Security Invariants

Introduction

• Chris Ferris and Rich Mogull discussed the concept of "Security Invariants" and how to implement them using various AWS security controls.
• Security Invariants are preventative controls that always hold true for a business, reducing the security burden and providing consistency.

Security Spectrum

• The presenters discussed the security spectrum, ranging from educating and empowering developers to vulnerability management.
• Security Invariants fit within this spectrum, acting as guard rails to prevent security issues from happening in the first place.

Defining Security Invariants

• Security Invariants should be:
  • Specific
  • Enforceable
  • Realistic
  • Avoid exceptions

Enforcement Options

• Service Control Policies (SCPs)
• Resource Control Policies (RCPs)
• Declarative Policies
• Auto Remediation

Service Control Policies (SCPs)

• SCPs are managed by AWS Organizations, defining the maximum permissions for an account, including the root user.
• SCPs apply to the identities in your organization.

Resource Control Policies (RCPs)

• RCPs apply to all identities in AWS, whether in your organization or not, and restrict access to specific resources.
• RCPs currently support S3, STS, SQS, and Secrets Manager.

Declarative Policies

• Declarative Policies enforce configurations at the service level, outside of the IAM policy evaluation logic.
• They currently support features like blocking public EBS snapshots and enforcing IMDSv2.

Writing Effective Invariants

• Start by defining the invariant in plain English or plain language.
• Determine the actions and resources to be controlled.
• Leverage condition keys, such as the principal ARN and IP address, to enforce the invariant.
• Avoid exceptions by building them into the invariant.

Deploying and Maintaining Invariants

• Be cautious and deliberate when rolling out invariants to avoid breaking production workloads.
• Leverage tools like AWS CloudTrail and Access Analyzer to understand the impact of the invariants.
• Communicate the invariants to developers and maintain them as infrastructure as code.
• Manage the organizational hierarchy, including the use of an "Exceptions OU" and an "Onboarding OU", to handle exceptions and new acquisitions.