Cloud cybersecurity

What does IAM Mean?

Identity and Access Management (IAM) is a web service that helps you securely control access to AWS resources.

IAM to control who is authenticated (signed in) and authorized (has permissions) to use resources. IAM provides the infrastructure necessary to control authentication and authorization for your AWS accounts.It enables you to create and manage AWS users and groups, and use permissions to allow or deny access to AWS resources.

What Does VPC Mean?

Virtual Private Cloud.

you can launch AWS resources in a logically isolated virtual network that you've defined.

What is Subnet

A subnet is a range of IP addresses in your VPC that allows you to segment your network and control resource access within specific portions of your virtual private cloud.

What is Security Group

a set of rules controlling allowed inbound and outbound traffic for supported cloud resources, such as AWS EC2 instances.

What’s the difference between Public vs. private access

public access can be appropriate for a public website, but administrative services and databases should normally be limited to trusted sources

What is S3 bucket

a container for objects such as documents, images, logs, or backups. Access settings determine who can read or change those objects.

What does 0.0.0.0/0 mean?

It represents all IPv4 addresses. If a rule allows SSH from 0.0.0.0/0, any IPv4 host can attempt to connect. This greatly increases exposure.

Key principle

allow only the traffic that is needed, from the narrowest practical source. Public HTTPS may be necessary; public SSH or public database access usually is not

What are Three Services of AWS

CloudTrail, CloudWatch, GuardDuty

What Does AWS CloudTrail.

AWS CloudTrail is an AWS service that helps you enable operational and risk auditing, governance, and compliance of your AWS account.

CloudTrail records actions taken through AWS, such as creating a user, changing a security group, or attempting to access a resource through an API.

What Does AWS CloudWatch

Amazon CloudWatch monitors your Amazon Web Services (AWS) resources and the applications you run on AWS in real time.

CloudWatch collects metrics and logs, and can trigger alarms when configured conditions are met—for example, unusually high CPU usage or a certain error count.

What Does AWS GuardDUty

Amazon GuardDuty is a threat detection service that continuously monitors, analyzes, and processes AWS data sources and logs in your AWS environment.

GuardDuty analyzes supported AWS data sources and produces security findings about potentially malicious or unauthorized behavior.

What are Three questions to ask when you run company on AWS?

• What happened?

• How is the system performing, and when should we receive an alert?

• Does the activity look like a threat?

How to think about the response

• Investigate: verify the identity, login, source IP, and exact rule change.

• Contain: remove the unintended public database rule and restrict access to the authorized application server, following your incident-response process.

• Check impact: look for evidence of unauthorized connections or other changes.

• Document: record the timeline, evidence, risk, and remediation.