Más seguro en la Nube

2019, Amazon Web Services, Inc. o sus empresas afiliadas. Reservados todos los derechos.
Más seguro en la nube

Foundation Services
Compute
AWS Global Infrastructure
Regions
Availability Zones
Edge Locations
Client-side Data Encryption
Server-side Encryption
(File System and/or Data)
Network Traffic Protection
(Encryption/Integrity/Identity)
Platform, Applications, Identity and Access Management
Operating System, Network & Firewall Configuration
Customer Data
CustomersAWS Shared Responsibility Model
Network Database Storage
Customers are
responsible for
the security IN
the Cloud
AWS is
responsible for
the security OF
the Cloud

OF

Example AWS Region
AZ
AZ
AZ AZ AZ
Transit
Transit

Example AWS Availability Zone
AZ
AZ
AZ AZ AZ
Transit
Transit

Example AWS Data Center

It is always YOUR data!
Customers choose where to place their data
AWS regions are geographically isolated by design
Data is not replicated to other AWS regions and does not
move unless the customer tell us to do so
Customer always owns their data, the ability to encrypt it,
move it, and delete it
AWS Customer Agreement
https://aws.amazon.com/agreement/

Management,
security, and
monitoring
Storage
Customer instances
Network
Hypervisor
SERVER
Original Amazon EC2 host architecture

Management,
security, and
monitoring
Storage
Customer instances
Network
Nitro hypervisor
SERVER
NITRO
SYSTEM
2017: Amazon EC2 C5 instances launched

Launched in November 2017
In development since 2013
All new launches use Nitro
Purpose-built hardware/software
Hypervisor built for AWS
AWS Nitro
The Nitro Platform – Hardware + Hypervisor

Nitro Cards Nitro Security Chip Nitro Hypervisor
VPC Networking
Amazon Elastic Block Store
(Amazon EBS)
Instance Storage
System Controller
Integrated into motherboard
Protects hardware resources
Hardware Root of Trust
Lightweight hypervisor
Memory and CPU allocation
Bare Metal-like performance
Nitro in three parts

System Control
Provides passive API endpoint
Coordinates all other Nitro Cards
Coordinates with Nitro Hypervisor
Coordinates with Nitro Security ChipNitro
Controller
Nitro Card Controller

Custom microcontroller
that traps all I/O to non-
volatile storage
Controllable from the
Nitro Controller to hold
system boot
Provides a simple, hardware-based root of trust
Nitro Security Chip

Radical simplification enabled by
Nitro Cards.
All write access to non-volatile
storage is blocked in hardware.
Simple to understand security due
to lack of legacy.
Instance
Nitro
Controller
BIOS, BMC,
et al
Nitro Hardware Root of Trust

Radical simplification enabled by
Nitro Cards.
All write access to non-volatile
storage is blocked in hardware.
Simple to understand security due
to lack of legacy.
Instance
Nitro
Controller
BIOS, BMC,
et al
Nitro Hardware Root of Trust
Writes

KVM-based hypervisor
with custom MM and
small userspace
Only executes on behalf
of instance, quiescent.
With Nitro, the hypervisor can be fast and simple
Nitro Hypervisor

192.168.0.0/16
VPC – Virtual Private Cloud

Physical Host Physical Host
VPC – Security and Routing

Your IP packet
VPC Encapsulation + Encryption
IP on the physical network
Physical network encryption

Blackfoot
Edge device
Internet traffic
Direct Connect
Amazon S3 / DynamoDB
Endpoints
VPN
VPC

AWS Shield and DDoS Response
All customers benefit from AWS Shield standard
Always-on in-line traffic monitoring and filtering using AWS built and
operated anti-DDOS technology
AWS Shield advanced includes access to our world-class DDOS response
team

Mapping
service
A distributed web service that handles mappings between customers VPC
routes and IPs and physical destinations on the wire.
To support microsecond-scale latencies, mappings are cached where they
are used, and pro-actively invalidated when they change.

MTCS
27001 27017 220189001
Assurance programs

Esquema Nacional de Seguridad - ENS
El ENS establece la política de seguridad en la
utilización de medios electrónicos en España y está
constituido por los principios básicos y requisitos
mínimos que permitan una protección adecuada de
la información.
AWS ha obtenido la certificación de conformidad
de categoría ALTA del Esquema Nacional de
Seguridad

AWS Artifact – Compliance reports
Provides customers with an easier process to obtain AWS compliance
reports (SOC, PCI, ISO) with self-service, on-demand access via the
console
AWS Artifact

IN

Encryption
Networking Compliance & Governance
Identity
Amazon
VPC
AWS Direct
Connect
VPN connection Security Groups
AWS WAFAWS Shield
AWS KMS AWS
CloudHSM
Flow logs
AWS Certificate
Manager
Client-side
encryption
IAM
AWS Artifact
AWS
Organizations
Temporary security
credential
AWS Directory
Service
Active Directory
integration
SAML
Federation
Amazon
Inspector
AWS Trusted
Advisor
AWS
Service Catalog
Amazon
CloudWatch
AWS
CloudFormation
AWS
CloudTrail
AWS Config
Route table
Amazon EC2
Systems
Manager
AWS Security Services and Features

