1. AWS Summit 2013 Tel Aviv
Oct 16 – Tel Aviv, Israel
AWS CLOUD SECURITY
Carlos Conde
Sr. Mgr. Solutions Architecture

2. SECURITY IS UNIVERSAL

3. EVERY CUSTOMER HAS ACCESS
TO THE SAME SECURITY
CAPABILITIES
CHOOSE WHAT’S RIGHT FOR YOUR BUSINESS

4. AWS GOV CLOUD
ITAR COMPLIANT

5. SECURITY IS VISIBLE

6. CAN YOU MAP YOUR NETWORK?
WHAT IS IN YOUR ENVIRONMENT
RIGHT NOW?

9. AWS API + CLOUDFORMER
ENVIRONMENT ARCHITECTURE DEFINITION
AND CHANGE DETECTION

10. SECURITY IS TRANSPARENT

11. SOC 1
SOC 2
ITAR
SOC 3
FIPS
PCI DSS L1
FedRAMP
ISO 27001
HIPAA

12. SECURITY IS FAMILIAR

13. SOC CONTROL OBJECTIVES
1.
2.
3.
4.
5.
6.
7.
8.
SECURITY ORGANIZATION
AMAZON USER ACCESS
LOGICAL SECURITY
SECURE DATA HANDLING
PHYSICAL SECURITY AND ENV. SAFEGUARDS
CHANGE MANAGEMENT
DATA INTEGRITY, AVAILABILITY AND REDUNDANCY
INCIDENT HANDLING

14. SOC CONTROL OBJECTIVES
1.
2.
3.
4.
5.
6.
7.
8.
SECURITY ORGANIZATION
AMAZON USER ACCESS
LOGICAL SECURITY
SECURE DATA HANDLING
PHYSICAL SECURITY AND ENV. SAFEGUARDS
CHANGE MANAGEMENT
DATA INTEGRITY, AVAILABILITY AND REDUNDANCY
INCIDENT HANDLING

15. SOC CONTROL OBJECTIVES
1.
2.
3.
4.
5.
6.
7.
8.
SECURITY ORGANIZATION
AMAZON USER ACCESS
LOGICAL SECURITY
SECURE DATA HANDLING
PHYSICAL SECURITY AND ENV. SAFEGUARDS
CHANGE MANAGEMENT
DATA INTEGRITY, AVAILABILITY AND REDUNDANCY
INCIDENT HANDLING

16. SOC CONTROL OBJECTIVES
1.
2.
3.
4.
5.
6.
7.
8.
SECURITY ORGANIZATION
AMAZON USER ACCESS
LOGICAL SECURITY
SECURE DATA HANDLING
PHYSICAL SECURITY AND ENV. SAFEGUARDS
CHANGE MANAGEMENT
DATA INTEGRITY, AVAILABILITY AND REDUNDANCY
INCIDENT HANDLING

17. LEAST PRIVILEGE PRINCIPLE
CONFINE ROLES ONLY TO THE MATERIAL
REQUIRED TO DO A SPECIFIC WORK

18. USE AWS IAM
IDENTITY & ACCESS MANAGEMENT

19. CONTROL WHO CAN DO WHAT IN
YOUR AWS ACCOUNT

23. IAM USERS & ROLES

24. ACCESS TO
SERVICE APIs

25. NO PASSWORDS

26. USE SEPARATE SETS OF
CREDENTIALS

27. ROTATE YOUR AWS SECURITY
CREDENTIALS

28. SOC CONTROL OBJECTIVES
1.
2.
3.
4.
5.
6.
7.
8.
SECURITY ORGANIZATION
AMAZON USER ACCESS
LOGICAL SECURITY
SECURE DATA HANDLING
PHYSICAL SECURITY AND ENV. SAFEGUARDS
CHANGE MANAGEMENT
DATA INTEGRITY, AVAILABILITY AND REDUNDANCY
INCIDENT HANDLING

29. YOUR DATA IS YOUR
MOST IMPORTANT ASSET
IF YOUR DATA IS NOT SECURE, YOU’RE NOT SECURE

31. …

32. MFA DELETE PROTECTION

34. ENCRYPT YOUR DATA
AMAZON S3 SSE DATA AT REST
AWS CLOUDHSM

35. SOC CONTROL OBJECTIVES
1.
2.
3.
4.
5.
6.
7.
8.
SECURITY ORGANIZATION
AMAZON USER ACCESS
LOGICAL SECURITY
SECURE DATA HANDLING
PHYSICAL SECURITY AND ENV. SAFEGUARDS
CHANGE MANAGEMENT
DATA INTEGRITY, AVAILABILITY AND REDUNDANCY
INCIDENT HANDLING

