AWS Security 101: Understanding the Shared Security Model - Jeff Westphal, Milwaukee
•
0 likes•208 views
AWS Community Day | Midwest 2018 Track 1 AWS Security 101: Understanding the Shared Security Model - Jeff Westphal, Milwaukee
Recommended
Recommended
More Related Content
What's hot
What's hot (20)
Similar to AWS Security 101: Understanding the Shared Security Model - Jeff Westphal, Milwaukee
Similar to AWS Security 101: Understanding the Shared Security Model - Jeff Westphal, Milwaukee (20)
More from AWS Chicago
More from AWS Chicago (20)
Recently uploaded
Recently uploaded (20)
AWS Security 101: Understanding the Shared Security Model - Jeff Westphal, Milwaukee
- 1. Jeff Westphal - Milwaukee and Madison AWS uGroup Leader AWS Security 101: Understanding the Shared Security Model
- 3. PROD-VPC Public Subnet Instances IGW Private Subnet Instances DEV-VPC Public Subnet Instances IGW Private Subnet Instances Security Group RDS USEast S3 Buckets Fundamental Concepts in AWS Network • VPC • Public/Private Subnets • Security Groups • NACLs • Availability Zones Identity and Access • IAM • Users/Groups • Permissions • MFA Data and Compute • EC2 • EBS • S3 • CloudTrail • CloudWatch ELB USEast-1A
- 4. Route 53Al Gore Shield DDOS Protection WAF
- 5. Demand Increases Clash of Coders
- 6. VPC-A Public Subnet Instances IGW Private Subnet Instances VPC-B Public Subnet Instances IGW Private Subnet Instances IAM Account A Services VPC Private Subnet Instances Availability Zone Security Group RDS Private Subnet Security Group Elastic IP AutoscalingVPC NAT Gateway ELB VPC Peer VPC Peer AWS Region A VPC-B Public Subnet Instances IGW Private Subnet Instances AWS Region B VPC-B Public Subnet Instances IGW Private Subnet Instances AWS Region C IAM Account B VPC Peer VPN Gateway S3 Buckets
- 7. VPC-A Public Subnet Instances IGW Private Subnet Instances VPC-B Public Subnet Instances IGW Private Subnet Instances IAM Account A Services VPC Private Subnet Instances Availability Zone Security Group RDS Private Subnet Security Group Elastic IP AutoscalingVPC NAT Gateway ELB VPC Peer VPC Peer AWS Region A VPC-B Public Subnet Instances IGW Private Subnet Instances AWS Region B VPC-B Public Subnet Instances IGW Private Subnet Instances AWS Region C IAM Account B VPC Peer VPN Gateway S3 Buckets
- 9. AWS and you share responsibility for security AWS Foundation Services Compute Storage Database Networking AWS Global Infrastructure Regions Availability Zones Edge Locations Identity & Access Control Network Security Customer applications, Operating Systems & content You get to define your controls ON the Cloud AWS takes care of the security OF the Cloud You Inventory & Config Data Encryption
- 10. Copyright 2018 Trend Micro Inc.10 Why do I need additional security in the cloud? Threats: • Network attack • Vulnerabilities • Malware • Insider threats Compliance: • PCI DSS • HIPAA • NIST • Internal
- 11. Route 53Al Gore Shield Security at Scale WAF
- 12. Copyright 2018 Trend Micro Inc.12 The 7 Security Domains of the Cloud Security Model 1. Network 2. Identity & Access Mgmt 3. Data 4. Visibility 5. Governance Rick & Compliance 6. Threat & Vulnerability Protection 7. Application Security
- 13. Copyright 2018 Trend Micro Inc.13 Security Domain 1 – Network Security Native Services • VPC • NACLs, Security Groups • VPN, Direct Connect • VPC Peering • Public/Private Subnets • ELB/ALB Third-Party Services: • Next-Gen Firewall • CASB • Software Defined Perimeter
- 14. Copyright 2018 Trend Micro Inc.14 Security Domain 2 – Identity and Access Management Native Services • IAM • MFA • SAML • STS • Directory Services • AWS Organizations Third-Party Services: • LDAP • SAML • SSO
- 15. Copyright 2018 Trend Micro Inc.15 Security Domain 3 – Data Native Services • Encryption- KMS • Cloud HSM • Macie • Guard Duty Third-Party Services: • DLP • Integrity Monitoring • Log Inspection
- 16. Copyright 2018 Trend Micro Inc.16 Security Domain 4 – Visibility Native Services • CloudTrail • CloudWatch • SNS • Trusted Advisor Third-Party Services: • SIEM • Log Intelligence • Perimeter Assessments
- 17. Copyright 2018 Trend Micro Inc.17 Security Domain 5 – Governance & Compliance Native Services • CloudTrail • CloudWatch • Config • AWS Quick Starts Third-Party Services: • Best-Practice Checks • Charge Monitoring • Customized Alerts
- 18. Copyright 2018 Trend Micro Inc.18 Security Domain 6 – Threat and Incident Detection and Response Native Services • VPC • Security Groups, NACLs • WAF • Shield • Inspector Third-Party Services: • Intrusion Prevention • Deep Packet Inspection • Malware, Antivirus • Zero Day/Hour Protection • Case Management
- 19. Copyright 2018 Trend Micro Inc.19 Security Domain 7 – Application Security Native Services • Inspector • WAF • API Gateway • Cognito Third-Party Services: • CVE Checks • Host-Based Security Controls • Application Control • Vulnerability Scanning
- 20. Clash of Coders
- 21. CloudFront DynamoDB SNS Mobile Notifications ALB ECR Kinesis Streams Lambda Functions ElastiCache Cluster Lambda Functions Game Updates Mobile Users S3 Bucket Static Content Internet Gateway CodeCommit ECR CodeBuild Lambda Functions Developer Serverless and Event Driven Architectures
- 22. CloudFront DynamoDB SNS Mobile Notifications ALB ECR Kinesis Streams Lambda Functions ElastiCache Cluster Lambda Functions Game Updates Mobile Users S3 Bucket Static Content Internet Gateway CodeCommit ECR CodeBuild Lambda Functions Developer Serverless and Event Driven Architectures
- 23. Copyright 2017 Trend Micro Inc.23 Integrated Protection through the entire Application Lifecycle BuildCommit Scan Alert DeployPush Sign/Promote Examine • Malware • Vulnerabilities • Custom IOCs APIs Signed
- 24. Copyright 2018 Trend Micro Inc.24 7 Security Domains OSI Model • Physical • Data Link • Network • Transport • Session • Presentation • Application Cloud Security Model • Network • Identity & Access Mgmt • Data • Visibility • Governance Rick/Compliance • Threat, Vulnerability Protection • Application Security Please Do Not Throw Sausage Pizza Away ? ? ? ? ? ? ? @mkeaws
- 25. Thank you!!! Hope to see everyone at Happy Hour!