SlideShare a Scribd company logo
© 2020, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Module 4:
Secure your cloud applications
Navjot Singh
Technical Trainer
AWS
© 2020, Amazon Web Services, Inc. or its affiliates. All rights reserved.
© 2020, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Security is our top priority
Designed for
security
Constantly
monitored
Highly
automated
Highly
available
Highly
accredited
© 2020, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Security of the cloud
• Hosts, network, software, facilities
• Protection of the AWS global infrastructure is top priority
• Availability of third-party audit reports
Foundation services
Compute Storage Database Network
AWS global
infrastructure
RegionsAvailability zones Edge locations
AWS
© 2020, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Security in the cloud
Considerations
• What you should store
• Which AWS services you
should use
• Which region to store in
• In what content format and
structure
• Who has access
Client-side data encryption &
Data integrity authentication
Platform, applications, identity & access management
Operating system, network & firewall configuration
Customer data
Customer
Server-side encryption
(File system and/or data)
Network traffic protection
(Encryption/integrity/identity)
© 2020, Amazon Web Services, Inc. or its affiliates. All rights reserved.
AWS shared responsibility model
Client-side data encryption &
Data integrity authentication
Platform, applications, identity & access management
Operating system, network & firewall configuration
Customer data
Customer
Server-side encryption
(File system and/or data)
Network traffic protection
(Encryption/integrity/identity)
Foundation services
Compute Storage Database Network
AWS global
infrastructure
RegionsAvailability zones Edge locations
AWS
© 2020, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Security, identity, and compliance products
AWS Artifact
AWS Certificate Manager
Amazon Cloud Directory
AWS CloudHSM
Amazon Cognito
AWS Directory Service
AWS Firewall Manager
Amazon GuardDuty
AWS Identity and Access Management
Amazon Inspector
AWS Key Management Service
Amazon Macie
AWS Organizations
AWS Shield
AWS Secrets Manager
AWS Single Sign-On
AWS WAF
AWS Artifact
AWS Certificate Manager
Amazon Cloud Directory
AWS CloudHSM
Amazon Cognito
AWS Directory Service
AWS Firewall Manager
Amazon GuardDuty
AWS Identity and Access Management
Amazon Inspector
AWS Key Management Service
Amazon Macie
AWS Organizations
AWS Shield
AWS Secrets Manager
AWS Single Sign-On
AWS WAF
© 2020, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Manage authentication and
authorization
© 2020, Amazon Web Services, Inc. or its affiliates. All rights reserved.
AWS Identity and Access Management (IAM)
Temporary privileges
that an entity can assume
GROUP ROLEIAM USER
Collection of users
with identical permissions
A person or application
that interacts with AWS
Securely control access to AWS resources
© 2020, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Authentication: Who are you?
$ aws
IAM GROUPIAM USER
IAM
AWS
CLI
AWS
SDKS
AWS
Management
Console
© 2020, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Authorization: What can you do?
IAM policies
Full
access
Read only
$ aws AWS
CLI
Amazon
S3 BucketIAM USER,
GROUP OR ROLE
© 2020, Amazon Web Services, Inc. or its affiliates. All rights reserved.
IAM roles
• IAM users, applications, and
services may assume IAM roles
• Roles uses an IAM policy
for permissionsIAM ROLE
© 2020, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Using roles for temporary security credentials
EC2
instance
Application
Amazon
S3 bucket
© 2020, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Using roles for temporary security credentials
EC2
instance
Application
Amazon
S3 bucket
© 2020, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Using roles for temporary security credentials
EC2
instance
Application
Amazon
S3 bucket
IAM Role IAM Policy
© 2020, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Using roles for temporary security credentials
EC2
instance
Application
Amazon
S3 bucket
Assume
IAM Role IAM Policy
© 2020, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Using roles for temporary security credentials
EC2
instance
Application
Amazon
S3 bucket
Assume
IAM Role IAM Policy
© 2020, Amazon Web Services, Inc. or its affiliates. All rights reserved.
© 2020, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Best practices
• Delete access keys for the
AWS account root user
• Activate multi-factor
authentication (MFA)
• Only give IAM users
permissions they need
• Use roles for applications
• Rotate credentials regularly
• Remove unnecessary users
and credentials
• Monitor activity in your
AWS account
© 2020, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Access your security and compliance
© 2020, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Challenges of threat assessment
• Expensive
• Complex
• Time-consuming
• Difficult to track IT changes
© 2020, Amazon Web Services, Inc. or its affiliates. All rights reserved.
What is Amazon Inspector?
Automated security
assessment as a service
• Assesses applications for
vulnerabilities
• Produces a detailed list of
security findings
• Leverages security best
practices
© 2020, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Amazon Inspector findings
© 2020, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Remediation recommendation
© 2020, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Protect your infrastructure from
Distributed Denial of Service (DDoS) attacks
© 2020, Amazon Web Services, Inc. or its affiliates. All rights reserved.
What is DDoS?
DDoS
DDoSDDoS
© 2020, Amazon Web Services, Inc. or its affiliates. All rights reserved.
DDoS mitigation challenges
Manual
Degraded
performance
Limited
bandwidth
Involves
rearchitecting
Time-
consuming Expensive
Complex
© 2020, Amazon Web Services, Inc. or its affiliates. All rights reserved.
What is AWS Shield? • A managed DDoS protection service
• Always-on detection and mitigations
• Seamless integration and deployment
• Cost-efficient and customizable protection
DDoS
DDoSDDoS
© 2020, Amazon Web Services, Inc. or its affiliates. All rights reserved.
AWS Shield Standard and AWS Shield Advanced
AWS Shield Standard
(Included)
• Quick detection
• Inline attack mitigation
AWS Shield Advanced
(Optional)
• Enhanced detection
• Advanced attack mitigation
• Visibility and attack notification
• DDoS cost protection
• Specialized support
© 2020, Amazon Web Services, Inc. or its affiliates. All rights reserved.
AWS security compliance
© 2020, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Assurance programs
© 2020, Amazon Web Services, Inc. or its affiliates. All rights reserved.
How AWS helps customers achieve compliance
Sharing information
• Industry certifications
• Security and control practices
• Compliance reports directly
under NDA
Assurance program
• Certifications/attestations
• Laws, regulations, and privacy
• Alignments/frameworks
© 2020, Amazon Web Services, Inc. or its affiliates. All rights reserved.
© 2020, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Customer responsibility
Review – Design – Identify – Verify
© 2020, Amazon Web Services, Inc. or its affiliates. All rights reserved.

