Successfully reported this slideshow.
We use your LinkedIn profile and activity data to personalize ads and to show you more relevant ads. You can change your ad preferences anytime.
Upcoming SlideShare
What to Upload to SlideShare
Next

Share

Become a Cloud Security Ninja - RedLock Lab

by RedLock

In order to confidently scale your AWS deployments, continuous security must be built into your continuous integration and continuous delivery architecture. Participate in a series of interactive capture the flag challenges to get hands on experience with DevSecOps. We’ll teach you how to think like a Security Ninja, highlight common mistakes that can have catastrophic consequences, and provide tips to avoid them.

Related Books

Free with a 30 day trial from Scribd

See all

Related Audiobooks

Free with a 30 day trial from Scribd

See all
  • Be the first to like this

Become a Cloud Security Ninja - RedLock Lab

  1. 1. AWS Loft – RedLock Lab session Abstract submitted Become a Cloud Security Ninja In order to confidently scale your AWS deployments, continuous security must be built into your continuous integration and continuous delivery architecture. Participate in a series of interactive capture the flag challenges to get hands on experience with DevSecOps. We’ll teach you how to think like a security ninja, highlight common mistakes that can have catastrophic consequences, and provide tips to avoid them. More specifically, learn how to: - Establish security guardrails in the DevOps process - Detect and remediate risky configurations - Identify vulnerable hosts - Detect and respond to malicious activities - Rapidly investigate incidents We provide the infrastructure necessary for the lab - simply show up with your laptop. Get ready to have some fun and win some exciting prizes!
  2. 2. Lab workflow Suggested agenda/flow 30 minutes “welcome/intro” ● Welcome ● Presentation of agenda and topics that’ll be covered during the lab session. ● Explain flow and rules for the capture the flag challenge. ● Distribute Capture the Flag answer cards to everyone ● Ask everyone to fill out name and contact details to participate in the challenge. ● Ask everyone to separate the answer card into 4 individual cards (one for each capture the flag challenge) ● Ensure everyone is connected to WIFI. ● Ensure everyone can log into the RedLock admin and AWS admin consoles. ● RedLock Console overview / walkthrough / demo (Dashboard, Secure/Report, Investigate and Alerts) Start Capture the flag challenges: ● Present the challenge on the central monitor ● Start the timer (10 minutes) ● Collect capture the flag answers from the participants ● Lecture: Explain the importance of the use case covered in the challenge, and demo how to find the answers for the capture the flag challenge. ● Continue to next challenge.
  3. 3. Capture the flag challenge #1 (20 minutes) Topic: Config & compliance checks and reporting Challenge: Your security and compliance team reviewed the last compliance report, and wants to leverage the RedLock console to find answers for the following: Question #1: Question: How many S3 buckets has been accessible anonymously to the internet within the last month? Answer: Alerts -> Last Month -> find the number of “S3 buckets are accessible to public” alerts Question #2 How many documents are accessible from the internet within the “XX” S3 bucket? Answer: Option #1: Alerts -> “S3 buckets are accessible to public” -> Click the “AWS console link” associated with the “XX” S3 bucket alert to connect to the AWS admin console -> count the number of documents in the bucket. Option #2: Open AWS admin console, find the “XX” S3 bucket, and count the number of files in the bucket. Question #3: Question: The compliance report indicates RDS snapshots are accessible to the public for the “XX” resource in your environment? What’s the AWS CLI command that can be executed to remediate this security risk? Answer A: aws rds --region us-west-1 modify-db-snapshot-attribute --db-snapshot-identifier new-snapshot-public --attribute-name restore --values-to-remove "all" Answer B: aws rds --region us-east-1 modify-db-snapshot-attribute --db-snapshot-identifier new- snapshot-public --attribute-name restore --values-to-remove "all" Answer C: aws rds --region eu-west-1 modify-db-snapshot-attribute --db-snapshot-identifier new-snapshot-public --attribute-name restore --values-to-remove "all" Answer: Alerts -> Last 3 months -> RDS Snapshots are accessible to public -> resolve button Question #4: Find the RDS snapshot accessible to the internet and provide the unique identifier (ARN) associated with the instance? Answer A: arn:aws:rds:eu-west-1:274307705868:snapshot:test-ss Answer B: arn:aws:rds:eu-east-1:274307705868:snapshot:test-ss Answer C: arn:aws:rds:eu-west-1:43207705868:snapshot:test-ss Answer B: arn:aws:rds:eu-east-1:432007705868:snapshot:test-ss
  4. 4. Answer: Alerts -> “RDS snapshots are accessible to public” -> Find and click the “XX” resource in the RedLock admin console. Question #5: Question: The security team has noticed that a number of AWS Security Groups allow internet traffic, including the “default” Security Group. Security wants to understand the number of workloads that has accepted TCP traffic through the “default” security group within the last 2 weeks. Answer: Alerts -> Security Groups Allow Internet Traffic -> hover over the “default” SG -> investigate button -> set time range to the last 2 weeks -> Count the number of workloads. Collect answers Collect all answer cards for challenge #1. RedLock will calculate the score for each attendee Lecture for challenge #1: Explain the above use cases and why each of them are important. Demonstrate how to find the answer for each of the above questions. Remember to demonstrate how to leverage the AWS console link associated with RedLock alerts for easy launch/access to AWS console.
