The document outlines the implementation of a highly secure and compliant omnichannel payment platform on AWS, achieved through strategic decision-making and adherence to PCI-DSS standards. Key learnings emphasize the importance of collaboration, continuous adaptation, incremental project management, and team care. The successful integration enhances security through various AWS services while improving compliance metrics significantly.

1. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Building Highly Sophisticated
Environments for Security and
Compliance on AWS
September 2018 Boyan Dimitrov
Director Platform Engineering
Sixt
@nathariel

3. Q1 2018: Brand New Omnichannel Payment Platform

4. Early 2017
Redesign our payment
channels
Adapt business
processes
Communicate to
partners and third
parties
Plan & Coordinate
Teams
Early 2017
Payment
Environment

5. Early 2017Requirements
In Production in
8 months
Integrated to
our business
Highly
Secure
Scalable Modular PCI-DSS
Compliant

6. What is PCI-DSS Compliance
• Standard for cardholder data
environments composed of security
best practices and controls.
• It’s all about maintaining a secure
environment
• If you are handling credit card data –
this applies to you too!

7. Build and Maintain a Secure Network
1. Install and maintain a firewall configuration to protect cardholder data
2. Do not use vendor-supplied defaults for system passwords and other
security parameters
Protect Cardholder Data
3. Protect stored cardholder data
4. Encrypt transmission of cardholder data across open, public networks
Maintain a Vulnerability Management
Program
5. Use and regularly update anti-virus software or programs
6. Develop and maintain secure systems and applications
Implement Strong Access Control
Measures
7. Restrict access to cardholder data by business need to know
8. Assign a unique ID to each person with computer access
9. Restrict physical access to cardholder data
Regularly Monitor and Test Networks
10. Track and monitor all access to network resources and cardholder data
11. Regularly test security systems and processes
Maintain an Information Security Policy 12. Maintain a policy that addresses information security for all personnel
PCI Goals and Requirements

8. Early 2017Decision to be made
Build On The Cloud
Build in our DCs
Outsource to third party

9. Security in the Cloud is a Shared Responsibility
https://aws.amazon.com/compliance/shared-responsibility-model/

10. Build and Maintain a Secure Network
Protect Cardholder Data
Maintain a Vulnerability Management
Program
Implement Strong Access Control
Measures
Regularly Monitor and Test Networks
Maintain an Information Security
Policy
PCI Requirements mapped to AWS Services
VPC Security Group Amazon EC2 Cloudformation
S3 EBS CloudHSM KMSRDS Security Group ELB VPN
WAF CloudFront
Cognito Directory ServiceIAM
S3Cloudtrail
Inspector
Config
Lambda
Lambda
Lambda
Lambda

11. AWS services in scope by PCI-DSS compliance
of all services
are PCI-
Compliant
> 55%
47,6%
Increase from
prev. year
26
In 2016
62
In 2018
42
In 2017

12. Early 2017Our Decision
Build On The Cloud
Build in our DCs
Outsource to third party

13. Outcome
Learning 1: Bring the right people together early on

14. Execution Strategy: Learnings from the past
https://en.wikipedia.org/wiki/OODA_loop#/media/File:OODA.Boyd.svg
Patrick Edwin Moran

15. OODA in an AWS security context
Observe Orient Decide ACT
VPC
Flow Logs
Inspector Agent
CloudWatch
Insights
CloudTrail Config
More
CloudWatch
Inspector
Lambda
Shield
ShieldShieldWAF
Machine
Learning
Config
Policies
Config
Policies
CloudWatchWAF
WAF
SNS
Lambda
Lambda
More MoreMore
Guard Duty

16. VPC
Flow Logs
CloudWatch
Insights
CloudTrail Config
CloudWatch
Config
Policies
Protected Accounts Security Account
Trails
Logs
Observe…

17. Orient, Decide, Act!
CloudWatch
Logs / Events
S3
SIEM
Config
Policies
Protectedaccounts
Lambda
Trails
Logs
SNS
Security
Team
Security Account
OPS
Active
Scans
Corrective
Actions

18. The Controlling Core
CloudWatch
Logs / Events
S3
SIEM
Config
Policies
Protectedaccounts
Active
Scans
Lambda
SNS
Security
Team
Security Account
Corrective
Actions
OPS
Trails
Logs

19. Learning 2: Have a strategy

20. Changes had to be made on the way
ECSLambda

21. Learning 3: Break down large projects into small iterations

22. End to end automation
Engineers CodePipeline CodeBuild ECR ECS
Deployment
Approval
Code Review
Code
Minutes

23. Learning 4: Know and leverage the ecosystem

24. Learning 5: Take care of your team

25. Summary
1. Bring the right people together early on
2. Have a strategy
3. Break down large projects into small iterations
4. Know and leverage the ecosystem
5. Take care of your team

26. Thank You