More Related Content

What's hot

Module 1: Introduction to the AWS Cloud - AWSome Day Online Conference 2019
Module 1: Introduction to the AWS Cloud - AWSome Day Online Conference 2019Module 1: Introduction to the AWS Cloud - AWSome Day Online Conference 2019
Module 1: Introduction to the AWS Cloud - AWSome Day Online Conference 2019
Amazon Web Services
 
Kubernetes on AWS with Amazon EKS - MAD301 - New York AWS Summit
Kubernetes on AWS with Amazon EKS - MAD301 - New York AWS SummitKubernetes on AWS with Amazon EKS - MAD301 - New York AWS Summit
Kubernetes on AWS with Amazon EKS - MAD301 - New York AWS Summit
Amazon Web Services
 
Costruire Applicazioni Moderne con AWS
Costruire Applicazioni Moderne con AWSCostruire Applicazioni Moderne con AWS
Costruire Applicazioni Moderne con AWS
Amazon Web Services
 
Running Active Directory in the AWS Cloud
Running Active Directory in the AWS Cloud Running Active Directory in the AWS Cloud
Running Active Directory in the AWS Cloud
Amazon Web Services
 
20180613 AWS Black Belt Online Seminar AWS Cloud9 入門
20180613 AWS Black Belt Online Seminar AWS Cloud9 入門20180613 AWS Black Belt Online Seminar AWS Cloud9 入門
20180613 AWS Black Belt Online Seminar AWS Cloud9 入門
Amazon Web Services Japan
 
Technical Essentials Training: AWS Innovate Ottawa
Technical Essentials Training: AWS Innovate OttawaTechnical Essentials Training: AWS Innovate Ottawa
Technical Essentials Training: AWS Innovate Ottawa
Amazon Web Services
 
AWS 101
AWS 101AWS 101
AWS Landing Zone Deep Dive (ENT350-R2) - AWS re:Invent 2018
AWS Landing Zone Deep Dive (ENT350-R2) - AWS re:Invent 2018AWS Landing Zone Deep Dive (ENT350-R2) - AWS re:Invent 2018
AWS Landing Zone Deep Dive (ENT350-R2) - AWS re:Invent 2018
Amazon Web Services
 
AWS Black Belt Techシリーズ AWS Data Pipeline
AWS Black Belt Techシリーズ  AWS Data PipelineAWS Black Belt Techシリーズ  AWS Data Pipeline
AWS Black Belt Techシリーズ AWS Data Pipeline
Amazon Web Services Japan
 
Journey Through The Cloud - Security Best Practices
Journey Through The Cloud - Security Best Practices Journey Through The Cloud - Security Best Practices
Journey Through The Cloud - Security Best Practices
Amazon Web Services
 
20210119 AWS Black Belt Online Seminar AWS CloudTrail
20210119 AWS Black Belt Online Seminar AWS CloudTrail20210119 AWS Black Belt Online Seminar AWS CloudTrail
20210119 AWS Black Belt Online Seminar AWS CloudTrail
Amazon Web Services Japan
 
Landing Zones Creating a Foundation - AWS Summit Sydney 2018
Landing Zones Creating a Foundation - AWS Summit Sydney 2018Landing Zones Creating a Foundation - AWS Summit Sydney 2018
Landing Zones Creating a Foundation - AWS Summit Sydney 2018
Amazon Web Services
 
Encryption and Key Management in AWS
Encryption and Key Management in AWSEncryption and Key Management in AWS
Encryption and Key Management in AWS
Amazon Web Services
 
Amazon Virtual Private Cloud (VPC) - Networking Fundamentals and Connectivity...
Amazon Virtual Private Cloud (VPC) - Networking Fundamentals and Connectivity...Amazon Virtual Private Cloud (VPC) - Networking Fundamentals and Connectivity...
Amazon Virtual Private Cloud (VPC) - Networking Fundamentals and Connectivity...
Amazon Web Services
 
An Introduction to AWS
An Introduction to AWSAn Introduction to AWS
An Introduction to AWS
Ian Massingham
 
AWS Technical Essentials Day
AWS Technical Essentials DayAWS Technical Essentials Day
AWS Technical Essentials Day
Amazon Web Services
 
Landing Zones - Creating a Foundation for Your AWS Migrations
Landing Zones - Creating a Foundation for Your AWS MigrationsLanding Zones - Creating a Foundation for Your AWS Migrations
Landing Zones - Creating a Foundation for Your AWS Migrations
Amazon Web Services
 
20200818 AWS Black Belt Online Seminar AWS Shield Advanced
20200818 AWS Black Belt Online Seminar AWS Shield Advanced20200818 AWS Black Belt Online Seminar AWS Shield Advanced
20200818 AWS Black Belt Online Seminar AWS Shield Advanced
Amazon Web Services Japan
 
