How Inovalon Uses Sophos to Control Security Costs on AWS

© 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Scott Ward, Solutions Architect
April 26, 2018
How Inovalon Controls
Security Costs with Sophos on
AWS

Why is security traditionally so hard?
Lack of
visibility
Low degree
of automation

The most sensitive workloads run on AWS
“With AWS, DNAnexus enables enterprises worldwide to perform genomic analysis
and clinical studies in a secure and compliant environment at a scale not
previously possible.”
— Richard Daly, CEO DNAnexus
“We determined that security in AWS is superior to our on-premises data center
across several dimensions, including patching,
encryption, auditing and logging, entitlements, and compliance.”
—John Brady, CISO, FINRA (Financial Industry Regulatory Authority)
“The fact that we can rely on the AWS security posture to boost our own security
is really important for our business. AWS does a much better job at security than
we could ever do running a cage in a data center.”
— Richard Crowley, Director of Operations, Slack

“CIOs and CISOs need to stop obsessing over
unsubstantiated cloud security worries, and
instead apply their imagination and energy to
developing new approaches to cloud control,
allowing them to securely, compliantly, and
reliably leverage the benefits of this increasingly
ubiquitous computing model.”
Source: Clouds Are Secure: Are You Using Them Securely?

Automate
with deeply
integrated
security services
Inherit
global
security and
compliance
controls
Highest
standards
for privacy
and data
security
Largest
network
of security
partners and
solutions
Scale with superior
visibility and
control
Move to AWS to strengthen your security posture

Inherit global security and compliance controls

Scale with visibility and control

Encryption at scale
with keys managed by
our AWS Key Management
Service (KMS) or managing
your own encryption keys
with Cloud HSM using
FIPS validated
cryptography systems
Meet data
residency requirements
Choose an AWS Region
and AWS will not replicate it
elsewhere unless you
choose to do so
Access services and tools
that enable you to
build compliant
infrastructure
on top of AWS
Comply with local
data privacy laws
by controlling who
can access content, its
lifecycle, and disposal
Highest standards for privacy

Bill Prout, Security Architect Manager,
April 26, 2018
Properly securing complex
cloud environments with
Sophos Unified Threat
Management (UTM)

The AWS Shared Responsibility Model

Common customer requirements
Web Application
Firewall
Intrusion Prevention
System
Virtual Private
Network
Next-Gen Firewall Outbound Traffic
Protection

Introduction to Sophos
 Recognized leader in Endpoint Protection,
Mobile Data Protection, and Unified Threat
Management.
 Long history of helping customer secure their
applications, data, endpoints, and networks—
both on-premises and more recently in the
cloud.
 Our solutions help secure more than 200,000
customers in over 150 countries.
 Customers like Xerox, Under Armour, Pixar,
Northrop Grumman, Ford, Avis, and Amazon.
 AWS Security Competency Partner

Achieving defense-in-depth and controlling
costs with Sophos UTM
To achieve defense-in-depth, AWS recommends layered security.
Sophos UTM provides layered security in a single solution, driving
down costs.
Infrastructure
Protection
Intrusion Prevention
System (IPS)
Web Application
Firewall (WAF)
Sandstorm Protection
(ATP and Cloud
Sandboxing)

Sophos UTM gives you flexibility along
your cloud journey
For most organizations, cloud adoption happens incrementally, and
their security needs get more robust over time.
Start with free trial, then
standalone UTM
Move to High Availability or
Auto Scaling when needed
Use Sophos UTM Conversion
to automatically modify your
architecture

Sophos UTM on AWS integrations
Amazon Elastic
Load Balancing
AWS
CloudFormation
Amazon S3 Auto Scaling
 High Availability (HA) and redundancy
supporting multiple Availability Zones (AZ)
 Auto Scaling WAF that automatically scales to
inspect all web traffic
 Built-in load balancer support for ELB and site-
to-site VPN configuration for VPC
 CloudFormation templates that automatically
deploy and configure Sophos UTM
 Automated outbound route table updates to
ensure continuous traffic flow
Sophos UTM is integrated with AWS services to make
deployment and management easy

Sophos UTM deployment and pricing
 Deploy directly from AWS
Marketplace
 Evaluate under free trial
 Easy pay-as-you-go pricing
 Leverage an existing investment
with bring-your-own-license (BYOL)
option

