How Should You Approach AWS Cloud Security? - C2C042

With me , as always , are my co-hosts Alex Perkins at Bumps in the Wire and Chris Miles at BGP Main , and with us we have a special guest tonight , a senior developer advocate from AWS , brandon Carroll . Thanks for joining us , and you want to go ahead and introduce yourself ?

At the same time , you get to take these really cool technologies that we're coming out with and create videos and educational content on it and teach people how to use it . And that's , I mean , that's always been a passion of mine being able to teach people how to , how to make sense of stuff that could be very complex .

So , yeah , it's kind of like a two-way role . There's some inbound stuff and some outbound stuff I get to do .

And for a while , well , I was an instructor for a long time Cisco instructor and did training videos and that whole thing , and then at some point I started going to things like tech field days and I was blogging I mean , this was back in the days of , like you know , eattherealmindcom and you know , 2012 , maybe something like that and I was blogging and went

independent for a while pretty good chunk of time and then one of the people that I met at a field day from Riverbed had a role that they were looking for , for an evangelist position , and I didn't really realize that what I was already doing was being an evangelist across a wide range of topics .

And so we talked and I joined Riverbed and then , from Riverbed , I went to AWS In a similar role .

So , yeah , tell us , tell us a little bit about kind of the differences there . Uh , you said you're an on-prem guy , so how does how does it differ ? Maybe just differences there . You said you're an on-prem guy , so how does it differ ? Maybe just start there .

When you're setting up firewalls , you know you're you get people to rack and stack it for you , maybe , but then you're doing VLANs and you're directing traffic and you're you know you're doing everything

. So I think one of the big differences like when I started in in the AWS space and cloud was really wrapping my head around what AWS calls a shared responsibility model and really it's just like this delineation between what AWS or any cloud provider really handles and what the customer is responsible for .

And that was a bit different for me , because all of a sudden there's this whole layer of stuff that I don't have access to anymore . I can't touch , I can't draw it out on a napkin , I don't know how it's all connected , none of that . So that was probably the first differentiation . I think that that struck me .

I think from a business perspective it's probably not off-putting right , because the business now has someone else that's taking responsibility for a whole layer that they otherwise had to provide for . So , you know , I guess it depends on how you look at it .

For me it was a challenge to get used to what I could see , and I think stemming from that , from understanding the shared responsibility model , was then figuring out the layers of abstraction between things . Right , log in .

Well , I guess , depending on how you do it , if you're going to go into the AWS console , you know everything's GUI driven and a lot of the examples that I started out with it was , you know , here's our documentation and I'm telling you how to do it in the GUI and in the console .

A lot of the stuff I did I was doing it from the command line or , you know , even getting to a point where I wanted to do a terraformer or some kind of IAC you know , and you can definitely do that stuff with cloud and you will , but I think in your initial transition that's probably not exactly what you're looking at , because you're just trying to wrap

your head around .

It probably differs between engineers across the board , right , but some of them want the utmost exposure , even when they're paying for a premium service like a , like an AWS service , right , maybe they want the utmost exposure so that they know when to point the finger and they actually will be able to come to AWS and say , hey look , I found this thing , you

guys need to fix this , whereas others are probably like , hey , shit's not working , start fixing it , look into it , figure it out , right . So I think it's a difficult balance to have , I think as far as what level of control or exposure you give to the people using the resource right .

One is that we have lived at the infrastructure , the level , the layer , one layer , for so long and not only just live there but been responsible for it . Right , when there's a problem , all fingers point at you and there's a little trauma , a little trauma built into that .

So when you're asking someone who lives at the infrastructure layer to let it go and just kind of hand over the keys to and just trust that it's all , it's all going to be good there's there's a struggle there for sure . Yeah .

When I learned and when we went through stuff , you had to learn how TCPIP worked , you had to learn the OSI model , you had to learn what a frame looked like and all of that right how VLANs worked . You had to learn all of these concepts that are really kind of down in the weeds .

