Determining which telemetry sources to monitor based on network design, threats, and attacks (for example, load balancer logs, VPC Flow Logs, Traffic Mirroring)

What types of telemetry data would you prioritize for monitoring in a high traffic AWS environment, and why?

In a high traffic AWS environment, I would prioritize VPC Flow Logs to monitor the network traffic for security and governance, Elastic Load Balancing (ELB) access logs for insights into application traffic patterns, AWS CloudTrail logs for auditing API calls, and AWS WAF logs if a web application firewall is in use, to monitor HTTP/S requests and prevent web-based attacks.

How can VPC Flow Logs contribute to identifying potential network threats?

VPC Flow Logs capture information about the IP traffic going to and from network interfaces in a VPC. By analyzing this data, we can identify anomalous traffic patterns, reconnaissance activities, attempted breaches, or unauthorized data exfiltration. Such insights are critical for threat detection and response.

What benefits does Traffic Mirroring offer over traditional log-based monitoring solutions?

Traffic Mirroring copies network traffic from an EC2 instance and forwards it to security and monitoring appliances for deep packet inspection. Unlike log-based monitoring, which provides metadata about network traffic, Traffic Mirroring allows for real-time content inspection, including packet payloads, which can reveal sophisticated threats and vulnerabilities in the traffic itself.

In which scenarios would you recommend using AWS Shield Advanced, and what telemetry sources would it integrate with?

AWS Shield Advanced is recommended for protecting against DDoS attacks, especially for resources such as Elastic IP addresses, ELB, CloudFront distributions, and Route 53 hosted zones. It integrates with AWS CloudWatch for metrics and alarms, and AWS CloudTrail for logging API activity, providing telemetry for potential DDoS activity.

What approach would you take to determine which AWS telemetry sources to monitor in the context of GDPR compliance?

When considering GDPR compliance, I would focus on telemetry sources that can help track access to and movement of personal data. This includes AWS CloudTrail for API activity, Amazon S3 server access logs for object-level operations, VPC Flow Logs for traffic monitoring, and possibly AWS Config for resource configuration compliance with GDPR requirements.

Can you describe how to configure and utilize AWS Config for monitoring changes in network resources?

AWS Config is used to assess, audit, and evaluate configurations of AWS resources. To configure it for monitoring changes in network resources, I would enable AWS Config, define the resources of interest (like subnets, security groups, network ACLs, etc.), and set up rules to check for compliance. AWS Config then records configuration changes over time, providing a history that can help detect and respond to unauthorized modifications.

What is the purpose of analyzing ELB access logs, and how can they help in identifying network threats?

ELB access logs provide detailed information about incoming requests to the load balancer. By analyzing these logs, we can detect anomaly patterns such as spikes in traffic, repeated failed authentication attempts, or abnormal geographical sources of traffic, which may indicate a threat like a brute force attack or potential DDoS.

How does Amazon GuardDuty enhance network monitoring, and which telemetry sources does it utilize?

Amazon GuardDuty is a threat detection service that uses machine learning, anomaly detection, and integrated threat intelligence to identify and prioritize potential threats. It analyzes telemetry data from AWS CloudTrail, VPC Flow Logs, and DNS logs, providing comprehensive and automated network monitoring and alerting.

In the context of AWS, why would you consider turning on DNS query logging, and what could it reveal about security threats?

DNS query logging, such as provided by Amazon Route 53 Resolver query logging, can pinpoint malicious domain requests and track the source of the requests within the AWS environment. It can reveal security threats like exfiltration attempts, command and control communications, or phishing attempts.

How would implementing AWS WAF help in monitoring HTTP/S traffic, and what types of threats can it mitigate?

AWS WAF allows for the monitoring and controlling of HTTP/S traffic to and from AWS resources. By defining customizable web security rules, AWS WAF can mitigate threats such as SQL injection, cross-site scripting (XSS), and known attacker patterns. It also helps in real-time monitoring of web requests, providing telemetry that can be analyzed for threats.

When would you recommend enabling encryption for AWS CloudTrail logs, and what are the added benefits in terms of security?

I would recommend enabling encryption for AWS CloudTrail logs especially when dealing with sensitive data or to ensure compliance with security standards. Encrypting CloudTrail logs with AWS Key Management Service (KMS) keys provides an extra layer of data security by ensuring that access to log data is tightly controlled and auditable.

Describe how Amazon Inspector can complement the existing telemetry monitoring solutions in AWS for enhanced network security.

Amazon Inspector is an automated security assessment service that helps improve the security and compliance of applications deployed on AWS. It complements existing telemetry monitoring by performing automated security assessments to check for vulnerabilities or deviations from best practices, such as open ports, insecure software configurations, or non-adherence to network security standards.