Sophos UTM - High Availability
10.10.0.0/16
Internet Gateway
Availability Zone #1
Private Client Subnet
10.10.100.0/24
Primary UTM
10.10.1.0/24
Availability Zone Failover
UTM Deployment
CloudFormation
Launches UTMs and
associated AWS services
Auto Scaling
Group
Auto Scaling
Launches and maintains
UTM AutoScaling groups
CloudWatch
Monitors UTM Health
and collects logs
S3
Stores UTM Controller
license, logs, and
configuration
EIP
10.10.2.0/24
Backup UTM

Sophos UTM - Auto Scaling
Internet Gateway
UTM WorkersUTM Controller
Active/Active Auto Scaling UTM
CloudFormation
Launches UTMs and
Auto Scaling Group
Auto Scaling
CloudWatch
Monitors UTM Health
and collects logs
S3
license, logs, and
configuration
UTM Workers
Admin
(Controller -> Workers)
Syslog
(Controller <- Workers)
External ELB
Internal ELB

Frank Scalzo, Director of Cloud Technologies & Engineering at Avalere Health/
Inovalon
April 26, 2018
How Inovalon is more agile
and secure with Sophos on
AWS

About Inovalon
 Leading provider of cloud-based healthcare platforms
 Enable organizations to make data-driven
transformation and better serve their patients
 Technology supports nearly:
 500 healthcare organizations
 932,000 physicians
 455,000 clinical facilities
 240 million Americans

Why Inovalon moved to the cloud
Agility to deploy hinged on delivering against tight timelines, and procuring
hardware was translating to lost time and productivity as well as large
procurement costs to meet over architecting an environment
Legacy security products are very expensive and cumbersome to manage
Commercial Cloud Engineering Team consisted of only 6 people
The ability to segregate products and departments within AWS with a
multi account strategy allowed for better cost governance over each
product but still allowing for central management and granular security

Syslog sends all
logging information
from Workers to
Controller
UTM on AWS Multi VPC

The considerations
 Storage and compute
infrastructure
 Consolidating security
tools
 Maturity of service
offerings
 Ability to provision and
configure resources
quickly
 HIPAA compliance
 Minimizing security
management overhead
 Automation and
centralized control
 Customer support
Functionality Security Management Cost

The choice: Deploying Sophos UTM on AWS
 Chose AWS for maturity, cost, and operational simplicity
 Met all security needs at a fraction of the costs
 Worked with Sophos Partner to negotiate fixed Enterprise Agreement,
minimizing license costs
 Started with single UTMs and NAT rules for inbound traffic protection
 Converted to UTM Auto Scaling with Web Server Protection WAF to
better align with AWS Best Practices
 Added Intrusion Prevention and Advanced Threat Protection
 Were able to modify default UTM Auto Scaling template to
accommodate need for multi-account/VPC solution

The Benefits
Reduced security costs by
40% over comparable
security products
Centralized management
has led to 20% reduction
in security operations
labor costs
In-box logging and
monitoring is tightly
integrated with SIEM,
Can meet customer
demands and get to market
in a matter of hours, with
the flexibility to scale up or
down at any time

Looking forward– protecting Amazon Workspaces
with Outbound Gateway
Internet Gateway
Workspaces Client
Subnet
UTM WorkersUTM Controller
Auto Scaling UTM with OGW
CloudFormation
Launches UTMs and
Auto Scaling
CloudWatch
Monitors UTM Health
and collects logs
S3
license, logs, and
configuration
UTM Workers
Admin
(Controller -> Workers)
Syslog
(Controller <- Workers)
External ELB
Internal ELB
OGW
Can be setup as
Active/Active or
Active/Passive OGW Subnet
Private Client
Subnet
Auto Scaling Group
GRE
Tunnel
IEP
Auto Scaling Group GRE Tunnel

© 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.© 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Scott Ward, Solutions Architect, AWS
Bill Prout, Security Architect, Sophos
Frank Scalzo, Director, Cloud Technologies & Engineering, Inovalon
Thank you
Questions & Answers

How Inovalon Uses Sophos to Control Security Costs on AWS

Recommended

Recommended

More Related Content

What's hot

What's hot (20)

Similar to How Inovalon Uses Sophos to Control Security Costs on AWS

Similar to How Inovalon Uses Sophos to Control Security Costs on AWS (20)

More from Amazon Web Services

More from Amazon Web Services (20)

How Inovalon Uses Sophos to Control Security Costs on AWS