And then for me to go to cloud and then start even taking some of the training where you're learning some of the security concepts or you're learning some of the routing concepts , that degree of depth is not there . So it always was sort of a question mark for me , like , well , what is happening here ?

You piece it together after you get some exposure , but it takes some time , and so I think that it really is . If you're going from on-prem and you're doing security stuff and you're used to putting in a firewall and then to go and to put AWS network firewall in . It's different . It's still a firewall , you know .

It still has the same kind of stuff happening . But you have to think a little differently as you start to build that into your existing infrastructure .

You know , on-prem , you can put things in line , right , or you can put them , you can hang them off a switch and , you know , through vlan manipulation , insert it into the service . There's none of that in the cloud . In the cloud it's .

It's this very clunky kind of you know , comparatively , uh , kind of clunky kind of service insertion where we're manipulating route tables and and and all of this to make it happen and and it's the same output or it's the same outcome , if you will , right , but it's . It's definitely a different experience , for sure .

With AWS Network Firewall , you build your firewall out , but you have to put a firewall endpoint in the VPC and then route traffic through that endpoint to get it inspected . Right For me , being an on-prem person , the way I wrap my head around that is . I started thinking of , like the old IDS , ips and how you'd have it hanging out on a leg .

But it's not traditional . I don't think it's traditional by any means if you go back to standard networking and whatnot .

So you don't have that ability to kind of step back and even most of the time an old firewall I wouldn't even know what , you know what is the traffic is doing going between over the firewall and then when you get into the cloud , you know , and then you're placing something into that path instead .

So it's like a completely different view , like you kind of have to take a step back and get that 10,000 foot view . So yeah , I think that's a huge like it's a big mind shift to do that for a lot of people .

You know that that's your NAT gateway and it's it's doing firewall services and stateful packet filtering for your workforce . That's . It's not the same in the cloud , because the workforce is still out there somewhere else . Right , traffic's coming a different direction . It's more refined in the workloads that you're looking at .

So you do have to step back and look at it from a different lens .

You know , one of the biggest things that I hear all the time from people going from on-prem to the cloud is especially security focused is how porous the perimeter became , right , like we had the on-prem , the very hedgehog type of formation right , where you've got the security at the perimeter .

Usually the business isn't paying tons of money so you can put security all the way through a strata of your network right . You just have it right there at the end personally as a hedgehog , and then if anybody can get in , you know lateral movement is a lot easier , right , and in the cloud it's much more porous .

You're like right , all your workloads , basically , are just sitting next to the internet pretty much all the time , right .

But is it still going like from a private VPC to a private subnet to a public subnet and then out in IGW , or is it in a public subnet and going right out of an IGW ?

to hear about or they're delighted to hear about , and things that are easier versus things that they kind of need .

to AWS , I think . I mean I don't know numbers or anything offhand , but of networking people that are using . AWS and managing the infrastructure for an organization . I don't know .

I think it's kind of mixed right , because there's a lot of partner offerings that are being run on AWS because they're more traditional on-prem offerings , but I think probably there's a lot of desire for the easier implementations that are going to give you the ability to move more quickly . I think that's really like cloud's message right .

It's like move quick , build now , and then that just goes right back to that shared responsibility model where it's like okay , we've got this covered , and then you focus on this and it'll be secured .

You know you have HIPAA and PCI and all this other stuff , even though the app owners want to focus on app security . You know those compliance frameworks often say , basically that's not good enough , right ?

So do you , as a developer advocate , I mean , do you only talk to developers or is this something where you see , do you see other people come in with similar security concerns , but from a different lens ?

You know you've got a lot of teams that deal specifically with compliance especially when you get into , like government and you know some of the public sector stuff and AWS does have offerings that are around that you know that that are going to give you more of a compliance lens .

But if , if they could just talk and if I could just extract easily information that this one has and this one has and put it together , I mean , that was always the dream , right , and I don't want to say the single pane of glass word , but I mean like that's what a you know that's what a lot of us wanted back then , like we were , we were working in

these different things and the and the images were different . Right , it wasn't the same base OS and um and a lot of yeah , it was clunky , um , and sometimes they still is right . I mean , that's just that's what we live in , that's the world we live in .

