Accelerating cloud adoption for your regulated workloads - AWS PS Summit Canberra 2017

CHRIS FLEISCHMANN
JOURNEY TO CLOUD
OFFERING EXECUTIVE
ACCELERATING
CLOUD ADOPTION
FOR YOUR
REGULATED
WORKLOADS
AWS SUMMIT
30 August 2017

AGENDA • Continuous Compliance
• The Accenture Security Framework for AWS
• Demo
• AWS Cloud Security Reference Architecture
• Application Walk-through
• Experience
Copyright © 2017 Accenture. All rights reserved. 2

Improve Workplace
Productivity
• Less time spent
managing and tracking
inventory
• Document updates to
meet new requirements
• Reduce time spent on
unplanned assessments
CONTINUOUS COMPLIANCE
WHY AUTOMATE COMPLIANCE?
Improve Customer
Experience
• Less data loss
• Resources have more
time to address
customer problems
Fewer Unplanned
Outages
• Improve traceability
through automated
logging of all interactions
• Increase data protection
through less manual
intervention

Shared Responsibilities
Who is responsible for
what
THREE LINES OF DEFENCE
AWS Services
The services used to
manage, monitor and
control the data flow
control between users
and applications
Application Controls
What can you control

WHO IS RESPONSIBLE FOR WHAT?
Accenture Security
Framework
Audit

AWS CLOUD SECURITY REFERENCE
ARCHITECTURE OVERVIEW
Optimized
security
controls
Incremental
security
controls
Native
security
controls
Application Security
Digital Identity
Foundation Security
Data Privacy and Protection
Cyber Security Operations
Governance & Risk Management
Accenture Cloud Security CapabilitiesCustomer Managed AWS security toolsAWS Managed
Accenture SupportedLegend: AWS Native Security Tools AWS Incremental Security Controls AWS Optimized Security Controls Technical recommendations available
Foundation Security
Computer
Storage
Network
Database
Configuration Management & Alerting
Security Assessment
Identity, Access and Entitlement Management
Security Information and Event Management
Data Privacy and Protection
Governance & Risk Management
Regions
Availability
Zones
Edge
Locations

• AWS IAM
• AWS CloudTrail
• VPC FlowLogs
• AWS Config
• S3 Encryption and
• EBS Encryption.
• AWS Certificate Manager
• NAT Gateway
• MFA…
• …
• There are more every day.
CONTINUOUS COMPLIANCE?
CONTROLS; THEM BE THE CONTROLS…
Common AWS Services used to
control the flow of information;
Monitoring, Configuration, Alerting…:

ACCENTURE VALUE-ADD, A.K.A. MORE
CONTROLS
Accenture provides a framework to help you meet compliance.
It provides the following controls:
1 of 3:
Control Feature for AWS Component AWS Services Third-Party Services
Access
Controls
Access Based on Business
Needs
Identification and
Authentication Techniques
Data Leakage
Cryptographic Techniques
to Restrict Data
Data Protection and Access Controls
• Role-Based Access Controls
• Externalisation of Keys
• Authentication and Access Controls
• Encryption and Tokenisation
• Encrypted Storage Volumes
• Encryption in Transit
Auditing and Configuration Management
• Tamper-Proof Metrics
• AWS IAM
• AWS CloudHSM
• AWS KMS
• MFA
• NAT Gateway
• AWS CloudTrail
• Amazon EBS Full Disk Encryption
• Amazon S3 Encryption
• AWS Certificate Manager
• Amazon RDS
• Ping
• Microsoft Active Directory
• [operating system authentication]
Bastion Host
• Remote Desktop
• Native DN Transparent Database
Encryption
• CipherCloud
Accenture Security Framework

ACCENTURE CONTROLS
2 of 3:
Control Feature For AWS Component AWS Services Third-Party Services
IT Asset Lifecycle
Management
Controls
Physical Security
Secure Software
Development
Legacy Technologies
Emerging Technologies
Monitoring Process
Incident Management
• Configuration and Change Management
• Continuous Deployment
• Hydration
• Alarms and Actions
• Log and Capture Flows
Separation and Flow Controls
• AWS Compliance Reports
• AWS CodeCommit
• AWS CodeDeploy
• AWS CodeWorkflow
• Auto Scaling groups
• AWS CloudWatch
• AWS CloudFormation
• IAM Accounts
• Amazon Virtual Private Cloud (VPC) Security
Groups
• AWS CloudTrail
• Amazon AMI
• Amazon Snapshot AMI
• GitHub
• Jenkins
• Native DN Transparent Database
Encryption
• CipherCloud
• Nagios
• ZenOss
• Splunk

