This document summarizes a presentation about security on AWS. It discusses that security is a shared responsibility between AWS and customers. AWS provides security capabilities across people and procedures, network security, physical security, and platform security. Customers are responsible for security controls like access management, data handling, and incident response. The presentation emphasizes that customers have visibility, auditability, and control over their environments on AWS to securely manage access, encrypt data, and monitor systems. It provides examples of how AWS services like CloudTrail, IAM, and encryption help customers securely use AWS.

1. AWS Summit 2014
Understanding AWS
Security
Carlos Conde
Head of EMEA Evangelism
@caarlco

2. Different customer viewpoints on security
PR exec
keep out of the news
CEO
protect shareholder
value
CI{S}O
preserve the
confidentiality, integrity
and availability of data

3. Security is Our No.1 Priority
Comprehensive Security Capabilities to Support Virtually Any Workload
PEOPLE &
PROCEDURES
NETWORK
SECURITY
PHYSICAL
SECURITY
PLATFORM
SECURITY

4. SECURITY IS SHARED

5. WHAT NEEDS
TO BE DONE
TO KEEP THE
SYSTEM SAFE

6. WHAT
WE DO
WHAT YOU
HAVE TO DO

7. SOC CONTROL OBJECTIVES
1. SECURITY ORGANIZATION
2. AMAZON USER ACCESS
3. LOGICAL SECURITY
4. SECURE DATA HANDLING
5. PHYSICAL SECURITY AND ENV. SAFEGUARDS
6. CHANGE MANAGEMENT
7. DATA INTEGRITY, AVAILABILITY AND REDUNDANCY
8. INCIDENT HANDLING

8. YOUR DATA IS YOUR
MOST IMPORTANT ASSET
IF YOUR DATA IS NOT SECURE, YOU’RE NOT SECURE

10. NETWORK SECURITY

11. “GAME DAYS”
INSERT ARTIFICIAL SECURITY INCIDENTS.
MEASURE SPEED OF DETECTION AND EXECUTION.

13. EVERY CUSTOMER HAS ACCESS
TO THE SAME SECURITY
CAPABILITIES
CHOOSE WHAT’S RIGHT FOR YOUR BUSINESS

14. AWS SECURITY OFFERS MORE
VISIBILITY
AUDITABILITY
CONTROL

15. MORE VISIBILITY

16. CAN YOU MAP YOUR NETWORK?
WHAT IS IN YOUR ENVIRONMENT
RIGHT NOW?

19. TRUSTED ADVISOR

23. MORE AUDITABILITY

26. AWS CLOUDTRAIL

27. You are making
API calls...
On a growing set of
services around the
world…
CloudTrail is
continuously
recording API
calls…
And delivering
log files to you

28. Security Analysis
Use log files as an input into log management and analysis solutions to perform
security analysis and to detect user behavior patterns.
Track Changes to AWS Resources
Track creation, modification, and deletion of AWS resources such as Amazon EC2
instances, Amazon VPC security groups and Amazon EBS volumes.
Troubleshoot Operational Issues
Quickly identify the most recent changes made to resources in your environment.
Compliance Aid
Easier to demonstrate compliance with internal policies and regulatory standards.

29. LOGS
OBTAINED, RETAINED, ANALYZED

32. PROTECT YOUR LOGS WITH IAM
ARCHIVE YOUR LOGS

35. VULNERABILITY
& PENETRATION TESTING

36. VULNERABILITY
& PENETRATION TESTING

37. MORE CONTROL

38. LEAST PRIVILEGE PRINCIPLE
CONFINE ROLES ONLY TO THE MATERIAL
REQUIRED TO DO A SPECIFIC WORK

39. AWS STAFF ACCESS
‣ Staff vetting
‣ Staff has no logical access to customer instances
‣ Staff control-plane access limited & monitored
Bastion hosts, Least privileged model, Zoned data center access
‣ Business needs
‣ Separate PAMS

46. USE SEPARATE SETS OF
CREDENTIALS

47. USE AWS IAM
IDENTITY & ACCESS MANAGEMENT

48. CONTROL WHO CAN DO WHAT IN
YOUR AWS ACCOUNT

52. ACCESS TO
SERVICE APIs

53. Amazon DynamoDB Fine Grained
Access Control
Directly and securely access application
data in Amazon DynamoDB
Specify access permissions at table, item
and attribute levels
With Web Identity Federation, completely
remove the need for proxy servers to
perform authorization

54. DEPLOYMENT PROCESS
HAS TO BE CONSTRAINED

55. DEV & TEST
ENVIRONMENT
AWS ACCOUNT A
PRODUCTION
ENVIRONMENT
AWS ACCOUNT B

56. “If you need to SSH into your instance,
your deployment process is broken.”

57. VERSIONED
AWS CLOUDFORMATION SCRIPTS
+
AWS OPSWORKS

59. MORE CONTROL
ON YOUR DATA

60. MFA PROTECTION

62. YOUR DATA STAYS
WHERE YOU PUT IT

63. USE MULTIPLE AZs
AMAZON S3
AMAZON DYNAMODB
AMAZON RDS MULTI-AZ
AMAZON EBS SNAPSHOTS

64. DATA ENCRYPTION
CHOOSE WHAT’S RIGHT FOR YOU:
Automated – AWS manages encryption
Enabled – user manages encryption using AWS
Client-side – user manages encryption using their own mean

65. ENCRYPT YOUR DATA
AWS CLOUDHSM
AMAZON S3 SSE
AMAZON GLACIER
AMAZON REDSHIFT
AMAZON RDS
…

66. MORE AUDITABILITY
MORE VISIBILITY
MORE CONTROL

67. “Based on our experience, I believe that we
can be even more secure in the AWS
cloud than in our own data centers”
Tom Soderstrom – CTO – NASA JPL

68. AWS.AMAZON.COM/SECURITY

69. AWS SECURITY WHITEPAPERS
RISK & COMPLIANCE
AUDITING SECURITY CHECKLIST
SECURITY PROCESSES
SECURITY BEST PRACTICES

70. Thank You!
AWS EXPERT?
GET CERTIFIED!
aws.amazon.com/certification
Carlos Conde
Head of EMEA Evangelism
@caarlco