This document discusses how AWS services like Amazon Inspector, AWS WAF, and AWS Config Rules help customers improve security and compliance while maintaining agility. Amazon Inspector allows customers to automate security assessments of their applications. AWS WAF provides centralized rule management and real-time protection against web attacks. AWS Config Rules enable continuous monitoring and simplify management of configuration changes across an organization. These services embed security expertise, streamline compliance processes, and allow customers to move fast while staying safe on AWS.

1. © 2015, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Stephen Schmidt
Vice President, Security Engineering & CISO
October 2015
SEC201
How Should We All Think About
Security?

2. 1) Why is security such a hot topic?
Because it’s important, and it’s hard

3. 2) Why is enterprise security traditionally so hard?
Because so much planning is needed

4. 3) Why does planning take so long?
Because it requires so many processes

5. 4) Why so many processes?
Because mistakes are easy
to make and hard to correct

6. 5) Why are mistakes so hard to correct?
Lack of visibility Low degree of automation

7. So where does AWS come in?
AWS makes security
more agile
Lets you move fast while
staying safe

8. New tools to move fast and stay safe
Amazon Inspector
AWS WAF
AWS Config Rules

9. Amazon Inspector (Preview)
Security assessment tool analyzing end-to-end
application configuration and activity

10. Why Amazon Inspector?
Applications testing key to moving fast but staying safe
Security assessment highly manual, resulting in delays or
missed security checks
Valuable security subject matter experts spending too
much time on routine security assessment

11. Amazon Inspector features
Configuration Scanning Engine
Activity monitoring
Built-in content library
Automatable via API
Fully auditable

12. Amazon Inspector rulesets
CVE
Network Security Best Practices
Authentication Best Practices
Operating System Best Practices
Application Security Best Practices
PCI DCSS 3.0 Readiness

13. Amazon Inspector benefits
Increased agility
Embedded expertise
Improved security posture
Streamlined compliance

14. Getting started

15. Prioritized findings

16. Detailed remediation recommendations

17. AWS WAF

18. AWS WAF features
Web filtering
Amazon CloudFront integration
Centralized rule management
Real-time visibility
API automation

19. AWS WAF benefits
Increased protection
against web attacks
Ease of deployment and
maintenance
Security embedded in
development process

20. AWS WAF in action
AWS Management
ConsoleAdmins
Developers AWS API
Web app in
CloudFront
Define rules
Deploy
protection
AWS WAF

21. AWS WAF Partner integrations
• Alert Logic, Trend Micro, and Imperva integrating with AWS WAF
• Offer additional detection and threat intelligence
• Dynamically modify rulesets of AWS WAF for increased protection

22. AWS Config Rules

23. AWS Config Rules features
Flexible rules evaluated continuously and
retroactively
Dashboard and reports for common goals
Customizable remediation
API automation

24. AWS Config Rules
Broad ecosystem of solutions

25. AWS Config Rules benefits
Continuous monitoring for
unexpected changes
Shared compliance
across your organization
Simplified management of
configuration changes

26. AWS Config Rules

27. Putting it all together: Before
Auditor:
???
Develops
app
Reviews
app
Fixes
app
Updates
app
Fixes
broken
AWS
WAF
rules
Deploys
AWS WAF
rules
Reviews
app

28. Putting it all together: After
Auditor has
full visibility
Defines
standards
Develops
app
Fixes
app
Defines
AWS WAF
rules
Optimizes
environment
Runs
security
tests
Rapid updates

29. Making Life Easier

30. Making life easier
Choosing security does not mean giving up
on convenience or introducing complexity

31. © 2015 OCEDO
OCEDO FOR AMAZON WEB SERVICES
- Angelo Comazzetto

32. © 2015 OCEDO
Security Convenience
Ocedo for AWS
Automate your network
(C) Copyright Schmidt-Ohm & Partner GmbH, Hamburg,and licensed for
reuse under the Creative Commons Attribution 3.0 License.

33. © 2015 OCEDO
Ocedo for AWS
Automate your network

34. © 2015 OCEDO
Ocedo for AWS
Automate your network
Authenticate to AWS

35. © 2015 OCEDO
Authenticate to AWS
Import VPCs
Ocedo for AWS
Automate your network

36. © 2015 OCEDO
Authenticate to AWS
Import VPCs
Deploy Ocedo
Ocedo for AWS
Automate your network

37. © 2015 OCEDO
Authenticate to AWS
Import VPCs
Deploy Ocedo
Ocedo for AWS
Automate your network

38. © 2015 OCEDO
Your
AWS
account
Ocedo
Cloud
account
IAM
role
sts.assu
merole
Ocedo for AWS
Automate your network

39. © 2015 OCEDO
www.ocedo.com/aws
Send us your praises, your rants, and stories of glory!
aws@ocedo.com

40. Security by Design (SbD)

41. Security by Design – SbD
• Systematic approach to ensure security
• Formalizes AWS account design
• Automates security controls
• Streamlines auditing
• Provides control insights throughout the
IT management processAWS
CloudTrail
AWS
CloudHSM
AWS IAM
AWS KMS
AWS
Config

42. SbD – Scripting your governance policy
Set of CloudFormation templates that accelerate
compliance with PCI, HIPAA, FFIEC, FISMA, CJIS
Result: Reliable technical implementation of administrative
controls

43. How We Build Our Organization

44. AWS Security Team
Operations
Application Security
Engineering
Compliance
Aligned for agility

45. Security ownership as part of DNA
• Promotes culture of “everyone is an owner” for security
• Makes security a stakeholder in business success
• Enables easier and smoother communication
Distributed Embedded

46. Operating principles
Separation of duties
Different personnel across service lines
Least privilege

47. Technology to automate operational principles
Visibility through automation
Shrinking the protection boundaries
Ubiquitous encryption

48. Security Training

49. New security training
Training
Security Fundamentals on AWS
(Free online course)
Security Operations on AWS
(3-day class)
Details at aws.amazon.com/training

50. Certification and education
• Security Fundamentals on AWS
• Free online course for security auditors and analysts
• Security Operations on AWS
• 3-day class for security engineers, architects, analysts, and
auditors
• Security Certification on AWS
• Available here at re:Invent for those who have achieved AWS
Solutions Architect – Professional certification

51. The Bottom Line

52. Design and deploy
Define sensible defaults
Inherit compliance controls
Use available security
features
Manage templates—not
instances

53. Operate and improve
Constantly reduce the role of
people
Reduce privileged accounts
Concentrate on what matters

54. Conclusions
Security is critical
We’re creating tools to make it
easier
We’re creating ways to help
you build a world-class team
You can move fast and stay
safe

55. Don’t take my word for it…
“CIOs and CISOs need to stop obsessing over
unsubstantiated cloud security worries, and instead apply
their imagination and energy to developing new
approaches to cloud control, allowing them to securely,
compliantly and reliably leverage the benefits of this
increasingly ubiquitous computing model.”
Clouds Are Secure: Are You Using Them Securely?
Published: 22 September 2015
-- Jay Heiser

56. Thank you!

57. Remember to complete
your evaluations!