ACCENTURE CONTROLS
3 of 3:
Control Feature for AWS Component AWS Services Third-Party Services
Monitoring and
Incident
Management
Accountability and Audit
Trails
• AWS CloudWatch
• AWS CloudTrail
• Splunk
• CyberArk
• PUAM
• QualysGuard
IT Security
Reporting and
Metrics
Regular Reporting
Effective Security Metrics
• AWS CloudWatch
• AWS CloudTrail
• Splunk
Business
Disruption
Reliance Auditing and Configuration Management
• Hydration
Separation and Flow Controls
• IAM Accounts
• VPC
• Security Groups
• AWS CodeDeploy, CodeCommit,
CodeWorkflow
• VPC: subnets, routing, gateways
• Security Groups
• IAM Accounts
• CloudWatch
• AutoScale Groups
• Amazon ELB
• Amazon RDS
• DynamoDB
• Amazon S3
Assurance IT Security and Assurance Auditing and Configuration Management
• Role-based access
• Alerting on deviation from defined configuration
baselines
• Roles and permissions used to store audit logs with
correct permissions
• AWS Compliance Reports
• AWS Config Rules
• S3 Permissions and Lifecycle Rules

PUTTING IT ALL TOGETHER:
“It's easier to stop something happening
in the first place than to repair the damage
after it has happened”.
DEMO TIME:
PREVENTION
IS BETTER THAN CURE

Using AWS Config along with AWS Config Rules to check to make sure that port 22 is not
open in any production security group.
AWS Config
Rules
AWS
Lambda
Amazon
SNS
Trigger Lambda function
when a user, group, role,
or policy changes
Run policy validation on
resources to check if they
are compliant.
Alert when compliant
status changes based on
Lambda validation.
1
2
3
4
Proactively respond to the
trigger using Lambda,
revert change
For further discussion: https://aws.amazon.com/blogs/security/how-to-monitor-aws-account-configuration-changes-and-api-calls-to-
amazon-ec2-security-groups/

SECURITY RECOMMENDATIONS

ACCOUNTS – REGIONS – AZS
Acc
Reg AZs
NACLs
Security
Groups
VPC
Direct
Connect
Cyber Defense
Services
Maximizes environment isolation with separate IAM domains
Create a separate account for every environment to increase isolation at the expense of manageability.
AWS
PROD
AWS
Sydney
DEV

VIRTUAL PRIVATE CLOUD (VPC)
Acc
Reg AZs
NACLs
Security
Groups
VPC
Direct
Connect
Cyber Defense
Services
Isolated VPCs with no inter-dependencies
Primary
Region
Production
Development
UAT / Test
Isolation between accounts and VPCs by deploying separate instances of all infrastructure and security tools.

Acc
Reg AZs
NACLs
Security
Groups
VPC
Direct
Connect
Cyber Defense
Services
Build tiers of applications with common functionality within subnets and distribute across multiple AZs for high availability.
Use subnets and network ACLs to segment tiers of applications
Presentation subnet
security groupsecurity group security group
Database subnet
Application subnet
security group security group security group
security group security group security group
Internet
Gateway
Web
App
Web
App
Web
App
App App App
DB DB DB
Corporate
DC

Acc
Reg AZs
NACLs
Security
Groups
VPC
Direct
Connect
Cyber Defense
Services
Use subnets and network ACLs
to segment tiers of applications
EC2 Instance
Global – Rules that are common
to all instances such as DNS or
NTP
Operating System – Rules
specific to an operating system
such as the SSH port for Linux
and RDP for Windows
Application – Rules specific
to all components of an
application
Role – Rules that apply to all
instances of an application that
perform the same function, a
pool of web servers for instance

Acc
Reg AZs
NACLs
Security
Groups
VPC
Direct
Connect
Cyber Defense
Services
For business critical applications ensure that redundant connectivity exists between AWS and client facilities
AWS Direct Connect
Direct Connect
Location
Direct Connect
Partner
Internet
Internet
VPN
VPN
MPLS
MPLS Customer
Gateway #2
Primary corporate
data center
DR corporate
data center
Customer
Gateway #1
Region
Production
Development
Management
Virtual
Private Gateway
Virtual
Private Gateway
Virtual
Private Gateway

USE ENCRYPTION IN TRANSIT AND AT
REST
AWS Storage Services
Your applications in
Amazon EC2
Your applications in your
data center
Encrypted
Data
S3 Glacier EBS Redshift RDS DynamoDB

