Top Cloud Security Myths Dispelled

P U B L I C S E C T O R
S U M M I T
B RUSSE LS

© 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.P U B L I C S E C TO R
S U M M I T
Top Cloud Security Myths Dispelled
Tim Rains
Leader Security & Compliance EMEA WWPS
Amazon Web Services

© 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Agenda
Myth #1: Attacks are getting more advanced...
Myth #2: On-premises IT is more secure than the cloud…
Myth #3: Data residency means better security…
Opportunity: Higher levels of security assurance
Opportunity: Innovation

Relatedbreakouts
Better, Faster, Cheaper: Government in the Cloud Age
Getting Started with Serverless Architectures
Accelerating Innovation in Public Sector with Cloud
Innovation Centers

S U M M I T

Examples of advanced malware
• Zeus/Zbot (2007): very successful information stealing Trojan
• Conficker (2008): novel payload distribution mechanism
• Stuxnet (2010): state sponsored cyber-kinetic attack
• Flame (2012): cryptographic attack enabling forged certificate
• Duqu 2.0 (2014-2015): advanced persistence capabilities using multiple
zero-day vulnerabilities
• Triton (2016-2017): attack framework to reprogram industrial control
systems
• WannaCry (2017): ransomware worm using stolen EternalBlue exploit

Historicallylargepubliclydiscloseddatabreaches
Top 10 breaches
• 40% occurred in 2018
• 80% occurred in the last 2 years
Top 25 breaches
• Average 298,084,000 records
• Greater than population of every
country except top 3

Attacker motivations
• Notoriety
• Profit
• Military espionage
• Economic espionage
• Hacktivism
• Foreign policy goals via information warfare, cultural manipulation, etc.
• Etc.

Attacker tacticsfor initialcompromise
1. Unpatched vulnerabilities
2. Security misconfigurations
3. Weak, leaked, stolen passwords
4. Social engineering
5. Insider threat

https://aws.amazon.com/blogs/publicsector/the-five-ways-organizations-initially-get-compromised-and-tools-to-protect-yourself/

Newwhitepapersnow available
https://d1.awsstatic.com/whitepapers/Break-Intrusion-Kill-Chains-with-AWS.pdf
https://d1.awsstatic.com/whitepapers/Break-Intrusion-Kill-Chains-with-AWS_Reference-Material.pdf

Zoom In: AWS Region Zoom In: AWS AZ
Sample Region
Datacenter Datacenter
Datacenter
Sample Availability Zone
Availability
Zone B
Availability
Zone A
Availability
Zone C
• Independent geographic areas, isolated from other Regions (security boundary)
• Customer chooses in which Region(s) to deploy services
• Regions are comprised of multiple Availability Zones (AZs), which enables the deployment of high-
availability architecture
• AZs are independent failure zones; physically separated; on separate low risk flood plains
• Discrete Uninterruptible Power Supply (UPS); Onsite backup generation facilities
• Built for continuous availability

AWSGlobal Infrastructure
61 Availability Zones within 20 geographic regions around the world, with announced plans for 12 more
Availability Zones and four more AWS Regions including Bahrain, Cape Town, Hong Kong SAR, and Milan

AWSCloudFront & Route53Edge Infrastructure
Amazon CloudFront uses a global network of 166 Points of Presence (155 Edge
Locations and 11 Regional Edge Caches) in 65 cities across 29 countries

Myth#2:On-premisesITismoresecurethanthecloud
On AWSOn-premises
Big perimeter
End-to-End ownership
Build it all yourself
Server-centric approach
De-centralised administration
Focus on physical assets
Multiple (manual) processes
Micro-perimeters
Own just enough
Focus on your core values
Service-centric approach
Central control plane (API)
Focus on protecting data
Everything is automated

Advantages of theAPI
• Authoritative - the interface to, and between, AWS services
• Auditable – always know what, and who, is doing what
• Secure – verified integrity, authenticated, no covert channels
• Fast - can be read and manipulated in sub-second time
• Precise – defines the state of all infrastructure and services
• Evolving – continuously improving
• Uniform - provides consistency across disparate components
• Automatable - enables some really cool capabilities

