Security on AWS(overview) Bertram Dorn EMEA Specialized Solutions Architect Security and Compliance

Transcription

1 Security on AWS(overview) Bertram Dorn EMEA Specialized Solutions Architect Security and Compliance

2 Agenda: Overview AWS Regions Availability Zones Shared Responsibility Security Features Best Practices for IAM Data at Rest

3 AWS Global Footprint US West (Oregon) GovCloud EU West (Ireland) EU Central (Frankfurt) China (Beijing) Korea (Seul) Asia Pacific (Tokyo) US East (Virginia) Region US West (N.California) An independent collection of AWS resources in a defined geography A solid foundation for meeting locationdependent privacy and compliance requirements Asia Pacific (Sydney) São Paulo Asia Pacific (Singapore)

4 Example AWS Region AZ AZ AZ AZ AZ Transit Transit Mesh of Availability Zones (AZ) and Transit Centers Redundant paths to transit centers Transit centers connect to: Private links to other AWS regions Private links to customers Internet through peering & paid transit Metro- area DWDM links between AZs 82,864 fiber strands in region AZs <2ms apart & usually <1ms 25Tbps peak inter- AZs traffic

5 AWS Global Footprint Availability Zone Designed as independent failure zones Physically separated within a typical metropolitan region

6 Example AWS Availability Zone AZ Transit AZ AZ AZ AZ Transit 1 of 30 AZs world- wide All regions have 2 or more AZs Each AZ is 1 or more DC No data center is in two AZs Some AZs have as many as 6 DCs DCs in AZ less than ¼ ms apart

7 Example AWS Data Center Single DC typically over 50,000 servers & often over 80,000 Larger DCs undesirable (blast radius) Up to 102Tbps provisioned to a single DC (inter DC not intra)

8 Shared Responsibility Managed by Customer Optimized Network/OS/App Controls Service-specific Controls Cross-service Controls Cloud Service Provider Controls Security in the Cloud Security of the Cloud Managed by AWS ISO ISO 9001 Request reports at: aws.amazon.com/compliance/#contact

9 What is AWS? Deployment & Administration Application Services Compute Storage Database Networking AWS Global Infrastructure

10 Service Breadth & Depth 2015, Amazon Web Services, Inc. or its Affiliates. All rights reserved.

11 Features Overview

12 Network Security Choose and combine a bunch of build in network related options: ü Build in firewall features (Security Groups and NACL s) ü Virtual Private Cloud ü Transport Encryption (IPsec and TLS) ü Dedicated Network Connection (Direct Connect) ü Cypher Suites with Perfect Forward Secrecy ü Managed NAT Gateways ü WebApplicationFilters 2015, Amazon Web Services, Inc. or its Affiliates. All rights reserved.

13 Virtual Private Cloud Security Layers Availability Zone A Availability Zone B Lockdown at instance level Security Group Security Group Security Group Isolate network functions Subnet /24 Subnet /24 Lockdown at network level Network ACL Router Network ACL Route restrictively Routing Table Routing Table Virtual Private Gateway Internet Gateway

14 Access Control Allow only authorized administrators and applications access on AWS resources ü Multi- Factor- Authentication (MFA) ü Fine granular access to AWS object ins3- Buckets/SQS/SNS and others ü API- Request Authentication ü Geo- Restrictions ü Temporary access tokens through STS 2015, Amazon Web Services, Inc. or its Affiliates. All rights reserved.

15 Monitoring and Logging Get an overview about activities on your AWS ressources ü Asset- Management and - Configuration with AWS Config ü Compliance Auditing and security analytics with AWS CloudTrail ü Identifications of configuration challenges through TrustedAdvisor ü Fine granular logging of access to S3 objects ü Detailed informations about flows in the network through VPC- FlowLogs ü Rule based config checks and actions with AWS Config Rules ü Filter and monitoring of HTTP access to applications with WAF functions in CloudFront 2015, Amazon Web Services, Inc. or its Affiliates. All rights reserved.

16 Encryption Security is the first priority for AWS ü Encryption of your data at rest with AES256 (EBS/S3/Glacier/RDS) ü Centralized (by Region) managed Key- Management ü IPsec tunnels into AWS with the VPN- Gateways ü Deicated HSM modules in the cloud with CloudHSM 2015, Amazon Web Services, Inc. or its Affiliates. All rights reserved.

17 IAM Overview

18 Identity and Access Management Users & Groups

19 Identity and Access Management Users & Groups Unique Security Credentials

20 Identity and Access Management Users & Groups Unique Security Credentials Temporary Security Credentials

21 Identity and Access Management Users & Groups Unique Security Credentials Temporary Security Credentials Policies & Permissions

22 Identity and Access Management Users & Groups Unique Security Credentials Temporary Security Credentials Policies & Permissions Roles

23 Identity and Access Management Users & Groups Unique Security Credentials Temporary Security Credentials Policies & Permissions Roles Multi-factor Authentication

24 IAM Best Practices

25 Root Accounts Do Not Need Access Keys Root Accounts Do Normally Not Log In

26 Best Practices Lock away your AWS account access keys Create individual IAM users Use groups to assign permissions to IAM users Grant least privilege Configure a strong password policy for your users Enable MFA for privileged users Use roles for applications that run on Amazon EC2 instances Delegate by using roles instead of by sharing credentials Rotate credentials regularly Remove unnecessary credentials Use policy conditions Keep a history of activity

27 What type of events should I monitor for? v You can monitor any specific event recorded by CloudTrail and receive notification from CloudWatch v Monitor for security or network related events that are likely to have a high blast radius v Popular examples based on customer feedback 1. Creation, deletion and modification of security groups and VPCs 2. Changes to IAM policies or S3 bucket policies 3. Failed AWS Management Console sign-in events 4. API calls that resulted in authorization failures 5. Launching, terminating, stopping, starting and rebooting EC2 instances v Fully defined and pre-built CloudFormation template to get started

28 Receive notifications of specific API activity

29 Demo: Kibana

30 Data at Rest: Simplified

31 Securing Data at Rest Amazon RDS Redshift > AES-256 key > KMS integration > Easy one-click encryption Amazon EBS Glacier Amazon S3

32 Securing Data at Rest Amazon S3 Glacier > AES-256 key > Each object is encrypted > Each key is encrypted with a master key > Master key is rotated regularly > KMS integration

33 Securing Data at Rest Amazon EBS > AES-256 key > Performed on EC2 host > Snapshots > KMS integrated > Each Volume gets it s DataKey > DataKey is encrypted with MasterKey

34 Securing Data at Rest Amazon RDS > AES-256 key > Logs, backups, and snapshots > Read replicas > Active and backup > CloudHSM (Oracle TDE only) > KMS integration

35 Securing Data at Rest Redshift > AES-256 key > Data blocks > Metadata > Active and backup > CloudHSM integration > 4-tier encryption architecture

36 Securing Data at Rest CloudHSM > Hardware Security Module > Single tenancy > Private key material never leaves the HSM > AWS provisioned, customer managed

37 Whitepaper: Encrypting Data at Rest

38 Thank You Content Providers: Bertram Dorn Brian Wagner Dave Walker