Course Introduction and Getting Started

0:00Well hello there and welcome my name is Scott Fletcher and this is the AWS Certified Security Specialty course. If you've ever wanted a quick and easy way to break into the fast-paced and exciting career of cyber security, well my sweet sweet summer child you may want to look elsewhere. This course is not for you. No this course is for those who are already well versed in information security and have the calluses to prove it. Maybe your organization is migrating to AWS and you need to keep the auditors happy. Perhaps you have been saddled with the thank less task of trying to keep your developers reasonably crowd yet still frictionless or maybe you just don't want your company to end up posted on the data breach wall of shame. Yep you are in the right place.

0:48We're going to cover encryption, firewalls, identity management, intrusion detection, a stack of best practices for AWS workloads and lots more. And we're going to keep things practical and dare I say occasionally entertaining and I promise not to use the C word in this course again. Let's get started.

0:00Okay, so to get us started, I figured the logical place to start would be the exam blueprint. Let's take a look at the blueprint, see what's in the exam, what's not in the exam, which is just as important as knowing what is in the exam, how it's scored and so forth. And then next, I wanted to share a little bit about my learning philosophy and maybe some tips and tricks to help you get the most out of this course. Now, for the rest of this course, sometimes I'll be here talking to you like this.

0:31Sometimes I'll be in a little box down here at the bottom. And sometimes I'll just be lurking in the shadows, which is what I'm going to do right now. So here we have the AWS certifications and there's more cropping up every now and then. Sometimes they end of life. Some of these certifications, sometimes they create new ones or consolidate. So one of the things I wanted to point out here is here is the security specialty certification right here. And it is a higher level certification.

1:03It is a more advanced certification. It's not quite as large as the solutions architect, but it's pretty specialized . So you are expected to have components that are covered in these certifications down here and this certification here. Now, this does not mean that you must have these certifications in order to take this exam, but the knowledge learned in pursuing some of these certifications will help support this.

1:37So hopefully you have some AWS background and you're not coming in new because as I said, this is not really a course for somebody just getting started in cloud or just getting started in AWS. So right here in the blueprint AWS says you need to have three to five years experience with security solutions and a minimum of two years hands on with AWS. Now this is a little bit deceptive because as we all know, somebody can just play around with S3 buckets for a whole two years and that doesn't constitute what they're trying to say is two years of hands on with AWS.

2:19You should have a pretty broad level of knowledge and experience with using AWS . Know your way around the console. Know your way around the CLI. So that's what they are expecting here. So for example, if I say something like this, hey, can you go set up a VPC with one subnet and spin up an EC2 instance there with a 50 gig EBS volume. And we're also going to launch an RDS instance along with an EFS share. Now if I say something like this and you literally have no idea what I'm talking about, then this might not be the best starting point for you.

2:58You can learn all of this in one of my other courses, like the certified cloud practitioner. Now if you said to yourself, I know how to do all that stuff, then I think you 'll be fine. Bonus points, if you started critiquing my design, if you said, hey, let's not use EC2, let's use some Lambda functions and Aurora serverless as the data store, then you're going to be doing just fine. So what is in this certification, the basics of AWS architectures, security controls and concepts, disaster recovery strategies, cryptographic and key management, data retention, lifecycle management, threat modeling and mitigation.

3:40So what's out? We're not going to be doing any software development. We're not going to be managing the SDLC lifecycle. We're not really going to be doing network design. However, we do have to build some networks because if we want to deploy, for instance, an EC2 instance to act as a honeypot, for example, we need to build a network such that we can deploy that resource. And also we're not going to be expected to architect whole deployments.

4:10Now here's one of the things that is a little bit deceptive about this security specialty. The amount of services, if you compare them to some of the other certifications , the amount of services is relatively small because AWS has a certain toolbox of security related tools. But the problem is those same security related tools apply to virtually every single one of the AWS services. So that's what AWS is saying here is that although we don't specifically call out services in the blueprint that are in scope, we might still have questions on those services on the exam because it relates to how we would use security principles and best practices with those services.

