This presentation will focus on security architecture, visibility, detection, and response capabilities within AWS. Highlighting the applicable security and compliance requirements, Zocdoc will cover how they implement security while minimizing the impact on innovation in today's cloud first world. Zocdoc will explain the importance of how selecting solutions to maintain visibility and control of sensitive assets is crucial to a successful migration to AWS. Speaker: Brian Lozada, Zocdoc CISO and Zhen Wang, Zocdoc Director of Engineering.

1. This document and its contents are proprietary and confidential of Zocdoc, Inc. and may not be reproduced or shared, in whole or in part, without the express written authorization of Zocdoc, Inc.
Elevating Security in the
Cloud
November 8, 2017

2. 2
We Started By Solving The Access Problem
Average Wait Time
(U.S.)
24
days
The Hidden Supply of Care
30%
Unbooked, cancelled
or rescheduled

3. 3
Zocdoc Brings Marketplace Efficiencies To
Healthcare
FOR HEALTHCARE
24 DAYS
24 HOURS

4. 4
Building Our Supply Of Care Since 2007
2015
Larger Health
Systems
2016
Zocdoc 2.0
2007
Private Medical
Practices

5. 5
Zocdoc AWS Goal
Scale
Horizontally
Diversify Tech
Stack
Open Source
Data
Liberation
Elevate
Security

6. 6
Zocdoc 2.0
2016
Zocdoc 2.0
2017
ALL IN
…..in less than 12 months

7. Maintaining
Compliance
Shared
Responsibility
Model
Maintain
Visibility
Access
Control
Encryption
and Key
Management
Logging &
Monitoring
Incident
Response
7
My Security Concerns

8. 8
Maintaining Compliance

9. 9
Shared Responsibility

10. 10
Partnerships within
Zocdoc

11. 11
Easier With AWS
Access
Control
Maintain
Visibility
Encryption & Key
Management
Logging &
Monitoring
Incident
Response

12. 12
Maintaining Visibility & Control with Agility
 Visibility of critical data
 Scope reduction
 Enhanced alerting
 Standardized configurations

13. 13
Infrastructure Hardening
 Hardened AMIs
 Packer
 Logging agents
 Host based intrusion detection
 Anti-Virus
 Hardened Containers using Docker
and Twistlock

14. 14
Infrastructure as Code

15. 15
Access Control
 Granular controls
 Default minimal privilege
 Visibility for administrative activities
 Maintaining authentication tokens

16. 16
AWS Identity & Access Management
 Segmented VPCs
 Security groups
 Policy control
 Automated rule checker
 MFA for users
 Public endpoints

17. 17
Encryption & Key Management
 Data protection
 Maintain end to end encryption
 Centralize key management
 Maintain appropriate key rotation controls
 Restricted access to keys

18. 18
Data Security at Rest
 Segment keys across AWS services
 Encrypted S3 buckets
 Encrypted EBS volumes

19. 19
Enhanced Logging & Monitoring
 DDoS protection & front end alerting
 Detective controls
 Centralized logging
 Office to cloud environment visibility

20. 20
Protecting Ourselves
DDoS protection & WAF
Data visibility
SIEM
Metrics monitoring
Application layer firewalls in
offices
Vulnerability scanning

21. 21
Incident Response & Disaster Recovery
 Incident Response >= existing response SLA
 Maintain pen test and table top exercise capabilities
 Environment resiliency >= existing recovery SLA

22. 22
Responding to Incidents
 Active disaster recovery site
 Remediating penetration test
issues as high priority
 Collaborative table top exercises
 Encrypted offsite backups across
S3 regions

23. 23
Zocdoc AWS Goal
Scale
Horizontally
Diversify Tech
Stack
Open Source
Data
Liberation
Elevate
Security

24. 24
Security Key Takeaways
 Available security controls
 Simplified security and
compliance
 Enhanced visibility and control
 Faster security recovery and
delivery
Get yourself a Squad

25. 25
We’re
Hiring!

26. 26
Q&A