not fairly Safety Bulletins at AWS re:Invent 2022 | by Teri Radichel | Cloud Safety | Dec, 2022 will lid the newest and most present steering approaching the world. strategy slowly consequently you comprehend properly and appropriately. will addition your data cleverly and reliably
A number of ideas on the safety bulletins to this point at AWS re:Invent
Extra AWS Safety Posts
On this submit I am simply compiling among the safety bulletins in AWS re:Invent. I am going to have to return and take a more in-depth have a look at them later as sadly and fortuitously somebody employed me to show a category throughout re:Invent.
I am undecided once I’ll be talking at a big convention once more, however I attempt to sustain with what persons are speaking about primarily based on what info I discover on-line. Nowadays I are likely to prioritize what drives the enterprise and makes cash to be trustworthy as I journey much less. However I actually miss seeing my buddies at re:Invent!
This is my preliminary response to the advertisements, however once more, with out all the main points and it is a girl’s prerogative to vary her thoughts. 🙂
Safe community entry with out VPN to company functions
Many options are taking totally different approaches to distant entry. There are numerous options that attempt to join individuals on the software layer, moderately than the community layer within the OSI mannequin. Some are attention-grabbing, others not a lot. With out diving into the answer, that is what you need to ask:
- If somebody will get your credentials or an lively session, can they use them from an alternate community location to get to the host the place you are lastly related and dealing? If that’s the case, it is an identification answer, not a community answer.
- Does the encryption used to hook up with the distant host encrypt all people community visitors to the distant host or simply visitors on a selected protocol? As I’ve written earlier than, some VPNs are higher than others in that regard (SSL vs. IPSEC).
- Does the answer assist you to examine all community visitors (accepted, rejected, or failed) on all ports between the distant host and the vacation spot endpoint?
- Are you able to see the whole packages? Some assaults under the appliance layer within the OSI mannequin will not be seen if you cannot see all the main points of the community packets, as I defined in different posts.
- When somebody connects to the distant endpoint, can others entry that distant endpoint over the Web? While you hook up with a VPN, the VPN endpoint is uncovered, however there are not any hosts contained in the community in case you are not related to the VPN. I as soon as ran a penetration take a look at the place one of many targets was to see if the bastion host was susceptible. Basically, I reverse engineered the truth that the bastion host was behind a VPN, so the one means it will be susceptible is that if it might get via the VPN first. That’s what a VPN does for you. When hosts are immediately uncovered to the Web with none layers between them, they’re open to direct assault from the Web.
- Are you able to handle all entry from one level or do you need to individually handle each host uncovered to the Web for distant entry? If you cannot handle them centrally, you have exponentially elevated administration and threat. Errors and misconfigurations accounted for 13% of safety incidents within the 2022 Verizon Knowledge Breach Report, so that you need to scale back the possibility of misconfiguration by lowering what you need to handle. A VPN does that (as does the automation I wrote about right here for per-user situations that use a single script for deployment to some extent – there are tradeoffs to that strategy vs. VPN, nevertheless it’s higher than exposing each host to the Web). I assume this new service is a centralized answer, however I have not appeared into it.
If this new answer meets all the above standards, then it may be a VPN substitute. More often than not, when corporations promote an answer as a VPN substitute, they’re truly not, however maybe Amazon has cracked the nut with this new service.
By way of new app-based safety approaches, one cool factor about them is that when somebody connects to an app, they can not “scan the community” within the conventional sense with a device like nmap. I have not inspected this but to see if it is that type of answer or one thing else.
This appears to be like very attention-grabbing if it could assist arrange a zero belief community for service to service communication. I have been writing about serverless networking in my newest weblog sequence on automating cybersecurity metrics and this service may help. I am going to should test it out. For individuals simply beginning to construct functions, serverless is less complicated than all of the configuration you need to do to arrange Kubernetes and even EC2. Associated networks, not a lot. Perhaps this can assist.
Once more, you may need to examine that it meets the identical community necessities because the VPN above to find out if it is really a community answer or an identification answer.
AWS KMS Exterior Key Retailer
This service appears to be like nice for organizations that have to host keys on premises however need to combine with KMS. Generally prospects need to management their very own key or want the important thing to be accessible on a personal community and on AWS (though I would not be too excited concerning the potential latency in that case). This may help some bigger organizations with compliance constraints or excessive safety wants.
AWS Inspector: Lambda Vulnerability Scan
Superior. You may want to check out the actual programming languages and vulnerabilities you discover, however that is nice information! I’ll positively attempt it.
