This whitepaper is for historical reference only. Some content might be outdated and some links might not be available.

Sample mapping exercise

AWS services and AWS Partner Network (APN) services can be mapped to this courses of action matrix(Hutchins, Op.Cit., Page. 5). Performing this mapping exercise can help identify which services, features, and functionality can help organizations detect, deny, disrupt, deceive, contain attacks, as well as respond to them and help recover from them when necessary.

Using the installation phase as an example, you can use the following AWS services and third-party services to help you to detect, deny, disrupt, deceive, contain, respond, and recover during this phase of the intrusion.

Detect

To help detect attacker activity, use log data from Amazon CloudWatch, CloudWatch Logs, AWS CloudTrail, and VPC Flow Logs, and use reporting tools such as Amazon OpenSearch Service, Amazon Quick and third-party tools. Key examples are provided in the following table.

Table 4: Controls for Detect

Deny

There are numerous process and technology controls that can help prevent an adversary from accessing and using critical information, systems, and services. A DevSecOps culture and processes that enforce CI/CD static and dynamic security analysis, and immutable, short-lived infrastructures all help mitigate attackers’ efforts in the installation phase of an attack. The following table contains numerous other control examples.

Table 5: Controls for Deny

Disrupt

AWS Config and AWS Systems Manager State Manager can monitor the configuration of cloud services as well as Amazon EC2 instances, specify a configuration policy for the instances, and automatically apply updates or configuration changes. This approach can help disrupt post-exploitation changes to systems. The following table contains more examples.

Table 6: Controls for Disrupt

Degrade

The objective of the Degrade control in the Installation phase is to negatively impact the attacker’s control, communications, and data collection activities. Some examples of controls that help defenders do this are listed in the following table.

Table 7: Controls for Degrade

Deceive

Third-party deception technologies present themselves as part of legitimate infrastructure so that when an attacker attempts to compromise it, they help detect, contain, and recover faster. Integrating honeypots, honeynets, fake credentials, and fake documents into a legitimate IT environment enables organizations to detect attempted unauthorized access to resources and respond and recover rapidly. Examples of third-party companies that offer deception technologies include GuardiCore, PacketViper, and others.

Table 8: Controls for Deceive

Contain

As previously noted, the segmented nature of typical cloud networks provides far more containment than traditional datacenter-wide layer 2 networks. Service-oriented architectures and microservices are also containment-oriented, as the compromise of one component can have a limited effect on a large application or system. The code running inside these services should be least-privileged in terms of the power to call cloud APIs, and then only with the temporary, fast-rotating STS credentials of an EC2 role, with VPC Endpoint Policies used to make it impossible to use even those short-lived credentials outside the cloud. All of these best practices make it difficult for a successful compromise of code inside a service to alter critical cloud configuration settings. Beyond that, with AWS Organizations, you can create service control policies (SCPs) that centrally control AWS service use across multiple AWS accounts. SCPs put bounds around the permissions that IAM policies can grant to entities in an account, such as users and roles. For example, SCP policies can be used to allow or deny certain activities so that no principals, not even the super-user in a child AWS account can bypass them, thus implementing a form of mandatory access control. This can help contain attackers during the Installation phase. The following table provides more examples of controls that can help contain those that seek unauthorized access.

Table 9: Controls for Contain

Respond

AWS Config monitors the state of an entire swath of cloud services, and can be configured to alert on any unexpected changes. At the instance level, file integrity monitoring (FIM) and enforcement are controls that help maintain the integrity of operating system files and application files by verifying the current file state and a known good baseline of these files. Some of these solutions can help respond during the Installation phase. Additionally, you can use AWS Lambda to automatically execute a function in response to an event to mitigate the threat or stop lateral movement. AWS Systems Manager State Manager and some APN Technology Partners can monitor file integrity.

Table 10: Controls for Respond

Restore

During the response to an incident, if a tool automatically shuts down a virtual instance of an operating environment, for example, autoscaling can create a new instance automatically from reference images to replace it, thus helping to restore infrastructure automatically and quickly. See the following table for details.

Table 11: Controls for Restore

In addition to the services and functionality listed previously, many other AWS and third-party services and functionality are available courses of action in the Installation phase of the intrusion method. For more information, see the Installation phase section of Appendix: Reference Material.

Using multiple services and features to detect, deny, disrupt, degrade, deceive, contain, respond, and recover, in each phase of the intrusion method can make it increasingly difficult for attackers to be successful. Attackers are faced with the challenge of defeating layers of defensive cybersecurity capabilities in each phase of their intrusion methods, in order to be successful.