AWS NYC Summit July

Join me at the the AWS NYC Summit as I co-present the Cloud migration session from 2-3 PM this Thursday July 9th.

http://aws.amazon.com/summits/new-york/sessions/

Cloud Migration, Application Modernization and Security for Partners

As AWS continues to expand, enterprise customers are increasingly looking to our partner ecosystem to assist in migrating their workloads to the cloud. This session describes the challenges, lessons learned, and best practices for large-scale application migrations. We will use real examples from our consulting partners and AWS Professional Services to illustrate how to move workloads to the cloud while modernizing the associated applications to take advantage of the unique benefits of AWS. We will also dive into how to use an array of AWS services and features to improve customers' security posture as they migrate and once they are up and running in the cloud.

Level: Introductory

AWS SF Summit 2015 migration sessions

Here are the AWS SF 2015 Summit decks and video replays:
1. AWS Cloud Transformation Framework:
http://www.slideshare.net/AmazonWebServices/application-portfolio-migration
https://www.youtube.com/watch?v=_FjCMWlskMU&index=11&list=PLhr1KZpdzukeD0iBeDI9WqZLYtuaFaaGc
The CAF white paper serves as the foundation for this session: http://d0.awsstatic.com/whitepapers/aws_cloud_adoption_framework.pdf 

2. AWS application modernization with a focus on security:
http://www.slideshare.net/AmazonWebServices/cloud-migration-application-modernization-and-security-for-partners
https://www.youtube.com/watch?v=UpeV4OqB6Us&index=26&list=PLhr1KZpdzukeD0iBeDI9WqZLYtuaFaaGc

3. AWS Partner session:
http://www.slideshare.net/AmazonWebServices/implementing-service-oriented-architecture

All sessions can be found on Slideshare and Youtube here:
http://www.slideshare.net/AmazonWebServices/tag/2015sfsummit?adbsc=awssummit2015_20150411_43646046&adbid=586959582653648896&adbpl=tw&adbpr=66780587
https://www.youtube.com/playlist?list=PLhr1KZpdzukeD0iBeDI9WqZLYtuaFaaGc&adbsc=awssummit2015_20150411_43648896&adbid=586713471154159616&adbpl=tw&adbpr=66780587

Oracle Database on Amazon Web Services Book

The first book that covers running Oracle on Amazon Web Services:
http://www.amazon.com/Oracle-Databases-Amazon-Web-Services/dp/012800956X

Written by these companies:
http://www.appsassociates.com/awslabs/
http://aws.amazon.com/rds/partners/dbvisit/
http://www.e-dba.com/oracle_labs_aws.html

Accenture : AWS Security Primer

Accenture released an AWS Security Primer at re:Invent last week: http://www.accenture.com/microsite/aws-2014/Documents/PDF/Accenture_Security_Perspective_AWS_web_final_1103.pdf

Cloud and security

Interesting article on cloud and security:
http://www.networkcomputing.com/networking/cloud-security-to-reap-$15-billion-by-2015/d/d-id/1093553?

AWS IAM services and features that play a role when moving Oracle workloads to AWS

Identity and access management (IAM) is a key component of AWS security.  IAM allows the creation of users, groups and roles. IAM services and features you will most likely consider when host Oracle on AWS are:

1. Security Token Service (STS) : STS generates temporary credentials for an IAM User or for users that you authenticate (federated users). Useful for improving security posture, mobile applications, and identity federation. Here are some basics of STS:

A. Generates a temporary Access Key, Secret Key, and Token
B. Expire automatically (15 minutes ~ 36 hours)
C. You write an “identity broker application” ( sample code here: http://docs.aws.amazon.com/STS/latest/UsingSTS/STSSampleApps.html)
D. Users authenticate to your identity broker
E. Your identity broker provisions temporary credentials via STS
F. SSO via the management console: Temporary credentials can be used to sign user directly into the AWS Management Console