But what I do think is fascinating about these things in cloud is how they can provide a lens , using the data between services , but presenting it to you in a way that's more relevant to what you're looking for .

So , if you do deal with like compliance and that's something that you work with , you can use something like AWS Config right and deploy these compliance packs and have it scanning your resources for compliance-related issues and reporting that to you . But maybe I'm more of a NOC person and I want like an overall dashboard .

Well , now I can look at Security Hub and I can see information from Config , but I can also see information from GuardDuty , my IDS , the IDS one yeah . Yeah . So that's what I think is neat is there are there are these services that help you see it through those different lenses that are more specific to the , to the role that you might be operating in .

So , and maybe none of those are developer roles , like I don't know a lot of developers that are sitting there staring at security hub all day going .

It's as simple as you can write a plugin and then you have this tool that already knows how to tie into all these different services and now just talk to them directly . Right , exactly , now that plugin can just do it easily because there's easily accessible and easily consumable APIs across all the services .

So , I agree , I think that's a huge benefit of the cloud over on-prem , even though it's slowly , slowly , kind of getting better . But you have to build a lot of it yourself . Yeah , you do .

Oh well , I'm going to just replace these doors with these doors and it's going to be current and up to it . It's not like there's a lot of work behind it . So if something like a house has that much work , think about all the technical stuff behind your infrastructure and the things that you have to change if you're trying to be more modern with it .

I mean .

Because they can't change it , because the default choice becomes hidden from the CLI . Right , the default choice is hidden from the CLI . So if you change the default , you've now changed the config on all these devices and so it's not that simple . Right , you can blow up somebody's multicast and implementation very , very simply just through an os upgrade .

So it's not . You know , it's the same thing with security and and apis and all of that , but , um , anyway . So so I mean abs has guidance on a lot of the security stuff , right , like they , they have the well architected framework . I think security is one of the security stuff , right , like they have the well-architected framework .

I think security is one of the pillars . You want to talk about that a little ?

And security , yeah , it's a big pillar of it , just like a Cisco validated design right , you get your CVD and it takes you through all the different ways that you should implement things and there's more specific designs for verticals and things like that , and AWS offers that .

The starting point really is the well-architected framework and then going through that security pillar and then from there you'll jump out to different best practices for things like identity management . And things change there , too . We were talking about how we change .

For a long time you would go into IAM and you would configure users and groups and policies and that's how users would access the cloud environment .

But you'll get to that as you go through the well-architected framework and you start looking at some of those best practices .

the the . The training process back then was different . Right , it was very clear cut . It was like you had your router switch security , you had your IDS , ips , you had your firewall , perimeter security , you had VPN and that kind of completed the whole security suite at that time .

And so for me coming into cloud and even before AWS , just when I started looking at other cloud providers , I always just gravitated towards what services are there for me are part of the security set of tools that I would normally use , because that's how I was trained to set up security in an infrastructure and it was always firewalls and IDS , IPS and all that

stuff . So I think with AWS my favorite services I like the perimeter protection stuff , AWS network firewall and it was a little different .

It wasn't like I could just take everything from an ASA or Firepower and be like , okay , I can just take everything I know here , and I'm going to start working with network firewall and I can configure anything and it works . It's not the case , even having , like IP tables , knowledge right .

Knowing a little bit about that you can go into network firewall and you can start setting up some simple rules . But if you really want to get to the power , you're going to use Suricata type rules right . So it's a little bit different . So now you got to kind of go down that path of learning about Suricata .

If you look at Suricata , it's a little bit different . So now you got to kind of go down that path of learning about Sircata . If you look at Sircata , it's mostly an IDS IPS , but in the way that the rule sets are used . network firewall they're firewall rules , so I do like network firewall .