Automated Knowledge Discovery for Macie
Macie needs that will help you discover the place automated knowledge exists that you simply won’t pay attention to in S3 buckets. As with knowledge exfiltration instruments, I assume this can have to be monitored and tuned for false positives. Knowledge exfiltration and the identification of delicate knowledge is all the time a problem. Burp typically identifies random strings corresponding to bank cards, for instance, in penetration assessments that aren’t truly bank cards. He could also be ready to take a position the assets to handle this device, nevertheless it ought to give you the chance that will help you discover your delicate knowledge and lock it down.
Permissions verified by Amazon
Amazon calls this new characteristic:
a scalable and granular permission administration and authorization service for customized functions
If it is what I feel it’s, I as soon as wrote one thing like this. We had a central automation service that may learn the configuration information and permit or deny actions primarily based on the configuration information written by the builders. The builders didn’t have to write down the code to authorize actions, however moderately outline the actions allowed for a selected sort of consumer.
It additionally sounds just like Open Coverage Agent (OPA) which got here out later and is an idea I actually like. I am going to should attempt it out to see if it is what it appears to be like like.
Automated failback on AWS for AWS Elastic Catastrophe Restoration
This new characteristic appears to be like attention-grabbing. We must see if it helps with Ransomware.
Backup for CloudFormation stacks
This additionally appears to be like fairly attention-grabbing. I look ahead to attempting this.
Helpful for individuals who use Redshift to revive when wanted.
New: Failover controls for Amazon S3 multi-region entry factors
One other service to examine and take a look at for these creating automated failover within the occasion of an AWS outage or safety incident. When S3 has issues, many functions have issues. Failover with S3 will be difficult. Hopefully this makes it simpler.
Amazon Safety Lake
Knowledge storage utilizing the OCSF customary. That is positively one thing for safety individuals to take a look at who has to cope with all the safety logs in a company. Should you take part within the preview, you could possibly present precious suggestions to assist push the modifications in the appropriate course to fulfill your wants.
Configuration Guidelines — Proactive Enforcement
Proactive is best than reactive. That is positively price testing. In a single setting I labored in, a community compliance device would roll again a non-compliant change in three minutes. And that was across the time somebody on the safety group wanted to open entry to his occasion and make a configuration change that he wanted. Once I confronted him about it, he stated it was a “dumb device”. It wasn’t, nevertheless it reveals the necessity to stop change if attainable, moderately than react after it is too late.
Management Tower — Complete Management Administration
Management Tower is a much-needed service, however as I’ve written earlier than, some issues are a bit difficult whenever you’re attempting to make use of and preserve it. However the idea is on level and I am excited to see this.
Amazon EventBridge Pipelines
This is not precisely a safety characteristic, but when it helps enhance consistency and reduces complexity via abstraction, it could assist total safety in a company by connecting providers asynchronously.
Wickr: end-to-end encryption for communication providers
There may be! I used to be on the lookout for extra info on end-to-end encryption in my final Amazon Chime weblog submit. It is not clear that the communication is definitely end-to-end encrypted primarily based on the documentation. I am undecided if Amazon Chime makes use of this service or is end-to-end encrypted or not primarily based on what I discovered, but when it must be, this service may help as a result of it clearly is.
New: Amazon ECS Service Join allows straightforward communication between microservices
This service sounds just like Lattice (above) however for ECS.
CloudWatch Log Knowledge Safety
Appears to detect delicate knowledge in logs. It’s positively price testing.
CloudWatch cross-account observability
I wrote about some points with cross account registration for KMS. I feel that is going to be a really, very helpful characteristic and I look ahead to attempting it out and probably running a blog about it later in my newest weblog sequence the place I am constructing a cloud safety structure for batch jobs (and actually the rest). ).
Runtime menace detection of containers on guard obligation
This was introduced on the AWS keynote by Adam Selipsky. I do not see it within the AWS information bulletins but, however I discovered this submit from November.
I wrote about that and another security-related options right here after watching the AWS keynote.
I’ll have missed one thing and there’s a bit additional to go in AWS re:Invent. I’ll replace this submit if I see something new.
Observe for updates.
Should you preferred this story please applaud Y proceed:
**************************************************** ** ****************
**************************************************** ** ****************
© second sight lab 2022
Cybersecurity for executives within the cloud period at Amazon
Do you want cloud safety coaching? 2nd Sight Lab Cloud Safety Coaching
Is your cloud safe? Rent 2nd Sight Lab for a penetration take a look at or safety evaluation.
Do you will have a query about cybersecurity or cloud safety? Ask Teri Radichel by scheduling a name with IANS Analysis.
Cybersecurity and Cloud Safety Sources by Teri Radichel: Cybersecurity and cloud safety lessons, articles, white papers, displays, and podcasts
I want the article just about Safety Bulletins at AWS re:Invent 2022 | by Teri Radichel | Cloud Safety | Dec, 2022 provides notion to you and is beneficial for addendum to your data
Security Announcements at AWS re:Invent 2022 | by Teri Radichel | Cloud Security | Dec, 2022