More reading: http://docs.aws.amazon.com/STS/latest/UsingSTS/Welcome.html

  Get the temporary temporary token (access key ID, secret Key, and security token) by issuing the get_federation_token API call.  The thing to keep in mind with your identity broker application is that you will have to have all the policies defined some where (in code as below, relational database, XML file, JSON templates, some file, etc) as you probably don't want to hard code in the application and will have 1000's of different users with different policies. 

http://docs.aws.amazon.com/AWSSDKforPHP/latest/index.html#m=AmazonSTS/get_federation_token
The role needs to have a policy associated. Here is the way it is done it code:

// Generate a new IAM policy (https://awspolicygen.s3.amazonaws.com/policygen.html)

$policy = new CFPolicy($token, array(

    'Statement' => array(

        array(

            'Sid' => 'SID' . time(),

            'Action' => array('s3:GetObject', 's3:GetObjectVersion', 's3:ListBucket', 's3:ListBucketVersions'),

            'Effect' => 'Allow',

            'Resource' => 'arn:aws:s3:::my-bucket/*'

        )

    )

));

Here is a REST web services call to generate temporary credentials: http://docs.aws.amazon.com/STS/latest/UsingSTS/CreatingFedTokens.htm

or you can use the assume-role API or web services all in document above. Here you would not need to send in a policy as the role would have a policy:

http://docs.aws.amazon.com/AWSSDKforPHP/latest/index.html#m=AmazonSTS/assume_role

2. IAM resource level permissions - More information can be found here:  http://aws.amazon.com/about-aws/whats-new/2013/07/08/announcing-resource-permissions-for-amazon-ec2-and-amazon-rds/

3. IAM Roles: Roles can be used to securely allow EC2 instances access other AWS services, enables identity federation with STS, cross account access, and web identity federation. 

A. Allow your applications (e.g., Java) running on EC2 to securely access other services (e.g., S3, SQS, etc)

B. Identity federation (including STS)

C. Web Identity federation : Web Identity Federation allows authenticating via Login with Amazon, Facebook, or Google, getting temporary security credentials, and then using those credentials to make a request to AWS. 

D. Allow cross-account management/access

Jane in Account A may assume a Role in Account B, giving Jane an Access Key/Secret Key/Token that may be used to make API calls to Account B. 

More reading:http://docs.aws.amazon.com/IAM/latest/UserGuide/WorkingWithRoles.html

VPC benefits over EC2 classic

Here are some of the reasons why you would use VPC instead of EC2 classic for your Oracle instances:

• Predictable internal IP ranges: You define the IP address range of your VPC as opposed to your IP address being part of the AWS region IP address range.
• Subnets : Logically group Amazon EC2 instances into a private or public subnets and assign them private IP addresses.
• Traffic Routing : Control the outbound/egress traffic from your Amazon EC2 instances (in addition to controlling the ingress traffic to them; EC2 Classic security groups are ingress only) and provide selective internet access to instances.
• Network ACLs : Additional layer of security to your Amazon EC2 instances in the form of network Access Control Lists (ACLs). These allow for deny rules instead of just allow rules that security groups have.
• VPN Connectivity : Connect your VPC to corporate data center and on-premise infrastructure with a VPN connection, so that you can use Amazon VPC as an extension of your existing data center network,
• DHCP options: DHCP option sets let you specify the domain name, DNS servers, NTP servers, etc. that new nodes will use when they’re launched within the VPC. This makes implementing custom DNS much easier. In EC2 you have to spin up a new node, modify DNS configuration, then restart networking services in order to gain the same effect. 
• Multiple IP's per MAC address: The Elastic Network Interfaces (ENI) is a virtual network interface that can include the following attributes :
  • a primary private IP address
  • one or more secondary private IP addresses
  • one Elastic IP address per private IP address
  • a MAC address
  • one or more security groups
  • a source/destination check flag
  • a description
• Multiple ENIs per instance: Attach multiple Elastic Network Interfaces (ENI) to each instance for multiple MAC addresses.
• Moving ENIs (MAC and IP addresses) between instances :  ENI's attributes follow the ENI as it is attached or detached from an instance and reattached to another instance.

