The document discusses Amazon WorkSpaces, a managed desktop service. It provides an overview of AWS end-user computing services and the security benefits of Amazon WorkSpaces. It then details how Bridgewater Associates uses Amazon WorkSpaces to address their business needs like rapid deployment and security controls.

1. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
A security-first approach to delivering
end-user computing services
Nathan Thomas
GM, Amazon WorkSpaces
Amazon Web Services
F N D 3 2 7
Ron Bledsoe
Senior Engineer
Bridgewater Associates

2. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Agenda
Overview of AWS end-user computing
Amazon WorkSpaces security benefits
Deep dive on Bridgewater Associates

3. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
AWS end-user computing services
Desktops
Applications Mobile Access
Documents

4. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Amazon WorkSpaces
Tens of thousands of customers running
hundreds of thousands of Amazon WorkSpaces

5. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Amazon WorkSpaces refresher
BundleClient Pricing
Desktop
Mobile
Web
Windows 10
Windows 7
Amazon Linux
Standard
Memory
Graphics
Monthly
Hourly
BYOL
OS

6. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Amazon WorkSpaces inherent security approach

7. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Keep data and apps off devices
• Client device loss is not important
• Authentication to the desktop itself can include MFA
• Segment policies between client devices and Amazon WorkSpaces to balance
user satisfaction and security

8. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Move the security perimeter to the VPC
• Every network beyond the VPC is untrusted
• All authentication is TLS 1.2 encrypted like your VPN
• All streams are AES-256 encrypted
• You own the security group for the VIF
• Traffic can be routed through your proxy

9. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Segmented access for user groups
• Amazon WorkSpaces are aligned to VPCs and directories
• Different groups of users can have unique VPCs and AD connectors
• This allows unique security and network configuration for these groups
• All Amazon WorkSpaces get full VMs and can be on dedicated hardware

10. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Desktops as code/automate and monitor
• APIs, Amazon CloudWatch, and AWS CloudTrail integration
• Monitor login events and track triggered actions
• Automate Amazon WorkSpaces launches and terminations
• Monitor and patch at all times, not just when a device is online

11. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Ron Bledsoe
Senior Engineer

12. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Business challenges

13. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Business challenges

14. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Rapid (re)deployment

15. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Active
Directory
SIEM
Direct Connect
or VPN
MFA (RADIUS)
Corporate
network

16. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Security controls
Certificate auth
IP access controls
MFA
Active
Directory
SIEM
Direct Connect
or VPN
MFA (RADIUS)
Corporate
network

17. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Security controls
Certificate auth
IP access controls
MFA
Security controls
Certificate auth
MFA
CloudWatch Events
Active
Directory
SIEM
Direct Connect
or VPN
MFA (RADIUS)
Corporate
network

18. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Security controls
Certificate auth
IP access controls
MFA
Security controls
Certificate auth
MFA
CloudWatch Events
Security controls
MFA
Active
Directory
SIEM
Direct Connect
or VPN
MFA (RADIUS)
Corporate
network

19. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Security Controls
Certificate Auth
IP Access Controls
MFA
Security Controls
Certificate Auth
MFA
CloudWatch Events
Security Controls
MFA
Active
Directory
SIEM
Direct Connect
or VPN
MFA (RADIUS)
Corporate
network

20. Thank you!
© 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Nathan Thomas
nathant@amazon.com