5:02So let's take a look at what the exam is like. It's still a multiple choice or multiple response and some of the more recent exams or some of the more recent certifications, AWS is starting to try to implement or incorporate some labs, which I think are a good thing. But as far as right now, this particular certification is still using the multiple choice or multiple response method. There are 50 scored questions and 15 unscored questions. Why in the world would there be unscored questions?

5:33Well, when the question writers write new questions to put into the question data bank, they need to test out those questions because maybe they have some sort of error in them or maybe they're ambiguous. And another reason why we have unscored questions is whenever a new service comes out, AWS is going to try to write questions for those new services and incorporate them into the test question data bank. Now, one thing to note and I get this question all the time is whenever a new service comes out, are we expected to know that new service?

6:09For example, if something is released last week, is it going to show up on the exam this week? Well, the answer is maybe, but most likely it's going to be an unscored question. So AWS has an internal policy that says that something has to be GA for at least six months before it can show up on an exam as a scored question. So don't worry too much about all the new services that get announced for reinvent, for example.

6:46And especially if they're in preview or beta, they have to become GA generally available. And then that has to be generally available for six months before it will show up as a scored question. So passing score is 750 out of 1000. And because everybody's test is different, it consists of a different collection of questions. The scoring is scaled, meaning that some questions are acknowledged to be more difficult than others, and AWS has some internal normalization that they try to apply to make sure everybody gets a fair shake.

7:25So that's a quick walkthrough of the exam itself in the blueprint. Let's keep going. [BLANK_AUDIO]

0:00Everybody has different learning journeys. I fully understand that people are coming to this course for different reasons. And rarely are those learning journeys perfect linear blinds. As a matter of fact, in my case, there's a bunch of loopty loops and cutbacks and so forth, but here we are. So I wanted to take a few moments to explain some of my learning philosophy and also how you might be able to maximize the benefit out of this course using not only the resources inside the course, but also some resources that you have access to beyond this course as well.

0:40So for example, I know that there are people out there that have a love of learning. Something comes out new, they're early adopters, they just wanna learn all the things. I also realize that there's people taking this course who are focused on career advancement. And that is a perfectly valid thing because certifications are a very useful thing in building out your resume and building out your portfolio. There are also those who are coming to this course because maybe they're curious or skeptical.

1:15Maybe this idea that, oh, well, if I put something on the cloud, it's inherently insecure. They probably don't believe that. And I don't believe that either. I think there's ways to perfectly secure information on the cloud. And by saying that, it's like saying that my money is more secure if I stuff it under my mattress than it is if I put it in a bank. It just doesn't make sense. So I welcome those skeptics out there or the folks that are just curious in this course or gonna learn some of those best practices that will keep our data secure.

1:51And then I also understand that there is a segment of folks who have been volintold. Hey, we are moving to AWS. You need to go learn AWS security so you can keep us safe. I understand that. And I appreciate it. And I stand with you on your learning journey for all those who have been volintold. And I appreciate that you selected this course for your volintold assignment.

2:22Now I wanted to talk a bit about Bloom's taxonomy. Now this is a way to organize different levels of learning. And down here at the bottom, this is kind of considered the basic level of learning. This is the most simplistic or the most elemental. And it's just asking us to remember stuff and examples of this are like memorization. We had to memorize our multiplication tables, for example. And at least what we were told at that time is, oh, that's so important because that's going to help us understand stuff.

2:58So understanding is kind of the next level up in complexity of learning. And then once we understand the hows and whys of things, then we should be able to apply them. Now this is the important step here because down here, we're not really building any sort of value or contributing our value to an organization or a school or something like that. We're just building some of the building blocks of these higher level actions.

3:30And that's what organizations, if there's a hiring manager here, I'm more interested, how can you actually apply your knowledge or maybe use your knowledge to analyze a situation that we're in and build something that fixes that problem? So when we talk about developing knowledge, really what I want to focus on is everything above this layer right here. So we are not going to spend a lot of time memorizing stuff and maybe a little bit of time understanding just because it's sometimes necessary, but we want to focus as much as we can on the application of these things that we learn.

