DevSecOps: How to secure Web App with AWS WAF and CloudWatch

Focused View

Sergii Demianchuk

3:08:26

2 View

1. Introduction

1. Promo introduction video.mp4

03:03

2. About me and cyber security experience.mp4

00:32

3. Coarse road map.mp4

03:55

2. Flask test API application

1.1 course-source-files-for-upload.zip

1.2 Gunicorn documentation.html

1. Flask app - local environment.mp4

04:15

2. Flask app - code overview, how application works.mp4

08:45

3.1 RFC 9110 specification.html

3. Flask app - custom exceptions.mp4

02:53

4.1 Flask-Log-Request-Id package.html

4. Flask app - logging.mp4

04:34

3. Application deployment at AWS using Terraform

1.1 A Beginners Guide to Installing Terraform on Windows.html

1.2 HOW TO USE MULTIPLE TERRAFORM VERSIONS AT ONE PC.html

1.3 tfutils tfenv.html

1. Terraform installation with tfenv.mp4

03:10

2.1 Configure AWS CLI Windows.html

2.2 DEVOPS BASICS HOW TO WORK WITH MULTIPLE AWS ACCOUNTS USING AWS CLI.html

2. AWS profile and terrafrom configuration.mp4

02:37

3.1 DevOps Terraform Network lecture - available for free - look at content.html

3. Running terraform scripts - essential introduction.mp4

00:58

4. Applying terraform - Part 1 pre init and network terrafrom modules.mp4

07:08

5.1 AWS managed rules.xlsx

5. Applying terraform - Part 2 AWS ALB and AWS Certificate Manage.mp4

09:00

6. Build docker image and push it to the AWS ECR.mp4

02:52

7. Applying terraform - Part 3 flask application at EC2 using auto scaling group.mp4

06:59

8. Applying terraform - Part 4 add EC2 to AWS ALB as target group.mp4

06:57

4. AWS WAF - deep inside

1. What is WAF and how it works.mp4

04:00

2. AWS WAF managed rules as first step.mp4

05:44

3. AWS WAF managed rules and count mode.mp4

05:02

4. AWS WAF logs and test data set.mp4

02:47

5. Initial Athena-WAF configuration.mp4

04:02

6. Athena - running first query, WAF logs structure, Athena pricing.mp4

03:03

7. How to analyse WAF logs data with Athena queries - part 1.mp4

03:45

8. How to analyse WAF logs data with Athena queries - part 2.mp4

05:54

9. AWS WAF managed rules configuration methodology and rules versions.mp4

04:51

10. AWS WAF managed rules in action.mp4

06:02

11. AWS WAF - custom white and black lists - part 1.mp4

03:16

12.1 Classless Inter-Domain Routing.html

12. AWS WAF - custom white and black lists - part 2.mp4

04:15

13. AWS WAF and custom regex pattern set.mp4

02:22

14. AWS WAF rate rules introduction.mp4

03:06

15. How to calculate rate thresholds for application using Athena and ALB logs.mp4

05:35

16.1 What is CIDR.html

16. AWS WAF rate rules in practice - part 1.mp4

05:07

17. AWS WAF rate rules in practice - part 2.mp4

06:12

18. AWS WAF metrics and alarms.mp4

05:12

19. AWS WAF priority.mp4

02:12

20. Why AWS WAF is not a silver bullet.mp4

03:36

5. Application and CloudWatch as security monitoring tool

1. How to use CloudWatch logs.mp4

03:38

2. Understanding Application logs with CloudWatch Logs Insights and Dashboards.mp4

04:24

3. Custom CloudWatch metrics and alerts as sensitive detector of abnormal behavior.mp4

06:19

6. Cyber threat analysis using Atena and Excel

1. Cyber threat analysis workflow - part 1.mp4

04:00

2. Cyber threat analysis workflow - part 2.mp4

04:08

3. Analyse data at Excel - part 1.mp4

04:43

4. Analyse data at Excel - part 2.mp4

04:40

7. Security defense framework

1.1 Cyber Security Questionnaire.html

1. Security defense framework.mp4

02:53

2. Cyber Security Questionnaire.html

Description

Web application cyber security practical guidance. AWS DevSecOps WAF masterclass. AWS DevOps security tips and tricks.

What You'll Learn?

How to secure Web application at AWS
How Web Application firewall works
How to configure AWS WAF poperly
How to configure WAF alarms
How to use Athena to analyse WAF and Application logs
How custom exceptions and custom logging can become a security defense tool
How to use CloudWatch for working with Application Logs
How to build custom CloudWatch filters and alerts upon it
How to provide cyber threat analysis using Athena and Excel after a hacker's attack

Who is this for?

Anyone who is interested at cyber security or who is responsible for Web resources - software engineers, DevOps, admin, CTO, CEO

What You Need to Know?