  5. 5. Capture the flag challenge #2 (20 minutes) Topic: Privileged activity monitoring & user behavior analytics Your security team has detected some suspicious user activities for <user_x>, and needs answers for the following questions: Question #1: Question: How many unusual user activities has been detected for <user_x> in October? Answer: Alerts -> Unusual user activity -> set time range to October -> find <user_x> -> click investigate -> select October -> count the number of suspicious activities. Question #2: Question: Why was the user activity for <user_x> identified as suspicious? Answer A: The user logged in from an unusual machine and unusual browser Answer B: The user logged in from an unusual location and performed unusual activities. Answer: Answer B: Question #3: Analyze login behavior within your environment to identify and count the number of users whose credentials may have been compromised due to “impossible time travel” (account compromise) scenarios in October. Answer: Alerts -> set time range to October -> Account Hi-jack attempts -> analyze the alerts, and find plus count the number of alerts related to “impossible time travel”
  6. 6. Question #4: Unusual privileges user activities have been detected within your environment. Leverage the RedLock console to find the number of 'DeleteAccessKey', 'DeleteBucket' , 'DeleteCertificate' actions performed by user “X” within your environment in October. Answer: Investigate -> select October -> event where operation IN ( 'DeleteAccessKey', 'DeleteBucket' , 'DeleteCertificate' ) and user = 'X' Collect answers Collect all answer cards for challenge #2. RedLock will calculate the score for each attendee Lecture for challenge #2: Explain the above use cases and why each of them are important. Demonstrate how to find the answer for each of the above questions.
  7. 7. Capture the flag challenge #3 (20 minutes) Topic: Network Intrusion Detection monitoring and alerting Your DevOps team provisioned a number of new database servers, and accidentally exposed them to the internet. Question #1: Question: How many DB and RDS servers has received inbound traffic from the internet within the last 72 hours? Answer: Investigate -> last 3 days -> run the below query and count the result set network where source.publicnetwork IN ( 'Internet IPs' , 'Suspicious IPs' ) and dest.resource in ( resource where role IN ( 'AWS RDS' , 'Database' )) Question #2: Question: Which security group has led to that the “X” DB workload has received traffic directly from the internet within the last 72 hours? Answer A: Security Group A Answer B: Security Group B Answer C: Security Group C Answer: Investigate -> last 3 days -> run the below query -> click the “X” DB workload -> analyze the security groups, and determine which security allowed internet traffic: network where source.publicnetwork IN ( 'Internet IPs' , 'Suspicious IPs' ) and dest.resource in ( resource where role IN ( 'AWS RDS' , 'Database' )) Question #3: Question: How many DB workloads has exchanged more than 10,000 bytes within the last 72 hours? Investigate -> last 3 days -> run the below query network where source.publicnetwork IN ( 'Internet IPs' , 'Suspicious IPs' ) and dest.resource in ( resource where role IN ( 'AWS RDS' , 'Database' )) and bytes > 10000
  8. 8. Question #4: Question: How many egress attempts from an EC2 instance (instance X) were made to external server on port 25 potentially indicating that the EC2 instance was compromised and used as a spam bot? Answer: Investigate -> last 2 weeks -> run the following query -> click the outbound connection link from suspicious IPs to your email server -> Click “View Details’ on the right -> count the number of outbound attempts. network where source.resource IN ( resource where tag ( 'name' ) = 'X') and dest.port = 25 Collect answers Collect all answer cards for challenge #3. RedLock will calculate the score for each attendee Lecture for challenge #3: Explain the above use cases and why each of them are important. Demonstrate how to find the answer for each of the above questions.
  9. 9. challenge #4 (20 minutes) Topic: Forensics Investigations and incident response Your AWS team has noticed changes and suspicious activities in core AWS configuration settings, and are looking for answers for the following questions: Question #1 Question: How many new Security Groups were created in the environment within the last month? Answer: Investigate -> last month -> count the results from the following query event where operation IN ('CreateSecurityGroup') Question #2: Question; How many workloads received traffic through the “default” Security Group within the last month? Answer: Option #1: Investigate -> last month -> count the results from the following query network where source.publicnetwork IN ( 'Internet IPs' , 'Suspicious IPs' ) and dest.resource IN ( resource where securitygroup.name IN ( 'default' )) Option #2: Security Groups Allows Internet Traffic -> Investigate button for “default” SG alert. Question #3: Question: Has any AWS instances with the tag “Environment” = ”Production” received traffic from suspicious IP addresses within the last week? Answer: Investigate -> last week -> and run the following query network where source.publicnetwork IN ( 'Suspicious IPs' ) and dest.resource IN ( resource where tag ( 'Environment' ) = 'Production ) and bytes >0
