AWS Security. Stephen E. Schmidt, Directeur de la Sécurité

Transcription

1 AWS Security Stephen E. Schmidt, Directeur de la Sécurité 2014 Amazon.com, Inc. and its affiliates. All rights reserved. May not be copied, modified, or distributed in whole or in part without the express consent of Amazon.com, Inc.

2 Different customer viewpoints on security CEO protect shareholder value CI{S}O preserve the confidentiality, integrity and availability of data PR exec keep out of the news

3 Security is Our No.1 Priority Comprehensive Security Capabilities to Support Virtually Any Workload PHYSICAL SECURITY NETWORK SECURITY PLATFORM SECURITY PEOPLE & PROCEDURES

4 SECURITY IS SHARED

5 WHAT NEEDS TO BE DONE TO KEEP THE SYSTEM SAFE

6 WHAT WE DO WHAT YOU HAVE TO DO

7 SOC CONTROL OBJECTIVES 1. SECURITY ORGANIZATION 2. AMAZON USER ACCESS 3. LOGICAL SECURITY 4. SECURE DATA HANDLING 5. PHYSICAL SECURITY AND ENV. SAFEGUARDS 6. CHANGE MANAGEMENT 7. DATA INTEGRITY, AVAILABILITY AND REDUNDANCY 8. INCIDENT HANDLING

8 YOUR DATA IS YOUR MOST IMPORTANT ASSET IF YOUR DATA IS NOT SECURE, YOU RE NOT SECURE

9

10 CHANGES IN PRODUCTION HAVE TO BE AUTHORIZED

11 DEPLOYMENT PROCESS HAS TO BE CONSTRAINED

12 NETWORK SECURITY

13 GAME DAYS INSERT ARTIFICIAL SECURITY INCIDENTS. MEASURE SPEED OF DETECTION AND EXECUTION.

14

15 EVERY CUSTOMER HAS ACCESS TO THE SAME SECURITY CAPABILITIES CHOOSE WHAT S RIGHT FOR YOUR BUSINESS

16 Based on our experience, I believe that we can be even more secure in the AWS cloud than in our own data centers Tom Soderstrom CTO NASA JPL

17 AWS SECURITY OFFERS MORE VISIBILITY AUDITABILITY CONTROL

18 MORE VISIBILITY

19 CAN YOU MAP YOUR NETWORK? WHAT IS IN YOUR ENVIRONMENT RIGHT NOW?

20

21

22 TRUSTED ADVISOR

23

24

25

26 MORE AUDITABILITY

27

28

29 INTRODUCING AWS CLOUDTRAIL

30 You are making API calls... On a growing set of services around the world CloudTrail is continuously recording API calls And delivering log files to you

31 Security Analysis Use log files as an input into log management and analysis solutions to perform security analysis and to detect user behavior patterns. Track Changes to AWS Resources Track creation, modification, and deletion of AWS resources such as Amazon EC2 instances, Amazon VPC security groups and Amazon EBS volumes. Troubleshoot Operational Issues Quickly identify the most recent changes made to resources in your environment. Compliance Aid Easier to demonstrate compliance with internal policies and regulatory standards.

32 CloudTrail records API calls and delivers a log file to your S3 bucket. Typically, delivers an event within 15 minutes of the API call. Log files are delivered approximately every 5 minutes. Multiple partners offer integrated solutions to analyze log files.

33 LOGS OBTAINED, RETAINED, ANALYZED

34

35

36 PROTECT YOUR LOGS WITH IAM ARCHIVE YOUR LOGS

37

38

39 VULNERABILITY & PENETRATION TESTING

40 VULNERABILITY & PENETRATION TESTING

41 MORE CONTROL

42 Defense in Depth Multi level security Physical security of the data centers Network security System security Data security

43 AWS Security Delivers More Control & Granularity Customize the implementation based on your business needs AWS IAM Amazon VPC AWS Storage Gateway AWS Direct Connect AWS CloudHSM Defense in depth Rapid scale for security Automated checks with AWS Trusted Advisor Fine grained access controls Server side encryption Multi-factor authentication Dedicated instances Direct connection, Storage Gateway HSM-based key storage

44 AWS STAFF ACCESS Staff vetting Staff has no logical access to customer instances Staff control-plane access limited & monitored Bastion hosts, Least privileged model, Zoned data center access Business needs Separate PAMS

45

46

47

48

49

50

51 MORE CONTROL ON IDENTITY & ACCESS

52 LEAST PRIVILEGE PRINCIPLE CONFINE ROLES ONLY TO THE MATERIAL REQUIRED TO DO A SPECIFIC WORK

53 USE AWS IAM IDENTITY & ACCESS MANAGEMENT

54 CONTROL WHO CAN DO WHAT IN YOUR AWS ACCOUNT

55

56

57

58 AWS IAM: Recent Innovations Securely control access to AWS services and resources Delegation Roles for Amazon EC2 Cross-account access Powerful integrated permissions Resource level permissions: Amazon EC2, Amazon RDS, Amazon DynamoDB, AWS CloudFormation Access control policy variables Policy Simulator Enhanced IAM support: Amazon SWF, Amazon EMR, AWS Storage Gateway, AWS CloudFormation, Amazon Redshift, Elastic Beanstalk Federation Web Identity Federation AD and Shibboleth examples Partner integrations Case study: Expedia Strong authentication MFA-protected API access Password policies Enhanced documentation and videos

