WEBVTT

1
00:00.000 --> 00:07.200
So now that we're more familiar with the flows of the traffic that we need to

2
00:07.200 --> 00:08.480
control, let's

3
00:08.480 --> 00:14.260
go ahead and jump into Amazon's AWS and take a more detailed look at some of

4
00:14.260 --> 00:15.200
the security

5
00:15.200 --> 00:18.120
offerings available in AWS.

6
00:18.120 --> 00:22.380
Now, again, some of these we have mentioned in the previous videos, but we're

7
00:22.380 --> 00:22.600
going to

8
00:22.600 --> 00:26.890
take a closer look at some of them and then we'll actually jump into the AWS

9
00:26.890 --> 00:27.860
console and

10
00:27.860 --> 00:34.120
see where we would configure these various security features.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

10
00:27.860 --> 00:34.120
see where we would configure these various security features.

11
00:34.120 --> 00:40.100
So as we mentioned, sort of the foundation of AWS's security features would be

12
00:40.100 --> 00:41.080
the network

13
00:41.080 --> 00:42.880
hierarchy.

14
00:42.880 --> 00:45.880
Remembering that we have this thing called the VPC.

15
00:45.880 --> 00:51.760
This again is a logical separation within the cloud and then inside of each one

16
00:51.760 --> 00:52.640
of those

17
00:52.640 --> 00:59.870
because the VPC is that first level of separation, then we're going to have sub

18
00:59.870 --> 01:01.700
nets inside of
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

18
00:59.870 --> 01:01.700
nets inside of

19
01:01.700 --> 01:04.220
these VPCs.

20
01:04.220 --> 01:09.540
Then within and between the subnets are going to be the resources.

21
01:09.540 --> 01:14.190
These will be things like EC2 instances, which if you're not familiar with it,

22
01:14.190 --> 01:14.900
that is what

23
01:14.900 --> 01:18.340
AWS calls their virtual server environment.

24
01:18.340 --> 01:22.530
Now, some of the different security features that we can implement within this

25
01:22.530 --> 01:23.160
structure

26
01:23.160 --> 01:27.120
would include things like our network ACLs.

27
01:27.120 --> 01:33.400
We again have our security groups, AWS supports private subnets.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

27
01:27.120 --> 01:33.400
We again have our security groups, AWS supports private subnets.

28
01:33.400 --> 01:37.670
We can of course limit the routes in our routing table, therefore limiting

29
01:37.670 --> 01:39.240
which other subnets

30
01:39.240 --> 01:43.200
or VPCs a particular device can reach.

31
01:43.200 --> 01:49.520
We can also do things like set up isolated VPNs for remote access.

32
01:49.520 --> 01:54.590
The VPCs actually maintain flow logs that we can use for troubleshooting and

33
01:54.590 --> 01:55.120
hunting

34
01:55.120 --> 01:58.300
down security violations.

35
01:58.300 --> 02:03.620
We have a lot of reporting available through the AWS security hub.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

35
01:58.300 --> 02:03.620
We have a lot of reporting available through the AWS security hub.

36
02:03.620 --> 02:08.800
And of course, we have the available AWS network firewall.

37
02:08.800 --> 02:14.480
Now all of this set, keep in mind as we go through these different providers,

38
02:14.480 --> 02:15.080
we can

39
02:15.080 --> 02:21.080
always implement Cisco solutions here as well, such as the ASA virtual

40
02:21.080 --> 02:22.160
appliance and

41
02:22.160 --> 02:23.240
so on.

42
02:23.240 --> 02:27.130
They have a lot of offerings that are available within the cloud that we could

43
02:27.130 --> 02:28.400
use to replace

44
02:28.400 --> 02:30.520
these various features.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

44
02:28.400 --> 02:30.520
these various features.

45
02:30.520 --> 02:35.360
These are just things that AWS offers natively within their environment.

46
02:35.360 --> 02:42.420
Now we mentioned before that our network ACLs and our security groups are

47
02:42.420 --> 02:44.280
fairly similar.