AWS Security Fundamentals
AWS Security FundamentalsAWS Security Fundamentals
AWS Security Fundamentals
Amazon Web Services
 
AWS Security Best Practices
AWS Security Best PracticesAWS Security Best Practices
AWS Security Best Practices
Amazon Web Services
 

What's hot (20)

Module 1: Introduction to the AWS Cloud - AWSome Day Online Conference 2019
Module 1: Introduction to the AWS Cloud - AWSome Day Online Conference 2019Module 1: Introduction to the AWS Cloud - AWSome Day Online Conference 2019
Module 1: Introduction to the AWS Cloud - AWSome Day Online Conference 2019
 
Kubernetes on AWS with Amazon EKS - MAD301 - New York AWS Summit
Kubernetes on AWS with Amazon EKS - MAD301 - New York AWS SummitKubernetes on AWS with Amazon EKS - MAD301 - New York AWS Summit
Kubernetes on AWS with Amazon EKS - MAD301 - New York AWS Summit
 
Costruire Applicazioni Moderne con AWS
Costruire Applicazioni Moderne con AWSCostruire Applicazioni Moderne con AWS
Costruire Applicazioni Moderne con AWS
 
Running Active Directory in the AWS Cloud
Running Active Directory in the AWS Cloud Running Active Directory in the AWS Cloud
Running Active Directory in the AWS Cloud
 
20180613 AWS Black Belt Online Seminar AWS Cloud9 入門
20180613 AWS Black Belt Online Seminar AWS Cloud9 入門20180613 AWS Black Belt Online Seminar AWS Cloud9 入門
20180613 AWS Black Belt Online Seminar AWS Cloud9 入門
 
Technical Essentials Training: AWS Innovate Ottawa
Technical Essentials Training: AWS Innovate OttawaTechnical Essentials Training: AWS Innovate Ottawa
Technical Essentials Training: AWS Innovate Ottawa
 
AWS 101
AWS 101AWS 101
AWS 101
 
AWS Landing Zone Deep Dive (ENT350-R2) - AWS re:Invent 2018
AWS Landing Zone Deep Dive (ENT350-R2) - AWS re:Invent 2018AWS Landing Zone Deep Dive (ENT350-R2) - AWS re:Invent 2018
AWS Landing Zone Deep Dive (ENT350-R2) - AWS re:Invent 2018
 
AWS Black Belt Techシリーズ AWS Data Pipeline
AWS Black Belt Techシリーズ  AWS Data PipelineAWS Black Belt Techシリーズ  AWS Data Pipeline
AWS Black Belt Techシリーズ AWS Data Pipeline
 
Journey Through The Cloud - Security Best Practices
Journey Through The Cloud - Security Best Practices Journey Through The Cloud - Security Best Practices
Journey Through The Cloud - Security Best Practices
 
20210119 AWS Black Belt Online Seminar AWS CloudTrail
20210119 AWS Black Belt Online Seminar AWS CloudTrail20210119 AWS Black Belt Online Seminar AWS CloudTrail
20210119 AWS Black Belt Online Seminar AWS CloudTrail
 
Landing Zones Creating a Foundation - AWS Summit Sydney 2018
Landing Zones Creating a Foundation - AWS Summit Sydney 2018Landing Zones Creating a Foundation - AWS Summit Sydney 2018
Landing Zones Creating a Foundation - AWS Summit Sydney 2018
 
Encryption and Key Management in AWS
Encryption and Key Management in AWSEncryption and Key Management in AWS
Encryption and Key Management in AWS
 
Amazon Virtual Private Cloud (VPC) - Networking Fundamentals and Connectivity...
Amazon Virtual Private Cloud (VPC) - Networking Fundamentals and Connectivity...Amazon Virtual Private Cloud (VPC) - Networking Fundamentals and Connectivity...
Amazon Virtual Private Cloud (VPC) - Networking Fundamentals and Connectivity...
 
An Introduction to AWS
An Introduction to AWSAn Introduction to AWS
An Introduction to AWS
 
AWS Technical Essentials Day
AWS Technical Essentials DayAWS Technical Essentials Day
AWS Technical Essentials Day
 
Landing Zones - Creating a Foundation for Your AWS Migrations
Landing Zones - Creating a Foundation for Your AWS MigrationsLanding Zones - Creating a Foundation for Your AWS Migrations
Landing Zones - Creating a Foundation for Your AWS Migrations
 
20200818 AWS Black Belt Online Seminar AWS Shield Advanced
20200818 AWS Black Belt Online Seminar AWS Shield Advanced20200818 AWS Black Belt Online Seminar AWS Shield Advanced
20200818 AWS Black Belt Online Seminar AWS Shield Advanced
 
AWS Security Fundamentals
AWS Security FundamentalsAWS Security Fundamentals
AWS Security Fundamentals
 
AWS Security Best Practices
AWS Security Best PracticesAWS Security Best Practices
AWS Security Best Practices
 

Similar to AWSome Day Online 2020_Module 4: Secure your cloud applications

AWSome Day Online 2020_Modul 4: Mengamankan aplikasi cloud Anda
AWSome Day Online 2020_Modul 4: Mengamankan aplikasi cloud AndaAWSome Day Online 2020_Modul 4: Mengamankan aplikasi cloud Anda
AWSome Day Online 2020_Modul 4: Mengamankan aplikasi cloud Anda
Amazon Web Services
 
