faun.dev/">Facebook</a> </b>👥<b> and <a href="https://instagram.com/fauncommunity/">Instagram</a> </b>📷 <b>and join our <a href="https://www.facebook.com/groups/364904580892967/">Facebook</a> and <a href="https://www.linkedin.com/company/faundev">Linkedin</a> Groups </b>💬</p><figure id="193b"><img src="https://cdn-images-1.readmedium.com/v2/resize:fit:800/1*_cT0_laE4iPcqW1qrbstAg.gif"><figcaption></figcaption></figure><h2 id="3062">If this post was helpful, please click the clap 👏 button below a few times to show your support for the author! ⬇</h2></article></body>

AWS Security Fundamentals

AWS Security tools are divided into 6 crucial components that form the pyramid of AWS Security. Those are:

1. Identity and Access Management
2. Detective Controls
3. Infrastructure Protection
4. Data Protection
5. Incident Response
6. DDoS Mitigation

Identity and Access Management

The tools used for Identity and Access Management in AWS are:

1. AWS IAM Users and Groups - mechanism for creating and managing individual users and their permissions

2. Secrets Manager - to manage secrets used to access AWS resources

3. Single Sign-On - centralized sign-on

4. Security Token Service - web service that enables to request temporary, limited privilege credentials for IAM users taking on a different role

5. Directory Service - active directory on Cloud built on Microsoft Active Directory

6. AWS Organizations - centrally manage and enforce policies for multiple AWS accounts

7. Cognito - lets you add user sign-in, sign-up and access control to web and mobile applications. Can define roles and map users to different roles so your application can access only the resources that are authorized for each user

8. User-Pool - user directory that manages the overhead of managing the tokens returned from social sign-in providers

Detective Controls

Detective Controls in AWS means Capturing and Collecting Logs and Auditing.

The most important tools for this that AWS provides are:

1. CloudTrail - records API calls made on your account. This info helps you track changes made to your AWS resources, troubleshoot operational issues, ensure compliance with internal policies and regulatory standards

2. CloudWatch - triggers actions, monitors logs, reacts to unexpected events, can automatically recover via Lambda functions if fails due to loss of network connectivity

3. VPC flow logs - captures IP traffic going in and out of your network interfaces and subnets

4. GuardDuty - tool that uses machine learning to detect anomalies

5. SecurityHub - single page glass view of high priority security alerts

6. AWS Config - continuous monitoring and assessment service to help detect non-compliance configurations in almost real time

Infrastructure Protection

Usually, the most important service for a business is the EC2 instance. The protection of the EC2 instance is done in 3 layers. The first layer is the Security Groups which act as a built-in firewall to control traffic. The second layer is the Network ACLs (Access Control Lists) and the third layer is the Subnet Routing which is used to group instances and AWS resources based on security and operational needs.

The most important tools here are the following:

1. AWS System Manager - used for deploying automation scripts for instances

2. CloudFormation - automates and simplifies the task of repeatedly creating and deploying AWS resources

3. Direct Connect - tool used for establishing private connection between AWS service and the data center

Data Protection

Data, for any business, is the most important currency. In AWS there are several tools that provide data protection:

1. KMS - service for creating and controlling encryption keys.

2. Certificate Manager - for managing SSL/TLS certificates

3. Macie - tool that uses machine learning to classify, discover and protect sensitive data

4. Glacier - infrequently used data storage device, also called cold data

5. Amazon S3 - storage for data, where the data stored can have client-side encryption (encrypt data before sending) or server-side encryption (encrypt data after it has been received by the service)

Incident Response

Besides all the efforts of protecting data, an incident still might happen, so every business should have an incident response plan to be able to take action at any time. AWS provides several tools and methods to keep you prepared:

1. API for Automation - automate routine tasks to be performed when incident response should take action

2. Forensics on Data Volume - EBS snapshots to see the state of the disk

3. Cloud Formation - to quickly create new, trusted environment in which to conduct a deeper investigation, deploy pre-configured instances in this isolated environment that contains all the necessary tools forensic teams need to determine the cause of the incident

4. Step Functions - to coordinate multiple AWS services into server-less workflows to build and update applications quickly

DDoS Mitigation

AWS provides a defense-in-depth model against DDoS attacks. This can be done with 3 tools:

1. Route 53 - connects user requests to infrastructure running on AWS

2. CloudFront -  a web service that  speeds up distribution of your static and dynamic web content, such as .  html, . css, . js, and image files, to your users. It delivers your content through a worldwide network of data centers called edge locations.

3. AWS Shield - which is a DDoS protection service that safeguards applications that run on AWS

Another very important tool in DDoS mitigation is:

AWS WAF - which is tool that helps protect web applications from common web exploits that could affect application availability. Web App Firewall gives control on which traffic to allow or block by defining customizable web security rules.

This is a quick overview of the kind of security you can implement in AWS and the tools and resources provided.

More information on AWS Security can be found on their official page.

Subscribe to FAUN topics and get your weekly curated email of the must-read tech stories, news, and tutorials 🗞️

Follow us on Twitter 🐦 and Facebook 👥 and Instagram 📷 and join our Facebook and Linkedin Groups 💬