48
02:44.280 --> 02:47.920
So let's spend just a minute to take a look at the differences.

49
02:47.920 --> 02:53.630
So here's just a table comparing the various differences between our security

50
02:53.630 --> 02:54.120
groups and

51
02:54.120 --> 02:56.320
our network ACLs.

52
02:56.320 --> 03:02.450
So the first thing here is that the security group is applied at an instance or
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

52
02:56.320 --> 03:02.450
So the first thing here is that the security group is applied at an instance or

53
03:02.450 --> 03:03.880
at a resource.

54
03:03.880 --> 03:11.560
So for example, it's applied to a network card on a virtual machine where the

55
03:11.560 --> 03:12.200
ACL is

56
03:12.200 --> 03:15.720
applied to the subnet as a whole.

57
03:15.720 --> 03:18.080
Now the next statement is a little bit odd.

58
03:18.080 --> 03:23.200
It says it only functions if it's applied to the instance.

59
03:23.200 --> 03:26.760
And what we're trying to say here is that you actually have to go to the

60
03:26.760 --> 03:27.560
instance.

61
03:27.560 --> 03:32.760
In other words, maybe that network card on that server and apply the security
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

61
03:27.560 --> 03:32.760
In other words, maybe that network card on that server and apply the security

62
03:32.760 --> 03:33.800
group before

63
03:33.800 --> 03:35.760
it will take effect.

64
03:35.760 --> 03:42.080
We're trying to contrast that to the ACL, which functions on the entire subnet.

65
03:42.080 --> 03:48.390
So again, we put the ACL on the subnet and it applies to all of the instances

66
03:48.390 --> 03:49.400
or resources

67
03:49.400 --> 03:55.080
in that subnet where the security group only functions on the instance to which

68
03:55.080 --> 03:57.320
it's applied.

69
03:57.320 --> 04:01.600
So the security group only supports allow rules.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

69
03:57.320 --> 04:01.600
So the security group only supports allow rules.

70
04:01.600 --> 04:05.920
That's because everything else is simply implicitly denied.

71
04:05.920 --> 04:10.600
Now an ACL supports both allow and deny.

72
04:10.600 --> 04:15.540
And in case you're wondering why this particular step is different, it actually

73
04:15.540 --> 04:16.280
has more to

74
04:16.280 --> 04:20.100
do with the next difference here.

75
04:20.100 --> 04:25.680
Because in a security group, all of the rules are evaluated.

76
04:25.680 --> 04:27.200
And what does that mean?

77
04:27.200 --> 04:31.400
That means that if it's not allowed with an explicit rule, it's ultimately
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

77
04:27.200 --> 04:31.400
That means that if it's not allowed with an explicit rule, it's ultimately

78
04:31.400 --> 04:32.080
going to be

79
04:32.080 --> 04:33.680
denied.

80
04:33.680 --> 04:40.500
On the other hand, since ACLs are evaluated in the order they're applied, you

81
04:40.500 --> 04:41.360
could actually

82
04:41.360 --> 04:47.300
put a deny before an allow that's more specific and you could actually deny

83
04:47.300 --> 04:48.640
something that

84
04:48.640 --> 04:54.000
might be allowed further down the list and it would still be denied.

85
04:54.000 --> 04:59.690
But since our security groups are not evaluated in order, then it really makes

86
04:59.690 --> 05:00.560
no sense to
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

86
04:59.690 --> 05:00.560
no sense to

87
05:00.560 --> 05:03.200
have a more specific deny.

88
05:03.200 --> 05:08.290
And our final difference here is that a security group is stateful much like

89
05:08.290 --> 05:09.440
most of today's

90
05:09.440 --> 05:17.200
firewalls are and an ACL sort of as they've always been are stateless.

91
05:17.200 --> 05:21.590
That means that return traffic will not automatically be allowed if it's

92
05:21.590 --> 05:23.960
permitted through an ACL.

