IaaS(AWS)の責任共有モデル Customer 1 Customer 2 … Customer n顧客が管理 Hypervisor Virtual Interfaces Customer 1 Security Groups Customer 2 Security Groups … Customer n Security Groups FirewallAWSが管理 Physical Interfaces
PaaSでの責任共有モデル Customer 1 Customer 2 … Customer n Business Logic顧客が管理 Hypervisor Virtual Interfaces Customer 1 Security Groups Customer 2 Security Groups … Customer n Security Groups Firewall事業者が管理 Physical Interfaces
顧客は「何に使うのか」を SaaSでの責任共有モデル 管理する Service 1 Service 2 … Service n Business Logic Hypervisor Virtual Interfaces Customer 1 Security Groups Customer 2 Security Groups … Customer n Security Groups Firewall事業者が管理 Physical Interfaces
ストレージの破棄データ消去基準 DoD 5220.22-M (“National Industrial Security Program Operating Manual”) NIST 800-88 (“Guidelines for Media Sanitization”)物理的に故障した場合は、消磁および破壊
障害分離のための、物理的な分散 US East Region (N. VA) EU Region (IRE)AZの中も複数の Availability Availability物理拠点が Zone A Zone B Availability Availability使用されている Zone A Zone B Availability Zone C US West Region APAC Region APAC Region (N. CA) (Singapore) (Tokyo) Availability Availability Availability Availability Availability Availability Zone A Zone B Zone A Zone B Zone A Zone B必要に応じて、顧客側で冗長構成可能
AWS Cloud Security Model Overview Shared Responsibility Model Certifications & Accreditations Customer/SI Partner/ISV controls Sarbanes-Oxley (SOX) compliance guest OS-level security, including ISO 27001 Certification patching and maintenance PCI DSS Level I Certification Application level security, including HIPAA compliant architecture password and role based access SAS 70 Type II Audit Host-based firewalls, including FISMA Low ATO Intrusion Detection/Prevention Pursuing FISMA Moderate ATO Systems Pursuing DIACAP MAC II I -Sensitive Encryption/Decryption of data. FedRAMP Hardware Security Modules Service Health Dashboard Separation of AccessPhysical Security VM Security Network Security Multi-level, multi-factor controlled Multi-factor access to Amazon Instance firewalls can be configured access environment Account in security groups; Controlled, need-based access for Instance Isolation The traffic may be restricted by AWS employees (least privilege) • Customer-controlled firewall at protocol, by service port, as well asManagement Plane Administrative Access the hypervisor level by source IP address (individual IP • Neighboring instances or Classless Inter-Domain Routing Multi-factor, controlled, need-based prevented access (CIDR) block). access to administrative host • Virtualized disk management Virtual Private Cloud (VPC) All access logged, monitored, layer ensure only account provides IPSec VPN access from reviewed owners can access storage existing enterprise data center to a AWS Administrators DO NOT have set of logically isolated AWS access inside a customer’s VMs, disks (EBS) resources including applications and data Support for SSL end point encryption for API calls
AWS Certifications Sarbanes-Oxley (SOX) compliant SAS70 Type II audit Goal: validate efficacy and efficiency of internal controls SAS 70 continues as a compliment to ISO 27001 ISO 27001 certification in all regions Finalized in November 2010 Standard is licensed content –purchase a copy from ISO Copy of report is available to you National Institute of Standards & Technology (NIST) Certification in progress Customers have deployed HIPAA-compliant healthcare applications now (whitepaper at aws.amazon.com)
SAS70 Type II Amazon Web Services publishes a Statement on AuditingStandards No. 70 (SAS 70) Type II Audit report every sixmonths and maintains a favorable unbiased andunqualified opinion from its independent auditors. AWSidentifies those controls relating to the operationalperformance and security to safeguard customer data.Through the SAS 70 report, the auditors evaluate the designof the stated control objectives and control activities andattest to the effectiveness of their design. They also audit theoperation of those controls, attesting that the controls areoperating as designed. This report is available to customersunder NDA who require a SAS70 Type II to meet their ownaudit and compliance needs.
ISO 27001 AWS has achieved ISO 27001 certification of our Information Security Management System (ISMS) covering AWS infrastructure, data centers in all regions worldwide, and services including Amazon Elastic Compute Cloud (Amazon EC2), Amazon Simple Storage Service (Amazon S3) and Amazon Virtual Private Cloud (Amazon VPC). We have established a formal program to maintain the certification.
PCI DSS Level 1 AWS has been successfully validated as a Level 1 service provider under the most recently published Payment Card Industry (PCI) Data Security Standard (DSS). Merchants and other service providers can run their applications on our PCI-compliant technology infrastructure for storing, processing, and transmitting credit card information in the cloud. Amazon Elastic Compute Cloud (EC2), Amazon Simple Storage Service (S3), Amazon Elastic Block Storage (EBS) and Amazon Virtual Private Cloud (VPC) are included in the PCI compliance validation.
AWS Security Resources http://aws.amazon.com/security/ Security Whitepaper Risk and Compliance Whitepaper Latest Versions May 2011 Regularly Updated Feedback is welcome