SlideShare a Scribd company logo
Automated Infrastructure Security
Monitoring using FOSS
#AllDayDevOps
@madhuakula, Automation Ninja
Appsecco
About Me !
Automation Ninja at Appsecco
Appsecco is a specialist application security company
Interested in Security, DevOps & Cloud
Found bugs in Google, Microsoft, Yahoo, etc
Never ending learner!
Follow (or) Tweet to me @madhuakula
2
What we are covering today?
ELK stack to analyse and visualise logs in near real­time
ElastAlert to create rules to automatically defend against SSH
bruteforce attacks
AWS Lambda to do this, since our infra is hosted on AWS
Python based Chalice framework for using AWS Lambda
3
Architecture
4
Automated Defence Demo
Appsecco Automated Infrastructure Security Monitoring Demo (ELK + AWS Lambda)
http://bit.ly/addo­aism
5
AWS Lambda ­ Chalice Code
https://github.com/appsecco/alldaydevops­aism
6
Security for our AWS Lambda
We are primarily doing the following two things
1. A sufficiently random token to protect the request when we
post the IP address from ElastAlert
2. Whitelist the IP address of the host where the  HTTP POST 
request originates from
7
Use Cases for Automated Defence
1. Automated Defender (Attack Alerts + Automated Firewall)
2. Security Analytics + Reports
3. Near real­time Centralised Log Monitoring
8
Attack Scenario : Wordpress XML­RPC
https://blog.appsecco.com/analysing­attacks­on­a­wordpress­xml­rpc­using­an­
elk­stack­3bf25a7e36cc
9
Needs Improvement
More attack signatures required
For example OSSEC Wazuh Ruleset
Improve the ElastAlert Alerter custom code
Any suggestions from your side
10
Alternatives to our stack
Stack
 Elastic
 Graylog
 TICK Stack
 Prometheus + Grafana
Serverless
 AWS Lambda
 Azure Functions
 Cloud Functions
11
Our assumptions
You are already monitoring in near real­time using the ELK
stack
You are under attack for a specific service
You have configured ElastAlert for your alerting
12
In Summary
We created attack threshold rules in ElastAlert
We created an AWS Lambda endpoint to be able to modify
AWS VPC Network ACLs
We have a real­time blocking system infinitely scalable
13
References
Blog Post
Elastic
Elast Alert
AWS Lambda
Chalice
14
Automated Infrastructure Security: Monitoring using FOSS
Automated Infrastructure Security: Monitoring using FOSS
Thanks
@madhuakula | @appseccouk | http://appsecco.com

More Related Content

PDF
Prepare to defend thyself with Blue/Green
PDF
Static Analysis For Security and DevOps Happiness w/ Justin Collins
PDF
There is No Server: Immutable Infrastructure and Serverless Architecture
PDF
Serverless security - how to protect what you don't see?
PDF
Security as Code: DOES15
PDF
Lock That Shit Down! Auth Security Patterns for Apps, APIs, and Infra - Sprin...
PDF
Kubernetes security
PDF
Characterizing and Contrasting Kuhn-tey-ner Awr-kuh-streyt-ors
Prepare to defend thyself with Blue/Green
Static Analysis For Security and DevOps Happiness w/ Justin Collins
There is No Server: Immutable Infrastructure and Serverless Architecture
Serverless security - how to protect what you don't see?
Security as Code: DOES15
Lock That Shit Down! Auth Security Patterns for Apps, APIs, and Infra - Sprin...
Kubernetes security
Characterizing and Contrasting Kuhn-tey-ner Awr-kuh-streyt-ors

What's hot (20)