93
05:23.960 --> 05:28.960
It would be if it's permitted through a security group.

94
05:28.960 --> 05:33.410
So now that we have an idea of these different features, let's jump over to the
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

94
05:28.960 --> 05:33.410
So now that we have an idea of these different features, let's jump over to the

95
05:33.410 --> 05:34.160
AWS console

96
05:34.160 --> 05:38.560
and just take a look at where some of these things are configured.

97
05:38.560 --> 05:43.440
So we'll start here on the VPC dashboard and we can see here that I actually

98
05:43.440 --> 05:44.880
already have

99
05:44.880 --> 05:49.880
some resources created for some testing and lab use that I've been doing.

100
05:49.880 --> 05:53.760
However, let's take a look at where we actually create these things.

101
05:53.760 --> 05:58.170
So for the VPC itself, we can see there's actually a button right here on the

102
05:58.170 --> 05:58.840
dashboard

103
05:58.840 --> 06:01.760
where we can create a VPC.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

103
05:58.840 --> 06:01.760
where we can create a VPC.

104
06:01.760 --> 06:06.600
Once you've created them, we can simply come over here to where it says you are

105
06:06.600 --> 06:07.200
VPCs.

106
06:07.200 --> 06:12.320
We could click on this and we can see that we have some VPCs up and running.

107
06:12.320 --> 06:14.280
We can also configure our subnets here.

108
06:14.280 --> 06:18.130
So if we click on subnets, we can see that I have quite a few subnets

109
06:18.130 --> 06:19.080
configured and

110
06:19.080 --> 06:24.590
over here towards the right, we can actually see the different IPv4 cider

111
06:24.590 --> 06:25.720
addresses that

112
06:25.720 --> 06:28.520
are assigned to these various subnets.

113
06:28.520 --> 06:31.950
And we can see in the top right corner, we have a button here if we wanted to
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

113
06:28.520 --> 06:31.950
And we can see in the top right corner, we have a button here if we wanted to

114
06:31.950 --> 06:32.440
create a

115
06:32.440 --> 06:34.160
new subnet.

116
06:34.160 --> 06:36.360
We also have our route tables here.

117
06:36.360 --> 06:42.000
So we have different route tables for the different subnets on the VPC.

118
06:42.000 --> 06:45.130
As you can see, there's a lot more things here to configure, but let's take a

119
06:45.130 --> 06:45.720
look down

120
06:45.720 --> 06:51.680
a bit further here under security and let's take a look at our network ACLs.

121
06:51.680 --> 06:55.240
So if we come down here to network ACL, I actually don't really have any

122
06:55.240 --> 06:56.080
specifically

123
06:56.080 --> 06:57.320
configured.

124
06:57.320 --> 07:02.940
These are just the default ACLs that are put in when you create your subnets.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

124
06:57.320 --> 07:02.940
These are just the default ACLs that are put in when you create your subnets.

125
07:02.940 --> 07:08.190
We can see here if we were to create a network ACL, if we put in a name, what

126
07:08.190 --> 07:08.880
we'll call

127
07:08.880 --> 07:15.610
it test, we can assign it to one of our VPCs or to say VPC one and we can

128
07:15.610 --> 07:16.760
create the network

129
07:16.760 --> 07:18.680
ACL.

130
07:18.680 --> 07:23.960
Notice however, it's currently not associated with any subnets.

131
07:23.960 --> 07:27.280
Now we could of course associate it with a subnet.

132
07:27.280 --> 07:31.680
We could simply highlight it here and then down at the bottom, we can choose
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

132
07:27.280 --> 07:31.680
We could simply highlight it here and then down at the bottom, we can choose

133
07:31.680 --> 07:33.680
subnet associations.

134
07:33.680 --> 07:37.400
We can say edit subnet associations.

135
07:37.400 --> 07:42.320
Choose the subnet we would want to associate it with and hit save changes.

136
07:42.320 --> 07:44.720
So fairly straightforward process.