59 ACCESS TO SERVICE APIs

60 Amazon DynamoDB Fine Grained Access Control Directly and securely access application data in Amazon DynamoDB Specify access permissions at table, item and attribute levels With Web Identity Federation, completely remove the need for proxy servers to perform authorization

61 MORE CONTROL ON YOUR DATA

62 MFA DELETE PROTECTION

63

64 YOUR DATA STAYS WHERE YOU PUT IT

65

66 REDUNDANCY & INTEGRITY CHECKS

67 USE MULTIPLE AZs AMAZON S3 AMAZON DYNAMODB AMAZON RDS MULTI-AZ AMAZON EBS SNAPSHOTS

68 DATA ENCRYPTION CHOOSE WHAT S RIGHT FOR YOU: Automated AWS manages encryption Enabled user manages encryption using AWS Client-side user manages encryption using their own mean

69 AWS CloudHSM Managed and monitored by AWS, but you control the keys AWS CloudHSM Increase performance for applications that use HSMs for key storage or encryption Comply with stringent regulatory and contractual requirements for key protection AWS CloudHSM EC2 Instance

70 ENCRYPT YOUR DATA AWS CLOUDHSM AMAZON S3 SSE AMAZON GLACIER AMAZON REDSHIFT AMAZON RDS

71 Axway, Cloud and Security David FIGINI, VP Cloud Managed Services EMEA 2014 Amazon.com, Inc. and its affiliates. All rights reserved. May not be copied, modified, or distributed in whole or in part without the express consent of Amazon.com, Inc.

72 Governing the flow of data 11,000 customers 100 countries 332,5M revenue in ,700+ employees HQ in Phoenix, AZ USA Offices in 19 countries DATA FLOW GOVERNANCE

73 Axway Cloud and AWS Start Quickly Everywhere No initial cost Pay per use Scale up and down No commitment Repeatable Reliable Secure VPC (Virtual Private Cloud) Privatization for Cloud components. Data centers (zones) - Tier IV and compliant with all major third-party certifications. Storage durability Database Multizone configuration Elastic Load Balancers Zone independence VPN AWS Direct Connect provides dedicated private networking for increased bandwidth and reliability. EC2 Instances Elastic computing Cloud Formation Reliable delivery from Web Services Applications Designed for no single points of failure and nonrepudiation. All services are monitored through a centralized location utilizing, SES, SNS, Cloud Watch, Nagios, etc.

74 Axway Cloud threat mitigation Architecture and Datacenter Vulnerabilities Service Platform Availability Information Confidentiality and Integrity Loss Decrease in Functional Performance Human Activities Very High Availability OS Patch management Data loss and confidentiality Human activity Multi AZ Auto-Scaling groups Solution deployed by Axway Data encryption at rest and for communications Backup policy based on snapshots Access to environments is centralized and all activity is tracked Real time monitoring Security and monitoring tools (Ossec, syslog, Nagios, CloudWatch, ) Splunk to receive, process and present security events

75 Axway Cloud security architecture Solution Management VPC peering AZ #1 Access Control Acc ess AZ #2 Elastic Load Balancing Auto Scaling group Axway workforce Axway data center VPN Supervision Monitoring & Security tools Monitoring & Security data Solution Amazon Route 53 VPC peering AZ #1 Elastic Load Balancing AZ #2 CloudWatch CloudTrail Amazon SES Auto Scaling group SOC1 Type 2 certification achieved in March ISO27001 Beginning of 2015

76 Takeaways from Axway Axway governs the flow of data in the Cloud Axway Cloud is based on a strong AWS partnership Security = AWS + Axway + Processes+ People

77 Merci! Axway, Cloud and Security David FIGINI, VP Cloud Managed Services EMEA 2014 Amazon.com, Inc. and its affiliates. All rights reserved. May not be copied, modified, or distributed in whole or in part without the express consent of Amazon.com, Inc.

78 MORE AUDITABILITY MORE VISIBILITY MORE CONTROL

79 Based on our experience, I believe that we can be even more secure in the AWS cloud than in our own data centers Tom Soderstrom CTO NASA JPL

80 AWS.AMAZON.COM / SECURITY

81 AWS SECURITY WHITEPAPERS AUDITING SECURITY CHECKLIST SECURITY BEST PRACTICES SECURITY PROCESSES RISK & COMPLIANCE

82 AWS MARKETPLACE SECURITY SOLUTIONS

83 Merci! AWS Security Stephen E. Schmidt, Directeur de la Sécurité 2014 Amazon.com, Inc. and its affiliates. All rights reserved. May not be copied, modified, or distributed in whole or in part without the express consent of Amazon.com, Inc.