AWS Security Model Overview Certifications & Accreditations Shared Responsibility Model Sarbanes-Oxley (SOX) compliance Customer/SI Partner/ISV controls ISO 27001 Certification guest OS-level security, including PCI DSS Level I Certification patching and maintenance HIPAA compliant architecture Application level security, including password and role based access SAS 70(SOC 1) Type II Audit Host-based firewalls, including FISMA Low & Moderate ATOs Intrusion Detection/Prevention DIACAP MAC III-Sensitive Systems Pursuing DIACAP MAC II–Sensitive Separation of AccessPhysical Security VM Security Network Security Multi-level, multi-factor controlled Multi-factor access to Amazon Instance firewalls can be configured access environment Account in security groups; Controlled, need-based access for Instance Isolation The traffic may be restricted by AWS employees (least privilege) • Customer-controlled firewall at protocol, by service port, as well asManagement Plane Administrative Access the hypervisor level by source IP address (individual IP Multi-factor, controlled, need-based • Neighboring instances or Classless Inter-Domain Routing access to administrative host prevented access (CIDR) block). All access logged, monitored, • Virtualized disk management Virtual Private Cloud (VPC) reviewed layer ensure only account provides IPSec VPN access from AWS Administrators DO NOT have owners can access storage existing enterprise data center to a logical access inside a customer’s disks (EBS) set of logically isolated AWS VMs, including applications and resources Support for SSL end point data encryption for API calls
AWS Security Resourceshttp://aws.amazon.com/security/Security WhitepaperRisk and Compliance WhitepaperLatest Versions May 2011, January2012 respectivelyRegularly UpdatedFeedback is welcome
AWS CertificationsSarbanes-Oxley (SOX)ISO 27001 CertificationPayment Card Industry Data SecurityStandard (PCI DSS) Level 1 CompliantSAS70(SOC 1) Type II AuditFISMA A&As • Multiple NIST Low Approvals to Operate (ATO) • NIST Moderate, GSA issued ATO • FedRAMPDIACAP MAC III Sensitive ATOCustomers have deployed various compliant applications such as HIPAA(healthcare)
SOC 1 Type II – Control ObjectivesControl Objective 1: Security OrganizationControl Objective 2: Amazon Employee LifecycleControl Objective 3: Logical SecurityControl Objective 4: Secure Data HandlingControl Objective 5: Physical SecurityControl Objective 6: Environmental SafeguardsControl Objective 7: Change ManagementControl Objective 8: Data Integrity, Availability and RedundancyControl Objective 9: Incident Handling
ISO 27001AWS has achieved ISO 27001 certification of ourInformation Security Management System (ISMS)covering AWS infrastructure, data centers in all regionsworldwide, and services including Amazon ElasticCompute Cloud (Amazon EC2), Amazon Simple StorageService (Amazon S3) and Amazon Virtual Private Cloud(Amazon VPC). We have established a formal programto maintain the certification.
Physical Security Amazon has been building large-scale data centers formany years Important attributes: • Non-descript facilities • Robust perimeter controls • Strictly controlled physical access • 2 or more levels of two-factor auth Controlled, need-based access for AWS employees (least privilege) All access is logged and reviewed
GovCloud US West US West US East South EU Asia Asia (US ITAR (Northern (Oregon) (Northern America (Ireland) Pacific Pacific Region) California) Virginia) (Sao Paulo) (Singapore) (Tokyo) AWS Regions AWS Edge Locations
AWS Regions and Availability Zones Customer Decides Where Applications and Data Reside
Amazon EC2 SecurityHost operating system • Individual SSH keyed logins via bastion host for AWS admins • All accesses logged and auditedGuest operating system • Customer controlled at root level • AWS admins cannot log in • Customer-generated keypairsFirewall • Mandatory inbound instance firewall, default deny mode • Outbound instance firewall available in VPC • VPC subnet ACLsSigned API calls • Require X.509 certificate or customer’s secret AWS key
Network Security ConsiderationsDDoS (Distributed Denial of Service): • Standard mitigation techniques in effectMITM (Man in the Middle): • All endpoints protected by SSL • Fresh EC2 host keys generated at bootIP Spoofing: • Prohibited at host OS levelUnauthorized Port Scanning: • Violation of AWS TOS • Detected, stopped, and blocked • Ineffective anyway since inbound ports blocked by defaultPacket Sniffing: • Promiscuous mode is ineffective • Protection at hypervisor level
Amazon Virtual Private Cloud (VPC)Create a logically isolated environment in Amazon’s highly scalableinfrastructureSpecify your private IP address range into one or more public or privatesubnetsControl inbound and outbound access to and from individual subnets usingstateless Network Access Control ListsProtect your Instances with stateful filters for inbound and outbound traffic usingSecurity GroupsAttach an Elastic IP address to any instance in your VPC so it can be reacheddirectly from the InternetBridge your VPC and your onsite IT infrastructure with an industry standardencrypted VPN connection and/or AWS Direct ConnectUse a wizard to easily create your VPC in 4 different topologies
Amazon VPC Architecture Customer’s isolated AWS resources Subnets NATInternet Router VPN Gateway Secure VPN Amazon Connection over the Internet Web Services AWS Direct Cloud Connect – Dedicated Path/Bandwidth Customer’s Network
Amazon VPC - Dedicated InstancesNew option to ensure physical hosts are not shared withother customers$10/hr flat fee per Region + small hourly chargeCan identify specific Instances as dedicatedOptionally configure entire VPC as dedicated
AWS Deployment Models Logical Server Granular Logical Physical Government Only ITAR Sample Workloads and Information Network server Physical Network Compliant Application Access Policy Isolation Isolation and Facility (US Persons Isolation Isolation Only)Commercial Public facing apps. WebCloud sites, Dev test etc.Virtual Private Data Center extension,Cloud (VPC) TIC environment, email, FISMA low and ModerateAWS GovCloud US Persons Compliant(US) and Government Specific Apps.
Thanks! Remember to visithttps://aws.amazon.com/security