9월 웨비나 - AWS에서의 네트워크 보안 (이경수 솔루션즈 아키텍트)

Editor's Notes

• #5: TCP “3 Way handshaking” 과정에서 2단계 까지만.. 3단계 ack가 올때까지 약 75초 동안 대기. Backlog queue에 계속 쌓임. 1단계.  A 클라이언트는 B 서버에 접속을 요청하는 SYN 패킷을 보낸다.2단계.  B 서버는 요청을 받고 A 클라이언트에게 요청을 수락한다는  SYN 패킷과 ACK 패킷을 발송한다. 3단계.  A 클라이언트는 B 서버에게 ACK 를 보내고 이후로부터 연결이 이루어지고         본격적으로 데이터가 교환된다. 해당 port만 영향. 잘 모르는 경우가 많음. netstat -na|grep SYN_RECV가 많으면 공격
• #7: Looks real. Identify a very expensive resource Flood, exhaust the available connections. Complex. Slow Lo They are hard to detect as they look like valid connections from a slow user. Keep the connection open
• #8: Looks real. Identify a very expensive resource Flood, exhaust the available connections. Complex. Slow Lo They are hard to detect as they look like valid connections from a slow user. Keep the connection open
• #12: The first thing we want to look at is the standard flow of an API call, including all components in the system First, a request comes in from a client, this could be a mobile device, a web application or a backend service The requests arrives at one of our CloudFront PoP locations, it’s accepted and routed through to the API Gateway in the customer’s region The API Gateway receives the request, then checks for records in the dedicated cache (if it is configured). If there are no cached records available then it will forward the request to the backend for processing The backend can be a Lambda function, a web service running on Amazon EC2, or any other publicly accessible web service Once the backend has processed the request the API call metrics are logged in Amazon CloudWatch and the content is returned to the client
• #15: Here is a simple, single-layer web application spanning two availability zones in a single region. This one supports auto-scaling. We’ll use this model to discuss how we might achieve our objective of passively monitoring network traffic to and from the web servers.
• #18: Hide your origin URL/IP address. Make attackers attack AWS and not you. Create hosted zone: www.example.com Create A record set Create alias to CNAME Point alias to CloudFront URL Point CloudFront origin to ELB
• #22: Shuffle Sharding 샤딩은 수평적인 데이터의 파티션들이 여러 대의 데이터베이스 서버로 분산되어 처리됨으로써 이중화 기능을 제공하는 것을 뜻합니다. 이와 유사하게 Amazon Route 53은 셔플 샤딩을 활용해 여러 곳의 PoP 으로 DNS 요청을 나누어 보냄으로써 여러분의 어플리케이션까지 도달하는 복수의 경로를 제공해 줍니다. Anycast Routing 애니캐스트 라우팅 (Anycast Routing)은 여러 곳의PoP에서 같은IP주소를 사용함으로써 서비스의 가용성을 높여줍니다. 만약 DDoS 공격이 어느 하나의 PoP을 공격하여 무력화 시킬지라도, 셔플 샤딩을 통해 해당 장애가 한 곳으로만 국한되며 나머지 경로들을 통해 여러분의 인프라까지 이상없이 서비스 할 수 있습니다.
• #26: At AWS we have a number of levels of ways for you to get help. It’s best to start with your account manager, who can act as your advocate. We also have Solutions Archtiects who are your chief technical points of contact. They’re very knowledgeable and are a fantastic resource for you to bounce ideas off, and get technical feedback on what you’re trying to do. WE have several tiers of support within AWS, but if you’re running sensitive workloads in AWS then we would strongly recommend buying either Business level or Enterprise level support. Business level support provdes phone, chat and email support, with a 1 hour response time. With enterprise support you get a quicker response time, but you also get a dedicated Technical Account Manager, who can also act as an additional advocate for you at AWS. Not only that, but if there is a problem, and you have Enterprise support, then your Technical Account Manger will reach out to you to let you know about it and what you should do about it.
• #49: RICH
• #50: RICH AWS WAF gives customers the web security features they need, but with an approach to security that’s unique in three ways: First…
• #51: TOM
• #52: TOM ….more to come later when we talk about a specific partner integration
• #53: ?x=test%27%20UNION%20ALL%20select%20NULL%20— http://dcixkh72iufmo.cloudfront.net