AWS Trend Micro web cast replay

You can view the Trend Micro webinar regarding >Deep Security as a Service to deploy intrusion detection and prevention, anti-malware, anti-virus, integrity monitoring, firewall and web reputation on AWS:

http://www.youtube.com/watch?v=zOWcTC45ruw&feature=youtu.be

IDS : Host-based and network-based

Intrusion Detection Systems and Intrusion Protection Systems on AWS come up when discussion security when moving to AWS.  Here is short introduction to Oracle technologist that may not deal with IDS and IPS in their current on premise environment.

A host-based intrusion detection system (HIDS) is an intrusion detection system that monitors and analyzes the internals of a computing system, and in some cases the network packets on its network interfaces (just like an NIDS).  A host-based IDS monitors all or parts of the dynamic behavior and the state of a computer system. HIDS was first designed for the mainframe.  HIDS uses sensors (agents) located on each host.    These host-based agents, which are sometimes referred to as sensors (or agents), would typically be installed on a machine that is deemed to be susceptible to possible attacks. The term “host” refers to an individual computer/virtual host. This means that separate sensor would be needed for every machine/virtual host. Sensors/agents work by collecting data about events taking place on the system being monitored. This data is recorded by operating system in audit trails. Therefore, HIDS is very log intensive.

Network-based intrusion detection systems offer a different approach. NIDS collects information from the network itself rather than from each separate host. They operate essentially based on a “wiretapping concept" (network taps).  Information is collected from the network traffic stream, as data travels on the network.  The intrusion detection system checks for attacks or irregular behavior by inspecting the contents and header information of all the packets moving across the network. The network sensors come equipped with “attack signatures” that are rules on what will constitute an attack, and most network-based systems allow advanced users to define their own signatures.  this method is also known as packet sniffing, and allows the sensor to identify hostile traffic.

  

AWS Life Sciences event

App Associates AWS Life Sciences event in Boston on Sept 19TH:

http://www.appsassociates.com/events-register/roadmap-to-cloud-for-life-sciences/

Security on AWS

Good overview of top security tips for running on AWS:
http://stratumsecurity.com/2012/12/03/practical-tactical-cloud-security-ec2/

AWS Security 101 for Oracle DBAs, Developers and Architects

Oracle DBAs understand securing data in transit and at rest, but they don't have to deal with file level encryption, security of the databases, firewalls, denial of service attacks, SQL injection attacks, and other OS level security.

General infrastructure security concepts:
1. Some networking concepts such as VPC, VPN, and IPSec also apply to the security realm.  More on these concepts can be found here: http://cloudconclave.blogspot.com/2013/07/aws-network-101-for-oracle-dbas.html
1. SSL : The Secure Sockets Layer (SSL) is a commonly-used protocol for managing the security of a message transmission on the Internet. SSL uses the public-and-private key encryption system from RSA, which also includes the use of a digital certificate.  
2. ACLs : Access Control Lists (ACLs) specifies which users or system processes are granted access to objects, as well as what operations are allowed on given objects.

3. MFA : Multifactor authentication (MFA) is a security system in which more than one form of authentication is implemented to verify the legitimacy of a transaction. The goal of MFA is to create a layered defense and make it more difficult for an unauthorized person to access a computer system or network.  An MFA device can be a Gemalto token (http://onlinenoram.gemalto.com/) or even an iPhone.  http://cloudconclave.blogspot.com/2013/06/mfa-made-easy.html
4. Bastion Host :A bastion host is a special purpose computer on a network specifically designed and configured to withstand attacks. Information on bastion hosts on AWS with Oracle on these two posts: http://cloudconclave.blogspot.com/2013/05/aws-bastion-host-as-single-point-of.html http://cloudconclave.blogspot.com/2013/05/dba-and-developer-access-to-oracle.html
5. iptables : iptables are the tables provided by the Linux kernel firewall.  These firewall rules make it possible for administrators to control what hosts can connect to the system, and limit risk exposure by limiting the hosts that can connect to a system.  Information on iptables for security on AWS here: http://cloudconclave.blogspot.com/2013/06/aws-security-with-iptables.html