Active AWS account, some active web domain, basic knowledge at using docker and web programming

More details

Description
What you'll learn:
How exceptions and logging should be organized at web application to become a security defensive tool
How to secure Web application at AWS Cloud
How to configure AWS WAF
How to use AWS WAF managed rules
How to use AWS WAF custom black and white list
How to use AWS WAF custom rate rules
How to configure WAF alarms
How to use CloudWatch as detector of abnormal hacker's behavior
How to build custom CloudWatch filters and alerts upon it
How to use Athena to analyse WAF and application logs
Cyber thread analysis basics using Athena and Excel
Requirements:
Active AWS account
Some active web domain
Basic knowledge at using docker and web programming
Short description:
Current course is about how to secure Web Application against hacker's attacks with AWS cloud solutions using application level, centralized log system and firewall protection. You will also learn a lot about how to provide effective cyber thread analysis during hacker's attack and after it.

COURSE STRUCTURE:
The course starts from creating a very small API application. For that purpose I will use the Python programming language and Flask framework.Â If you are not aware of current technologies, don't worry, you should not. Believe me, the application would be extremely simple, so anyone, even a child, can understand how it works.
While creating according application I will concentrate at next essential aspects:
Custom exceptions
Logging
I will explain why it is so essential to have those both things at any application and how to make it properly in order it would be helpful from a security defense perspective.

The principles which I will show you are extremely simple and can be easily propagated at any existing web application. You will see the real power of properly done exceptions and logging at your own eyes when we will make real hackerâ€™s attacks simulations at our application after deploying it at AWS cloud

Generally speaking, deploying - it is 2nd essential part of our learning. Together we will deploy our test API application at AWS using Terraform. And again, if you have never used current technology, donâ€™t worry. I will show you step by step, how to run according terraform scripts.

At 1st we will prepare the AWS network, after that we will deploy AWS ALB with WAF, and finally, at the last step, we will deploy our application at EC2 using an auto scaling group. Current pattern of deployment can be easily used by you at production as it is rather cost effective and almost a HA solution. Though as every solution it also has some limitations, which I will discover during Terraform lectures

At deployment section I will speak a lot about different AWS Services, that would be used for creating security defense mechanisms

IAM policies and Security groups as restriction mechanisms to our resources
S3 as place for keeping our ALB and WAF logs
CloudWath as centralized log storage and alarm system
SNS - as mechanism for sending alarm notifications during security attacks detection
I will also touch a little bit Route 53 and Certificate manager services
The deployed Falsk application and all AWS infrastructure around it would be intensively used as a lab environment for imitating different hackerâ€™s attacks and providing a cyber security learning process. That will allow you to perform real practice training and try different security tools and tricks with your own hands. That is why, as for me, it is so essential to have it to be done.

In the third section we will speak about AWS WAF. We will discuss in details:
What resources can we attach WAF at - ALB, API gateway, CloudFront
How properly to configure it
Why correct configurationof AWS WAF is so time consuming process
How to set up AWS WAF managed rules and custom blocking policies
How to analyse WAF and ALB logs using Athena
Why WAF is not silver bullet that canâ€™t protect web app against all possible threats
At current section I will also show you some examples of real attacks that were blocked by WAF taken from my commercial experience, in order you could feel how powerful WAF is as a security defense tool

At 4th section we will discuss deeply AWS CloudWatch service, especially:
how to use our application logs as security detector
how to build custom CloudWatch filters
how to raise alerts in case web application is under the hackerâ€™s attack
how you can be aware of attack even before WAF will detect it, or when WAF could not deal with the problem

In the 5th section we will speak about cyber threat analysis using Atena and Excel after a hacker's attack. We will discuss how to gather all required data using Athena and how to verify if the hacker's actions had any success.

At last section we will make a short summary of all passed practice materials, by creating effective security defense framework, that can be used at any cloud or even at on-premise solutions

Who this course is for:
Anyone who is interested at cyber security or who is responsible for Web resources:
Software engineer
DevOps
Admin
CTO
CEO
Who this course is for:
Anyone who is interested at cyber security or who is responsible for Web resources - software engineers, DevOps, admin, CTO, CEO

User Reviews

Rating

average 0

Total votes0

Focused display

My name is Sergii Demianchuk. I have over 15 year’s experience as a software engineer. At my work I am mostly using next technologies: PHP, Python, Java, Javascript, Symfony, Flask, Spring, Vue, Docker, AWS Cloud, ML, Ansible, Jenkins, MySQL, Redis, ElasticSeach. I started my IT carrier as Engineer at national telecommunication Ukrainian networks. Than I worked as web full stack developer and IT manager for 10 years. After relocation to Poland at 2012, I continued my carrier path at Clicktrans company which represents one of the biggest transport marketplaces in Europe. Currently I am taking the position of CTO&System Architect at Clicktrans. My work is concentrated around architecture for complex systems, using ML for solving transport problems, big data sets analysis, search & recommendations systems. I am also deeply involved at devops and security world. My favorite slogan: "There is nothing impossible. The main question is how to do complicated system in the most efficient way having right people on a board with keeping it safe and simple at support :)"

Udemy

View courses Udemy

Students take courses primarily to improve job-related skills.Some courses generate credit toward technical certification. Udemy has made a special effort to attract corporate trainers seeking to create coursework for employees of their company.