What's up everyone?
If you want to learn how you can build a cyber security product, stick around.
This is the episode for you.
Today we have Charles, the CEO of Cyberthentic,
a New Jersey start-up that is trying to crack the code on email phishing.
Charles began tinkering with technology in the 7th grade while living in Africa.
He has a PhD in Computer Science from Texas A&M
and is hungry to bring his 20 plus years of security experience
into his own venture.
Let's hear from Charles.
Charles wants to build an application that detects and blocks email phishing.
I'll give you tips on how to build your own cyber security application
using AWS.
Let's check out an email that I just got.
"Hi Jillian, I hope you're having an awesome time on set.
I can't wait to see how your show turns out! -Sally"
Aw, thanks Sally.
Let's break down how that email went through safely.
As soon as Sally hit send a plugin will call API endpoints,
using Amazon API Gateway with AWS Lambda functions as the back end.
API Gateway is a fully managed service that creates, publishes and secures APIs.
The plugin will perform a series of security checks
to look for signals such as improper grammar, misspelled words,
does the sending domain have a bad reputation, and more importantly, is this really Sally.
Checking for a combination of many signals across a large volume of emails
is a powerful way to indicate that an email is a threat.
So as you can see, there's actually a lot going on
to make sure that email is legit.
But, what if there were an evil zombie phisher that is pretending to be Sally?
It sends an email saying: "Hay Jullian, it's me, Sally!
I heard ur looking 2 mke sum xtra$$$ on theee side
hit me urp here for some DOLLA DOLLA BILLS
www.gimmethatmonayhonay.com
this is sally by the way!!"
That is tempting.
There are so many things that I could do with that extra cash.
But I also don't want to risk my bank account getting taken hostage
and having to pay someone lots of bitcoin to get it back.
This is where machine learning would do the trick.
Charles could use Amazon SageMaker to determine if these emails are likely spam.
SageMaker is a machine learning service to train, build, and deploy models at scale.
In fact, SageMaker comes with an optimized implementation of the Blazing Text Algorithm,
which is one of many methods used for spam detection.
You can use Amazon Aurora to store insights on the malicious emails it received.
Aurora is a MySQL and PostgreS compatible
relational database built for the cloud.
You can use Amazon DynamoDB, a NoSQL database for storing email metadata
about synthetic attributes.
DynamoDB can manage structured or semi-structured data including JSON documents.
If the email actually isn't spam, then you just need to update the entry
in DynamoDB as not spam and false positive.
This data can be used to improve the machine learning model over time.
Sorry evil zombie, your tactics are no match for Charles.
There are a number of other security best practices
that you should implement to secure your APIs.
One, implement least privileged access.
Two, implement logging with AWS CloudWatch Logs.
And three, implement Amazon CloudWatch Alarms.
Four, enable AWS CloudTrail.
Five, deploy an application firewall for added layer of security in front of API Gateway.
To control access to the back end, use a feature of API Gateway
called a Lambda Authorizer.
A Lambda Authorizer is a Lambda function that controls access to your API.
When a client makes a request, API Gateway calls a Lambda Authorizer Function
which takes the caller's identity and returns it AWS IAM Policy
that allows access.
IAM stands for Identity and Access Management
and is the service that enables users to create and assign policies
that define who and what has access and permissions
to use specific AWS services.
The second security best practice is to implement logging with AWS CloudWatch Logs.
You'll want to log all requests to your APIs.
CloudWatch is a monitoring and observability service.
You could even use CloudWatch to build a dashboard of emails blocked.
You'll want to be as proactive with security as possible
which means analyzing data from CloudWatch Logs and from Amazon GuardDuty.
GuardDuty is a threat detection service that continuously monitors for malicious activity
and unauthorized behavior to protect your AWS accounts and workloads.
The third security best practice is to implement Amazon CloudWatch Alarms.
Using CloudWatch Alarms, you watch a single metric over a time period that you specify.
If the metric exceeds a given threshold, a notification is sent to
an Amazon Simple Notification Service topic.
Amazon Simple Notification service is a secure and fully managed pub sub service.
This notification could send an email to your customer to inform them of something suspicious.
The fourth is to enable AWS CloudTrail.
CloudTrail provides event history of your AWS account activity.
With CloudTrail you can log and determine things like who made the request,
when it was made and their IP address.
Last, is to deploy an AWS Web Application Firewall
for an added layer of security in front of API Gateway.
You can use AWS Web Application Firewall to protect your API from common web exploits
such as SQL injection and cross site scripting attacks.
These are general guidelines.
You'll want to review the security pillar at AWS's Well-Architected framework
for an extensive list and explanation of security best practices.
Now, it's time for the recap.
Amazon API Gateway will control access to your APIs that are running on AWS Lambda.
Use AWS WAF in front of API Gateway for more fine-grained security.
You can monitor requests and access to your APIs and AWS environment
using Amazon CloudWatch Logs, Amazon CloudTrail, and Amazon GuardDuty.
Use CloudWatch Alarms with Amazon's Simple Notification Service
to notify you of anything suspicious.
Amazon SageMaker will be your go-to service for all of your machine learning needs.
Amazon Aurora will store insights on malicious data
and Amazon DynamoDB will store metadata and synthetic attributes.
That's how you build a cyber security app in AWS.
It doesn't matter when you start as long as you just get started.
Thanks for hanging out with me. See you next time.