The document discusses Amazon Web Services (AWS) security capabilities. It notes that AWS prioritizes security and offers comprehensive security controls including people, procedures, network security, physical security, and platform security. It emphasizes that security is a shared responsibility between AWS and customers, with AWS providing security of the cloud infrastructure and platforms, while customers are responsible for security in the cloud. The document highlights how AWS provides more visibility into networks and environments, more auditability of actions through logging and monitoring, and more control over identity and access management than traditional data centers.

1. © 2014 Amazon.com, Inc. and its affiliates. All rights reserved. May not be copied, modified, or distributed in whole or in part without the express consent of Amazon.com, Inc.
Understanding AWS Security
Bill Murray,
Sr Manager, AWS Security Programs

2. Different customer viewpoints on security
PR exec
keep out of the news
CEO
protect shareholder
value
CI{S}O
preserve the
confidentiality, integrity
and availability of data

3. Security is Our No.1 Priority
Comprehensive Security Capabilities to Support Virtually Any Workload
PEOPLE &
PROCEDURES
NETWORK
SECURITY
PHYSICAL
SECURITY
PLATFORM
SECURITY

4. SECURITY IS SHARED

5. WHAT NEEDS
TO BE DONE
TO KEEP THE
SYSTEM SAFE

6. WHAT
WE DO
FOR YOU
WHAT YOU DO
YOURSELF

7. EVERY CUSTOMER HAS ACCESS
TO THE SAME SECURITY
CAPABILITIES
CHOOSE WHAT’S RIGHT FOR YOUR BUSINESS

8. “Based on our experience, I believe that we
can be even more secure in the AWS
cloud than in our own data centers”
Tom Soderstrom – CTO – NASA JPL

9. AWS SECURITY OFFERS MORE
VISIBILITY
AUDITABILITY
CONTROL

10. MORE VISIBILITY

11. CAN YOU MAP YOUR NETWORK?
WHAT IS IN YOUR ENVIRONMENT
RIGHT NOW?

14. TRUSTED ADVISOR

18. MORE AUDITABILITY

20. SECURITY CONTROL OBJECTIVES
1. SECURITY ORGANIZATION
2. AMAZON USER ACCESS
3. LOGICAL SECURITY
4. SECURE DATA HANDLING
5. PHYSICAL SECURITY AND ENV. SAFEGUARDS
6. CHANGE MANAGEMENT
7. DATA INTEGRITY, AVAILABILITY AND REDUNDANCY
8. INCIDENT HANDLING

22. AWS CLOUDTRAIL

23. You are making
API calls...
On a growing set of
services around the
world…
CloudTrail is
continuously
recording API
calls…
And delivering
log files to you

24. Security Analysis
Use log files as an input into log management and analysis solutions to perform
security analysis and to detect user behavior patterns.
Track Changes to AWS Resources
Track creation, modification, and deletion of AWS resources such as Amazon EC2
instances, Amazon VPC security groups and Amazon EBS volumes.
Troubleshoot Operational Issues
Quickly identify the most recent changes made to resources in your environment.
Compliance Aid
Easier to demonstrate compliance with internal policies and regulatory standards.

25. ‣ CloudTrail records API calls and
delivers a log file to your S3 bucket.
‣ Typically, delivers an event within 15
minutes of the API call.
‣ Log files are delivered approximately
every 5 minutes.
‣ Multiple partners offer integrated
solutions to analyze log files.

26. LOGS
OBTAINED, RETAINED, ANALYZED

29. PROTECT YOUR LOGS WITH IAM
ARCHIVE YOUR LOGS

32. MORE CONTROL

33. Defense in Depth
Multi level security
• Physical security of the data centers
• Network security
• System security
• Data security

34. AWS Security Delivers More Control & Granularity
Customize the implementation based on your business needs
AWS
CloudHSM
Defense in depth
Rapid scale for security
Automated checks with AWS Trusted Advisor
Fine grained access controls
Server side encryption
Multi-factor authentication
Dedicated instances
Direct connection, Storage Gateway
HSM-based key storage
AWS IAM
Amazon VPC
AWS Direct
Connect
AWS Storage
Gateway

