The AWS cloud infrastructure has been architected to be one of the most flexible and secure cloud computing environments available today. Security for AWS is about three related elements: visibility, auditability, and control. You have to know what you have and where it is before you can assess the environment against best practices, internal standards, and compliance standards. Controls enable you to place precise, well-understood limits on the access to your information. Did you know, for example, that you can define a rule that says that “Tom is the only person who can access this data object that I store with Amazon, and he can only do so from his corporate desktop on the corporate network, from Monday-Friday 9-5 and when he uses MFA?”. That’s the level of granularity you can choose to implement if you wish. In this session, we’ll cover these topics to provide a practical understanding of the security programs, procedures, and best practices you can use to enhance your current security posture. Speakers: Rob Whitmore, AWS Solutions Architect

1. ©2015, Amazon Web Services, Inc. or its affiliates. All rights reserved
INTRO TO AWS: SECURITY
Rob Whitmore – Solutions Architect

2. Security is the foundation
Physical
Security
Network
Security
Platform
Security
People &
Procedures
Familiar security model
Validated by security experts
Collaboration on Enhancements
Every Customer Benefits

3. SECURITY IS SHARED

4. Build everything on a constantly improving security baseline
AWS Foundation Services
Compute Storage Database Networking
AWS Global
Infrastructure
Regions
Availability
Zones Edge
Locations
GxP
ISO 13485
AS9100
ISO/TS 16949
AWS is
responsible for
the security OF
the Cloud

5. AWS Foundation Services
Compute Storage Database Networking
AWS Global
Infrastructure
Regions
Availability
Zones Edge
Locations
Client-side Data
Encryption
Server-side Data
Encryption
Network Traffic
Protection
Platform, Applications, Identity & Access Management
Operating System, Network, & Firewall Configuration
Customer applications & contentCustomers
Security & compliance is a shared responsibility
Customers have
their choice of
security
configurations IN
the Cloud
AWS is
responsible for
the security OF
the Cloud

6. SECURITY IS FAMILIAR

7. Security is Familiar
• We make security at AWS as familiar as what
you are doing right now
– Visibility
– Auditability
– Controllability
– Agility

8. AWS Marketplace: One-stop shop for familiar tools
Advanced
Threat
Analy/cs
Applica/on
Security
Iden/ty
and
Access
Mgmt
Encryp/on
&
Key
Mgmt
Server
&
Endpoint
Protec/on
Network
Security
Vulnerability
&
Pen
Tes/ng

9. SECURITY REQUIRES VISIBILITY

10. VISIBILITY
HOW OFTEN DO YOU MAP YOUR NETWORK?
WHAT’S IN YOUR ENVIRONMENT
RIGHT NOW?

13. Security is Visible
• Who is accessing the resources?
• Who took what action?
– When?
– From where?
– What did they do?
– Logs Logs Logs

14. AWS CLOUDTRAIL
You are making
API calls...
On a growing set of
services around the
world…
AWS CloudTrail
is continuously
recording API
calls…
And delivering
log files to you

15. Use cases enabled by CloudTrail
• Security Analysis
• Track Changes to AWS Resources
• Troubleshoot Operational Issues
• Compliance Aid

16. CloudTrail Regional Availability

17. SECURITY IS AUDITABLE

18. AWS Config
AWS Config is a fully managed service that
provides you with an inventory of your AWS
resources, lets you audit the resource
configuration history and notifies you of resource
configuration changes.

19. Continuous Change
Recording
Changing
Resources
AWS Config
History
Stream
Snapshot (ex. 2014-11-05)
AWS Config

20. Use cases enabled by Config
• Security Analysis: Am I safe?
• Audit Compliance: Where is the evidence?
• Change Management: What will this change
affect?
• Troubleshooting: What has changed?