1. Unpatched vulnerabilities
2. Security misconfigurations
3. Weak, leaked, stolen passwords
4. Social engineering
5. Insider threat
Physical location of data doesn’t mitigate any of these

Dataresidency does not provide better security
1. Most threats are exploited remotely
2. Manual processes present risk of human error

Whyunauthorized riskis lower in thecloud
1. Encryption - Appropriately encrypting data can make it unreadable if compromised.
2. Tokenization – A sequence of data that represents sensitive information and is undecipherable
without a tokenization system.
3. Data Decomposition – Reducing data sets into unrecognizable fragments that are stored in a
distributed fashion so that any compromise would yield insignificant data.
4. Cyber Deception Defense – Deception solutions use highly sophisticated traps and decoys to
present an attacker with the perception that they have infiltrated the system while in reality
diverting them to a highly controlled environment.
Preventing unauthorized access requires practicing proper security hygiene and implementing robust
preventive and detective capabilities.

Logical separation securityequivalence
Three-pronged approach:
1. Virtualization
2. Encryption
3. Deploying compute to dedicated hardware
Combined with visibility & control APIs provide
Governments worldwide can leverage to confidently
migrate sensitive (e.g., high impact) unclassified
workloads to the cloud without the need for a
physically dedicated infrastructure
https://aws.amazon.com/blogs/security/how-aws-meets-a-physical-separation-requirement-with-a-logical-separation-approach/

Broad accreditations & certifications
GLACIER VAULT LOCK
& SEC RULE 17A-4(F)
SOC 1
SOC 2
SOC 3
PSN

Securityassurance
Start with bare concrete
Periodic checks
Workload-specific compliance
checks
Must keep pace and invest in
security innovation
Heterogeneous governance
processes and tools
Typically reactive
Start on accredited services
Continuous monitoring
Compliance approach based
on all workload scenarios
Security innovation drives
broad compliance
Integrated governance
processes and tools
Focus on prevention
On AWSOn-premises

Innovation
• First standard public telephone kiosk introduced
by UK Post Office, produced in concrete, in 1920
and was designated K1 (Kiosk No.1)
• First red telephone box, constructed in cast iron,
deployed in the UK in 1926, called K2 (Kiosk No.2)
• K3-K8 models introduced 1930-1968
• After privatisation in 1982, British Telecom began
to replace most of the existing boxes with modern
models
• BT was reported to have stopped making
telephone boxes in January 2001
• Public telephone kiosks obsolete less than 100
years after introduction
Source: https://en.wikipedia.org/wiki/Red_telephone_box

AWS Paceof Innovation

Serverlessmeans…
No servers to provision
or manage
Never pay for idle Availability and fault
tolerance built in
Scales with usage

F RA M EW ORKS
ML Frameworks
+ Infrastructure
ML Services
AI Services
I NT E RF A CES I NF RA S T RUCT URE
A m azon
S ageM ak er
Amazon
Transcribe
Amazon
Polly
Amazon
Lex
CHA T B OT S
Amazon
Rekognition
Image
Amazon
Rekognition
Video
V I S I ON S P E ECH
Amazon
Comprehend
Amazon
Translate
LA NGUA GES
P3 P3dn C5 C5n Elastic inference Inferentia AWS Greengrass
N E WN E W
Ground Truth Notebooks Algorithms + Marketplace RL Training Optimization Deployment Hosting
N E W N E W N E W N E W
AI& ML

S U M M I T
William Gibson
Author

https://aws.amazon.com/blogs/publicsector/dont-discount-the-value-of-innovation/

Thank you!
S U M M I T
Tim Rains
rainstim@amazon.co.uk

Top Cloud Security Myths Dispelled

Recommended

Recommended

More Related Content

What's hot

What's hot (20)

Similar to Top Cloud Security Myths Dispelled

Similar to Top Cloud Security Myths Dispelled (20)

More from Amazon Web Services

More from Amazon Web Services (20)

Top Cloud Security Myths Dispelled