AWSome Day Online 2020_โมดูล 4: การรักษาความปลอดภัยแอปพลิเคชันบนระบบคลาวด์ของคุณ
AWSome Day Online 2020_โมดูล 4: การรักษาความปลอดภัยแอปพลิเคชันบนระบบคลาวด์ของคุณAWSome Day Online 2020_โมดูล 4: การรักษาความปลอดภัยแอปพลิเคชันบนระบบคลาวด์ของคุณ
AWSome Day Online 2020_โมดูล 4: การรักษาความปลอดภัยแอปพลิเคชันบนระบบคลาวด์ของคุณ
Amazon Web Services
 
Module 4: Secure your cloud applications - AWSome Day Online Conference 2019
Module 4: Secure your cloud applications - AWSome Day Online Conference 2019Module 4: Secure your cloud applications - AWSome Day Online Conference 2019
Module 4: Secure your cloud applications - AWSome Day Online Conference 2019
Amazon Web Services
 
Serverless-First Function: Serverless application security
Serverless-First Function: Serverless application securityServerless-First Function: Serverless application security
Serverless-First Function: Serverless application security
RobSutter2
 
AWS SSA Webinar 11 - Getting started on AWS: Security
AWS SSA Webinar 11 - Getting started on AWS: SecurityAWS SSA Webinar 11 - Getting started on AWS: Security
AWS SSA Webinar 11 - Getting started on AWS: Security
Cobus Bernard
 
Pitt Immersion Day Module 5 - security overview
Pitt Immersion Day Module 5 - security overviewPitt Immersion Day Module 5 - security overview
Pitt Immersion Day Module 5 - security overview
EagleDream Technologies
 
Introduction_to_AWS_Services__Networking,_Security.pptx
Introduction_to_AWS_Services__Networking,_Security.pptxIntroduction_to_AWS_Services__Networking,_Security.pptx
Introduction_to_AWS_Services__Networking,_Security.pptx
GauravSharma164138
 
Getting Started with AWS Security
Getting Started with AWS SecurityGetting Started with AWS Security
Getting Started with AWS Security
Amazon Web Services
 
A Practitioner Guide to Securing Your Cloud (Like an Expert)
A Practitioner Guide to Securing Your Cloud (Like an Expert)A Practitioner Guide to Securing Your Cloud (Like an Expert)
A Practitioner Guide to Securing Your Cloud (Like an Expert)
Amazon Web Services
 
Fundamentals of AWS Security
Fundamentals of AWS SecurityFundamentals of AWS Security
Fundamentals of AWS Security
Amazon Web Services
 
Building a Secured Network environment on AWS
Building a Secured Network environment on AWSBuilding a Secured Network environment on AWS
Building a Secured Network environment on AWS
Amazon Web Services
 
A Practitioner's Guide to Securing Your Cloud (Like an Expert) (SEC203-R1) - ...
A Practitioner's Guide to Securing Your Cloud (Like an Expert) (SEC203-R1) - ...A Practitioner's Guide to Securing Your Cloud (Like an Expert) (SEC203-R1) - ...
A Practitioner's Guide to Securing Your Cloud (Like an Expert) (SEC203-R1) - ...
Amazon Web Services
 
Data Security in the Cloud - Matt Taylor - AWS TechShift ANZ 2018
Data Security in the Cloud - Matt Taylor - AWS TechShift ANZ 2018Data Security in the Cloud - Matt Taylor - AWS TechShift ANZ 2018
Data Security in the Cloud - Matt Taylor - AWS TechShift ANZ 2018
Amazon Web Services
 
Strengthen Your Organizations Security and Privacy.pdf
Strengthen Your Organizations Security and Privacy.pdfStrengthen Your Organizations Security and Privacy.pdf
Strengthen Your Organizations Security and Privacy.pdf
Amazon Web Services
 
Identity and Access Management and Directory Services
Identity and Access Management and Directory ServicesIdentity and Access Management and Directory Services
Identity and Access Management and Directory Services
Amazon Web Services
 
AWS Identity Access Management
AWS Identity Access ManagementAWS Identity Access Management
AWS Identity Access Management
Richard Harvey
 
Module 3: Security, Identity and Access Management - AWSome Day Online Confer...
Module 3: Security, Identity and Access Management - AWSome Day Online Confer...Module 3: Security, Identity and Access Management - AWSome Day Online Confer...
Module 3: Security, Identity and Access Management - AWSome Day Online Confer...
Amazon Web Services
 
Module 3: Security, Identity and Access Management - AWSome Day Online Confer...
Module 3: Security, Identity and Access Management - AWSome Day Online Confer...Module 3: Security, Identity and Access Management - AWSome Day Online Confer...
Module 3: Security, Identity and Access Management - AWSome Day Online Confer...
Amazon Web Services
 
Introduction to AWS Security
Introduction to AWS SecurityIntroduction to AWS Security
Introduction to AWS Security
Amazon Web Services
 
AWS雲端自動化合規檢核與資安警訊通報管理
AWS雲端自動化合規檢核與資安警訊通報管理AWS雲端自動化合規檢核與資安警訊通報管理
AWS雲端自動化合規檢核與資安警訊通報管理
Amazon Web Services
 

Similar to AWSome Day Online 2020_Module 4: Secure your cloud applications (20)

AWSome Day Online 2020_Modul 4: Mengamankan aplikasi cloud Anda
AWSome Day Online 2020_Modul 4: Mengamankan aplikasi cloud AndaAWSome Day Online 2020_Modul 4: Mengamankan aplikasi cloud Anda
AWSome Day Online 2020_Modul 4: Mengamankan aplikasi cloud Anda
 
