A couple of ideas on the safety bulletins thus far at AWS re:Invent
Extra AWS Safety Posts
On this publish I am simply compiling among the safety bulletins in AWS re:Invent. I will have to return and take a more in-depth take a look at them later as sadly and thankfully somebody employed me to show a category throughout re:Invent.
I am undecided after I’ll be talking at a big convention once more, however I attempt to sustain with what persons are speaking about primarily based on what data I discover on-line. Today I are inclined to prioritize what drives the enterprise and makes cash to be sincere as I journey much less. However I actually miss seeing my pals at re:Invent!
Here is my preliminary response to the adverts, however once more, with out all the small print and it is a lady’s prerogative to vary her thoughts. 🙂
Safe community entry with out VPN to company functions
Many options are taking totally different approaches to distant entry. There are lots of options that attempt to join individuals on the software layer, quite than the community layer within the OSI mannequin. Some are attention-grabbing, others not a lot. With out diving into the answer, that is what you need to ask:
- If somebody will get your credentials or an energetic session, can they use them from an alternate community location to get to the host the place you are lastly related and dealing? In that case, it is an identification answer, not a community answer.
- Does the encryption used to connect with the distant host encrypt all people community site visitors to the distant host or simply site visitors on a specific protocol? As I’ve written earlier than, some VPNs are higher than others in that regard (SSL vs. IPSEC).
- Does the answer can help you examine all community site visitors (accepted, rejected, or failed) on all ports between the distant host and the vacation spot endpoint?
- Are you able to see the whole packages? Some assaults under the appliance layer within the OSI mannequin is probably not seen if you cannot see all the small print of the community packets, as I defined in different posts.
- When somebody connects to the distant endpoint, can others entry that distant endpoint over the Web? Once you connect with a VPN, the VPN endpoint is uncovered, however there aren’t any hosts contained in the community if you’re not related to the VPN. I as soon as ran a penetration check the place one of many targets was to see if the bastion host was weak. Basically, I reverse engineered the truth that the bastion host was behind a VPN, so the one means it might be weak is that if it might get via the VPN first. That’s what a VPN does for you. When hosts are straight uncovered to the Web with none layers between them, they’re open to direct assault from the Web.
- Are you able to handle all entry from one level or do you must individually handle each host uncovered to the Web for distant entry? If you cannot handle them centrally, you have exponentially elevated administration and danger. Errors and misconfigurations accounted for 13% of safety incidents within the 2022 Verizon Knowledge Breach Report, so that you need to cut back the possibility of misconfiguration by lowering what you must handle. A VPN does that (as does the automation I wrote about right here for per-user situations that use a single script for deployment to some extent – there are tradeoffs to that strategy vs. VPN, nevertheless it’s higher than exposing each host to the Web). I assume this new service is a centralized answer, however I have not regarded into it.
If this new answer meets the entire above standards, then it may be a VPN alternative. More often than not, when firms promote an answer as a VPN alternative, they’re really not, however maybe Amazon has cracked the nut with this new service.
When it comes to new app-based safety approaches, one cool factor about them is that when somebody connects to an app, they cannot “scan the community” within the conventional sense with a instrument like nmap. I have not inspected this but to see if it is that form of answer or one thing else.
VPC community
This appears very attention-grabbing if it may well assist arrange a zero belief community for service to service communication. I have been writing about serverless networking in my newest weblog sequence on automating cybersecurity metrics and this service may help. I will need to test it out. For individuals simply beginning to construct functions, serverless is less complicated than all of the configuration you must do to arrange Kubernetes and even EC2. Associated networks, not a lot. Possibly it will assist.
Once more, you will need to examine that it meets the identical community necessities because the VPN above to find out if it is really a community answer or an identification answer.
AWS KMS Exterior Key Retailer
This service appears nice for organizations that must host keys on premises however need to combine with KMS. Typically clients need to management their very own key or want the important thing to be accessible on a personal community and on AWS (though I would not be too excited in regards to the potential latency in that case). This may help some bigger organizations with compliance constraints or excessive safety wants.
AWS Inspector: Lambda Vulnerability Scan
Superior. You will want to try the actual programming languages ​​and vulnerabilities you discover, however that is nice information! I’ll undoubtedly attempt it.
Automated Knowledge Discovery for Macie
Macie needs that can assist you discover the place automated knowledge exists that you just won’t pay attention to in S3 buckets. As with knowledge exfiltration instruments, I assume it will have to be monitored and tuned for false positives. Knowledge exfiltration and the identification of delicate knowledge is at all times a problem. Burp typically identifies random strings comparable to bank cards, for instance, in penetration exams that aren’t really bank cards. He could also be ready to take a position the sources to handle this instrument, nevertheless it ought to have the opportunity that can assist you discover your delicate knowledge and lock it down.