35. LEAST PRIVILEGE PRINCIPLE
AT AWS

36. LEAST PRIVILEGE PRINCIPLE
CONFINE ROLES ONLY TO THE MATERIAL
REQUIRED TO DO SPECIFIC WORK

37. LEAST PRIVILEGE PRINCIPLE
SEPARATE NETWORKS FOR CORPORATE WORK VS.
ACCESSING CUSTOMER DATA

38. LEAST PRIVILEGE PRINCIPLE
MUST HAVE A BUSINESS NEED-TO-KNOW ABOUT
SENSITIVE INFORMATION LIKE DATACENTER
LOCATIONS

39. LEAST PRIVILEGE PRINCIPLE
MUST HAVE A BUSINESS NEED-TO-KNOW IN ORDER
TO ACCESS DATACENTERS

40. SIMPLE SECURITY CONTROLS
ARE THE EASIEST TO GET RIGHT, EASIEST TO AUDIT,
AND EASIEST TO ENFORCE

42. MORE CONTROL
ON IDENTITY & ACCESS

43. USE AWS IAM
IDENTITY & ACCESS MANAGEMENT

44. CONTROL WHO CAN DO WHAT
WITH YOUR AWS ACCOUNT

46. AWS IAM: Recent Innovations
Securely control access to AWS services and resources
• Delegation
– Roles for Amazon EC2
– Cross-account access
• Powerful integrated permissions
– Resource level permissions:
Amazon EC2, Amazon RDS,
Amazon DynamoDB, AWS
CloudFormation
– Access control policy variables
– Policy Simulator
– Enhanced IAM support: Amazon
SWF, Amazon EMR, AWS Storage
Gateway, AWS CloudFormation,
Amazon Redshift, Elastic Beanstalk
• Federation
– Web Identity Federation
– AD and Shibboleth examples
– Partner integrations
– Case study: Expedia
• Strong authentication
– MFA-protected API access
– Password policies
• Enhanced documentation and
videos

47. ACCESS TO
SERVICE APIs

48. Amazon DynamoDB Fine Grained
Access Control
Directly and securely access application
data in Amazon DynamoDB
Specify access permissions at table, item
and attribute levels
With Web Identity Federation, completely
remove the need for proxy servers to
perform authorization

49. MORE CONTROL
OF YOUR DATA

50. MFA DELETE PROTECTION

52. YOUR DATA STAYS
WHERE YOU PUT IT

54. USE MULTIPLE AZs
AMAZON S3
AMAZON DYNAMODB
AMAZON RDS MULTI-AZ
AMAZON EBS SNAPSHOTS

55. DATA ENCRYPTION
CHOOSE WHAT’S RIGHT FOR YOU:
Automated – AWS manages encryption
Enabled – user manages encryption using AWS
Client-side – user manages encryption using their own mean

56. AWS CloudHSM
Managed and monitored by AWS, but you
control the keys
Increase performance for applications that
use HSMs for key storage or encryption
Comply with stringent regulatory and
contractual requirements for key protection
EC2 Instance
AWS CloudHSM
AWS CloudHSM

57. ENCRYPT YOUR DATA
AWS CLOUDHSM
AMAZON S3 SSE
AMAZON GLACIER
AMAZON REDSHIFT
AMAZON RDS
…

58. MORE AUDITABILITY
MORE VISIBILITY
MORE CONTROL

59. IDC Survey
Attitudes and Perceptions Around Security and Cloud Services
Nearly 60% of organizations agreed that CSPs [Cloud Service
Providers] provide better security than their own IT organization
Source: IDC 2013 U.S. Cloud Security Survey
Doc #242836, September 2013

60. AWS.AMAZON.COM/SECURITY

61. AWS SECURITY WHITEPAPERS
RISK & COMPLIANCE
AUDITING SECURITY CHECKLIST
SECURITY PROCESSES
SECURITY BEST PRACTICES

62. AWS MARKETPLACE
SECURITY SOLUTIONS

63. © 2014 Amazon.com, Inc. and its affiliates. All rights reserved. May not be copied, modified, or distributed in whole or in part without the express consent of Amazon.com, Inc.
AWS Security
Bill Murray, Sr. Manager, AWS Security Programs
Thank You!