AWSome Day Online 2020_โมดูล 4: การรักษาความปลอดภัยแอปพลิเคชันบนระบบคลาวด์ของคุณ
AWSome Day Online 2020_โมดูล 4: การรักษาความปลอดภัยแอปพลิเคชันบนระบบคลาวด์ของคุณAWSome Day Online 2020_โมดูล 4: การรักษาความปลอดภัยแอปพลิเคชันบนระบบคลาวด์ของคุณ
AWSome Day Online 2020_โมดูล 4: การรักษาความปลอดภัยแอปพลิเคชันบนระบบคลาวด์ของคุณ
 
Module 4: Secure your cloud applications - AWSome Day Online Conference 2019
Module 4: Secure your cloud applications - AWSome Day Online Conference 2019Module 4: Secure your cloud applications - AWSome Day Online Conference 2019
Module 4: Secure your cloud applications - AWSome Day Online Conference 2019
 
Serverless-First Function: Serverless application security
Serverless-First Function: Serverless application securityServerless-First Function: Serverless application security
Serverless-First Function: Serverless application security
 
AWS SSA Webinar 11 - Getting started on AWS: Security
AWS SSA Webinar 11 - Getting started on AWS: SecurityAWS SSA Webinar 11 - Getting started on AWS: Security
AWS SSA Webinar 11 - Getting started on AWS: Security
 
Pitt Immersion Day Module 5 - security overview
Pitt Immersion Day Module 5 - security overviewPitt Immersion Day Module 5 - security overview
Pitt Immersion Day Module 5 - security overview
 
Introduction_to_AWS_Services__Networking,_Security.pptx
Introduction_to_AWS_Services__Networking,_Security.pptxIntroduction_to_AWS_Services__Networking,_Security.pptx
Introduction_to_AWS_Services__Networking,_Security.pptx
 
Getting Started with AWS Security
Getting Started with AWS SecurityGetting Started with AWS Security
Getting Started with AWS Security
 
A Practitioner Guide to Securing Your Cloud (Like an Expert)
A Practitioner Guide to Securing Your Cloud (Like an Expert)A Practitioner Guide to Securing Your Cloud (Like an Expert)
A Practitioner Guide to Securing Your Cloud (Like an Expert)
 
Fundamentals of AWS Security
Fundamentals of AWS SecurityFundamentals of AWS Security
Fundamentals of AWS Security
 
Building a Secured Network environment on AWS
Building a Secured Network environment on AWSBuilding a Secured Network environment on AWS
Building a Secured Network environment on AWS
 
A Practitioner's Guide to Securing Your Cloud (Like an Expert) (SEC203-R1) - ...
A Practitioner's Guide to Securing Your Cloud (Like an Expert) (SEC203-R1) - ...A Practitioner's Guide to Securing Your Cloud (Like an Expert) (SEC203-R1) - ...
A Practitioner's Guide to Securing Your Cloud (Like an Expert) (SEC203-R1) - ...
 
Data Security in the Cloud - Matt Taylor - AWS TechShift ANZ 2018
Data Security in the Cloud - Matt Taylor - AWS TechShift ANZ 2018Data Security in the Cloud - Matt Taylor - AWS TechShift ANZ 2018
Data Security in the Cloud - Matt Taylor - AWS TechShift ANZ 2018
 
Strengthen Your Organizations Security and Privacy.pdf
Strengthen Your Organizations Security and Privacy.pdfStrengthen Your Organizations Security and Privacy.pdf
Strengthen Your Organizations Security and Privacy.pdf
 
Identity and Access Management and Directory Services
Identity and Access Management and Directory ServicesIdentity and Access Management and Directory Services
Identity and Access Management and Directory Services
 
AWS Identity Access Management
AWS Identity Access ManagementAWS Identity Access Management
AWS Identity Access Management
 
Module 3: Security, Identity and Access Management - AWSome Day Online Confer...
Module 3: Security, Identity and Access Management - AWSome Day Online Confer...Module 3: Security, Identity and Access Management - AWSome Day Online Confer...
Module 3: Security, Identity and Access Management - AWSome Day Online Confer...
 
Module 3: Security, Identity and Access Management - AWSome Day Online Confer...
Module 3: Security, Identity and Access Management - AWSome Day Online Confer...Module 3: Security, Identity and Access Management - AWSome Day Online Confer...
Module 3: Security, Identity and Access Management - AWSome Day Online Confer...
 
Introduction to AWS Security
Introduction to AWS SecurityIntroduction to AWS Security
Introduction to AWS Security
 
AWS雲端自動化合規檢核與資安警訊通報管理
AWS雲端自動化合規檢核與資安警訊通報管理AWS雲端自動化合規檢核與資安警訊通報管理
AWS雲端自動化合規檢核與資安警訊通報管理
 

More from Amazon Web Services

Come costruire servizi di Forecasting sfruttando algoritmi di ML e deep learn...
Come costruire servizi di Forecasting sfruttando algoritmi di ML e deep learn...Come costruire servizi di Forecasting sfruttando algoritmi di ML e deep learn...
Come costruire servizi di Forecasting sfruttando algoritmi di ML e deep learn...
Amazon Web Services
 
Big Data per le Startup: come creare applicazioni Big Data in modalità Server...
Big Data per le Startup: come creare applicazioni Big Data in modalità Server...Big Data per le Startup: come creare applicazioni Big Data in modalità Server...
Big Data per le Startup: come creare applicazioni Big Data in modalità Server...
Amazon Web Services
 