21. Am I safe?
• Properly configured resources
are critical to security
• Config enables you to
continuously monitor the
configurations of your
resources and evaluate these
configurations for potential
security weaknesses

22. Where is the evidence?
• Many compliance audits
require access to the state of
your systems at arbitrary times
(i.e. PCI, HIPAA)
• A complete inventory of all
resources and their
configuration attributes is
available for any point in time

23. What will this change affect?
• When your resources are
created, updated, or deleted,
these configuration changes
are streamed to Amazon SNS
• Relationships between
resources are understood, so
that you can proactively assess
change impact

24. What changed?
• It is critical to be able to quickly
answer “What has changed?”
• You can quickly identifying the
recent configuration changes
to your resources by using the
console or by building custom
integrations with the regularly
exported resource history files

25. SECURITY PROVIDES CONTROL

26. First class security and compliance
starts (but doesn’t end!) with encryption
Automatic encryption with managed keys
Bring your own keys
Dedicated hardware security modules

27. Data Protection Best Practice with AWS
Managed key encryption
Key storage with AWS CloudHSM
Customer-supplied key encryption
DIY on Amazon EC2
Create, store, & retrieve keys securely
Rotate keys regularly
Securely audit access to keys
Partner enablement of crypto

28. AWS Key Management Service
• A managed service that makes it easy for you to create,
control, and use your data protection keys
• Integrated with AWS SDKs and AWS services including
Amazon EBS, Amazon S3, and Amazon Redshift
• Integrated with AWS CloudTrail to provide auditable logs
to help your regulatory and compliance activities

29. AWS Key Management Service
Integrated with AWS IAM Console

30. AWS Key Management Service
Integrated with Amazon EBS

31. AWS Key Management Service
Integrated with Amazon S3

32. AWS Key Management Service
Integrated with Amazon Redshift

33. SECURITY IS AGILE

34. HOW DOES AWS PRACTISE SECURITY?

35. The practice of security at AWS is
different, but the outcome is familiar:
So what does your security team look like?
• Operations
• Engineering
• Application Security
• Compliance

36. Our Culture:
Everyone’s an owner
When the problem is “mine” rather than
“hers” there’s a much higher likelihood I’ll do
the right thing

37. Measure constantly, report regularly, and
hold senior executives accountable for
security – have them drive the right
culture
Our Culture:

38. Our Culture:
Measure measure measure
• 5 min metrics are too coarse
• 1 min metrics just barely OK

39. Our Culture:
Saying “no” is a failure

40. Our Culture:
Apply more effort to the “why” rather than the
“how”
Why is what really matters
When something goes wrong, ask the “five whys””

41. Our Culture:
Decentralise - don’t be a bottleneck
It’s human nature to go around a bottleneck
Produce services that others can consume through
hardened APIs

42. Our Culture:
Test, CONSTANTLY
• Inside/outside
• Privileged/unprivileged
• Black-box/white-box
• Vendor/self

43. Our Culture:
Proactive monitoring rules the day
• What’s “normal” in your environment?
• Depending on signatures == waiting to
find out WHEN you’ve been had

44. Our Culture:
Collect, digest, disseminate, & use intelligence
Make your compliance team a part of your security
operations

45. Our Culture:
Base decisions on facts, metrics, & detailed
understanding of your environment and
adversaries

46. Simple Security Controls
Easy to Get Right
Easy to Audit
Easy to Enforce

47. This
To This

48. CONSTANT REDUCTION IN
SURFACE AREA

49. CONSTANT REDUCTION IN
HUMAN ACCESS POTENTIAL

50. UBIQUITOUS ENCRYPTION

51. EVEN MORE GRANULAR
SEPARATION

52. Security is the foundation
– “Based on our experience, I believe that we can be even more secure in the AWS
cloud than in our own data centers.”
-Tom Soderstrom, CTO, NASA JPL
– Nearly 60% of organizations agreed that CSPs [cloud service providers] provide
better security than their own IT organizations.
Source: IDC 2013 U.S. Cloud Security Survey,
doc #242836, September 2013
YOU ARE BETTER OFF IN AWS THAN YOU ARE IN YOUR
OWN ENVIRONMENT

53. RISK & COMPLIANCE
AUDITING SECURITY CHECKLIST
SECURITY PROCESSES
SECURITY BEST PRACTICES
More information..
http://aws.amazon.com/security/security-resources/

54. LONDON