4:13So within every skill in this course, we're going to have a lab, a hands-on exercise that you need to do. And I want you to do those things rather than just kind of kicking back, watching me do them. In some cases, I'm going to have challenges where I'm going to lay out a scenario and I want you to try to complete that scenario or solve that problem or whatever. And this is going to help us develop this apply aspect, which is really what AWS wants us to be able to do.

4:45And that's what employers want us to be able to do. So if we go back to our certifications here, does getting one of these certifications really prove that we have knowledge? No, not at all. I think we all know somebody who has a ton of certifications and they couldn't architect their way out of a wet paper bag, for example. And conversely, I'm sure we know lots of brilliant people who, for one reason or another, whenever they sit down in an exam, they just kind of lose their mind and they don't test very well, they're still very, very capable and they have lots of knowledge, but they just don't have the little certification on their profile or hanging on their wall.

5:30And just so we're on the same page, I wanted to let you know that I do not believe that certifications are proof of knowledge. However, I do believe that certifications are a very useful framework for learning. And that's, at the end of the day, that's what we want to do, we want to learn. We just don't want to rack up certifications and still have that gap in our knowledge because if we go into an interview with that certification and we can't really walk the walk, then that's gonna be very embarrassing and very uncomfortable for us.

6:03So in this course, I'm going to focus heavily on the understand, apply and analyze and not so much on the memorize. And I really want you to look at this as something greater than just passing an exam. The intent here is that we build a knowledge set and sure we can use the exam to test that knowledge and evidence that, but just having that certification doesn't mean that we really know what we're talking about. I want you to focus on building that you know what you're talking about, confidence, that's so important.

6:37And along those same lines, I'm going to build scenarios within this course that is gonna help you try to apply that. And I'm gonna try to make these scenarios as realistic as possible within bounds and within reason, but still entertaining and still a bit fun to do. So within this course, we're gonna use a variety of different learning methods. We're gonna use of course, audio visual, which you are experiencing right now. We're gonna use text.

7:07Now inside the skills in between the videos, I include textual information a lot of times. Sometimes it's a link, sometimes it's a YouTube video that I suggest you watch, but that stuff is important. Do not skip that stuff because that stuff is just as important as the audio visual components. I will also sometimes direct you to AWS content. Maybe it's a white paper. Maybe it's a blog that does just a beautiful job of explaining something. And it doesn't really make sense for me to regurgitate that inside the context of the course.

7:40We're also gonna have quiz questions. So there are gonna be quiz questions as we go throughout the skill. And at the end of every skill, we're gonna have a validation section. And I'm going to include some questions that are written in the style of the AWS exam to help you get comfortable with some of the tricks they try to use to trip you up. Now sometimes we're gonna have hands-on follow-alongs. I'm gonna show you how to do something and I would really encourage you to actually follow along and do the same thing.

8:14So you start building that muscle memory and that familiarity with doing things either in the console or the CLI. And then we're also gonna have some challenges here and there. And these are the scenario based things that I was talking about, where I'm gonna build these scenarios and challenge you to solve them. And then afterwards, I'm gonna show you how I solved it. Not saying that that's the only way to solve it, but we can compare notes and see how you did versus how I managed to address the issue. Now beyond this course material, there are some other things that you can do to kind of enrich your learning.

8:49Maybe have a study group. I know there are folks that have a lunch and learn, for example, and they'll watch a skill during their lunch hour and kind of follow along as I go through these things. Flashcards, flashcards help as well if you're trying to learn or memorize. But again, I wouldn't focus too much on the memorization. AWS typically does not ask you to memorize what's the system spec for a T4G nano instance or something like that.

9:21That's not gonna show up on an exam. But sometimes if you're talking about concepts or vocabulary words or something like that, flashcards might help. There's also the AWS documentation. Do not discount this as a source of information, but also a source of test questions. I'm gonna point out some cases in the AWS documentation where they use certain little flags to kind of give you a hint that says, hey, we believe this is very important.

9:51You might wanna know this for the exam. And another way is just talk to folks. Talk to folks who have already been through this cycle who are well-versed in AWS security. If you happen to go to a conference, maybe sit in on some seminars or something like that. So there's a lot of different ways that you can really kind of enrich your learning beyond just the content offered in this course. And by the end of this course, I really want you to have this common understanding of AWS security strategies and why AWS does things the way they do and how it does things the way they do.

