AWS and its partners offer a wide range of tools and features to help you to meet your security objectives. These tools mirror the familiar controls you deploy within your on-premises environments. AWS provides security-specific tools and features across network security, configuration management, access control and data security. In addition, AWS provides monitoring and logging tools to can provide full visibility into what is happening in your environment. In this session, you will get introduced to the range of security tools and features that AWS offers, and the latest security innovations coming from AWS.

1. © 2015, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Fall 2015
AWS Security Roadshow
More Secure in the Cloud

2. Security Roadshow Agenda
1:00 pm – AWS Security Overview + What’s New
2:00 pm – Network Security & Access Control in AWS
2:55 pm – Refreshment Break (15 minutes)
3:10 pm – Protecting Your Data in AWS
4:10 pm – Securing Systems at Cloud Scale
5:00 pm – Closing Remarks + Open Q&A

3. © 2015, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
AWS Security Overview
+
What’s New

4. 1) Why is security such a hot topic?
Because it’s important, and it’s hard

5. 2) Why is enterprise security traditionally so hard?
Because so much planning is needed

6. 3) Why does planning take so long?
Because it requires so many processes

7. 4) Why so many processes?
Because mistakes are easy
to make and hard to correct

8. 5) Why are mistakes so hard to correct?
Lack of visibility Low degree of automation

9. So where does AWS come in?
AWS makes security
more agile
Lets you move fast while
staying safe

10. New tools to move fast and stay safe
Amazon Inspector
AWS WAF
AWS Config Rules

11. Making Life Easier

12. Making life easier
Choosing security does not mean giving up
on convenience or introducing complexity

13. Security by Design (SbD)

14. Security by Design – SbD
• Systematic approach to ensure security
• Formalizes AWS account design
• Automates security controls
• Streamlines auditing
• Provides control insights throughout the
IT management processAWS
CloudTrail
AWS
CloudHSM
AWS IAM
AWS KMS
AWS
Config

15. SbD – Scripting your governance policy
Set of CloudFormation templates that accelerate
compliance with PCI, HIPAA, FFIEC, FISMA, CJIS
Result: Reliable technical implementation of administrative
controls

16. How We Build Our Organization

17. AWS Security Team
Operations
Application Security
Engineering
Compliance
Aligned for agility

18. Security ownership as part of DNA
• Promotes culture of “everyone is an owner” for security
• Makes security a stakeholder in business success
• Enables easier and smoother communication
Distributed Embedded

19. Operating principles
Separation of duties
Different personnel across service lines
Least privilege

20. Technology to automate operational principles
Visibility through automation
Shrinking the protection boundaries
Ubiquitous encryption

21. Amazon Inspector (Preview)
Security assessment tool analyzing end-to-end
application configuration and activity

22. Why Amazon Inspector?
Applications testing key to moving fast but staying safe
Security assessment highly manual, resulting in delays or
missed security checks
Valuable security subject matter experts spending too
much time on routine security assessment

23. Amazon Inspector features
Configuration Scanning Engine
Activity monitoring
Built-in content library
Automatable via API
Fully auditable

24. Amazon Inspector rulesets
CVE
Network Security Best Practices
Authentication Best Practices
Operating System Best Practices
Application Security Best Practices
PCI DCSS 3.0 Readiness

25. Amazon Inspector benefits
Increased agility
Embedded expertise
Improved security posture
Streamlined compliance

26. Getting started

27. Prioritized findings

28. Detailed remediation recommendations

29. AWS WAF

30. AWS WAF features
Web filtering
Amazon CloudFront integration
Centralized rule management
Real-time visibility
API automation

31. AWS WAF benefits
Increased protection
against web attacks
Ease of deployment and
maintenance
Security embedded in
development process

32. AWS WAF in action
AWS Management
ConsoleAdmins
Developers AWS API
Web app in
CloudFront
Define rules
Deploy
protection
AWS WAF

33. AWS WAF Partner integrations
• Alert Logic, Trend Micro, and Imperva integrating with AWS WAF
• Offer additional detection and threat intelligence
• Dynamically modify rulesets of AWS WAF for increased protection

34. AWS Config Rules

35. AWS Config Rules features
Flexible rules evaluated continuously and
retroactively
Dashboard and reports for common goals
Customizable remediation
API automation

36. AWS Config Rules
Broad ecosystem of solutions

37. AWS Config Rules benefits
Continuous monitoring for
unexpected changes
Shared compliance
across your organization
Simplified management of
configuration changes

38. AWS Config Rules

39. Putting it all together: Before
Auditor:
???
Develops
app
Reviews
app
Fixes
app
Updates
app
Fixes
broken
AWS
WAF
rules
Deploys
AWS WAF
rules
Reviews
app

40. Putting it all together: After
Auditor has
full visibility
Defines
standards
Develops
app
Fixes
app
Defines
AWS WAF
rules
Optimizes
environment
Runs
security
tests
Rapid updates

41. Security Training

42. New security training
Training
Security Fundamentals on AWS
(Free online course)
Security Operations on AWS
(3-day class)
Details at aws.amazon.com/training

43. Certification and education
• Security Fundamentals on AWS
• Free online course for security auditors and analysts
• Security Operations on AWS
• 3-day class for security engineers, architects, analysts, and
auditors
• Security Certification on AWS
• Available here at re:Invent for those who have achieved AWS
Solutions Architect – Professional certification

44. Security Partners

45. AWS Foundation Services
Compute Storage Database Network
AWS Global Infrastructure
RegionsAvailability Zones Edge Locations
Client-side
Data
Encryption
Server-side
Data Encryption
Network Traffic
Protection
Platform, Applications,
Identity & Access Management
Operating System, Network,
& Firewall Configuration
Customer Applications & Content
Security & Compliance is a shared responsibility
AWS Marketplace offers customers a
choice of security configurations IN the Cloud
AWS is responsible for the security OF the Cloud
• Infrastructure Security – gateway,
firewall, router, WAF, network, UTM
• Identity & Access Control -
allowed/authorized access
• Logging & Monitoring - SIEM/
Governance, Risk, & Compliance (GRC)
• Configuration & Vulnerability Analysis –
scanning/pen testing and IPS/IDS
• Data Protection - DRM/DLP/Encryption
• Threat Analytics - continuous monitoring

46. AWS Marketplace Network/Security Partner Eco-system
Infrastructure
Security
Logging &
Monitoring
Identity &
Access Control
Configuration &
Vulnerability
Analysis
Data
Protection
SaaS
SaaS
SaaS

47. The Bottom Line

48. Design and deploy
Define sensible defaults
Inherit compliance controls
Use available security
features
Manage templates—not
instances

49. Operate and improve
Constantly reduce the role of
people
Reduce privileged accounts
Concentrate on what matters

50. Conclusions
Security is critical
We’re creating tools to make it
easier
We’re creating ways to help
you build a world-class team
You can move fast and stay
safe

51. Don’t take my word for it…
“CIOs and CISOs need to stop obsessing over unsubstantiated cloud security worries,
and instead apply their imagination and energy to developing new approaches to cloud
control, allowing them to securely, compliantly and reliably leverage the benefits of this
increasingly ubiquitous computing model.”
Clouds Are Secure: Are You Using Them Securely?
Published: 22 September 2015
-- Jay Heiser
“”"We worked closely with the Amazon team to develop a security model which we
believe enables us to operate more securely in the public cloud than we can even in
our own data centers.” – Rob Alexander, CIO Capital One

52. Thank you!