This document discusses the importance of data security and outlines best practices for ensuring confidentiality, integrity, and availability of data in the cloud. It describes Amazon Web Services' (AWS) physical and logical security controls to prevent unauthorized access to data centers and data. AWS provides a suite of security services to help with identity and access control, detection of threats, infrastructure security, incident response, and data protection through encryption. The document emphasizes automating security checks and compliance to help customers securely use AWS cloud services.

1. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Myles Hosford – Principal Security Architect APAC
14th May 2018
Amazon Web Services
Cloud & Data Security

2. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
WHY IS DATA SECURITY
IMPORTANT?

3. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.

4. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Confidentiality: Prevent
unauthorized access
Integrity: Prevent
unauthorized change
Availability: Ensure it is
running to serve
customers

5. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
PHYSICAL LOGICAL

6. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Confidentiality: Physical
• Protect unauthorized access to data center facilities
• Protect insider access to sensitive data
 Strong access control (approved, reviewed)
 Destruction of media
 Security controls (CCTV, guard, perimeter, etc)
 Separation of duties
How do we know a provider is doing all of the above?

7. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
AWS Compliance

8. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Confidentiality: Logical
• Protect unauthorized access to data
• Protect insider access to sensitive data
 Multi-factor authentication
 Role based access control (separation of duties)
 Robust logging & monitoring
 Encryption
 Maintain ownership
 Grant access to approved parties (regulators, law)

9. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
AWS Security Services
AWS Identity & Access
Management (IAM)
AWS Organizations
AWS Cognito
AWS Directory Service
AWS Single Sign-On
AWS CloudTrail
AWS Config
Amazon
CloudWatch
Amazon GuardDuty
VPC Flow Logs
Amazon EC2
Systems Manager
AWS Shield
AWS Web Application
Firewall (WAF)
Amazon Inspector
Amazon Virtual Private
Cloud (VPC)
AWS Key Management
Service (KMS)
AWS CloudHSM
Amazon Macie
Certificate Manager
Server Side Encryption
AWS Config Rules
AWS Lambda
Identity
Detective
control
Infrastructure
security
Incident
response
Data
protection

10. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Data Protection

11. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Protecting Data - Encryption
KMS
KMS
(Import
Key)
AWS
CloudHSM
On-Prem
HSM
Client-Side
Encryption
Cheap & Easy
$12
Expensive & Complex
$100k+
FIPS140-2 Level 2 FIPS140-2 Level 3
The Federal Information Processing Standard (FIPS) Publication 140-2, (FIPS
PUB 140-2), is a U.S. government computer security standard used to
approve cryptographic modules.

12. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Encryption with AWS KMS

13. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
AVAILABILITY

14. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
18 Regions – 54 Availability Zones

15. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Region
AZ-1 AZ-2
AZ-2
DC
DC
DC
Fully distributed infrastructure
Data does not resides in a single server or data center
Maximizing security, resiliency & availability

16. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
AWS Shield: DDoS Protection
 Protection against most common
infrastructure attacks
 SYN/ACK Floods, UDP Floods,
Refection attacks etc.
 No additional cost
DDoS mitigation
systems
DDoS Attack
Users

17. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Automating Security Checks
Real Time Notification

18. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Automating Regulatory Compliance
Changes
Compliance
Engine
Automated
Response

19. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Encryption Example
User launches a new
server without encryption
Automated
response to
perform
encryption
Automated
response to
terminate server
AWS Config reviews change
against controls you define
in near real-time

20. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Conclusion
 Protect your data with strong physical and logical
security controls
 Use providers that have audited and certified controls
 Encrypt all your data
 Ensure availability to service your customers
 Use real-time compliance checks
 Classify your data……. Quint will help with this! 

21. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Thank you!
Any questions?