36. NEED TO KNOW
+
CCTV, GUARDS, MAN TRAPS,
FENCES, ETC…

37. …

38. SOC CONTROL OBJECTIVES
1.
2.
3.
4.
5.
6.
7.
8.
SECURITY ORGANIZATION
AMAZON USER ACCESS
LOGICAL SECURITY
SECURE DATA HANDLING
PHYSICAL SECURITY AND ENV. SAFEGUARDS
CHANGE MANAGEMENT
DATA INTEGRITY, AVAILABILITY AND REDUNDANCY
INCIDENT HANDLING

39. CHANGES IN PRODUCTION
HAVE TO BE AUTHORIZED

40. DEV & TEST
PRODUCTION
ENVIRONMENT
ENVIRONMENT
AWS ACCOUNT A
AWS ACCOUNT B

41. DEPLOYMENT PROCESS
HAS TO BE CONSTRAINED

42. SOC CONTROL OBJECTIVES
1.
2.
3.
4.
5.
6.
7.
8.
SECURITY ORGANIZATION
AMAZON USER ACCESS
LOGICAL SECURITY
SECURE DATA HANDLING
PHYSICAL SECURITY AND ENV. SAFEGUARDS
CHANGE MANAGEMENT
DATA INTEGRITY, AVAILABILITY AND REDUNDANCY
INCIDENT HANDLING

43. CONTINUOUS DELIVERY MODEL

44. CONTINUOUS DEPLOYMENT
SESSION
13:30 START-UP TRACK

45. REDUNDANCY & INTEGRITY
CHECKS

46. USE MULTIPLE AZs
AMAZON S3
AMAZON DYNAMODB
AMAZON RDS MULTI-AZ
AMAZON EBS SNAPSHOTS

47. SOC CONTROL OBJECTIVES
1.
2.
3.
4.
5.
6.
7.
8.
SECURITY ORGANIZATION
AMAZON USER ACCESS
LOGICAL SECURITY
SECURE DATA HANDLING
PHYSICAL SECURITY AND ENV. SAFEGUARDS
CHANGE MANAGEMENT
DATA INTEGRITY, AVAILABILITY AND REDUNDANCY
INCIDENT HANDLING

48. “GAME DAYS”
INSERT ARTIFICIAL SECURITY INCIDENTS.
MEASURE SPEED OF DETECTION AND EXECUTION.

49. GAME DAYS !!
INSERT ARTIFICIAL SECURITY INCIDENTS.
MEASURE SPEED OF DETECTION AND EXECUTION.

51. SECURITY IS AUDITABLE

53. VULNERABILITY / PENETRATION
TESTING

54. VULNERABILITY / PENETRATION
TESTING

55. LOGS
OBTAINED, RETAINED, ANALYZED

56. OBTAIN, RETAIN, ANALYSE
YOUR LOGS

59. PROTECT YOUR LOGS WITH IAM
ARCHIVE YOUR LOGS

62. TRUSTED ADVISOR

66. SECURITY IS SHARED

67. NETWORK SECURITY:
DDOS

68. NETWORK SECURITY:
SSL

69. NETWORK SECURITY:
SPOOFING

70. NETWORK SECURITY:
PORT SCANNING

71. AMAZON EC2 SECURITY:
HOST OS
SSH KEYED LOGINS VIA BASTION HOST
ALL ACCESSES LOGGED AND AUDITED

72. AMAZON EC2 SECURITY:
GUEST OS
CUSTOMER CONTROLLED AT ROOT LEVEL
AWS ADMINS CANNOT LOG IN
CUSTOMER-GENERATED KEYPAIRS

73. “If you need to SSH into your
instance, your deployment process
is broken.”

74. AMAZON EC2 SECURITY:
STATEFUL & STATELESS FIREWALL
MANDATORY INBOUND
DEFAULT DENY MODE

80. SECURITY IS
UNIVERSAL
VISIBLE
TRANSPARENT
FAMILIAR
AUDITABLE
SHARED

81. AWS.AMAZON.COM / SECURITY

83. AWS SECURITY WHITEPAPERS
AUDITING SECURITY CHECKLIST
SECURITY BEST PRACTICES
SECURITY PROCESSES
RISK & COMPLIANCE

84. AWS MARKETPLACE
SECURITY SOLUTIONS