Top Cloud Security Myths presented at AWS Initiate Day in Dublin on April 11, 2019.

2. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Top Cloud Security Myths - Dispelled!
Mark Rowlands: Head of Pan-Eu AWS Solutions
Architecture Public Sector EMEA.

3. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
SECURITY IS
JOB ZERO

4. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
The three stages of cloud security curiosity
General cloud
security
Specific service
security
Data
security
New to cloud
and / or
business teams
Experienced in cloud
and / or
technology teams
Advanced in cloud
and / or
risk teams

6. Cloud security
Service security
Data
security

7. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Myth 01
“The public cloud is not as secure as
my on-premises infrastructure and not
as secure as my private cloud.”

8. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Zoom In: AWS Region Zoom In: AWS AZ
Sample Region
Datacenter Datacenter
Datacenter
Sample Availability Zone
Availability
Zone B
Availability
Zone A
Availability
Zone C
• Independent geographic areas, isolated from other Regions (security boundary)
• Customer chooses in which Region(s) to deploy services
• Regions are comprised of multiple Availability Zones (AZs), which enables the deployment of high-
availability architecture
• AZs are independent failure zones; physically separated; on separate low risk flood plains
• Discrete Uninterruptible Power Supply (UPS); Onsite backup generation facilities
• Built for continuous availability

9. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Advantages of the API
• Authoritative - the interface to, and between, AWS services
• Auditable – always know what, and who, is doing what
• Secure – verified integrity, authenticated, no covert channels
• Fast - can be read and manipulated in sub-second time
• Precise – defines the state of all infrastructure and services
• Evolving – continuously improving
• Uniform - provides consistency across disparate components
• Automatable - enables some really cool capabilities

10. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
01: AWS security of the cloud and in the cloud
Visible AutomatedPhysical
AWS’s global infrastructure is built to meet the requirements of the
most security-sensitive organizations in the world

11. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Myth #1: On-premises IT is more secure than the cloud
On AWSOn-premises
Big perimeter
End-to-End ownership
Build it all yourself
Server-centric approach
De-centralised administration
Focus on physical assets
Multiple (manual) processes
Micro-perimeters
Own just enough
Focus on your core values
Service-centric approach
Central control plane (API)
Focus on protecting data
Everything is automated

12. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Myth 02
“When I put my data in the cloud I lose
ownership of it, and it may move
across national borders.”

13. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
02: You own and control your content
Access TraceabilityOwnership
You retain ownership and control of your content, and you choose
which region that content resides in

14. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Myth 03
“I am a highly regulated business and I
cannot use the cloud because of my
compliance requirements.”

15. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.

16. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Certifications and compliance programs

17. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
03: AWS global compliance program
Countries Enterprise
agreement
Certifications
Our security assurance program meets or exceeds industry,
country-specific, and global security requirements

18. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Myth 04
“My business requires sensitive
personal data, I cannot use the cloud.”

19. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
04: Using encryption on AWS
AWS KMS High
standards
Ubiquitous
AWS encryption services are integrated into dozens of our services
and meet the strictest industry requirements

20. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Myth 05
“I have a requirement for security
testing, I cannot do that in the cloud.”

21. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
05: Security testing on AWS
Seek approval Or use
pre-approved
Shared
responsibility
AWS permits security testing of your resources in line with our
acceptable usage policy, and we provide tools to help you

22. Cloud security
Service security
Data
security

23. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Myth 06
“All of my operating systems are
patched automatically in the cloud.”

24. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
06: Patch management on AWS
How we help Our
responsibility
Your
responsibility
You are responsible for patching operating systems that you
manage. AWS is responsible for patching services that we manage

25. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Myth 07
“I cannot use the cloud to store
sensitive data because everyone will
have access to it.”

26. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
07: How to secure data in Amazon Simple Storage
Service (Amazon S3)
Notify RespondProtect
Amazon S3 and our other storage services are secure by default.
Customers control who can access their data, and AWS provides
multiple tools so you can understand how access is configured

27. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Myth 08
“I hear about secret keys being stolen,
the way you grant access is not
secure.”

28. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
IAM Roles.

29. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
08: How to protect AWS credentials
Amazon
GuardDuty
Multi-factor
authentication
AWS provides a number of tools to protect your identity and access
credentials and to help you detect misuse
Temporary
access

30. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Myth 09
“I cannot control the deletion of my
data and I cannot verify it has been
deleted.”

31. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
09: How AWS manages data deletion
Physical ValidatedLogical
When you delete your data we take multiple steps to wipe it and
eventually destroy it. This process is validated by independent
third parties

32. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Myth 10
“Serverless services are not secure
because they are shared between
customers.”

33. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
10: How AWS protects serverless services
Identity Limited
surface
When you use AWS’s serverless services you inherit the multiple
layers of strong security controls that are built into our core services
Building
blocks

34. Cloud security
Service security
Data
security

35. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Myth 11
“The government can access my data
at any time.”

36. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
11: How AWS manages information requests
Notification EncryptionValid requests
Amazon does not disclose customer information unless we’re
required to do so to comply with a legally valid and binding order.
Where we need to act publicly to protect customers, we do

37. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Myth 12
“A malicious insider can look at my
data via your shared administrative
access.”

38. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
12: How AWS manages administrative access
Process
controls
Technology
controls
AWS strictly controls our infrequent administrative access to
services. This process has executive oversight within AWS and is
validated by independent third parties
Automation

39. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Myth 13
“It is possible to bypass your isolation
technology and access someone else’s
data.”

40. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
13: How AWS secures the hypervisor
Experience
AWS has over a decade of experience securing our virtualization
technology. We provide a deep level of isolation within the cloud
Customization
& innovation
Isolation

41. Cloud security
Service security
Data
security

42. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Security benefits of the AWS cloud
Automate
with deeply
integrated
security
services
Inherit
global
security and
compliance
controls
Highest
standards
for privacy
and data
security
Largest
network
of security
partners and
solutions
Scale with
superior
visibility and
control

43. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
SECURITY IS
JOB ZERO
http://amzn.to/2FZdEgH

44. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
“CIOs and CISOs need to stop obsessing over
unsubstantiated cloud security worries, and instead
apply their imagination and energy to developing new
approaches to cloud control, allowing them to securely,
compliantly, and reliably leverage the benefits of this
increasingly ubiquitous computing model.”
Source: “Clouds Are Secure: Are You Using Them Securely?”

45. Thank you!
© 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.