CSS17: Dallas - The AWS Shared Responsibility Model in Practice
•Download as PPTX, PDF•
1 like•224 views
Presentation from Amazon Web Services AWS Solutions Architect, Larry Gilreath at the Cloud Security Summit in Dallas, Texas on May 31, 2017.
Recommended
Recommended
More Related Content
What's hot
What's hot (20)
Similar to CSS17: Dallas - The AWS Shared Responsibility Model in Practice
Similar to CSS17: Dallas - The AWS Shared Responsibility Model in Practice (20)
More from Alert Logic
More from Alert Logic (20)
Recently uploaded
Recently uploaded (20)
CSS17: Dallas - The AWS Shared Responsibility Model in Practice
- 1. The AWS Shared Responsibility Model in practice
- 2. © 2016, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Agenda • Define the Shared Responsibility Model • AWS Controls that You Don’t Need to Worry About • Framework to Help You Adapt the Cloud Faster • AWS Services that You Should be Using • Reference Architectures that You Can Use
- 3. © 2016, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Agenda
- 4. © 2016, Amazon Web Services, Inc. or its Affiliates. All rights reserved. AWS Security Controls
- 5. © 2016, Amazon Web Services, Inc. or its Affiliates. All rights reserved. AWS Security Controls 2,500+
- 6. I wish I was a Solid State Drive in someone else’s Datacenter…
- 7. © 2016, Amazon Web Services, Inc. or its Affiliates. All rights reserved. AWS Security Controls
- 9. © 2016, Amazon Web Services, Inc. or its Affiliates. All rights reserved. AWS Security Controls AWS Foundation Services Compute Storage Database Networking AWS Global Infrastructure Regions Availability Zones Edge Locations Your own accreditation Your own certifications Your own external auditsCustomerAWS Customer scope and effort is reduced Better results through focused efforts Built on AWS consistent baseline controls
- 10. © 2016, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Scaling to >1 Million Users RDS DB Instance Active (Multi-AZ) Availability Zone ELB Balancer RDS DB Instance Read Replica RDS DB Instance Read Replica Web Instance Web Instance Web Instance Web Instance Amazon Route 53 User Amazon S3 Amazon CloudFront DynamoDB Amazon SQS ElastiCache Worker Instance Worker Instance Amazon CloudWatch Internal App Instance Internal App Instance Amazon SES Lambda
- 11. © 2016, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Security Already Built In… Security groups are virtual firewalls that control the traffic for one or more resources AWS IAM securely controls access to AWS services and resources for your users.
- 12. © 2016, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Security Already Built In…
- 13. © 2016, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Identity and Access Management AWS Organizations AWS IAM AWS Security Token Service
- 14. © 2016, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Detective Controls AWS CloudTrail Amazon CloudWatch AWS Config Amazon Inspector VPC Flow Logs Account Resources Network
- 15. © 2016, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Infrastructure Security AWS OpsWorks AWS Shield AWS WAF Resources Network AWS Trusted Advisor AWS Config Rules
- 16. © 2016, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Infrastructure Security – AWS Config Rules • Amazon CloudTrail should be enabled… • Is it? • All EBS volumes encrypted… • Are they? • All security groups in attached state should not have unrestricted access to port 22. • Do they?
- 17. © 2016, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Infrastructure Security – AWS Config Rules • Codify and automate your own practices • Get started with samples in AWS Lambda • Implement guidelines for security best practices and compliance • Use rules from various AWS Partners • View compliance in one dashboard
- 18. © 2016, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Data Protection AWS CloudHSM AWS Key Management Service AWS Certificate Manager
- 19. © 2016, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Data Protection - Encryption Encryption In-Transit SSL/TLS VPN / IPSEC SSH Encryption At-Rest Object Database Filesystem Disk
- 20. © 2016, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Data Protection – AWS Certificate Manager • AWS Certificate Manager (AWS ACM) is a service that lets you easily provision, manage, and deploy TLS certificates for use with Amazon Elastic Load Balancer or Amazon CloudFront distribution. • No additional charge for provisioning TLS certificates • Manages the renewal process of TLS certificates • Certificates are verified by Amazon’s certificate authority (CA), Amazon Trust Services (ATS)
- 21. © 2016, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Data Protection – AWS Certificate Manager
- 22. © 2016, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Data Protection – AWS KMS Data key 1 S3 object EBS volume Amazon Redshift cluster Data key 2 Data key 3 Data key 4 Custom application Customer Master Keys
- 23. © 2016, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Incident Response Amazon CloudWatch Amazon Lambda
- 24. © 2016, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Incident Response – AWS CloudWatch Events
- 25. © 2016, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Incident Response – AWS CloudWatch Events
- 26. © 2016, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Incident Response – AWS CloudWatch Events
- 27. © 2016, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Incident Response – AWS CloudWatch Events
- 28. © 2016, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Incident Response – AWS CloudWatch Events
- 29. © 2016, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Incident Response – AWS CloudWatch Events
- 30. © 2016, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Incident Response – Amazon SNS Notification
- 31. © 2016, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Incident Response – Complete
