How AWS threat intelligence becomes managed firewall rules
summary
AWS collects 5.6 billion sensor interactions in three months and extracts IPs, malware and C2s to turn into mitigations used by services like WAF, Shield and GuardDuty. A curated Amazon IP reputation list of ~26,000 proxies accounts for 88% of L7 DDoS and Shield Advanced pushes that list into a WebACL in under 10 seconds. Bot defenses use challenge token servers and device fingerprints; a customer hit with 1.4 billion requests sees challenge action cut attack traffic by ~97%.
AI-written summary · about
chapters (24)
- 0:00Introduction
- 0:57Agenda
- 1:56Perimeter Protection Team
- 3:41How to leverage threat intelligence
- 4:33Types of attacks
- 5:43AWS Shared Responsibility
- 6:51AWS Threat Intelligence
- 7:29AWS Threat Sensors
- 9:41HTTP request example
- 13:13Internal use cases
- 17:20DDOS attacks
- 18:55Layer 7 attacks
- 20:54IP Reputationist
- 23:46Takedowns
- 26:40botnet analysis
- 34:11custom threat intelligence
- 36:01application telemetry
- 39:26fingerprinting
- 44:20attack scenario
- 44:52basic mitigation
- 47:25capture action
- 48:20account takeover prevention
- 49:41metrics summary
- 51:44conclusion
related talks
33mNetwork and application protection on AWS
29mWeb application protection on AWS
51mProtect your internet-facing web applications hosted on AWS
18mEnhance application security at the edge with AWS
42mProtect your workloads from DDoS attacks with Shield Advanced
51mCyber threat intelligence sharing on AWS
15mLevel up security: Advanced AWS WAF rules & bot detection techniques
32mAdvanced threat detection and response on AWS