1. AWS Summit 2013 Barcelona
Oct 24 – Barcelona, Spain
AWS CLOUD SECURITY
Bill Shinn
AWS Principal Security Solutions Architect

2. SECURITY IS UNIVERSAL

3. EVERY CUSTOMER HAS ACCESS
TO THE SAME SECURITY
CAPABILITIES
CHOOSE WHAT’S RIGHT FOR YOUR BUSINESS

4. AWS GOV CLOUD
ITAR COMPLIANT

5. SECURITY IS VISIBLE

6. CAN YOU MAP YOUR NETWORK?
WHAT IS IN YOUR ENVIRONMENT
RIGHT NOW?

9. AWS API + CLOUDFORMATION
ENVIRONMENT ARCHITECTURE DEFINITION
AND CHANGE DETECTION

10. SECURITY IS TRANSPARENT

11. SOC 1
SOC 2
ITAR
SOC 3
FIPS
PCI DSS L1
FedRAMP
ISO 27001
HIPAA

12. SECURITY IS FAMILIAR

13. SOC CONTROL OBJECTIVES
1.
2.
3.
4.
5.
6.
7.
8.
SECURITY ORGANIZATION
AMAZON USER ACCESS
LOGICAL SECURITY
SECURE DATA HANDLING
PHYSICAL SECURITY AND ENV. SAFEGUARDS
CHANGE MANAGEMENT
DATA INTEGRITY, AVAILABILITY AND REDUNDANCY
INCIDENT HANDLING

14. SOC CONTROL OBJECTIVES
1.
2.
3.
4.
5.
6.
7.
8.
SECURITY ORGANIZATION
AMAZON USER ACCESS
LOGICAL SECURITY
SECURE DATA HANDLING
PHYSICAL SECURITY AND ENV. SAFEGUARDS
CHANGE MANAGEMENT
DATA INTEGRITY, AVAILABILITY AND REDUNDANCY
INCIDENT HANDLING

15. SOC CONTROL OBJECTIVES
1.
2.
3.
4.
5.
6.
7.
8.
SECURITY ORGANIZATION
AMAZON USER ACCESS
LOGICAL SECURITY
SECURE DATA HANDLING
PHYSICAL SECURITY AND ENV. SAFEGUARDS
CHANGE MANAGEMENT
DATA INTEGRITY, AVAILABILITY AND REDUNDANCY
INCIDENT HANDLING

16. SOC CONTROL OBJECTIVES
1.
2.
3.
4.
5.
6.
7.
8.
SECURITY ORGANIZATION
AMAZON USER ACCESS
LOGICAL SECURITY
SECURE DATA HANDLING
PHYSICAL SECURITY AND ENV. SAFEGUARDS
CHANGE MANAGEMENT
DATA INTEGRITY, AVAILABILITY AND REDUNDANCY
INCIDENT HANDLING

17. LEAST PRIVILEGE PRINCIPLE
CONFINE ROLES ONLY TO THE MATERIAL
REQUIRED TO DO A SPECIFIC WORK

18. USE AWS IAM
IDENTITY & ACCESS MANAGEMENT

19. CONTROL WHO CAN DO WHAT IN
YOUR AWS ACCOUNT

23. IAM USERS & ROLES

24. ACCESS TO
SERVICE APIs

25. NO PASSWORDS

26. USE SEPARATE SETS OF
CREDENTIALS

27. ROTATE YOUR AWS SECURITY
CREDENTIALS

28. SOC CONTROL OBJECTIVES
1.
2.
3.
4.
5.
6.
7.
8.
SECURITY ORGANIZATION
AMAZON USER ACCESS
LOGICAL SECURITY
SECURE DATA HANDLING
PHYSICAL SECURITY AND ENV. SAFEGUARDS
CHANGE MANAGEMENT
DATA INTEGRITY, AVAILABILITY AND REDUNDANCY
INCIDENT HANDLING

29. YOUR DATA IS YOUR
MOST IMPORTANT ASSET

31. …

32. MFA DELETE PROTECTION

34. ENCRYPT YOUR DATA
AMAZON S3 SSE DATA AT REST
AWS CloudHSM

35. SOC CONTROL OBJECTIVES
1.
2.
3.
4.
5.
6.
7.
8.
SECURITY ORGANIZATION
AMAZON USER ACCESS
LOGICAL SECURITY
SECURE DATA HANDLING
PHYSICAL SECURITY AND ENV. SAFEGUARDS
CHANGE MANAGEMENT
DATA INTEGRITY, AVAILABILITY AND REDUNDANCY
INCIDENT HANDLING