- 32. © 2016, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Scaling to >1 Million Users RDS DB Instance Active (Multi-AZ) Availability Zone ELB Balancer RDS DB Instance Read Replica RDS DB Instance Read Replica Web Instance Web Instance Web Instance Web Instance Amazon Route 53 User Amazon S3 Amazon CloudFront DynamoDB Amazon SQS ElastiCache Worker Instance Worker Instance Amazon CloudWatch Internal App Instance Internal App Instance Amazon SES Lambda
- 33. © 2016, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Scaling to >1 Million Users RDS DB Instance Active (Multi-AZ) Availability Zone ELB Balancer RDS DB Instance Read Replica RDS DB Instance Read Replica Web Instance Web Instance Web Instance Web Instance Amazon Route 53 User Amazon S3 Amazon CloudFront DynamoDB Amazon SQS ElastiCache Worker Instance Worker Instance Amazon CloudWatch Internal App Instance Internal App Instance Amazon SES Lambda AWS WAF AWS Shield AWS Organizations AWS CloudTrail AWS Config VPC Flow Logs Amazon Inspector AWS OpsWorks
- 34. © 2016, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Deploy Faster Wherever You Like 16 Regions – 42 Availability Zones – 68 Edge Locations Region & Number of Availability Zones AWS GovCloud (2) EU Ireland (3) US West Frankfurt (2) Oregon (3) London (2) Northern California (3) Asia Pacific US East Singapore (2) N. Virginia (5), Ohio (3) Sydney (2), Tokyo (3), Seoul (2), Mumbai (2) Canada Central (2) China Beijing (2) South America São Paulo (3)
- 35. © 2016, Amazon Web Services, Inc. or its Affiliates. All rights reserved. AWS Marketplace Security Partners Infrastructure Security Logging & Monitoring Identity & Access Control Configuration & Vulnerability Analysis Data Protection
- 36. © 2016, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Summary • AWS Security Benefits: • Integrated Security & Compliance • Global Resilience, Visibility, & Control • Maintain Your Privacy and Data Ownership • Agility Through Security Automation • Security Innovation at Scale • Broad Security Partner & Marketplace Solutions
- 37. © 2016, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Questions?
Editor's Notes
- Seriously… this is all about helping YOU make smarter decisions when adopting AWS and removing speedbumps from your adoption path.
- AWS has over 1,800 security and compliance controls that we continually monitor and validate for you!
- [picture of a shredded hard drive] We have a set of very clear rules, they're implement across our data centers, on how to dispose things like harddrives. Going back to a lot of Amazon design philosophy, simplicity is one of the most important precursors for success in implementing controls. Controls are complicated, people get confused and make mistakes. So what we have done with our data centers is make a rule that says no hard drive shall leave our facilities intact.
- You benefit from an environment built for the most security sensitive organizations You get to define the right security controls for your workload sensitivity You always have full ownership and control of your data
- AWS Organizations allows for policy-based management for multiple AWS accounts AWS IAM securely controls access to AWS services and resources for your users. AWS STS allows you to federate your existing identity provider with AWS IAM.
- AWS CloudTrail tracks user activity and API usage AWS Config allows you to view AWS resource inventory and configuration history and drive change notifications Amazon CloudWatch provides monitoring for AWS cloud resources and the applications you run on AWS. Amazon Inspector is an automated security assessment service to help improve the security and compliance of applications. VPC Flow logs capture information about the IP traffic going to and from network interfaces in your VPC.
- Concentrate on what AWS Shield and WAF provide to our customers AWS Shield is a DDoS protection service that safeguards web applications running on AWS – Standard is no additional cost AWS WAF protects your web applications from common web exploits AWS Trusted Advisor provides real time guidance to help you provision your resources following AWS best practices. AWS Config Rules enables you to create rules that automatically check the configuration of AWS resources recorded by AWS Config. AWS OpsWorks automates how servers are configured, deployed, and managed.
- AWS CloudHSM is a dedicated HSM to meet corporate, contractual and regulatory compliance requirements AWS KMS is an AWS managed service that allows you to easily create and manage keys to encrypt your data AWS CM is a service that lets you easily provision, manage and deploy SSL certs for use with AWS
- Best part… IT IS SUPER EASY!
- You get the flexibility you need in a key management system while also not having to worry about availability and management of the system itself. The CMK never leave AWS’s HSA in clear text, complete integration with AWS IAM and CloudTrail for AuthZ and visibility into the use of the keys. In a mutli-account architecture you can deploy AWS KMS within each of the environments or based upon the data classification within an account. Additionally, you can import your own key material for the CMKs to have even additional control over the keys. Best part… is the cost! Fraction of the cost of dedicated or virtualized appliances.
- Amazon CloudWatch Events delivers a near real-time stream of system events that describe AWS resource changes Amazon Lambda lets you run code without provisioning or managing servers
- Incident Response should NOT just be a manual process! Lets walk through how to quickly respond to someone disabling CloudTrail without ANY human interaction.
- Incident Response should NOT just be a manual process!
- Incident Response should NOT just be a manual process!
- Incident Response should NOT just be a manual process!
- Incident Response should NOT just be a manual process!
- Incident Response should NOT just be a manual process!
- Incident Response should NOT just be a manual process!
- Incident Response should NOT just be a manual process!