AWS Data Security Security Update

Transcription

1 AWS Data Security Security Update December 1 st , Amazon Web Services, Inc. or its Affiliates. All rights reserved.

2 Data Security Agenda 1:00 pm AWS Security Overview + What s New 2:00 pm Network Security & Access Control in AWS 2:55 pm Refreshment Break (15 minutes) 3:10 pm Protecting Your Data in AWS 4:10 pm Securing Systems at Cloud Scale 5:00 pm Closing Remarks + Open Q&A

3 AWS Security Overview + What s New 2015, Amazon Web Services, Inc. or its Affiliates. All rights reserved.

4 AWS Security An Intro

5 AWS Security Team Operations Engineering Application Security Security Assurance Aligned for agility

6 Security ownership as part of DNA Distributed Embedded Promotes culture of everyone is an owner for security Makes security a stakeholder in business success Enables easier and smoother communication

7 Operating principles Separation of duties Different personnel across service lines Least privilege

8 Technology to automate operational principles Visibility through automation Shrinking the protection boundaries Ubiquitous encryption

9 Shared Responsibility

10 Intro to AWS Everyday, AWS adds enough new server capacity to support Amazon.com when it was a $7 billion global enterprise. 11 Regions 30 Availability Zones 53 Edge Locations Over 1 Million Active Customers Across 190 Countries

11 A European view of Cloud Regions: Dublin (EU-West) 3 x Availability Zones Launched in 2007 Frankfurt (EU-Central) 2 x Availability Zones Launched in 2014 Edge Locations: Amsterdam, The Netherlands (2), Dublin, Ireland, Frankfurt, Germany (3), London, England (3), Madrid, Spain, Marseille, France, Milan, Italy, Paris, France (2), Stockholm, Sweden, and Warsaw, Poland Direct Connect POPs: Dublin, London, Frankfurt

12 Data Locality Customer chooses where to place data AWS regions are geographically isolated by design Data is not replicated to other AWS regions and doesn t move unless you choose to move it

13 Overview of AWS Services Enterprise Applications Virtual Desktop Workspaces Your Applications AWS Global Infrastructure Document Collaboration Zocalo Deployment & Management Web Interface Monitoring Deployment & Automation AWS Global Infrastructure Identity & Access Human Interaction Management Console Billing CloudWatch BeanStalk OpsWorks Cloud Formation DataPipe IAM Federation Mechanical Turk Application Services Foundation Services Content Delivery Applications Distributed Computing Libraries & SDK s AWS Global Infrastructure CloudFront SES SNS SQS Elastic CloudSearch SWF EMR Transcoder Compute Storage Networking Databases EC2 S3 EBS Glacier Storage Gateway AWS Global Infrastructure VPC Direct Connect ELB Route53 RDS Dynamo ElastiCache RedShift Regions AWS Global Availability Infrastructure Zones Edge Locations AWS Global Infrastructure

14 How does a customer interact with AWS services? Common Protocols SSH, RDP, HTTP, SSL, SQL etc API Calls (Management Console, SDKs, Unified CLI) S3, EC2, RDS

15 API Calls Authentication is provided by IAM (Identity Access Management) API calls are secured within an TLS connection API Calls are made to AWS Service endpoints deployed globally A full list of endpoints available here: AWS Unified CLI aws ec2 start-instances aws ec2 stop-instances aws s3 ls aws s3 cp <source> <destionation>

16 Lets look at how customers traditionally manage IT

17 Customer view Data Encryption Core Services Data Centre Customer Data Platform & Applications Management Operating System Data Integrity/Backup Network Protection Server Storage Networking HVAC UPS Security Management, Monitoring & Logging Customer Responsibility: - Data & Network Protection - High Availability - Disaster Recovery - Backup - Scalability - Audit

18 AWS Shared Responsibility Model Lets talk about Security within the Cloud and who is responsible for which parts? Security OF the Cloud vs Security IN the Cloud

19 AWS Shared Responsibility Model: for Infrastructure Services Customers Customer content Platform & Applications Management Operating System, Network & Firewall Configuration Client-Side Data encryption & Data Integrity Authentication Server-Side Encryption File System and/or Data Network Traffic Protection Encryption / Integrity / Identity Customer IAM Managed by Optional Opaque data: 1 s and 0 s (in transit/at rest) AWS Foundation Services Compute Storage Database Networking AWS Global Infrastructure Availability Zones Regions Edge Locations API Endpoint AWS IAM Managed by