Esegui pod serverless con Amazon EKS e AWS Fargate
Esegui pod serverless con Amazon EKS e AWS FargateEsegui pod serverless con Amazon EKS e AWS Fargate
Esegui pod serverless con Amazon EKS e AWS Fargate
Amazon Web Services
 
Come spendere fino al 90% in meno con i container e le istanze spot
Come spendere fino al 90% in meno con i container e le istanze spot Come spendere fino al 90% in meno con i container e le istanze spot
Come spendere fino al 90% in meno con i container e le istanze spot
Amazon Web Services
 
Open banking as a service
Open banking as a serviceOpen banking as a service
Open banking as a service
Amazon Web Services
 
Rendi unica l’offerta della tua startup sul mercato con i servizi Machine Lea...
Rendi unica l’offerta della tua startup sul mercato con i servizi Machine Lea...Rendi unica l’offerta della tua startup sul mercato con i servizi Machine Lea...
Rendi unica l’offerta della tua startup sul mercato con i servizi Machine Lea...
Amazon Web Services
 
OpsWorks Configuration Management: automatizza la gestione e i deployment del...
OpsWorks Configuration Management: automatizza la gestione e i deployment del...OpsWorks Configuration Management: automatizza la gestione e i deployment del...
OpsWorks Configuration Management: automatizza la gestione e i deployment del...
Amazon Web Services
 
Microsoft Active Directory su AWS per supportare i tuoi Windows Workloads
Microsoft Active Directory su AWS per supportare i tuoi Windows WorkloadsMicrosoft Active Directory su AWS per supportare i tuoi Windows Workloads
Microsoft Active Directory su AWS per supportare i tuoi Windows Workloads
Amazon Web Services
 
Computer Vision con AWS
Computer Vision con AWSComputer Vision con AWS
Computer Vision con AWS
Amazon Web Services
 
Database Oracle e VMware Cloud on AWS i miti da sfatare
Database Oracle e VMware Cloud on AWS i miti da sfatareDatabase Oracle e VMware Cloud on AWS i miti da sfatare
Database Oracle e VMware Cloud on AWS i miti da sfatare
Amazon Web Services
 
Crea la tua prima serverless ledger-based app con QLDB e NodeJS
Crea la tua prima serverless ledger-based app con QLDB e NodeJSCrea la tua prima serverless ledger-based app con QLDB e NodeJS
Crea la tua prima serverless ledger-based app con QLDB e NodeJS
Amazon Web Services
 
API moderne real-time per applicazioni mobili e web
API moderne real-time per applicazioni mobili e webAPI moderne real-time per applicazioni mobili e web
API moderne real-time per applicazioni mobili e web
Amazon Web Services
 
Database Oracle e VMware Cloud™ on AWS: i miti da sfatare
Database Oracle e VMware Cloud™ on AWS: i miti da sfatareDatabase Oracle e VMware Cloud™ on AWS: i miti da sfatare
Database Oracle e VMware Cloud™ on AWS: i miti da sfatare
Amazon Web Services
 
Tools for building your MVP on AWS
Tools for building your MVP on AWSTools for building your MVP on AWS
Tools for building your MVP on AWS
Amazon Web Services
 
How to Build a Winning Pitch Deck
How to Build a Winning Pitch DeckHow to Build a Winning Pitch Deck
How to Build a Winning Pitch Deck
Amazon Web Services
 
Building a web application without servers
Building a web application without serversBuilding a web application without servers
Building a web application without servers
Amazon Web Services
 
Fundraising Essentials
Fundraising EssentialsFundraising Essentials
Fundraising Essentials
Amazon Web Services
 
AWS_HK_StartupDay_Building Interactive websites while automating for efficien...
AWS_HK_StartupDay_Building Interactive websites while automating for efficien...AWS_HK_StartupDay_Building Interactive websites while automating for efficien...
AWS_HK_StartupDay_Building Interactive websites while automating for efficien...
Amazon Web Services
 
Introduzione a Amazon Elastic Container Service
Introduzione a Amazon Elastic Container ServiceIntroduzione a Amazon Elastic Container Service
Introduzione a Amazon Elastic Container Service
Amazon Web Services
 
Come costruire un'architettura Serverless nel Cloud AWS
Come costruire un'architettura Serverless nel Cloud AWSCome costruire un'architettura Serverless nel Cloud AWS
Come costruire un'architettura Serverless nel Cloud AWS
Amazon Web Services
 

More from Amazon Web Services (20)

Come costruire servizi di Forecasting sfruttando algoritmi di ML e deep learn...
Come costruire servizi di Forecasting sfruttando algoritmi di ML e deep learn...Come costruire servizi di Forecasting sfruttando algoritmi di ML e deep learn...
Come costruire servizi di Forecasting sfruttando algoritmi di ML e deep learn...
 
Big Data per le Startup: come creare applicazioni Big Data in modalità Server...
Big Data per le Startup: come creare applicazioni Big Data in modalità Server...Big Data per le Startup: come creare applicazioni Big Data in modalità Server...
Big Data per le Startup: come creare applicazioni Big Data in modalità Server...
 
Esegui pod serverless con Amazon EKS e AWS Fargate
Esegui pod serverless con Amazon EKS e AWS FargateEsegui pod serverless con Amazon EKS e AWS Fargate
Esegui pod serverless con Amazon EKS e AWS Fargate
 
Come spendere fino al 90% in meno con i container e le istanze spot
Come spendere fino al 90% in meno con i container e le istanze spot Come spendere fino al 90% in meno con i container e le istanze spot
Come spendere fino al 90% in meno con i container e le istanze spot
 
Open banking as a service
Open banking as a serviceOpen banking as a service
Open banking as a service
 
Rendi unica l’offerta della tua startup sul mercato con i servizi Machine Lea...
Rendi unica l’offerta della tua startup sul mercato con i servizi Machine Lea...Rendi unica l’offerta della tua startup sul mercato con i servizi Machine Lea...
Rendi unica l’offerta della tua startup sul mercato con i servizi Machine Lea...
 
