AWS Console Walkthrough and Demo

Ian Olson of Amazon Web Services introduced AWS Network Security Manager, the newly launched successor to AWS Firewall Manager for centrally managing AWS WAF and AWS Shield Advanced. The session demonstrated how policies, scopes, and deployments let central security teams, application teams, and threat analysts collaborate, including granting targeted WAF exceptions at scale and rolling out emergency mitigations in minutes. At Security Field Day 16, Olson recalled deploying WAF and Shield Advanced to about 5,000 endpoints in an hour for a customer under DDoS attack.

Network Security Manager launched about five weeks before the event. Rules are bundled into policies whose priorities set rule order, scopes define targets by organizational unit, account, tag, ARN, or properties like internet-facing load balancers, and deployments join the two. Enforcement is event driven through AWS Config, so if an application team deletes or replaces a Web ACL, the service restores the baseline, while retrofit mode layers rules onto existing Web ACLs without causing infrastructure-as-code drift. Olson’s exception demo set the AWS common rule set to count and add labels, followed by a low-priority rule that blocks labeled requests unless an exception label is present. An application-specific rule placed between those priorities adds that label, leaving room for more than 9,000 applications. Versioned scopes and rules let teams test updates in dev before promoting them, and an AI assistant generates rule JSON from plain language.

For threat analysts, Olson rolled out a managed PHP rule set at top priority by reusing the central team’s existing scopes, describing a sub-five-minute response to a vulnerability that only patching can fully resolve. Changes typically propagate in seconds to a couple of minutes. AWS has already announced Network Firewall and security group support. WAF now includes a built-in dashboard showing which AI crawlers hit an application, verifies Web Bot Auth signatures for around 400 named bots, and can charge verified bots for access. Olson framed Network Security Manager strictly as a management plane, saying more native insight tools would arrive around re:Invent, and stressed that putting production baselines in dev and sandbox environments eliminates the last-minute security conflicts that stall application teams before launch.