PDF
Batten Down the Hatches: A Practical Guide to Securing Kubernetes - RMISC 2019
PDF
Policy as code what helm developers need to know about security
PDF
DevSecCon London 2017: Hands-on secure software development from design to de...
PDF
Application Security in a Container World - Akash Mahajan - BCC 2017
PPTX
DevOps & Security: Here & Now
PPT
Continuous integration
PDF
Securing your AWS Deployments with Spinnaker and Armory Enterprise
PDF
The Future of Security and Productivity in Our Newly Remote World
PDF
Create Disposable Test Environments with Vagrant and Puppet
PPTX
Automated Infrastructure Testing
PPTX
Third Party Performance (Velocity, 2014)
PDF
Security Patterns for Microservice Architectures - SpringOne 2020
PDF
Security as Code: A DevSecOps Approach
PDF
System Hardening Using Ansible
PDF
Security Patterns for Microservice Architectures - London Java Community 2020
PPTX
Pipeline your pipelines!
PPTX
Shift Left - How to improve your security with checkov before it’s going to p...
PDF
Android Tamer: Virtual Machine for Android (Security) Professionals
PDF
NetflixOSS: The Netflix Way
PDF
DEFCON 23 - Nir Valtman and Moshe Ferber - from zero to secure in 1
Batten Down the Hatches: A Practical Guide to Securing Kubernetes - RMISC 2019
Policy as code what helm developers need to know about security
DevSecCon London 2017: Hands-on secure software development from design to de...
Application Security in a Container World - Akash Mahajan - BCC 2017
DevOps & Security: Here & Now
Continuous integration
Securing your AWS Deployments with Spinnaker and Armory Enterprise
The Future of Security and Productivity in Our Newly Remote World
Create Disposable Test Environments with Vagrant and Puppet
Automated Infrastructure Testing
Third Party Performance (Velocity, 2014)
Security Patterns for Microservice Architectures - SpringOne 2020
Security as Code: A DevSecOps Approach
System Hardening Using Ansible
Security Patterns for Microservice Architectures - London Java Community 2020
Pipeline your pipelines!
Shift Left - How to improve your security with checkov before it’s going to p...
Android Tamer: Virtual Machine for Android (Security) Professionals
NetflixOSS: The Netflix Way
DEFCON 23 - Nir Valtman and Moshe Ferber - from zero to secure in 1
Ad

Viewers also liked (20)

PPTX
Developing highly scalable applications with Symfony and RabbitMQ
PPTX
CloudStack EU user group - Trillian
PDF
Linux Malware Analysis
PDF
Chicago AWS user group meetup - May 2014 at Cohesive
DOC
Gaurav dev ops (AWS, Linux, Automation-ansible, jenkins:CI and CD:Ansible)
PDF
Aws + Puppet = Dynamic Scale
PPTX
e-Extortion Trends and Defense
PDF
Astricon 2016 - Scaling ARI and Production
PPTX
Python Pants Build System for Large Codebases
PPTX
Apache Ambari: Managing Hadoop and YARN
PDF
Bridging the Gap: Connecting AWS and Kafka
PDF
Powerupcloud - Customer Case Studies
PDF
Platform - Technical architecture
PPT
Jake Fox Pd. 5
PDF
Gartner 2017 London: How to re-invent your IT Architecture?
PPTX
Reversing malware analysis training part2 introduction to windows internals
PDF
Application Deployment at UC Riverside
PPT
Docker introduction
PPTX
Software Architectures, Week 3 - Microservice-based Architectures
PDF
Machine Learning & IT Service Intelligence for the Enterprise: The Future is ...
Developing highly scalable applications with Symfony and RabbitMQ
CloudStack EU user group - Trillian
Linux Malware Analysis
Chicago AWS user group meetup - May 2014 at Cohesive
Gaurav dev ops (AWS, Linux, Automation-ansible, jenkins:CI and CD:Ansible)
Aws + Puppet = Dynamic Scale
e-Extortion Trends and Defense
Astricon 2016 - Scaling ARI and Production
Python Pants Build System for Large Codebases
Apache Ambari: Managing Hadoop and YARN
Bridging the Gap: Connecting AWS and Kafka
Powerupcloud - Customer Case Studies
Platform - Technical architecture
Jake Fox Pd. 5
Gartner 2017 London: How to re-invent your IT Architecture?
Reversing malware analysis training part2 introduction to windows internals
Application Deployment at UC Riverside
Docker introduction
Software Architectures, Week 3 - Microservice-based Architectures
Machine Learning & IT Service Intelligence for the Enterprise: The Future is ...
Ad

