AWS_Security_Dashboard_AWS_Community_Days_2022.pdf

AWS provides Security Hub as a single pane of glass for security visibility over an organization. The dashboard it provides leaves a few things to be desired as it is pretty hard to understand what the provided percentage means as far as security posture is concerned and the details provided do not make things easily actionable. At Schuberg Philis we have created a project were we "energy label" accounts and landing zones and have build a dashboard to make the data provided actionable for engineers to easily follow up with the findings and remediation.

Transcript

1. Why measuring Cloud Security matters AWS Community Days 03/10/2022 Costas Tyfoxylos, Sayantan Khanra, Jenda Brands and Theodoor Scholte
2. Cloud platform and workloads Landing Zone & Building Blocks Public Cloud Provider PaaS/IaaS Customer Workload A Customer Workload B Customer Workload X
3. Analogy and similarities Building foundations and public clouds • Foundations are essential for a building’s structure • Dimensions, sizing and types are dependent on the use and the environment • Foundations are invisible, especially their state, to the owners of the entire structure • Foundations may deteriorate (over time) depending on the circumstances which remains under the surface and has impact…
4. Groningen Amsterdam Cologne
5. Security problems in the Cloud scale extremely well August 2021: A flaw in Microsoft Azure Cosmos DB allowed unauthorized access to secrets, exposing data of thousands of companies https://www.crn.com/news/security/microsoft-azure-cosmos-db-vulnerability-allows-manipulation-of-customer-data-report
6. Differences Building foundations and public clouds • Foundations are all physical, clouds are… • Knowledge and awareness about risks • Adoption of quality standards and norms • Measurable quality allowing modeling, simulations and inspections
7. Schuberg Philis’ Integrated Control Framework DNB Good Security Practices ISO27017 PCI DSS v3
8. secure secure AWS Account / AWS Landing Zone
9. What is measured? Exposure In particular, we measure: • Number of open findings in AWS Security Hub. • The severity of each finding. • The duration that the finding is unresolved / open which is an indicator for the window of exposure.
12. How to measure Documentation https://awsenergylabelerlib.readthedocs.io/en/latest/ https://aws-energy-labeler-cli.readthedocs.io/en/latest/ Source code https://github.com/schubergphilis/awsenergylabelerlib https://github.com/schubergphilis/awsenergylabelercli
13. How to measure? First step: rating an AWS account Rating is based on thresholds for number of findings and criticality Label # of critical and high findings # of medium findings # of low findings A <= 0 <= 10 <=20 B <= 10 <= 20 <= 40 C <= 15 <= 30 <= 60 D <= 20 <= 40 <= 80 E <= 25 <= 50 <= 100 F
14. Security scoring Examples account ratings Example 1 • 0 high and critical findings • 5 medium findings • 15 low findings Account Rating: A Example 2 • 12 high and critical findings • 35 medium findings • 40 low findings Account Rating: D Example 3 • 30 high and critical findings • 2 medium findings • 3 low findings Account Rating: F
15. How to measure? Second step: rating a Landing Zone Thresholds for percentages of accounts Label Thresholds A At least 90% of accounts have a “A” rating B At least 70% of accounts have a “B” rating or higher C At least 50% of accounts have a “C” rating or higher D At least 30% of accounts have a “D” rating or higher E At least 20% of accounts have a “E” rating or higher F
16. Security scoring Examples landing zone ratings Example 1 100 accounts • 20 accounts have an “A” rating • 80 accounts have a “F” rating Landing Zone Rating: • 20% of accounts have an “E” or higher rating • Therefore, the landing zone has an “E” rating Example 2 100 accounts • 19 accounts have an “A” rating • 81 accounts have a “F” rating Landing Zone Rating: • Less than 20% of the accounts have an “E” or higher rating. • Therefore, the landing zone has an “F” rating Example 3 100 accounts • 15 accounts have an “A” rating • 25 accounts have a “C” rating • 25 accounts have a “D” rating • 35 accounts have a “F” rating Landing Zone Rating: • 65% of accounts have a “D” or higher rating • Therefore, the landing zone has a “D” rating. Label Thresholds A At least 90% of accounts have a “A” rating B At least 70% of accounts have a “B” rating or higher C At least 50% of accounts have a “C” rating or higher D At least 30% of accounts have a “D” rating or higher E At least 20% of accounts have a “E” rating or higher F
17. Proof of concept with two use cases based on AWS native technologies
18. First use case: security visibility of one AWS Landing Zone SBP Managed AWS Account 1 SBP Managed AWS Account 3 SBP Managed AWS Account 2 AWS Security Hub AWS Security Hub AWS Security Hub MCE AWS BASELINE Security Dashboard AWS QuickSight SBP AWS Customer A CISO Architect Product Owner IT Program Manager Auditor Customer access Schuberg Philis’ Customer Team A Customer Director • The customer or customer team wants to know which workloads require extra attention from a security point of view. • AWS QuickSight Dashboard showing the security status of the Landing Zone.
20. Second use case: central security visibility of multiple AWS Landing Zones SBP Managed AWS Account 1 SBP Managed AWS Account 3 SBP Managed AWS Account 2 AWS Security Hub AWS Security Hub AWS Security Hub MCE AWS BASELINE Security Dashboard AWS QuickSight SBP AWS Customer A CISO Architect Product Owner IT Program Manager Auditor Customer access Schuberg Philis’ Customer Team A Customer Director SBP Managed AWS Account 1 SBP Managed AWS Account 3 SBP Managed AWS Account 2 AWS Security Hub AWS Security Hub AWS Security Hub MCE AWS BASELINE Security Dashboard AWS QuickSight SBP AWS Customer B CISO Architect Product Owner IT Program Manager Auditor Customer access Schuberg Philis’ Customer Team B Customer Director AWS CENTRAL Security Dashboard AWS QuickSight CISO Security Team
22. Bridging the Gap… Between building foundations and public clouds ü Knowledge and awareness about risks ü Adoption of quality standards and norms ü Measurable quality allowing modeling, simulations and inspections
23. Questions Interested? Come and join us: careers.schubergphilis.com
24. Other interesting sessions by our colleagues 12.30 Daan Stakenburg – How to get from AWS' Shared Responsibility Model to a Happy Customer 12.30 Jacob Verhoeks – Stepfunctions Advanced Design Patterns 14.30 Enri Peters – Build your 1st CRUD API in 60mins with AWS CDK! 16.45 Martijn van Dongen – Fireside Chat with Dr. Werner Vogels 19.45 Enri Peters – How I failed to become an AWS Community Builder 20.30 Martijn van Dongen – Cloud Education At Scale 20.30 Jos Vliegenthart – Cloud exit as a service (CEaaS) Interested? Come and join us: careers.schubergphilis.com
25. It’s the people, actually. Costas Tyfoxylos, Sayantan Khanra, Jenda Brands and Theodoor Scholte Interested? Come and join us: careers.schubergphilis.com