OpsWorks Configuration Management: automatizza la gestione e i deployment del...
OpsWorks Configuration Management: automatizza la gestione e i deployment del...OpsWorks Configuration Management: automatizza la gestione e i deployment del...
OpsWorks Configuration Management: automatizza la gestione e i deployment del...
 
Microsoft Active Directory su AWS per supportare i tuoi Windows Workloads
Microsoft Active Directory su AWS per supportare i tuoi Windows WorkloadsMicrosoft Active Directory su AWS per supportare i tuoi Windows Workloads
Microsoft Active Directory su AWS per supportare i tuoi Windows Workloads
 
Computer Vision con AWS
Computer Vision con AWSComputer Vision con AWS
Computer Vision con AWS
 
Database Oracle e VMware Cloud on AWS i miti da sfatare
Database Oracle e VMware Cloud on AWS i miti da sfatareDatabase Oracle e VMware Cloud on AWS i miti da sfatare
Database Oracle e VMware Cloud on AWS i miti da sfatare
 
Crea la tua prima serverless ledger-based app con QLDB e NodeJS
Crea la tua prima serverless ledger-based app con QLDB e NodeJSCrea la tua prima serverless ledger-based app con QLDB e NodeJS
Crea la tua prima serverless ledger-based app con QLDB e NodeJS
 
API moderne real-time per applicazioni mobili e web
API moderne real-time per applicazioni mobili e webAPI moderne real-time per applicazioni mobili e web
API moderne real-time per applicazioni mobili e web
 
Database Oracle e VMware Cloud™ on AWS: i miti da sfatare
Database Oracle e VMware Cloud™ on AWS: i miti da sfatareDatabase Oracle e VMware Cloud™ on AWS: i miti da sfatare
Database Oracle e VMware Cloud™ on AWS: i miti da sfatare
 
Tools for building your MVP on AWS
Tools for building your MVP on AWSTools for building your MVP on AWS
Tools for building your MVP on AWS
 
How to Build a Winning Pitch Deck
How to Build a Winning Pitch DeckHow to Build a Winning Pitch Deck
How to Build a Winning Pitch Deck
 
Building a web application without servers
Building a web application without serversBuilding a web application without servers
Building a web application without servers
 
Fundraising Essentials
Fundraising EssentialsFundraising Essentials
Fundraising Essentials
 
AWS_HK_StartupDay_Building Interactive websites while automating for efficien...
AWS_HK_StartupDay_Building Interactive websites while automating for efficien...AWS_HK_StartupDay_Building Interactive websites while automating for efficien...
AWS_HK_StartupDay_Building Interactive websites while automating for efficien...
 
Introduzione a Amazon Elastic Container Service
Introduzione a Amazon Elastic Container ServiceIntroduzione a Amazon Elastic Container Service
Introduzione a Amazon Elastic Container Service
 
Come costruire un'architettura Serverless nel Cloud AWS
Come costruire un'architettura Serverless nel Cloud AWSCome costruire un'architettura Serverless nel Cloud AWS
Come costruire un'architettura Serverless nel Cloud AWS
 

