Battle in the Clouds - Attacker vs Defender on AWS
- 1. Battle in the Clouds: Attacker vs Defender on AWS Dani Goland Mohsan Farid
- 3. Hummus Bombing Celery Workers
- 4. Relay 101
- 9. Pivoting isn’t always easy but it sho is fun!
- 10. Everybody Wants To Rule The World
- 11. Shell Yeah!
- 12. Lateral-aly
- 21. Infrastructure As Code (Hashicorp Terraform / AWS Cloudformation)
- 22. Immutable Infrastructure(Hashicorp Packer) • Bake AMIs with Packer • Use Ansible to harden the OS • https://github.com/openstack/ansi ble-hardening
- 23. Secret Management • Hashicorp Vault/AWS SSM Parameter Store • Granular control over access to secrets • Automatic generation of short-lived DB credentials(Vault)
- 24. Interservice Communication • Use TLS • Manage your own keys via Vault • Use Consul Connect sidecar to automatically proxy your traffic encrypted.
- 25. WAF • AWS WAF Custom Rules or Managed Rules • Open Source Solutions Like NAXSI(with NGINX) https://github.com/nbs-system/naxsi
- 26. Example Architecture • ALB à NGINX(w/ NAXSI) à ECS with Consul Connect Sidecar à Vault
- 27. AWS Services Guard Duty – A threat detection service that continuously monitors for malicious activity and unauthorized behavior. Inspector - An automated security assessment service that helps improve the security and compliance of applications deployed on AWS.