Common security threats

What is a DDoS attack, and how can AWS services mitigate such threats?

A DDoS (Distributed Denial of Service) attack is an attempt to make an online service unavailable by overwhelming it with traffic from multiple sources. AWS provides services such as AWS Shield, which offers basic protection for all users and advanced protection for higher-tier customers, and Amazon CloudFront, which can help distribute traffic and withstand unexpected traffic loads to protect against DDoS attacks.

Can you explain what a man-in-the-middle attack is, and how AWS services can prevent them?

A man-in-the-middle (MITM) attack is where an attacker secretly intercepts and possibly alters the communication between two parties who believe they are directly communicating with each other. AWS provides services like AWS Certificate Manager to manage SSL/TLS certificates, which encrypt data in transit and help prevent MITM attacks.

How does AWS Identity and Access Management (IAM) help prevent unauthorized access to AWS resources?

AWS IAM allows you to manage access to AWS services and resources securely. By using IAM, you can create and manage AWS users and groups, and use permissions to allow and deny their access to AWS resources. IAM provides fine-grained access control to minimize the risk of unauthorized access.

Describe the SQL injection attack and how can you protect your AWS-hosted databases from it.

A SQL injection attack involves the insertion of malicious SQL statements into an entry field for execution within a database. To protect against it, AWS recommends using prepared statements or stored procedures in the application code to access databases. AWS RDS also provides the option for enabling built-in database parameter settings tailored to mitigate this threat.

What security practices should be followed when securing AWS S3 buckets to prevent data breaches?

Adequate security practices for AWS S3 include enabling access logging, using bucket policies to restrict access, enabling MFA (Multi-Factor Authentication) for ‘Delete’ operations, using AWS Identity and Access Management (IAM) to control access at the user level, and regularly auditing permissions with the IAM Access Analyzer.

Can you explain how cross-site scripting (XSS) affects web applications and the measures to protect against it on AWS?

Cross-site scripting (XSS) is a security vulnerability that allows attackers to inject scripts into web pages viewed by other users. Protection against XSS includes input validation, output encoding, implementing content security policy (CSP), and utilizing AWS WAF (Web Application Firewall) to create custom rules that block common XSS attack patterns.

Describe the role of Amazon VPC Flow Logs in network security monitoring.

Amazon VPC Flow Logs capture information about the IP traffic going to and from network interfaces in your VPC. Flow logs can be used for security monitoring, detecting anomalous traffic patterns, and intrusion detection. They provide visibility into network traffic to and from AWS resources and facilitate security analysis and timely response to potential threats.

What is an ARP spoofing attack, and does AWS protect its customers from it within its network?

ARP spoofing (or poisoning) is an attack in which an attacker sends fake ARP (Address Resolution Protocol) messages over a local area network to link their MAC address with the IP address of a legitimate computer or server on the network. AWS’s virtualization infrastructure is designed to prevent ARP spoofing attacks between instances that reside on the same physical host.

How does encryption at rest and in transit differ, and what AWS services enable these encryption features?

Encryption at rest involves encrypting data stored on a disk, while encryption in transit refers to encrypting data that is being transferred over a network. AWS offers various services and features, such as EBS encryption, S3 server-side encryption for data at rest, and TLS/SSL encryption with services like CloudFront and ELB for data in transit.

Give an example of a phishing attack. How can AWS customers reduce the risk of their staff falling victim to phishing scams?

A phishing attack typically involves sending an email that appears to be from a reputable source, asking users to provide sensitive information. AWS customers can use AWS WorkMail which offers integrated security controls to help protect against phishing attacks. Additionally, companies should conduct regular security awareness training for staff to recognize and report phishing attempts.

Explain “insider threats” and how AWS recommends mitigating such threats within an organization’s cloud environment.

Insider threats are security risks that come from within an organization; this could be anyone with legitimate access to the organization’s systems, such as employees or contractors. Mitigation strategies in AWS include following the principle of least privilege using AWS IAM, using Amazon CloudTrail for auditing and monitoring all actions taken in AWS by authenticated users, and regularly reviewing IAM policies and credentials.

What are AWS Security Groups, and how do they help in protecting EC2 instances?

AWS Security Groups act as virtual firewalls for EC2 instances to control inbound and outbound traffic. Security groups help in protecting EC2 instances by allowing administrators to specify the protocols, ports, and source/destination IP ranges that can reach the instances, thus ensuring that only authorized traffic can access them.