When migrating to the cloud, the shared responsibility model inherent to AWS creates different paradigms for assessing your security, risk and compliance posture. Determining how to deal with these aspects of cloud can often slow migration and adoption far more than any technical blockers. In this session, we will discuss how you can build your landing zone in a way that addresses your security, risk, and compliance requirements. The session will feature ECMC who will chronicle the migration and transformation of regulated workloads to AWS and their approach to addressing security risk and compliance in the cloud

1. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Robert D. Barnes
Cloud Security Architect, AWS
Amedeo Minutolo
Chief IT Architect, ECMC Group
195345
How Do I Plan for Security, Risk, and
Compliance when Migrating to AWS?

2. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Robert D. Barnes
Cloud Security Architect, AWS
Amedeo Minutolo
Chief IT Architect, ECMC Group
195345
How Do I Plan for Security, Risk, and
Compliance when Migrating to AWS?

3. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Answer:
Early and often

4. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Start small: What is this?
Is it secure?

5. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
How about this?
Is this secure?

6. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Where do I start?

7. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Introducing the vowels of security, risk, and compliance!

8. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
is for automate
Automate everything*
*Eventually

9. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
is for educate
Educate everyone

10. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
is for iterate
The three rules of AWS adoption are:
• Iterate
• Iterate
• Iterate

11. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
is for OODA
What the heck is OODA?
• Observe
• Orient
• Decide
• Act

12. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
is for understand
Understand your requirements.

13. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
And sometimes
Why not encrypt everything?
Why not use native services?
Why not log everything…forever?

14. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Resources:
AWS Quick Starts (https://aws.amazon.com/quickstart/)
• NIST
• PCI
• HIPAA
• CJIS
• CIS AWS Foundations Benchmark

15. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
But don’t take my word for it…

16. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Educational Credit Management Corporation
At ECMC, we help students succeed. We:
• Work to lower student loan default rates
• Sponsor college access and success initiatives and financial literacy
programs
• Provide resources to support student loan borrowers to successfully
repay their loans
As a nonprofit corporation providing services in support of higher education
finance, we assist students and families in their efforts to plan and pay for
college.

17. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Educational Credit Management Corporation
ECMC must adhere to two compliance/regulatory initiatives:
• Federal Information Security Management Act (FISMA)
• We must maintain PCI-DSS compliance

18. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
FISMA
The Federal Information Security Management Act (FISMA) requires
federal agencies to develop, document, and implement an information
security and protection program.
The top FISMA requirements include:
• Information System Inventory
• Risk Categorization
• System Security Plan
• Security Controls: NIST SP 800-53 outlines an extensive catalog of
suggested security controls for FISMA compliance
• Risk Assessments
• Certification and Accreditation

19. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
The National Institute of Standards and Technology (NIST)
outlines nine steps toward compliance with FISMA:
1. Categorize the information to be protected.
2. Select minimum baseline controls.
3. Refine controls using a risk assessment procedure.
4. Document the controls in the system security plan.
5. Implement security controls in appropriate information systems.
6. Assess the effectiveness of the security controls once they have been
implemented.
7. Determine agency-level risk to the mission or business case.
8. Authorize the information system for processing.
9. Monitor the security controls on a continuous basis.

20. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Determine your organization’s risk tolerance
• Perform a business process review.
• Perform an IT service audit, mapping them to the
business processes.
• Categorize the services into enterprise application
definitions.
• Conduct a business impact analysis on the
services.
• Map cross-service dependencies and determine
RTO/RPO requirements for each service.
• Classify each application’s data into protection
levels and determine the risk tolerance for each
application.

21. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Determine your organization’s risk tolerance
Fault and threat isolation influenced many decisions.
• Account design
• AWS Organizations usage
• Multi-region AWS deployment
• VPC/account design, placement, and isolation
• Network design
• Application and service designs

22. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Some decisions made early will help the process.
• If you adopt a multi-account strategy, will you use AWS
organizations?
• Can you automate account provisioning early?
• Can/will you use federated services for account access? What
will you use?
• Based on your regulatory requirements, can you use AWS Quick
Starts as a starting point? (NIST, PCI, CIS AWS Foundations
Benchmark, etc.)
• Can you use CloudFormation for consistent deployments?
• Can you develop deployment pipelines to build your
environment?

23. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Determine your organization’s security requirements.
• What are you required to accomplish?
• How can technology support achieving these goals?
• What solutions meet the technical requirements?
• Focus on cloud-native or cloud-integrated technologies.

24. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Treat security solutions like everything else in the cloud.
• Look at solutions as cattle and not as pets.
• Security tends to be a religious topic, so the challenge here
is related to cultural and operational change.
• Education and training are critical.
• What works in a traditional data center may not be right in
the cloud.

25. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
To sniff or not to sniff? That is the question.
• In the cloud, the network is a shared resource. Trust
AWS to manage layers 1-3.
• Avoid using subnets and IP addresses as a security
construct.
• Using network layers 2 and 3 as a security control will
quickly complicate the environment.
• Use network layers 4-7 to secure the environment
with host-based controls.
• Use AWS security mechanisms where possible to
protect the network.

26. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Continuous Monitoring
• Utilize AWS Config to track resource changes and report on
compliance items related to configuration management.
• Utilize CloudTrail to track and monitor user and infrastructure
activity.
• Use CloudWatch to monitor and react to changes in the
environment.
• Leverage Trusted Advisor to evaluate security configurations.
• Use Lambda and Inspector for continuous vulnerability scanning.
• Use GuardDuty to continuously monitor CloudTrail, VPC Flow
Logs, and DNS logs

27. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Consider a Dev-Sec-Ops model
• While enterprise security controls are necessary, involving
security in application design and operations will yield better
solutions in the long run.
• Placing some responsibility on security for application
usability and performance creates a balance and prevents
the security controls from becoming unnecessarily restrictive.
• Security will understand the
landscape and application base
more thoroughly, and the end result
will be a more secure environment.

28. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Thank you!
Please complete the session survey in the Summit
mobile app.