THE ACCENTURE SECURITY FRAMEWORK
FOR AWS
The Accenture Security Framework for AWS employs a layered approach to security,
building on security features as required by the workload.
Separation and Network
Flow Controls
Auditing and
Configuration
Management
Data Protection and
Access Management

SEPARATION AND NETWORK FLOW
CONTROLS
Main Components of AWS:
• AWS Accounts
• Amazon Virtual Private Cloud (VPC), Internet Gateway & Peering
• Subnets
• Route Tables
• Security Groups

DATA PROTECTION AND ACCESS
MANAGEMENT
• Role-Based Access Controls
• Externalisation of Keys
• Authentication and Access Controls
• Encrypted Storage Volumes
• Encryption in Transit

AUDITING AND CONFIGURATION
MANAGEMENT
• Log Capture and Flows
• Configuration and Change Management
• Hydration

STOP…THE ARCHITECTURE CHANGES
How to prevent the Architecture from
unwelcome change?
… ENTER DEMO

CLOUD SECURITY OPERATING MODEL
Use this Model to translate Cloud Security Strategy to Operating Results
Cloud Security
Operating Model
results are measured
by:
• Business Risk
Reduction
• Cost Profile
• Flexibility
• Performance Metrics
• Ability to Scale
Cloud Security Strategy
defines:
• Cloud Security Vision
and guiding principles
• Service Strategy
• Sourcing Strategy
• Investments
Objectives
CLOUD SECURITY OPERATING MODEL
How we
execute
the work
Who is
accountable
for doing the
work
How we make, sponsor and
enforce the right decisions
around cloud security
How we
measure
security
effectiveness
What enabling
technology we use to
deliver Cloud services
How we
interact to
deliver
consistent
services
How we organise
ourselves to deliver
services
FUNCTIONS
GOVERNANCE
ORGANISATION,
ROLES &
SOURCING
PERFORMANCE
METRICS
TOOLS
INTERFACES
PROCESSES
Security
Operating
Model
Copyright © 2017 Accenture. All rights re25

ACCENTURE AWS OFFERINGS SUPPORT SCALE
JOINTLY DEVELOPED AND DELIVERED SERVICES AND SOLUTIONS
Run and operate via AWS managed services provider certified Accenture cloud platform
Analytics & big data
on AWS
Accelerated path to analytics
driven business relevant
outcomes.
The Accenture Insights Platform,
AWS Edition leverages AWS’ big
data and analytics services
An enabler for industries that
manage risk and compliance
challenges of regulated data in
the AWS cloud
Iot solutions and
services on AWS
Comprehensive industry
solutions and secure, scalable
IoT platform.
Industry-specific solutions include
Connected Home and Insurance
Telematics, with more to follow.
Solutions run on Accenture
Connected Products as a Service
(CPaaS) our broadly deployed and
open IoT platform architecture,
integrated with and optimised for
AWS IoT services.
Cloud transformation
services optimised for
AWS
Move existing applications to
and develop new applications
on AWS.
Services include:
• Cloud strategy
• Organisational and architecture
design
• Application migration and
refactoring
• Application development
services
• Migration ‘factory’ to automate
processes
SAP migration
to AWS
Simplify and accelerate the
journey of most customers
moving their SAP applications
to the cloud in the next 2-5
years.
Services include:
• SAP Implementation
• Cloud Infrastructure
Architecture and Setup
• SAP Run Support for Basis,
Functional, and Development
• Cloud Infrastructure Project &
Run Support
Cloud operating
model – security
solutions
Enhanced security solutions
focus on defence in depth
depth to secure client data and
applications emphasising
visibility and auditability.
Services include:
• Security assessment and
strategy for full migration or
hybrid AWS cloud scenarios
• Security architecture and
design
• Security expertise in cyber
defenses: intrusion and anomaly
detection, breach protection,
vulnerability assessment with
Accenture Cyber Defence
Platform
Strategic solutions
• Workplace-as-a-Service
• Accenture Digital Video

CALL TO ACTION
• Do you have compliance concerns that need addressing today?
• Do you have cloud auditing set up? Is it automated?
• Do you have a cloud security operate model?

Accelerating cloud adoption for your regulated workloads - AWS PS Summit Canberra 2017

Recommended

Recommended

More Related Content

What's hot

What's hot (20)

Similar to Accelerating cloud adoption for your regulated workloads - AWS PS Summit Canberra 2017

Similar to Accelerating cloud adoption for your regulated workloads - AWS PS Summit Canberra 2017 (20)

More from Amazon Web Services

More from Amazon Web Services (20)

Accelerating cloud adoption for your regulated workloads - AWS PS Summit Canberra 2017