  10. 10. Question #4: Your security team has received reports that some of your Database and Web Servers has been compromised due to known host vulnerabilities, and need your help with the following: Question: How many workloads has reported a known host vulnerability within the last 7 days? Answer: Option #1: investigate -> last 7 days -> run the following query: network where dest.resource IN ( resource where alert.type IN ( 'cve' )) Option #2: network where source.ip = 0.0.0.0 and bytes >0 and manually count the number of workloads with “exclamation marks” Question #5: The security team has been notified that an EC2 instance running (host_x) is receiving traffic from internet AND also has known vulnerabilities and need your help to analyze which type of communication has been accepted by <host_x> within the last 2 weeks. Answer: Investigate -> last 2 weeks -> run the following query network where dest.resource IN ( resource where tag ( 'Name') = '<host_x>' ) and source.publicnetwork IN (‘Internet IPs’, ‘Suspicious IPs’) and bytes > 0 Answer A: SSH and Web Answer B: SSH Answer C: SSH, Web and FP Collect answers Collect all answer cards for challenge #4. RedLock will calculate the score for each attendee Lecture for challenge #2: Explain the above use cases and why each of them are important. Demonstrate how to find the answer for each of the above questions.
  11. 11. Wrap-up / prizes (15 minutes) 5 minutes wrap-up / summary of what was covered during the capture the flag challenges. Prizes ● Grand prize goes to the attendee with the most total points for all 4 challenges *) ● The prize for each of the 4 challenges goes to the attendee with the most point for each of the challenges *) ● Attendees can “only” win once. Draw if there is a tie for any of the above.
  12. 12. Capture the flag rules and logistics Each attendee will receive an answer card (see below) - maybe we can create “online” cards.. Each attendee will turn-in their answers after each capture the flag challenge. All correct answers will get a score of 2, and the total score for each challenge will be the sum of the correct answers on the answer card. The winner of each challenge is the one with the most points for each challenge, and if there is a tie we will draw a winner. There will be a prize for each capture the flag challenge. The grand-prize winner is the one with the most points for all 4 capture the flag challenges, and if there is a tie we will draw a winner. Each individual can “only” win once, and will be “excluded” for future drawings after winning a prize.
  13. 13. RedLock capture the flag answer card Capture the flag challenge #1: Config & compliance checks and reporting Participant #: <unique number will be printed on each card> Name: _______________________ Email: _______________________ Phone: _______________________ Answer for question #1: _______________________ Answer for question #2: _______________________ Answer for question #3: _______________________ Answer for question #4: _______________________ Answer for question #5: _______________________ ------------------------ cut answer card here ----------------------- Capture the flag challenge #2: User anomaly & user comprise monitoring and alerting Participant #: <unique number will be printed on each card> Answer for question #1: _______________________ Answer for question #2: _______________________ Answer for question #3: _______________________ Answer for question #4: _______________________ ------------------------ cut answer card here ----------------------- Capture the flag challenge #3: Network Intrusion Detection monitoring and Alerting Participant #: <unique number will be printed on each card> Answer for question #1: _______________________ Answer for question #2: _______________________ Answer for question #3: _______________________ Answer for question #4: _______________________ ------------------------ cut answer card here ----------------------- Capture the flag challenge #4: Forensics Investigations and incident response Participant #: <unique number will be printed on each card> Answer for question #1: _______________________ Answer for question #2: _______________________ Answer for question #3: _______________________ Answer for question #4: _______________________ Answer for question #5: _______________________

by RedLock In order to confidently scale your AWS deployments, continuous security must be built into your continuous integration and continuous delivery architecture. Participate in a series of interactive capture the flag challenges to get hands on experience with DevSecOps. We’ll teach you how to think like a Security Ninja, highlight common mistakes that can have catastrophic consequences, and provide tips to avoid them.

Views

Total views

490

On Slideshare

0

From embeds

0

Number of embeds

1

Actions

Downloads

0

Shares

0

Comments

0

Likes

0

×