10:31And I want you to effectively apply those strategies. Remember, that's what employers care about. Can you actually turn that knowledge into value? And AWS has a host of best practices that they recommend. But also more importantly, that you are familiar with some of the potential dangers on. Some of the things that we don't wanna do with our AWS account. And of course, I want you to smash that certified security specialty exam. And another thing I want you to do after you've gone through this course is maybe help somebody else out.

11:07Help somebody either start or continue on their cloud journey, their cloud security journey. So that's that. Let's get our hands dirty and get out there in the console and actually start doing some stuff.

0:00For the rest of the skill, we are going to create an AWS account and apply some security best practices to it. Now you may be saying, "Hey, I already got an account. My employer gave me an account that I can play with." I would really recommend against that because in some cases we are going to be implementing some bad security practices to be able to test some of our audits and some of our tools. And you may inadvertently open up your organization to stuff that you don't want to open up.

0:30So I would really suggest that you just create a personal account. It's fairly easy. You're going to be in the free tier. All the stuff in this course tries to be in the free tier. Occasionally we have to venture off a little bit, but it's not going to cost you much at all. And it is well worth the potential exposure that you might inadvertently do, especially if you're just learning some of this security with AWS that you might inadvertently expose your organization to some additional risk that is not needed.

1:00So just create a personal account. So let's do that right now. And to do that, we just go out to aws.amazon.com. We'll come up here to says, " Create an AWS account." We click on that and it's going to take us to this other screen. And we're being asked to give a root user email address. Now, let me enlarge this a bit. Here we go. Now this is an email address for the root user. The root user is the most important and the most powerful user inside an AWS account.

1:32There's nothing that this user cannot do, which means that we need to really secure it. And ideally, just like in a regular Linux system, for example, you don't use root for your daily driver account. You use a user account. And then if you need to assume root, then you use a sudo or something like that. And we can do the same type of thing. So we don't want to use our root account for everything. But nonetheless, we still have to create a root account. So I'm just going to enter an email address here. Now we're being asked for an account name.

2:05And we can change this name later, but let's just say, "Plecher security." And I'm going to click verify email address. And it will send us some sort of email to this email address. Going out to my email, there's the code. I'm going to paste this code in here, verify it. Now we're being asked for a password. And it's really best practices to use a very complex password here. However, we're also going to enable MFA, but you really should have a relatively complex password.

2:36So I just entered my proposed password and it meets all the criteria here. And I'm going to continue to the next step. Now it is asking us whether this account is for business or personal use. It's for personal use. And I also have to enter some personal information here. So I'm going to do that and proceed on to the next step. Now in this next step, we have to enter a debit card or a credit card, some sort of payment card. I'm going to enter my details here and then proceed to the next step.

3:06Next, we're being asked to confirm our identity. And it wants to either send us an SMS or an automated voice call. I'm going to enter my mobile phone number here and proceed to the next step. So my code just arrived on my phone. I'm going to enter that there and proceed to the next step. Now it's going to ask us if we want to sign up for a support plan. And for our purposes, we're just going to keep it at basic support. That's a free tier. We can also, if we wanted to sign up for the developer support or the business support, if you are a professional organization, I would highly recommend at least sign up for the business support.

3:43But for our purposes, the basic is just fine. And we can complete the sign up process. And that's all we have to do. Now we can go login to the AWS Management Console . console, and that's where we're going to pick up the next video.

0:00Okay, in our last video, we just finished up creating our account. Now we can sign into our account. Just click this little box up here and it's going to give us this prompt. Now right now, they are testing a new UI experience. By the time you watch this video, your user interface may look a little like this and may look a little different. But nonetheless, it still has all the same parts and pieces. Now, by default, we are dropped here to an IAM user sign in. That's an identity and access management user sign in. And that is a best practice. We should be using an IAM user for 99.999% of our activity in our account. But because it's a brand new account, we only have our root user. So we're going to have to log in as our root user.

