(Diapositivas de presentación son en inglés.)

1. © 2016, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Bill Murray
AWS Security Programs
June 2016
How We Should Think
About Security

2. 1) Why is security such a hot topic?
Because it’s important, and it’s hard

3. 2) Why is enterprise security traditionally so hard?
Because so much planning is needed

4. 3) Why does planning take so long?
Because it requires so many processes

5. 4) Why so many processes?
Because mistakes are easy
to make and hard to correct

6. 5) Why are mistakes so hard to correct?
Lack of visibility Low degree of automation

7. So where does AWS come in?
AWS makes security
more agile
Lets you move fast while
staying safe

8. Security is Job Zero
Network
Security
Physical
Security
Platform
Security
People &
Procedures

9. Security is Shared

10. Build everything on a constantly improving security baseline
AWS
Founda+on
Services
Compute
Storage
Database
Networking
AWS
Global
Infrastructure
Regions
Availability
Zones
Edge
Loca+ons
GxP
ISO 13485
AS9100
ISO/TS 16949

11. AWS
Founda+on
Services
Compute
Storage
Database
Networking
AWS
Global
Infrastructure
Regions
Availability
Zones
Edge
Loca+ons
Client-­‐side
Data
Encryp2on
Server-­‐side
Data
Encryp2on
Network
Traffic
Protec2on
Pla<orm,
Applica2ons,
Iden2ty
&
Access
Management
Opera2ng
System,
Network,
&
Firewall
Configura2on
Customer
applica2ons
&
content
Customers
Security & compliance is a shared responsibility
Customers have
their choice of
security
configurations IN
the Cloud
AWS is
responsible for
the security OF
the Cloud

12. Security is Familiar
We strive to make security at AWS as familiar as what you
are doing right now
• Visibility
• Auditability
• Controllability
• Agility

13. AWS Marketplace: One-stop shop for familiar tools
Advanced
Threat
Analy+cs
Applica+on
Security
Iden+ty
and
Access
Mgmt
Encryp+on
&
Key
Mgmt
Server
&
Endpoint
Protec+on
Network
Security
Vulnerability
&
Pen
Tes+ng

14. VISIBILITY
HOW OFTEN DO YOU MAP YOUR NETWORK?
WHAT’S IN YOUR ENVIRONMENT
RIGHT NOW?

17. Security is Visible
Who is accessing the resources?
Who took what action?
• When?
• From where?
• What did they do?
• Logs Logs Logs

18. Tools to move fast and stay safe
Amazon Inspector
AWS WAF
AWS Config Rules

19. Amazon Inspector
Security assessment tool analyzing end-to-end
application configuration and activity

20. Why Amazon Inspector?
• Application Security testing key to moving fast bust staying
safe
• Security assessment highly manual - resulting in delays or
missed security checks.
• Valuable security subject matter experts spending too
much time on routine security assessment

21. Amazon Inspector Features
Configuration Scanning Engine
Activity Monitoring
Built-in Content Library
Automatable via API
Fully Auditable

22. Amazon Inspector Rule Sets
CVE
Network Security Best Practices
Authentication Best Practices
CIS Operating System Benchmarks
Application Security Best Practices
Runtime Behavior Analysis

23. Amazon Inspector Benefits
Increased Agility
Embedded Expertise
Improved Security Posture
Streamlined Compliance

24. Getting started

25. Prioritized Findings

26. Detailed Remediation Recommendations

27. AWS WAF
(Web Application Firewall)

28. AWS WAF Features
Web Filtering
CloudFront Integration
Centralized Rule Management
Real-Time Visibility
API Automation

29. AWS WAF Benefits
Increased Protection
Against Web Attacks
Ease of Deployment and
Maintenance
Security Embedded in
Development Process

30. AWS WAF in Action
AWS Management
Console
Admins
Developers AWS API
Web App in
CloudFront
Define rules
Deploy
protection
AWS WAF

31. AWS WAF Partner integrations
• Alert Logic, Trend Micro & Imperva integrating with AWS WAF
• Offer additional detection and threat intelligence
• Dynamically modify rulesets of AWS WAF for increased protection

32. AWS Config Rules

33. AWS Config Rules Features
Flexible Rules evaluated continuously and
retroactively
Dashboard and Reports for Common Goals
Customizable Remediation
API Automation

34. AWS Config Rules Benefits
Continuous monitoring for
unexpected changes
Shared Compliance across
your organization
Simplified management of
configuration changes

35. AWS Config Rules
Broad Ecosystem of solutions

36. AWS Config Rules

37. Making Life Easier

38. Making Life Easier
Choosing security does not mean giving up
on convenience or introducing complexity

39. The AWS Journey
Phase 1:
How do I move
to AWS?
Time
Experience

40. The journey we’re seeing with AWS customers
Dev & Test True Production Mission Critical All-in
Build production apps
Migrate production apps
Marketing
Build mission-critical apps
Migrate mission-critical apps
Development and
test environments
Corporate standard
1 2 3 4

41. The AWS Journey
Phase 2:
How do I use
AWS to improve?
Time
Experience

42. Example: Hardened InstancesQuestiontoanswer
• How many of my
instances came
from the correct
“approved” server
image?
• How many
“approved”
instances? TraditionalIT
• Manual IT process
to prevent
• Even more manual
process to audit
AWS
• CloudTrail
identifies instance
launches with
unapproved AMIs
• Continuously
auditable
• Push notification
rather than regular
pull

43. Example: Entitlements ReportingQuestiontoanswer
• What accesses do
your people have?
TraditionalIT
• Inventory your
assets and
privileges
• Reconcile with
user accounts
• All manual
AWS
• IAM Auditing native
API calls
• GetAccountAuthoriza
tionDetails
• ListUserPolicies
• ListGroupPolicies
• ListRolePolicies

44. The AWS Journey
Phase 3:
How do I design
for tomorrow?
Time
Experience

45. Security by Design (SbD)

46. Security by Design - SbD
• Systematic approach to ensure security
• Formalizes AWS account design
• Automates security controls
• Streamlines auditing.
• Provides control insights throughout the
IT management processAWS
CloudTrail
AWS
CloudHSM
AWS IAM
AWS KMS
AWS
Config

47. SbD - Scripting your governance policy
Set of CloudFormation Templates that accelerate
compliance with PCI, HIPAA, FFIEC, FISMA, CJIS
Result: Reliable technical implementation of administrative
controls

48. How we build our organization

49. AWS Security Team
Operations
Application Security
Engineering
Compliance
Aligned for agility

50. Security Ownership as part of DNA
Promotes culture of “everyone is an owner” for security
Makes security stakeholder in business success
Enables easier and smoother communication
Distributed Embedded

51. Operating Principles
Separation of duties
Different personnel across service lines
Least privilege

52. Technology to automate operational principles
Visibility through automation
Shrinking the protection boundaries
Ubiquitous encryption

53. The Bottom Line…….

54. Design & Deploy
Define sensible defaults
Inherit compliance controls
Use available security features
Manage templates - not
instances

55. Operate & Improve
Constantly reduce the role of
people
Reduce Privileged accounts
Concentrate on what matters

56. Conclusions
Security is critical
We’re creating tools to make it
easier
We’re creating ways help you
build a world class team
You can move fast and stay
safe

57. Don’t take my word for it…..
CIOs and CISOs need to stop obsessing over
unsubstantiated cloud security worries, and instead apply
their imagination and energy to developing new
approaches to cloud control, allowing them to securely,
compliantly and reliably leverage the benefits of this
increasingly ubiquitous computing model.
Clouds Are Secure: Are You Using Them Securely?
Published: 22 September 2015
-- Jay Heiser