6. IDS : An intrusion detection system (IDS) is a device or software application that monitors network or system activities for malicious activities or policy violations and produces reports to a management station. Some systems may attempt to stop an intrusion attempt but this is neither required nor expected of a monitoring system.
7. IPS : Intrusion prevention systems (IPS), also known as intrusion detection and prevention systems (IDPS), are network security appliances that monitor network and/or system activities for malicious activity. The main functions of intrusion prevention systems are to identify malicious activity, log information about this activity, attempt to block/stop it, and report it.   Intrusion prevention systems are considered extensions of intrusion detection systems because they both monitor network traffic and/or system activities for malicious activity.

8. DoS :  A denial-of-service attack (DoS attack) or distributed denial-of-service attack (DDoS attack) is an attempt to make a machine or network resource unavailable to its intended users.  IPS, iptables, AWS security groups, NACLs, and bastion hosts are all ways to prevent DoS attacks.
9. Penetration testing : A penetration test, occasionally pentest, is a method of evaluating computer and network security by simulating an attack on a computer system or network from external and internal threats.

AWS specifics. You must be familiar with all of these concepts in order to perform basic actions on AWS and EC2:

1. Access key and secret key : The access key is used to access AWS using the CLI and TEST API.  The REST and Query APIs use your access keys as the credential.You might be using a third-party product such as S3Fox or ElasticWolf that requires your access keys (because the product itself makes AWS requests for you). Although access keys are primarily used for REST or Query APIs, Amazon S3 and Amazon Mechanical Turk also use access keys with their SOAP APIs. Your Access Key ID identifies you as the party responsible for service requests. You include it in each request, so it's not a secret.The secret key provide anyone that possesses them incredible power to perform delete, terminate, start etc actions on your AWS resources (EC2, ELB, S3 etc) so be very careful with them. Don't e-mail it to anyone, include it any AWS requests, or post it on the AWS Discussion Forums. No authorized person from AWS will ever ask for your Secret Access Key.
2. x509 : X.509 certificates are based on the idea of public key cryptography. It is used for \making requests to AWS product SOAP APIs (except for Amazon S3 and Amazon Mechanical Turk, which use access keys for their SOAP APIs).  SOAP services are being defocused so x509 will not be used as much moving forward.
3. Key pair file (SSH pem file) : You use an Amazon EC2 key pair (aka: PEM file) each time you launch an EC2 Linux/UNIX or Windows instance. The key pair ensures that only you have access to the instance.Each EC2 key pair includes a key pair name, a private key, and a public key.  PEM is a file format that may consist of a certificate (aka. public key), a private key or indeed both concatenated together. Don't pay so much attention to the file extension; it means Privacy Enhanced Mail, a use it didn't see much use for but the file format stuck around. more on using PEM with EC2 here http://cloudconclave.blogspot.com/2012/09/connecting-to-aws-ec2-using-ssh-and-sftp.html
4. Security Groups : A security group acts as a firewall that controls the traffic allowed to reach one or more instances. When you launch an instance, you assign it one or more security groups. You add rules to each security group that control traffic for the instance. You can modify the rules for a security group at any time; the new rules are automatically applied to all instances to which the security group is assigned.