AWSome Day Online 2020_Module 4: Secure your cloud applications

  • 1. © 2020, Amazon Web Services, Inc. or its affiliates. All rights reserved. Module 4: Secure your cloud applications Navjot Singh Technical Trainer AWS
  • 2. © 2020, Amazon Web Services, Inc. or its affiliates. All rights reserved.
  • 3. © 2020, Amazon Web Services, Inc. or its affiliates. All rights reserved. Security is our top priority Designed for security Constantly monitored Highly automated Highly available Highly accredited
  • 4. © 2020, Amazon Web Services, Inc. or its affiliates. All rights reserved. Security of the cloud • Hosts, network, software, facilities • Protection of the AWS global infrastructure is top priority • Availability of third-party audit reports Foundation services Compute Storage Database Network AWS global infrastructure RegionsAvailability zones Edge locations AWS
  • 5. © 2020, Amazon Web Services, Inc. or its affiliates. All rights reserved. Security in the cloud Considerations • What you should store • Which AWS services you should use • Which region to store in • In what content format and structure • Who has access Client-side data encryption & Data integrity authentication Platform, applications, identity & access management Operating system, network & firewall configuration Customer data Customer Server-side encryption (File system and/or data) Network traffic protection (Encryption/integrity/identity)
  • 6. © 2020, Amazon Web Services, Inc. or its affiliates. All rights reserved. AWS shared responsibility model Client-side data encryption & Data integrity authentication Platform, applications, identity & access management Operating system, network & firewall configuration Customer data Customer Server-side encryption (File system and/or data) Network traffic protection (Encryption/integrity/identity) Foundation services Compute Storage Database Network AWS global infrastructure RegionsAvailability zones Edge locations AWS
  • 7. © 2020, Amazon Web Services, Inc. or its affiliates. All rights reserved. Security, identity, and compliance products AWS Artifact AWS Certificate Manager Amazon Cloud Directory AWS CloudHSM Amazon Cognito AWS Directory Service AWS Firewall Manager Amazon GuardDuty AWS Identity and Access Management Amazon Inspector AWS Key Management Service Amazon Macie AWS Organizations AWS Shield AWS Secrets Manager AWS Single Sign-On AWS WAF AWS Artifact AWS Certificate Manager Amazon Cloud Directory AWS CloudHSM Amazon Cognito AWS Directory Service AWS Firewall Manager Amazon GuardDuty AWS Identity and Access Management Amazon Inspector AWS Key Management Service Amazon Macie AWS Organizations AWS Shield AWS Secrets Manager AWS Single Sign-On AWS WAF
  • 8. © 2020, Amazon Web Services, Inc. or its affiliates. All rights reserved. Manage authentication and authorization
  • 9. © 2020, Amazon Web Services, Inc. or its affiliates. All rights reserved. AWS Identity and Access Management (IAM) Temporary privileges that an entity can assume GROUP ROLEIAM USER Collection of users with identical permissions A person or application that interacts with AWS Securely control access to AWS resources
  • 10. © 2020, Amazon Web Services, Inc. or its affiliates. All rights reserved. Authentication: Who are you? $ aws IAM GROUPIAM USER IAM AWS CLI AWS SDKS AWS Management Console
  • 11. © 2020, Amazon Web Services, Inc. or its affiliates. All rights reserved. Authorization: What can you do? IAM policies Full access Read only $ aws AWS CLI Amazon S3 BucketIAM USER, GROUP OR ROLE
  • 12. © 2020, Amazon Web Services, Inc. or its affiliates. All rights reserved. IAM roles • IAM users, applications, and services may assume IAM roles • Roles uses an IAM policy for permissionsIAM ROLE
  • 13. © 2020, Amazon Web Services, Inc. or its affiliates. All rights reserved. Using roles for temporary security credentials EC2 instance Application Amazon S3 bucket
  • 14. © 2020, Amazon Web Services, Inc. or its affiliates. All rights reserved. Using roles for temporary security credentials EC2 instance Application Amazon S3 bucket
  • 15. © 2020, Amazon Web Services, Inc. or its affiliates. All rights reserved. Using roles for temporary security credentials EC2 instance Application Amazon S3 bucket IAM Role IAM Policy
  • 16. © 2020, Amazon Web Services, Inc. or its affiliates. All rights reserved. Using roles for temporary security credentials EC2 instance Application Amazon S3 bucket Assume IAM Role IAM Policy
  • 17. © 2020, Amazon Web Services, Inc. or its affiliates. All rights reserved. Using roles for temporary security credentials EC2 instance Application Amazon S3 bucket Assume IAM Role IAM Policy
  • 18. © 2020, Amazon Web Services, Inc. or its affiliates. All rights reserved.
  • 19. © 2020, Amazon Web Services, Inc. or its affiliates. All rights reserved. Best practices • Delete access keys for the AWS account root user • Activate multi-factor authentication (MFA) • Only give IAM users permissions they need • Use roles for applications • Rotate credentials regularly • Remove unnecessary users and credentials • Monitor activity in your AWS account
  • 20. © 2020, Amazon Web Services, Inc. or its affiliates. All rights reserved. Access your security and compliance
  • 21. © 2020, Amazon Web Services, Inc. or its affiliates. All rights reserved. Challenges of threat assessment • Expensive • Complex • Time-consuming • Difficult to track IT changes
  • 22. © 2020, Amazon Web Services, Inc. or its affiliates. All rights reserved. What is Amazon Inspector? Automated security assessment as a service • Assesses applications for vulnerabilities • Produces a detailed list of security findings • Leverages security best practices
  • 23. © 2020, Amazon Web Services, Inc. or its affiliates. All rights reserved. Amazon Inspector findings
  • 24. © 2020, Amazon Web Services, Inc. or its affiliates. All rights reserved. Remediation recommendation
  • 25. © 2020, Amazon Web Services, Inc. or its affiliates. All rights reserved. Protect your infrastructure from Distributed Denial of Service (DDoS) attacks
  • 26. © 2020, Amazon Web Services, Inc. or its affiliates. All rights reserved. What is DDoS? DDoS DDoSDDoS
  • 27. © 2020, Amazon Web Services, Inc. or its affiliates. All rights reserved. DDoS mitigation challenges Manual Degraded performance Limited bandwidth Involves rearchitecting Time- consuming Expensive Complex
  • 28. © 2020, Amazon Web Services, Inc. or its affiliates. All rights reserved. What is AWS Shield? • A managed DDoS protection service • Always-on detection and mitigations • Seamless integration and deployment • Cost-efficient and customizable protection DDoS DDoSDDoS
  • 29. © 2020, Amazon Web Services, Inc. or its affiliates. All rights reserved. AWS Shield Standard and AWS Shield Advanced AWS Shield Standard (Included) • Quick detection • Inline attack mitigation AWS Shield Advanced (Optional) • Enhanced detection • Advanced attack mitigation • Visibility and attack notification • DDoS cost protection • Specialized support
  • 30. © 2020, Amazon Web Services, Inc. or its affiliates. All rights reserved. AWS security compliance
  • 31. © 2020, Amazon Web Services, Inc. or its affiliates. All rights reserved. Assurance programs
  • 32. © 2020, Amazon Web Services, Inc. or its affiliates. All rights reserved. How AWS helps customers achieve compliance Sharing information • Industry certifications • Security and control practices • Compliance reports directly under NDA Assurance program • Certifications/attestations • Laws, regulations, and privacy • Alignments/frameworks
  • 33. © 2020, Amazon Web Services, Inc. or its affiliates. All rights reserved.
  • 34. © 2020, Amazon Web Services, Inc. or its affiliates. All rights reserved. Customer responsibility Review – Design – Identify – Verify
  • 35. © 2020, Amazon Web Services, Inc. or its affiliates. All rights reserved.