20 Infrastructure Service Example EC2 AWS Responsibility: Foundational Services Networking, Compute, Storage AWS Global Infrastructure AWS IAM AWS API Endpoints Customer Responsibility: Customer Data Customer Application/Platform Operating System Network & Firewall Customer IAM High Availability, Scaling Instance Management, Data Protection (Transit, Rest, Backup)

21 Customers AWS Shared Responsibility Model: for Container Services Client-Side Data encryption & Data Integrity Authentication AWS Foundation Services Compute Storage Database Networking AWS Global Infrastructure Customer content Optional Opaque data: 1 s and 0 s (in transit/at rest) Platform & Applications Management Operating System, Network Configuration Availability Zones Regions Network Traffic Protection Encryption / Integrity / Identity Edge Locations Firewall Configuration Customer IAM API Endpoint AWS IAM Managed by Managed by

22 Infrastructure Service Example RDS AWS Responsibility: Foundational Services Networking, Compute, Storage AWS Global Infrastructure AWS IAM AWS API Endpoints Operating System Platform / Application High Availability Customer Responsibility: Customer Data Data Protection (Transit, Rest, Backup) Firewall (VPC) Scaling Customer IAM (DB Users, Table Permissions)

23 Customers AWS Shared Responsibility Model: for Abstract Services Managed by Customer content Optional Opaque Data: 1 s and 0 s (in flight / at rest) Client-Side Data Encryption & Data Integrity Authentication Data Protection by the Platform Protection of Data at Rest AWS Foundation Services Network Traffic Protection by the Platform Protection of Data at in Transit Platform & Applications Management Operating System, Network & Firewall Configuration API Endpoint AWS IAM Managed by Compute Storage Database Networking AWS Global Infrastructure Availability Zones Regions Edge Locations

24 Infrastructure Service Example S3 AWS Responsibility: Foundational Services Networking, Compute, Storage AWS Global Infrastructure AWS IAM AWS API Endpoints Operating System Platform / Application Data Protection (Rest - SSE, Transit) High Availability / Scaling Customer Responsibility: Customer Data Data Protection

25 Shared Responsibility Summary of Security IN the Cloud (Customer Responsibility Infrastructure Services Container Services Abstract Services Data Data Data Customer IAM AWS IAM Applications Customer IAM AWS IAM Networking/Firewall AWS IAM Operating System Networking/Firewall

26 Shared Responsibility What about Security OF the Cloud?

27 AWS Security Shared Responsibility Model AWS Foundation Services Compute Storage Database Network AWS Global Infrastructure Regions Availability Zones Edge Locations AWS is responsible for the security OF the cloud

28 Auditing - Comparison on-prem vs on AWS on-prem Start with bare concrete Functionally optional (you can build a secure system without it) Audits done by an in-house team Accountable to yourself Typically check once a year Workload-specific compliance checks Must keep pace and invest in security innovation on AWS Start on base of accredited services Functionally necessary high watermark of requirements Audits done by third party experts Accountable to everyone Continuous monitoring Compliance approach based on all workload scenarios Security innovation drives broad compliance

29 What this means You benefit from an environment built for the most security sensitive organizations AWS manages 1,800+ security controls so you don t have to You get to define the right security controls for your workload sensitivity You always have full ownership and control of your data

30 AWS Assurance Program Updates SOC: PCI: New services in scope after successful assessment KMS, Workspace, SES New services in scope after achieving PCI DSS 3.1 certification KMS, Cloudtrail, Cloudfront ISO 27017: International code of practice focusing on Cloud providers ISO 27018: International code of practice that focuses on protection of PII in the cloud.

31 Meet your own security objectives Customers Your own accreditation Your own certifications Your own external audits Customer scope and effort is reduced Better results through focused efforts AWS Foundation Services Compute Storage Database Networking AWS Global Infrastructure Availability Zones Regions Edge Locations Built on AWS consistent baseline controls

32 Why AWS? How AWS Security features and services can help our Customers

33 Amazon Inspector (Preview) Security assessment tool analyzing end-to-end application configuration and activity

34 Why Amazon Inspector? Applications testing key to moving fast but staying safe Security assessment highly manual, resulting in delays or missed security checks Valuable security subject matter experts spending too much time on routine security assessment

35 Amazon Inspector features Configuration Scanning Engine Activity monitoring Built-in content library Automatable via API Fully auditable