AWS Authentication supporting:
• Enables you to control who can do
what in your AWS account
• Splits into users, groups, roles, and
permissions
• Control
• Centralized
• Fine-grained - APIs, resources, and
AWS Management Console
• Security
• Secure (deny) by default
Identity & Access Management (IAM)

Complete visibility of your AWS environment
CloudTrail logs all API calls and stores them into your
S3 buckets
Who did what, when and from where
The recorded informacion includes caller identity,
time, the source IP address, parameters, and the
response returned by the AWS service.
Call History
• The AWS API call history produced by CloudTrail
enables security analysis, resource change
tracking, and compliance auditing.
AW
S
Console
Loggly
Splunk
AWS CloudTrail: Record AWS API Calls

Automate the IT inventory
Register all configuration changes
Audit and diagnose what caused a
problem
AWS Config - Record AWS Environment Changes

Trusted Advisor

VPC Public Subnet 10.10.1.0/24 VPC Public Subnet 10.10.2.0/24
VPC CIDR 10.10.0.0/16
VPC Private Subnet 10.10.3.0/24 VPC Private Subnet 10.10.4.0/24
VPC Private Subnet 10.10.5.0/24 VPC Private Subnet 10.10.6.0/24
AZ A AZ B
Public ELB
Internal ELB
RDS
Master
Autoscaling
Web Tier
Autoscaling
Application Tier
Internet
Gateway
RDS
Standby
Snapshots
Multi-AZ RDS
Data Tier
Existing
Datacenter
Virtual
Private
Gateway
Customer
Gateway
VPN Connection
Direct Connect
Network
Partner
Location
Administrators &
Corporate Users
Amazon VPC – Virtual Private Cloud

Availability Zone A
Private subnet
Public subnet
Private subnet
Availability Zone B
Public subnet
Private subnet
ELB
Web
Back end
VPC CIDR 10.1.0.0/16
ELB
Web
Back end
VPC
sg_ELB_FrontEnd (ELB Security Group)
sg_Web_Frontend (Web Security Group)
sg_Backend (Backend Security Group)
Security Groups

Security Groups

• Agentless
• Enable per ENI, per subnet, or per VPC
• Logged to AWS CloudWatch Logs
• Create CloudWatch metrics from log data
• Alarm on those metrics
AWS
account
Source IP
Destination IP
Source port
Destination port
Interface Protocol Packets
Bytes Start/end time
Accept or
reject
VPC Flow Logs – See all your traffic

CloudWatch provides visibility and metrics into
every aspect of your AWS environment, metrics are
actionable and can notifications, run code, etc.
Metrics include
• EC2 Instances (CPU Usage, Networking, etc)
• RDS instances (Connections, CPU, etc)
• ELB metrics (Healthy backends, Network, etc)
• Many services are included
• Support for Custom metrics
Amazon CloudWatch – Monitoring service

Amazon CloudWatch Dashboards

CloudWatch Logs provides a centralized service to
absorb, store, analyze, and take action on a variety
of log sources.
• Operating system logs
• Webserver logs
• Application logs
Use cases
• Centralized log store
• Prevent log modification on instances
• Notifications on events
Amazon CloudWatch Logs – Log Centralization

• Vulnerability Assessment Service
Built from the ground up to support Dev/Ops Model
Automatable via API’s
AWS Context Aware
Static & Dynamic Telemetry
Integrated with CI/CD tools
On-Demand Pricing model
CVE & CIS Rules Packages
AWS AppSec Best Practices
Amazon Inspector

Free native encryption on most AWS services
S3, EBS, RDS, RedShift
SSL/TLS end to end
Scalable Key Management
AWS Key Management Service allows a scalable
key management at a low cost
CloudHSM is a dedicated hardware device
dedicated for a single customer to store and
manage keys
Encryption

HTTP floods Scanners and
probes
SQL injection
Bots and scrapers
IP reputation
lists
Cross-site
scripting
AWS WAF Security Automations
https://aws.amazon.com/answers/security/aws-waf-security-automations/
AWS WAF – Layer 7 application protection

§ AWS Shield Standard
– Included by default at no cost
– Protection against most common
attacks:
• Flood SYN/UDP
• Amplification and reflection attacks
– Automatically detects and
mitigates
§ AWS Shield Advanced
– Monitors network traffic
– Heuristics-based anomaly detection
– 24x7 DDoS Response Team
– Real-time attack notification
– AWS Cost protection
• Amazon Elastic Compute Cloud (EC2)
• Amazon CloudFront
• Elastic Load Balancing
• AWS Global Accelerator
• Route53
AWS Shield: Protection against DDoS attacks

Amazon GuardDuty - Threat Detection and
Notification

Amazon GuardDuty - Findings

• Remediate a Compromised Instance
• Remediate Compromised AWS Credentials
GuardDuty CloudWatch Events Lambda
Amazon
GuardDuty
Amazon
CloudWatch
CloudWatch
Event
Lambda
Function
AWS Lambda
Responding to findings: Automatic Remediation

Más seguro en la Nube

Recomendados

Recomendados

Más contenido relacionado

La actualidad más candente

La actualidad más candente (16)

Similar a Más seguro en la Nube

Similar a Más seguro en la Nube (20)

Más de Amazon Web Services

Más de Amazon Web Services (20)

Más seguro en la Nube