Permissions verified by Amazon
Amazon calls this new characteristic:
a scalable and granular permission administration and authorization service for customized functions
If it is what I feel it’s, I as soon as wrote one thing like this. We had a central automation service that might learn the configuration recordsdata and permit or deny actions primarily based on the configuration recordsdata written by the builders. The builders didn’t have to write down the code to authorize actions, however quite outline the actions allowed for a specific sort of consumer.
It additionally sounds just like Open Coverage Agent (OPA) which got here out later and is an idea I actually like. I will need to attempt it out to see if it is what it appears like.
Automated failback on AWS for AWS Elastic Catastrophe Restoration
This new characteristic appears attention-grabbing. We should see if it helps with Ransomware.
Backup for CloudFormation stacks
This additionally appears fairly attention-grabbing. I sit up for making an attempt this.
Redshift Backup
Helpful for many who use Redshift to revive when wanted.
New: Failover controls for Amazon S3 multi-region entry factors
One other service to examine and check for these creating automated failover within the occasion of an AWS outage or safety incident. When S3 has issues, many functions have issues. Failover with S3 could be difficult. Hopefully this makes it simpler.
Amazon Safety Lake
Knowledge storage utilizing the OCSF customary. That is undoubtedly one thing for safety individuals to take a look at who has to take care of all the safety logs in a company. In the event you take part within the preview, you could possibly present helpful suggestions to assist push the modifications in the correct route to satisfy your wants.
Configuration Guidelines — Proactive Enforcement
Proactive is best than reactive. That is undoubtedly price testing. In a single surroundings I labored in, a community compliance instrument would roll again a non-compliant change in three minutes. And that was across the time somebody on the safety group wanted to open entry to his occasion and make a configuration change that he wanted. Once I confronted him about it, he mentioned it was a “dumb instrument”. It wasn’t, nevertheless it exhibits the necessity to stop change if attainable, quite than react after it is too late.
Management Tower — Complete Management Administration
Management Tower is a much-needed service, however as I’ve written earlier than, some issues are a bit difficult whenever you’re making an attempt to make use of and keep it. However the idea is on level and I am excited to see this.
Amazon EventBridge Pipelines
This is not precisely a safety characteristic, but when it helps enhance consistency and reduces complexity via abstraction, it may well assist total safety in a company by connecting companies asynchronously.
Wickr: end-to-end encryption for communication companies
There’s! I used to be in search of extra data on end-to-end encryption in my final Amazon Chime weblog publish. It isn’t clear that the communication is definitely end-to-end encrypted primarily based on the documentation. I am undecided if Amazon Chime makes use of this service or is end-to-end encrypted or not primarily based on what I discovered, but when it must be, this service may help as a result of it clearly is.
New: Amazon ECS Service Join permits simple communication between microservices
This service sounds just like Lattice (above) however for ECS.
CloudWatch Log Knowledge Safety
Appears to detect delicate knowledge in logs. It’s undoubtedly price testing.
CloudWatch cross-account observability
I wrote about some points with cross account registration for KMS. I feel that is going to be a really, very helpful characteristic and I sit up for making an attempt it out and presumably running a blog about it later in my newest weblog sequence the place I am constructing a cloud safety structure for batch jobs (and actually anything). ).
Runtime risk detection of containers on guard responsibility
This was introduced on the AWS keynote by Adam Selipsky. I do not see it within the AWS information bulletins but, however I discovered this publish from November.
I wrote about that and another security-related options right here after watching the AWS keynote.
I’ll have missed one thing and there’s a bit additional to go in AWS re:Invent. I’ll replace this publish if I see something new.
Comply with for updates.
teri radichel
In the event you favored this story please applaud Y proceed:
**************************************************** ** ****************
Medium: Teri Radichel or E mail Listing: Teri Radichel
Twitter: @teriradichel both @2ndSightLab
Request companies via LinkedIn: Teri Radichel or IANS Analysis
**************************************************** ** ****************
© second sight lab 2022
_____________________________________________
Creator:
Cybersecurity for executives within the cloud period at Amazon
Do you want cloud safety coaching? 2nd Sight Lab Cloud Safety Coaching
Is your cloud safe? Rent 2nd Sight Lab for a penetration check or safety evaluation.
Do you may have a query about cybersecurity or cloud safety? Ask Teri Radichel by scheduling a name with IANS Analysis.
Cybersecurity and Cloud Safety Assets by Teri Radichel: Cybersecurity and cloud safety lessons, articles, white papers, shows, and podcasts
– Security Announcements at AWS re:Invent 2022 | by Teri Radichel | Cloud Security | Dec, 2022