It's really grown on me as I've done some stuff with TLS inspection , which was launched , you know , in the last year , and some stuff earlier like Ingress and Egress TLS inspection . So I enjoyed that and WAF a little bit . But I think when you get into into WAF you're way more focused on just protecting a web application . Yeah , it's still a firewall .

To me it's like okay , it's just the different rules .

Right , if you're a content creator and you have like a subscription to Zapier and you're going to build these zaps that are going to go through this little automated stuff , it's exactly what EventBridge can do for you , right , as you start taking these different services and you build these little flows .

And then there's always just the stuff that it's there like security groups in your VPC , like you know , firewall everywhere kind of thing .

you know what the buzz right now the generative AI and not you know , part of that being like the guardrails around those services , but then also like the threats that come along with it If you're not . You know people that are not using AI responsibly Right , like if you look at the OWASP top 10 for LLMs like prompt injection attacks and things like that .

So , for example , again with infrastructure services like your compute , your storage database , the networking stuff , the security of that would be AWS responsibility . The security of the hardware and of that would be AWS responsibility . The security of the hardware and the data centers that it's in , that's AWS responsibility .

As a customer , now you've got to start thinking about what you're running on top of that , thinking about the security of the client-side data , the server-side data , the network traffic that's a customer responsibility . And then all the way up the you know the platform to the customer data . That's one like delineation . Again , that was for infrastructure services .

Now , if you were to get a little bit more detailed into something like container services , well , now the AWS responsibility shifts a little higher in that model , right , right , and the same with , you know , abstracted services . It shifts even higher in the model , right , right , yep , and the same with abstracted services . It shifts even higher in the model .

So , yeah , you really got to know what product you're trying to use and , like you said , basically where's your touch point ?

So you know you can make your calls to S3 from an application that's sitting in your VPC and if you do that then essentially you're kind of leaving your virtual cloud and you're going over that more public endpoint in the AWS network to S3 . Okay , so the traffic in your VPC is your responsibility to secure it .

So how do you secure that traffic when S3 is managed right , but your VPC has a little bit lower level of responsibility ? more responsibility on the customer , and that's where you have to know about other services like PrivateLink right . So he's private link to have an endpoint .

That's basically keeping it private in your vpc , securing that that traffic and you get I mean , and you get secure .

I think , yeah , I think , wow , that's that we've covered . We've covered a ton to a ton tonight . I hope that our listeners are gonna really , you know , dig in on it because there's there's so much , uh , there's so much to it , any that makes sense that I've got .

I've got one of those two , that's the Alexa , which kind of makes yes , it's now listening to me , yeah , I made the mistake and said the name and now it's like what do you want ? So , anyway , yeah , so , yeah . So we need to probably wrap up pretty soon .

But I'd love to know is there anything else that you think like is really like super important for the listeners to know about the security stuff at AWS there ?

You go to a reinforcer or reinvent and there's product announcements of all these really cool things that you can do . And I think the cycle of how quickly the innovation is happening or the features are being developed .

It's something that we'd wait a long time for a new iOS to come out to get a feature in the past and now it's like okay , well , six months later I just heard about it , six months later it's it's out . So I think that's exciting .

Um , sorry , I've been trying to not not be , sniffing and sneezing all into the mic today , but , um , yeah , I think it's been great and uh , I think , um , we said waft a few times and I think we probably needed to delineate that there's a well-architected , well-architected framework and then there's also a web application firewall .

So when , when people are googling those things , make sure you're looking at the right one .

If you guys like what you heard or see , please subscribe to us . Like us I don't know whatever else people do when they share things on social media with each other and we will see you next time on another episode . Hi everyone , it's Tim and this has been the Cables to Clouds podcast . Thanks for tuning in today .

If you enjoyed our show , please subscribe to us in your favorite podcast catcher , as well as subscribe and turn on notifications for our YouTube channel to be notified of all our new episodes . Follow us on socials at Cables to Clouds . You can also visit our website for all the show notes at cables to cloudscom .

Thanks again for listening and see you next time .