Ransomware Risk Management on AWS Using the NIST Cyber Security Framework (CSF)
 
https://d1.awsstatic.com/whitepapers/Security/ransomware-risk-management-on-aws-using-csf.pdf
 
Если попытаться отразить все аспекты безопасности из данного документа в сервисах AWS, то получится следующий (длинный) список.
 
🔹 Basic
Use antivirus software at all times.
▪️ Marketplace
Keep computers fully patched.
▪️ SSM Patch Manager
Block access to ransomware sites.
▪️ Route 53 Resolver DNS Firewall
▪️ Network Firewall
▪️ NACL
Allow only authorized apps.
▪️ SSM State Manager
Use standard user accounts
▪️ IAM
Make an incident recovery plan.
▪️ AWS Security Incident Response Guide
Backup and restore.
▪️ EBS Snapshots
▪️ Backup
▪️ CloudEndure Disaster Recovery
▪️ CodeCommit
Keep your contacts.
▪️ AWS Security Incident Response Guide
 
🔸 NIST Practice Guide goals
Backup
▪️ EBS Snapshots
▪️ Backup
▪️ CloudEndure Disaster Recovery
▪️ CodeCommit
Corruption testing
▪️ Config Rules
▪️ SSM State Manager
Denylisting
▪️ EC2 Security Groups
▪️ Route 53 Resolver DNS Firewall
▪️ Network Firewall
▪️ VPC endpoints
▪️ WAF
▪️ WAF Security Automations
▪️ WAF-Managed Rules
▪️ NACL
Event detection
▪️ GuardDuty
▪️ Macie
▪️ Network Firewall
Forensics and analytics
▪️ Detective
▪️ GuardDuty
▪️ Network Firewall
Integrity monitoring
▪️ ECR
▪️ Macie
▪️ Config Rules
▪️ Lambda function versioning
▪️ SSM State Manager
Inventory
▪️ ECR
▪️ Config
▪️ IAM credential report
▪️ SSM Inventory
Logging
▪️ Athena
▪️ CloudWatch
▪️ CloudWatch Logs
▪️ CloudWatch Logs Insights
▪️ OpenSearch Service
▪️ GuardDuty
▪️ Inspector
▪️ Lookout for Metrics
▪️ Macie
▪️ Route 53 Public Zone Logs and Resolver Query Logs
▪️ S3 Server Access Logs
▪️ VPC Flow Logs
▪️ Audit Manager
▪️ CloudTrail
▪️ CloudTrail Insights
▪️ Config
▪️ Config Rules
▪️ Security Hub
▪️ SSM Inventory
▪️ IAM Credential Report
▪️ SSM Session Logs
Mitigation and containment
▪️ EC2 Security Groups
▪️ Nitro Enclaves
Network protection
▪️ CloudFront
▪️ EC2 Security Groups
▪️ GuardDuty
▪️ Route 53 Resolver DNS Firewall
▪️ ALB
▪️ Firewall Manager
▪️ Network Firewall
▪️ Shield
▪️ WAF
▪️ WAF Automation
▪️ WAF-Managed Rules
▪️ NACL
Policy enforcement
▪️ Inspector
▪️ Config Rules
▪️ Lambda
▪️ SSM document
▪️ SSM Patch Manager
▪️ SSM State Manager
Reporting
▪️ SNS
Secure storage
▪️ Access Analyzer for S3
▪️ EBS
▪️ KMS
▪️ Macie
▪️ IAM
▪️ S3 Access Control Lists
▪️ S3 Bucket Policies
▪️ S3 Access Points
▪️ S3 Query string authentication
▪️ PrivateLink for S3
▪️ Storage Gateway
▪️ VPC endpoints
▪️ EFS
▪️ S3 Block Public Access
▪️ S3 Encryption
▪️ S3 MFA delete
▪️ S3 Object Lock
▪️ S3 Versioning
Virtual infrastructure
▪️ EBS snapshots
▪️ Backup
Vulnerability management
▪️ ECR image scanning
▪️ Inspector
▪️ Security Hub
 
Очень полезный документ, самые объёмные пункты по логированию, защите сети и шифрованию данных.
 
#security #NIST #devsecops

​​Видео с fwd:cloudsec 2021:

https://www.youtube.com/playlist?list=PLCPCP1pNWD7Ofg8prNuVasGIwkKB3Ejhw

Полезные темы по cloud security от авторитетной конференции и известных спикеров.

#security #video #devsecops

Проверка CloudFormation кода на уязвимости:

https://github.com/aquasecurity/cfsec

Ещё один статический анализатор CloudFormation шаблонов, поддерживаемые форматы — YAML, JSON.

#CloudFormation #security #devsecops

Cloud Security Tooling for the Sole Practitioner:

https://www.youtube.com/watch?v=7gMjJVdUmwU

Отличный старт для безопасника AWS проектов - рекомендуемые инструменты с конкретными примерами работы и советами.

#security #devsecops

​​Data Classification — Secure Cloud Adoption:

https://d1.awsstatic.com/whitepapers/compliance/AWS_Data_Classification.pdf

Обязательный этап начала выстраивания процессов безопасности на проекте — классификация данных по уровням секретности. В документы перечислены текущие подходы для США и Великобритании, а также даны рекомендации с учётом возможностей AWS сервисов.

#security #devsecops

Хорошая подборка DevSecOps ссылок и инструментов для работы с AWS:

https://github.com/sottlmarek/DevSecOps

🔨 Tooling
😀 Precommit and threat modeling
👀 SAST
😈 DAST
💥 Supply chain and dependencies
💡 Infrastructure as code
🔎 Containers security
⛵️ Kubernetes security
☁️ Cloud (Now AWS only and expect more from GCP and Azure)
🐵 Chaos engineering
🎯 Policy as code
⚡️ Methodologies

#DevSecOps

Интересный рассказ от @pyToshka про open source DevSecOps инструмент Wazuh:

https://www.youtube.com/watch?v=hSXpUj_RkEI

#devsecops #security #compliance #opensource