Similar to Automated Infrastructure Security: Monitoring using FOSS (20)

PDF
Automating Security in Cloud Workloads with DevSecOps
PPTX
AWS Security Architecture - Overview
PDF
Advanced Security Automation Made Simple
PPTX
Automating AWS security and compliance
PPTX
AWS Security Best Practices for Effective Threat Detection & Response
PDF
Shared Responsibility In Action
PPTX
5 minutes on security
PPTX
AWS Lambda Security Inside & Out
PDF
INTERFACE by apidays 2023 - Security Exposure Management in API First World, ...
PPTX
Security Risk Advisors - BSides PGH 2018 - Red Team SIEM
PDF
Threat stack aws
PDF
Pragmatic Cloud Security Automation
PDF
AWS Community Day - Vitaliy Shtym - Pragmatic Container Security
PPTX
Stephen Sadowski - Securely automating infrastructure in the cloud
PPTX
Automating your AWS Security Operations
PDF
Serverless Security Automation on AWS - Hamburg AWS User Group
PPTX
Cloud Security (AWS)
PPTX
Ghost Environment
PDF
Practical AWS Security - Scott Hogg
PDF
A Pragmatic Approach to Network Security Across Your Hybrid Cloud Environment
Automating Security in Cloud Workloads with DevSecOps
AWS Security Architecture - Overview
Advanced Security Automation Made Simple
Automating AWS security and compliance
AWS Security Best Practices for Effective Threat Detection & Response
Shared Responsibility In Action
5 minutes on security
AWS Lambda Security Inside & Out
INTERFACE by apidays 2023 - Security Exposure Management in API First World, ...
Security Risk Advisors - BSides PGH 2018 - Red Team SIEM
Threat stack aws
Pragmatic Cloud Security Automation
AWS Community Day - Vitaliy Shtym - Pragmatic Container Security
Stephen Sadowski - Securely automating infrastructure in the cloud
Automating your AWS Security Operations
Serverless Security Automation on AWS - Hamburg AWS User Group
Cloud Security (AWS)
Ghost Environment
Practical AWS Security - Scott Hogg
A Pragmatic Approach to Network Security Across Your Hybrid Cloud Environment

More from Sonatype (20)

PPTX
DevOps Days Columbus - Derek Weeks - 2019
PDF
2019 DevSecOps Reference Architectures
PDF
RSAC DevSecOpsDays 2018 - We are all Equifax
PPTX
DevSecOps reference architectures 2018
PDF
30+ Nexus Integrations to Accelerate DevOps
PDF
2017 DevSecOps Survey
PPTX
Starting and Scaling DevOps In the Enterprise
PPTX
DevOps Friendly Doc Publishing for APIs & Microservices
PDF
The Unrealized Role of Monitoring & Alerting w/ Jason Hand
PPTX
DevOps and All the Continuouses w/ Helen Beal
PDF
Serverless and the Way Forward
PDF
A Small Association's Journey to DevOps w/ Edward Ruiz
PDF
What's My Security Policy Doing to My Help Desk w/ Chris Swan
PDF
Getting out of the Job Jungle with Jenkins
PDF
Modern Infrastructure Automation
PDF
Continuous Everyone: Engaging People Across the Continuous Pipeline
PDF
The Road to Continuous Deployment
PDF
Docker Inside/Out: The 'Real' Real- World World of Stacking Containers in pro...
PDF
I, For One, Welcome Our New Robot Overlords
PDF
Meta Infrastructure as Code: How Capital One Automated Our Automation Tools w...
DevOps Days Columbus - Derek Weeks - 2019
2019 DevSecOps Reference Architectures
RSAC DevSecOpsDays 2018 - We are all Equifax
DevSecOps reference architectures 2018
30+ Nexus Integrations to Accelerate DevOps
2017 DevSecOps Survey
Starting and Scaling DevOps In the Enterprise
DevOps Friendly Doc Publishing for APIs & Microservices
The Unrealized Role of Monitoring & Alerting w/ Jason Hand
DevOps and All the Continuouses w/ Helen Beal
Serverless and the Way Forward
A Small Association's Journey to DevOps w/ Edward Ruiz
What's My Security Policy Doing to My Help Desk w/ Chris Swan
Getting out of the Job Jungle with Jenkins
Modern Infrastructure Automation
Continuous Everyone: Engaging People Across the Continuous Pipeline
The Road to Continuous Deployment
Docker Inside/Out: The 'Real' Real- World World of Stacking Containers in pro...
I, For One, Welcome Our New Robot Overlords
Meta Infrastructure as Code: How Capital One Automated Our Automation Tools w...