0:45But what we want to do is protect our root user with MFA. So let's go down here to click this button here sign in using root user email, going to enter the root email address that I used, and the password, and sign in. Now right off the bat, it's going to prompt us to enter an MFA device or register an MFA device. I'm partial to UB keys. I probably have about six or 70s things. And I use them whenever I possibly can for as many different things as I can. I also have this little hardware token here.

1:21It has a little button where it gives you a LCD readout of a number there. You can also use an application like LastPass or Bitwarden or something like that. I would really recommend at a minimum, you can set up keys, sure, hardware keys. But if you're sharing this account with other people, then you want those root credentials to be stored in some location that if you have to break the glass, you can get access to them. So maybe use LastPass or Bit warden where you can actually share that password and that account with some colleagues so that if they need to get in there and get access, they have that authentication code set up as well. So for our purposes, I'm going to create an entry for my UB key that I'm going to show you how we can also add an authenticator app called us UB key for Neo. And let me plug it in here. And then I'm going to click next.

2:18There we go. So that's as easy as it is to set up a multi factor authentication for our root user. I'm going to continue to the console. And I'm also going to show you how we can set up another alternative way to log in. So we can go up here to this little drop down here and go down to security credentials. So let's enlarge this a bit. So here's my account number. And if you didn't notice, here's my account number up here. Now for some reason , people are very sensitive around account numbers. AWS themselves does not consider AWS account numbers to be sensitive or any sort of private thing that needs to be kept private. So I don 't keep them private.

3:05There's really if you secure your account properly, there's really nothing anybody can do with just knowing your AWS account ID plus I go through accounts so often that by the time this course actually gets published, this particular account is going to be long gone and closed out. But anyway, here are we're at the security credentials. It's telling us it's the root user here. If we go down here to multi factor authentication, we have our our past key that's already been set up. We can assign another device here. Let's call this bit warden. And I can scroll down here to authenticator app. And it's going to give me either a QR code or the secret key here. Now I am just going to use the secret key here. And I'm going to enter that into bit warden over here. And it requires me to enter my code or the codes that were generated down here. And I have to enter two codes in succession. Add the MFA device, there we go. So there, my virtual MFA device has been registered. So you can register up to eight of these. Again, I would really recommend that you use kind of a shared password vault for your root user. It's not so important for I

4:20am users. If you happen to lose your root credentials or unintentionally lock yourself out, there is a process to get back in, but it is a major hassle. So please do not do that. Okay, so there's one more thing that we have to do with our root user before we're ready to create our I am user. And that is enable some permissions for billing access. And this is something that has to be done under the root account. So to do that, we're going to go up here to this little dropdown, we're going to go to account.

4:54And then we are going to scroll all the way down. Scroll, scroll, scroll. And then we're going to get here, I am user and role access to billing information. So I'm going to click on edit, I'm going to click this little checkbox and click update. What this is going to do is allow us to assign permissions to our I am user to be able to look at billing information. In other words, our budgets, our costs, and stuff like that. So that's a good thing. Now in the next video, we are going to create our I am user. And from there on out, we are going to use that I am user instead of this root user.

0:00Okay, here we are still logged in as our root user. We are going to create our IAM user. To get there, we type in IAM up here. And what does IAM stand for? Identity and Access Management. And this is the central tool for dealing with logins and users and permissions and whatnot. And we're going to do a very deep dive into this whole service later. But for now, I just want us to create an IAM user so that we can use so that we're outside of the danger zone of constantly using our root account. So I just click on users here. I'm going to click create user. Give it a name.

0:37Provide access to the AWS console. Yes, we want to do this. Now it is giving us a choice here. It is saying, do we want to create an identity center or do we want to create an IAM user? Now identity center is something that we are definitely going to cover. But for now, I want to try to keep it simple and do old school. So we're just going to create an IAM user. And I'm going to use a custom password here that I'm going to enter. And we can also have the user whenever they log in, reset the password themselves. I'm going to uncheck that because I'm me. And I know what my password is. I'm going to click on next, and it's going to ask me for what sort of permissions do I want to assign to this particular user? Now, we can assign permissions directly, or we can add the user to a group. I'm going to create a group. I'm going to name this group administrators. And now I can choose what sort of permissions do I want to assign to this group.