36. NEED TO KNOW
+
CCTV, GUARDS, MAN TRAPS,
FENCES, ETC…

37. …

38. SOC CONTROL OBJECTIVES
1.
2.
3.
4.
5.
6.
7.
8.
SECURITY ORGANIZATION
AMAZON USER ACCESS
LOGICAL SECURITY
SECURE DATA HANDLING
PHYSICAL SECURITY AND ENV. SAFEGUARDS
CHANGE MANAGEMENT
DATA INTEGRITY, AVAILABILITY AND REDUNDANCY
INCIDENT HANDLING

39. CHANGES IN PRODUCTION
HAVE TO BE AUTHORIZED

40. DEV & TEST
PRODUCTION
ENVIRONMENT
ENVIRONMENT
AWS ACCOUNT A
AWS ACCOUNT B

41. DEPLOYMENT PROCESS
HAS TO BE CONSTRAINED

42. SOC CONTROL OBJECTIVES
1.
2.
3.
4.
5.
6.
7.
8.
SECURITY ORGANIZATION
AMAZON USER ACCESS
LOGICAL SECURITY
SECURE DATA HANDLING
PHYSICAL SECURITY AND ENV. SAFEGUARDS
CHANGE MANAGEMENT
DATA INTEGRITY, AVAILABILITY AND REDUNDANCY
INCIDENT HANDLING

43. CONTINUOUS DELIVERY MODEL

44. CONTINUOUS DEPLOYMENT
SESSION
13:30 START-UP TRACK

45. REDUNDANCY & INTEGRITY
CHECKS

46. USE MULTIPLE AZs
AMAZON S3
AMAZON DYNAMODB
AMAZON RDS MULTI-AZ
AMAZON EBS SNAPSHOTS

47. SOC CONTROL OBJECTIVES
1.
2.
3.
4.
5.
6.
7.
8.
SECURITY ORGANIZATION
AMAZON USER ACCESS
LOGICAL SECURITY
SECURE DATA HANDLING
PHYSICAL SECURITY AND ENV. SAFEGUARDS
CHANGE MANAGEMENT
DATA INTEGRITY, AVAILABILITY AND REDUNDANCY
INCIDENT HANDLING

48. “GAME DAYS”
INSERT ARTIFICIAL SECURITY INCIDENTS.
MEASURE SPEED OF DETECTION AND EXECUTION.

49. GAME DAYS !!
INSERT ARTIFICIAL SECURITY INCIDENTS.
MEASURE SPEED OF DETECTION AND EXECUTION.

50. SECURITY IS AUDITABLE

52. VULNERABILITY / PENETRATION
TESTING

53. VULNERABILITY / PENETRATION
TESTING

54. LOGS
OBTAINED, RETAINED, ANALYZED

55. OBTAIN, RETAIN, ANALYSE
YOUR LOGS

58. PROTECT YOUR LOGS WITH IAM
ARCHIVE YOUR LOGS

61. TRUSTED ADVISOR

65. SECURITY IS SHARED

66. NETWORK SECURITY:
DDOS

67. NETWORK SECURITY:
SSL

68. NETWORK SECURITY:
SPOOFING

69. NETWORK SECURITY:
PORT SCANNING

70. AMAZON EC2 SECURITY:
HOST OS
SSH KEYED LOGINS VIA BASTION HOST
ALL ACCESSES LOGGED AND AUDITED

71. AMAZON EC2 SECURITY:
GUEST OS
CUSTOMER CONTROLLED AT ROOT LEVEL
AWS ADMINS CANNOT LOG IN
CUSTOMER-GENERATED KEYPAIRS

72. “If you need to SSH into your
instance, improve your deployment
process.”

73. AMAZON EC2 SECURITY:
STATEFUL & STATELESS FIREWALL
MANDATORY INBOUND
DEFAULT DENY MODE

79. SECURITY IS
UNIVERSAL
VISIBLE
TRANSPARENT
FAMILIAR
AUDITABLE
SHARED

80. AWS.AMAZON.COM / SECURITY
AWS.AMAZON.COM/COMPLIANCE
BLOGS.AWS.AMAZON.COM/SECURITY

82. AWS SECURITY WHITEPAPERS
AUDITING SECURITY CHECKLIST
SECURITY BEST PRACTICES
SECURITY PROCESSES
RISK & COMPLIANCE

83. AWS MARKETPLACE
SECURITY SOLUTIONS

84. billshin@amazon.com