Recently uploaded (20)

PDF
How to Migrate SBCGlobal Email to Yahoo Easily
PPTX
Materi_Pemrograman_Komputer-Looping.pptx
PDF
Upgrade and Innovation Strategies for SAP ERP Customers
DOCX
The Five Best AI Cover Tools in 2025.docx
PPTX
Presentation of Computer CLASS 2 .pptx
PPTX
Lecture 3: Operating Systems Introduction to Computer Hardware Systems
PDF
Addressing The Cult of Project Management Tools-Why Disconnected Work is Hold...
PDF
Which alternative to Crystal Reports is best for small or large businesses.pdf
PDF
PTS Company Brochure 2025 (1).pdf.......
PPTX
ISO 45001 Occupational Health and Safety Management System
PDF
Build Multi-agent using Agent Development Kit
PDF
Flood Susceptibility Mapping Using Image-Based 2D-CNN Deep Learnin. Overview ...
PPTX
ManageIQ - Sprint 268 Review - Slide Deck
PDF
How Creative Agencies Leverage Project Management Software.pdf
PDF
T3DD25 TYPO3 Content Blocks - Deep Dive by André Kraus
PDF
Digital Strategies for Manufacturing Companies
PDF
IEEE-CS Tech Predictions, SWEBOK and Quantum Software: Towards Q-SWEBOK
PPTX
Transform Your Business with a Software ERP System
PPTX
Agentic AI : A Practical Guide. Undersating, Implementing and Scaling Autono...
PPTX
AIRLINE PRICE API | FLIGHT API COST |
How to Migrate SBCGlobal Email to Yahoo Easily
Materi_Pemrograman_Komputer-Looping.pptx
Upgrade and Innovation Strategies for SAP ERP Customers
The Five Best AI Cover Tools in 2025.docx
Presentation of Computer CLASS 2 .pptx
Lecture 3: Operating Systems Introduction to Computer Hardware Systems
Addressing The Cult of Project Management Tools-Why Disconnected Work is Hold...
Which alternative to Crystal Reports is best for small or large businesses.pdf
PTS Company Brochure 2025 (1).pdf.......
ISO 45001 Occupational Health and Safety Management System
Build Multi-agent using Agent Development Kit
Flood Susceptibility Mapping Using Image-Based 2D-CNN Deep Learnin. Overview ...
ManageIQ - Sprint 268 Review - Slide Deck
How Creative Agencies Leverage Project Management Software.pdf
T3DD25 TYPO3 Content Blocks - Deep Dive by André Kraus
Digital Strategies for Manufacturing Companies
IEEE-CS Tech Predictions, SWEBOK and Quantum Software: Towards Q-SWEBOK
Transform Your Business with a Software ERP System
Agentic AI : A Practical Guide. Undersating, Implementing and Scaling Autono...
AIRLINE PRICE API | FLIGHT API COST |

Automated Infrastructure Security: Monitoring using FOSS