1:37So I'm definitely going to assign administrator access. And then I also want to assign something called billing down here. That's going to allow us to access the billing information inside this account from our IAM user. So I'm going to create that group. And it's asking us, okay, here's your group. Do you want to assign that user to this group? Yes, I do click next. And it's going to give me a little confirmation screen here. There we go. So it has a username, it has the password here, it's even given us a little URL that we can use as a shortcut to be able to sign in to our console.

2:16We can even email instructions to whoever we created this user for. So I'm just going to copy that. I'm going to return to the users list. And I'm done for the moment, I'm done using my root account. And generally speaking, I don't think in this whole course, we're even going to have to use this root account again. I think maybe we will when we set up AWS organizations . But for the most part, just put that password away, put that MFA away, lock it away. Don't use it. Use your IAM user from here on out.

0:00Okay, so I use the URL that it prepared for so I'm going to bookmark that so I have it when I need it and I'm going to enter my IAM username here and my password and Then click sign in There we go now you'll notice that we were able to just sign in But what we need to do is add MFA to this account as well. Yes, that is correct This account as well needs MFA access so we're going to go down here to security credentials from this little drop down up here and Right off the bat here. It's saying hey, you don't have MFA assigned. Well, of course we're going to sign it and I'm going to register my same UV key and Pass keys fine next There we go, so now it is registered here if I wanted to I could add another device here But I'm okay with just the UV key for now. So now with MFA enabled on this account I'm reasonably confident that it's fairly secure at this moment But what we need to do is enable some other things for our account the first thing we want to enable is Something called a cloud trail and we're going to cover this in more detail

1:18later But think of cloud trail is kind of like an eye in the sky It's going to capture all the API activity going in and out of your account And if something bad happens then you're going to have this trail to be able to go back through and Evaluate what maybe happened so we're going to click on create a trail and I'm just going to call it management events and It's going to propose an s3 bucket name here that it's going to create So whenever something happens with our account It's going to log it into this trail name management events into this bucket.

1:54So I'm going to click create the trail That's it. That's all we have to do so we can go over here to this s3 bucket and We can see that we have a cloud trail folder here It's going to take a little bit of time for these entries to start showing up but later in this course we are going to analyze these entries and Set up notifications for whenever maybe somebody has an erroneous login or some sort of threat Maybe happening we can set up an alert to alert us So it's really important right now that you go ahead and turn this on so we can start building some history here Such that we can have access to it So that is creating cloud trail in the next video We want to do something that's also just as important and that's setting up a budget alert

0:00Okay, the next best practice that I want to implement is to set up a budget alert so that if I spend too much, I get notified before I get this shocking bill at the end of the month that says, "Hey, I owe $600 because I forgot to turn off an instance or something like that." So to help prevent that, we are going to go to Building and Cost Management and we go down here to Budget Status. It says, "Set Up Required." We're going to click on that.

0:30And it's going to bring us to a page that we can select a budget. We can either use a custom budget or use a ready-made template. And we have a couple different options here. We have a zero-spin budget. Basically, if we go outside the free tier, it's going to alert us of that. That may be something you want to do. I am going to use a monthly cost budget. We are able to supply some sort of number that if it exceeds or if we're on the trending towards exceeding that number, it's going to notify us.

1:02Now, down here, these daily savings plan coverage, these daily reservation utilization budget, these are really outside the scope of this particular course. They have to do with savings plans and reservations for EC2 and other compute services just to make sure that we're trying to fully utilize those particular contracts, but we are not going to go into those. Down here, I'm just going to say 100 bucks a month, sure. I'll leave the budget name the same, and now we're going to enter the email address that we want to send these notifications.

1:37And you can see here, we are going to get a notification when our actual spend reaches 85%, or we reach 100%, or if we're forecasted to exceed or reach 100%. So I'm going to click on Create Budget. That's it. That's all you have to do. So turning on CloudTrail, enabling a budget, enabling MFA, that will cover you and get you pretty far. So I think we're in a good position to really get underway in this course.