36 Getting started

37 Amazon Inspector rulesets CVE Network Security Best Practices Authentication Best Practices Operating System Best Practices Application Security Best Practices PCI DCSS 3.0 Readiness

38 Prioritized findings

39 Detailed remediation recommendations

40 AWS WAF

41 AWS WAF features Web filtering Amazon CloudFront integration Centralized rule management Real-time visibility API automation

42 AWS WAF benefits Increased protection against web attacks Ease of deployment and maintenance Security embedded in development process

43 AWS WAF

44 AWS WAF in action Admins AWS Management Console Define rules AWS WAF Developers AWS API Deploy protection Web app in CloudFront

45 AWS WAF Partner integrations Alert Logic, Trend Micro, and Imperva integrating with AWS WAF Offer additional detection and threat intelligence Dynamically modify rulesets of AWS WAF for increased protection

46 AWS Config Rules

47 AWS Config Fully managed service which provides: An Inventory of your AWS resources Lets you audit the resource configuration history Notifies you of resource configuration changes Logs are placed in customer defined S3 bucket

48 AWS Config Rules features Flexible rules evaluated continuously and retroactively Dashboard and reports for common goals Customizable remediation API automation

49 AWS Config Rules example rules Is Cloudtrail Enabled? Are in-use volumes encrypted? Are resources appropriately tagged? Is incoming SSH disabled? Are instanced running in the correct VPC? Are Elastic IPs attached to the correct EC2 instances?

50 AWS Config Rules Broad ecosystem of solutions

51 AWS Config Rules benefits Continuous monitoring for unexpected changes Shared compliance across your organization Simplified management of configuration changes

52 AWS Config Rules

53 Security by Design (Preview)

54 Evolution of security & compliance at AWS AWS certifications Customer enabler docs Customer case studies Security by Design (SbD) AWS IAM AWS CloudHSM AWS KMS AWS CloudTrail AWS Config

55 Security by Design - SbD AWS IAM AWS CloudHSM AWS KMS AWS CloudTrail Security by Design (SbD) is a modern, security assurance approach that formalizes AWS account design, automates security controls, and streamlines auditing. It is a systematic approach to ensure security; instead of relying on after-the-fact auditing, SbD provides control insights throughout the IT management process. AWS Config

56 Putting it all together (SbD) Build your AWS applications using Security by Design Customer Workload Continuous Compliance through Config Rules Continuous Compliance through Inspector

57 Security Training

58 New security training Training Security Fundamentals on AWS Free online course for Security Auditors, Analysts and Management 5 modules over 3 hours Progress is saved Details at aws.amazon.com/training

59 New security training Training Security Operations on AWS 3 day class for: Security Engineers/Architects Security Analysts and Auditors 11 modules with X Labs Details at aws.amazon.com/training

60 Security Partners

61 AWS Marketplace Offers customers a choice of security configurations IN the Cloud Infrastructure Security gateway, firewall, router, WAF, network, UTM Identity & Access Control - allowed/authorized access Logging & Monitoring - SIEM/ Governance, Risk, & Compliance (GRC) Configuration & Vulnerability Analysis scanning/pen testing and IPS/IDS Data Protection - DRM/DLP/Encryption Threat Analytics - continuous monitoring

62 AWS Marketplace Network/Security Partner Eco-system Infrastructure Security Logging & Monitoring Identity & Access Control Configuration & Vulnerability Analysis Data Protection SaaS SaaS SaaS

63 Helpful Resources

64 Getting help - Trusted Advisor Performs a series of security configuration checks of your AWS environment: Open ports Unrestricted access IAM use CloudTrail Logging S3 Bucket Permissions Multi-factor authentication Password Policy DB Access Risk DNS Records Load Balancer configuration

65 Getting Help - AWS Auditing Checklists

66 Getting help - AWS Compliance: Workbooks IT Grundschutz (TUV Trust IT) CESG UK Security Principles PCI Workbook Anitian Audit Checklists Whitepapers FAQs EU Data Protection Risk & Compliance Overview of Security Processes FERPA PCI, HIPAA, EU Data Protection, ISO 27001, 9001 etc Training Blogs elearning Security Fundamentals 3hour free online course Instructor Lead Training 3day course for Security Professionals Qwiklabs - Security & Auditing Self Paced Lab

67 Getting help - Resources Compliance Enablers: Risk & Compliance Whitepaper: Compliance Center Website: Security Center: Security Blog: AWS Audit Training: AWS Security Training: awsaudittraining@amazon.com