137
07:44.720 --> 07:50.960
If we go back to our dashboard again, we can also see our security groups here.

138
07:50.960 --> 07:55.940
Now here I have created some security groups for what I've been testing in the

139
07:55.940 --> 07:56.240
lab.

140
07:56.240 --> 07:58.800
So you can see our different security groups here.

141
07:58.800 --> 08:03.900
If we were to highlight one of them, say, for example, SG underscore one, I'm
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

141
07:58.800 --> 08:03.900
If we were to highlight one of them, say, for example, SG underscore one, I'm

142
08:03.900 --> 08:04.600
using this

143
08:04.600 --> 08:07.480
as my outside security group.

144
08:07.480 --> 08:11.820
If we were to look at things like our inbound rules, for example, scroll down a

145
08:11.820 --> 08:13.560
little bit.

146
08:13.560 --> 08:17.120
We can actually adjust these windows so we can see a little bit better.

147
08:17.120 --> 08:21.150
So once we adjust this a little bit, you can see that I'm allowing things like

148
08:21.150 --> 08:21.680
IP sec

149
08:21.680 --> 08:30.720
through HTTP S or allowing RDP and a few other custom ports for SD WAN.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

149
08:21.680 --> 08:30.720
through HTTP S or allowing RDP and a few other custom ports for SD WAN.

150
08:30.720 --> 08:36.590
So you can see here that again, much like an ACL, it is a complete list of in

151
08:36.590 --> 08:37.280
bound and

152
08:37.280 --> 08:42.920
outbound rules, but then these get applied to network cards.

153
08:42.920 --> 08:47.040
Notice that none of these fields anywhere list the subnet.

154
08:47.040 --> 08:53.270
However, if I were to go over to my EC2 instances, so my resources, notice that

155
08:53.270 --> 08:54.720
under my EC2

156
08:54.720 --> 09:00.400
instances, I also have security groups and I have network interfaces.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

156
08:54.720 --> 09:00.400
instances, I also have security groups and I have network interfaces.

157
09:00.400 --> 09:05.500
If I go into my network interfaces, notice that each of my network interfaces

158
09:05.500 --> 09:06.520
has a security

159
09:06.520 --> 09:09.160
group associated with it.

160
09:09.160 --> 09:14.380
So this is what we mean when we say that the security group gets associated to

161
09:14.380 --> 09:15.360
a resource.

162
09:15.360 --> 09:21.750
In other words, a network card on a server, for example, and the network ACL

163
09:21.750 --> 09:22.800
gets applied

164
09:22.800 --> 09:25.000
to a subnet.

165
09:25.000 --> 09:29.640
So in this video, we took a look at some of the specific features that are

166
09:29.640 --> 09:30.880
available in
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

166
09:29.640 --> 09:30.880
available in

167
09:30.880 --> 09:32.760
AWS.

168
09:32.760 --> 09:37.450
Now we also jumped in here to the console and just got a real quick overview of

169
09:37.450 --> 09:38.080
where you

170
09:38.080 --> 09:42.080
can go to configure these and how they tie together.

171
09:42.080 --> 09:46.160
We're not going to do this for all of our cloud providers simply because we

172
09:46.160 --> 09:47.040
will be seeing

173
09:47.040 --> 09:50.440
this as we move through the rest of the course.

174
09:50.440 --> 09:54.530
But I did want to come in here at least to the most popular cloud provider as

175
09:54.530 --> 09:55.120
of right

176
09:55.120 --> 09:59.560
now and at least give you an introduction to where you would find these

177
09:59.560 --> 10:01.200
different services.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

177
09:59.560 --> 10:01.200
different services.

178
10:01.200 --> 10:05.690
So next, let's take a look at the different features that are available in

179
10:05.690 --> 10:06.440
Microsoft's

180
10:06.440 --> 10:07.040
Azure.

181
10:07.040 --> 10:17.040
[BLANK_AUDIO]