Cloud Security Myths & Opportunities, originally presented at AWS re:Invent Comes to London on January 24, 2019.

2. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
COMESTOLONDON
Cloud Security
Myths & Opportunities
Tim Rains
EMEA Regional Leader Security & Compliance
Worldwide Public Sector
Amazon Web Services

3. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
COMESTOLONDON

4. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
COMESTOLONDON
Examples of Advanced Malware
• Zeus/Zbot (2007): very successful information stealing Trojan
• Conficker (2008): novel payload distribution mechanism
• Stuxnet (2010): state sponsored cyber-kinetic attack
• Flame (2012): cryptographic attack enabling forged certificate
• Duqu 2.0 (2014-2015): advanced persistence capabilities using
multiple zero-day vulnerabilities
• Triton (2016-2017): attack framework to reprogram industrial control
systems

5. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
COMESTOLONDON
Large Data Breaches
Data source: https://www.csoonline.com/article/2130877/data-breach/the-biggest-data-breaches-of-the-21st-century.html

6. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
COMESTOLONDON
Security Organizations Breached
• RSA Security
• Kaspersky Lab
• US National Security Agency (NSA)
• DigiNotar certificate authority
• Etc.

7. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
COMESTOLONDON
Attacker Motivations
• Notoriety
• Profit
• Military espionage
• Economic espionage
• Hacktivism
• Foreign policy goals via information warfare, cultural manipulation,
etc.
• Etc.

8. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
COMESTOLONDON
Attacker Tactics for Initial Compromise
1. Unpatched vulnerabilities
2. Security misconfigurations
3. Weak, leaked, stolen passwords
4. Social engineering
5. Insider threat

9. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
COMESTOLONDON
https://aws.amazon.com/blogs/publicsector/the-five-ways-organizations-initially-get-compromised-and-tools-to-protect-yourself/

10. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
COMESTOLONDON

11. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
COMESTOLONDON

12. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
COMESTOLONDON
AWS Global Infrastructure
20 Regions – 60 Availability Zones
Announced plans for 12 more Availability Zones in 4 new AWS Regions

13. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
COMESTOLONDON
AWS CloudFront & Route 53 Edge Infrastructure
Content Distribution Network, WAF, DDoS protection, etc.
160 Points of Presence (149 Edge Locations and 11 Regional Edge Caches) in 65 cities across 29 countries

14. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
COMESTOLONDON
EMEA Infrastructure

15. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
COMESTOLONDON
Myth #2: On-premises IT is more secure than the Cloud
On AWSOn-premises
Big Perimeter
End-to-End Ownership
Build it all yourself
Server-centric approach
De-centralised Administration
Focus on physical assets
Multiple (manual) processes
Micro-Perimeters
Own just enough
Focus on your core values
Service-Centric approach
Central control plane (API)
Focus on protecting data
Everything is automated

16. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
COMESTOLONDON
Advantages of the API
• Authoritative - the interface to, and between, AWS services
• Auditable – always know what, and who, is doing what
• Secure – verified integrity, authenticated, no covert channels
• Fast - can be read and manipulated in sub-second time
• Precise – defines the state of all infrastructure and services
• Evolving – continuously improving
• Uniform - provides consistency across disparate components
• Automatable - enables some really cool capabilities

17. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
COMESTOLONDON

18. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
COMESTOLONDON
Attacker Tactics for Initial Compromise
• Unpatched vulnerabilities
• Security misconfigurations
• Weak, leaked, stolen passwords
• Social engineering
• Insider threat
Physical location of data doesn’t mitigate any of these

19. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
COMESTOLONDON
Data Residency Does Not Provide Better Security
• Most threats are exploited remotely
• Manual processes present risk of human error

20. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
COMESTOLONDON
Why Unauthorized Risk is Lower in the Cloud
1. Encryption - Appropriately encrypting data can make it unreadable if
compromised.
2. Tokenization – A sequence of data that represents sensitive information and is
undecipherable without a tokenization system.
3. Data Decomposition – Reducing data sets into unrecognizable fragments that are
stored in a distributed fashion so that any compromise would yield insignificant
data.
4. Cyber Deception Defense – Deception solutions use highly sophisticated traps
and decoys to present an attacker with the perception that they have infiltrated
the system while in reality diverting them to a highly controlled environment.
Preventing unauthorized access requires practicing proper security hygiene and
implementing robust preventive and detective capabilities.

21. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
COMESTOLONDON

22. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
COMESTOLONDON
Broad Accreditations & Certifications
https://aws.amazon.com/compliance/
REGULATION
2016/679 [EU]
Processing of personal
data

23. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
COMESTOLONDON
Security Assurance
Start with bare concrete
Periodic checks
Workload-specific compliance
checks
Must keep pace and invest in
security innovation
Heterogeneous governance
processes and tools
Typically reactive
Start on accredited services
Continuous monitoring
Compliance approach based
on all workload scenarios
Security innovation drives
broad compliance
Integrated governance
processes and tools
Focus on prevention
On AWSOn-premises

24. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
COMESTOLONDON

25. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
COMESTOLONDON
• First standard public telephone kiosk
introduced by UK Post Office, produced in
concrete, in 1920 and was designated K1
(Kiosk No.1)
• First red telephone box, constructed in cast
iron, deployed in the UK in 1926, called K2
(Kiosk No.2)
• K3-K8 models introduced 1930-1968
• After privatisation in 1982, British Telecom
began to replace most of the existing boxes
with modern models
• BT was reported to have stopped making
telephone boxes in January 2001
• Public telephone kiosks obsolete less than
100 years after introduction
Source: https://en.wikipedia.org/wiki/Red_telephone_box

26. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
COMESTOLONDON
AWS Pace of Innovation
24
48
61
82
159
280
516
722
1017
1430
1957
0 300 600 900 1200 1500 1800 2100
1
2
3
4
5
6
7
8
9
10
11

27. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
COMESTOLONDON

28. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
COMESTOLONDON
No servers to provision
or manage
Scales with usage
Never pay for idle Availability and fault
tolerance built in
Serverless means…

29. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
COMESTOLONDON

30. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
COMESTOLONDON
Easily add intelligence to applications

31. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
COMESTOLONDON
https://aws.amazon.com/blogs/publicsector/dont-discount-the-value-of-innovation/

32. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
COMESTOLONDON