This is a story about how PageUp bounced back from a recent security incident with a ‘Castles in Castles’ approach to further protect their customers - Multi Account Cloud architecture, automated security baselines, design of sensible guard rails, and provisioning of platform capabilities at scale across product development without creating any bottlenecks.

1. S U M M I T
SYDNEY

2. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Castles in Castles
Tom LeGrice
ISV SaaS Lead
Amazon Web Services

3. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
The PageUp SaaS journey
PageUp
Moves into
AWS
Leverages
higher order
AWS services
inc. containers,
APIs
Begins to
explore
Serverless,
AI/ ML
Connecting 100 million people to their careers
PageUp
established
Graduate
recruitment
module
success
Iconic
Australian
brands, all
recruitment
types
Global users
5 continents
UK
operations
Unified talent management
• Recruitment
• Onboarding
• Contractor
• Learning
• Performance
• Compensation
• Succession
• Analytics
• Marketplace
Growth equality
SEA & OS
market entry
1997 2000 2004 2008 2012 2014 2016 2018

4. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Introduction to PageUp

5. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T

6. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Connect people
to great careers
Karthik Padmanabhan
Senior Technical Advisor

7. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
PageUp product development - context
Clients Culture Technology

8. S U M M I T © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.

9. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
PageUp security
Previous state

10. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
PageUp security
Previous state:
• WAF, Network segregations
• AWS Guard Duty
• Anti-malware server protection
Additionally:
• Password salting and hashing
• Encryption in transit and rest
• Segregation of network traffic

11. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Incident

12. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Containment and remediation

13. S U M M I T © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.

14. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Operational evaluation

15. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Program of work - key highlights
Isolation of
assets
Continuously
improving
security

16. S U M M I T © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.

17. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Isolation of assets

18. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Isolation of assets

19. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Castles within a castle

20. S U M M I T © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.

21. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Enabling continuous improvement

22. S U M M I T © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.

23. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Isolation options
Security groups
and subnets
VPC Multi-account
strategy

24. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Multi-account strategy
100+ isolations needed!
20+ Domains and
capabilities to be
isolated
Across 5
regions

25. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Multi-account strategy - limitations
Awesome! However, how do we:
• Provision and maintain 100+ accounts at scale?
• Continuously improve our security posture across accounts?

26. S U M M I T © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.

27. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
CD - Security guardrails as code

28. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Automated security guardrails
• VPC guard rails
• Cloud Trail and VPC flow logs
• Guard Duty reporting
• NAT whitelisting
• Prevention of user creation

29. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
AWS Account Vending Machine

30. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
PageUp Domain Vending Machine
Domains:
- Name: careers
OrgUnit: functional
Cidr: 10.x.x.x
VpcOption: 3-Tier-3-AZ-Public-Private-Private-VPC
DomainStackPolicies:
- Name: careers-https-stack-policy
PolicyFile: /policies/careers-deploy-policy.json

31. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
PageUp Landing Zone - Learnings
Advantages
• Scale and continuous delivery
• Infrastructure as Code
• Security guardrails as code
• Codifying architectural
decisions
Challenges
• Complex machine
• Upgrade path

32. S U M M I T © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.

33. S U M M I T © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.

34. S U M M I T © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
“Cyber attacks: It’s not a matter of if but when.”
Matthew Clarke
Insurance & Risk Professional Magazine,
June/July 2014

35. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
What has changed since?
automation services

36. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
The Future
Launch of PageUp Express
Visionary by Gartner for Talent
Management in 2018
JB-HIFI & The Good Guys as
new customers

37. Thank you!
S U M M I T © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Karthik Padmanabhan
@humblelistener