These AWS security concepts are not necessary but one you get beyond the 'playing around phase' of working with AWS these security components are key to working with AWS:
1. ARNs : Amazon Resource Names (ARNs) uniquely identify AWS resources. We require an ARN when you need to specify a resource unambiguously across all of AWS, such as in IAM policies, Amazon Relational Database Service (Amazon RDS) tags, and API calls.  Here is an example ARN: 
<!-- Amazon RDS tag -->
arn:aws:rds:eu-west-1:001234567890:db:mysql-db
ARNs are used extensively with IAM to place security/access policies on AWS services.
2. IAM : AWS Identity and Access Management (IAM) enables you to securely control access to AWS services and resources for your users. Using IAM you can create and manage AWS users and groups and use permissions to allow and deny their permissions to AWS resources. More details here: http://cloudconclave.blogspot.com/2012/10/aws-iam-service.html, http://cloudconclave.blogspot.com/2013/05/aws-getting-started-with-groups-and.html
3. NACLs : Network ACLs operate at the subnet level and evaluate traffic entering and exiting a subnet. Network ACLs can be used to set both Allow and Deny rules. Network ACLs do not filter traffic between instances in the same subnet. In addition, network ACLs perform stateless filtering while security groups perform stateful filtering.

 4. S3 SSE :  http://cloudconclave.blogspot.com/2013/07/s3-sse-without-request-header.html Server-side encryption is about data encryption at rest, that is, Amazon S3 encrypts your data as it writes it to disks in its data centers and decrypts it for you when you access it. As long as you authenticate your request and you have access permissions, there is no difference in the way you access encrypted or unencrypted objects. Amazon S3 manages encryption and decryption for you. For example, if you share your objects using a pre-signed URL, the pre-signed URL works the same way for both encrypted and unencrypted objects.

5. Data Encryption : AWS does not provide encryption of EBS (Elastic Block Storage) . More details on a couple of vendors that provide solutions here: http://cloudconclave.blogspot.com/2013/04/ebs-volume-encryption.html

AWS security with iptables

AWS Security Groups are one of the key ways to secure your AWS environment. IPtables add another layer of security on top of Security Groups.   For example, security groups are not state-sensitive, you cannot have them respond automatically to an attack for instance. IPTables are well suited to more dynamic rules - either adapting to certain scenarios, or providing finer grained conditional control.

ELB and Security Groups

The ELB Security Groups for EC2 classic can not be changed and the ELB security group name is the same across all ELBs launched an account. This means there is no way to control security group for different apps as same securiy group name across the account.  VPC changes this as each ELB has its own security group name.

AWS Bastion host as single point of attack?

Bastion host could open you up to a single point of attack?  It can, but here are two ways to secure your bastion host:

• AWS security WP recommends only allowing access through the corporate network(VPN access):
• http://awsmedia.s3.amazonaws.com/pdf/AWS_Security_Whitepaper.pdf (page 17)
• This video talks about separate security credentials for bastion host:
• http://www.youtube.com/watch?v=XhYX06RmMHc&list=PLhr1KZpdzukcPA0A7h3FKDcMfKNPytXVf&feature=player_detailpage#t=837s  (this could be a separate user name password or more likely another PEM/PPK private key file)

Having only one point of attack is way better then opening up more than one or all of your EC2 instances for port 22 (SSH..assuming Linux) to 0.0.0.0/0 CIDR block.

AWS SSO integration with AWS

This is a question that comes up quite often, "How can I delegate authentication into my on premise MS AD for AWS users?"  This product has just been released.

SSO integration with AWS

http://www.okta.com/aws/

They were also showcased in Andy’s keynote on Tuesday at the SF AWS Summit.

http://www.youtube.com/watch?v=bWL0_Xdntzo#t=50m52s  

The other option is to use AWS STS: http://docs.aws.amazon.com/STS/latest/UsingSTS/Welcome.html

VPN without VPC on AWS

AWS VPC has its own hardware appliance built into the service that is not openVPN.  openVPN is a software based VPN client connectivity that can be used with VPC.

If you are not running AWS VPC, you have to install a software VPN on an EC2 instance. You  may want to use a micro instance and not install on same server as all the other software components (for security reasons).   This web page explains how to use openVPN to just this:

http://expedienttech.net/?p=68