Data and IoT are very exciting but also very dangerous, this presentation walk though AWS best practicing for securing the cloud platfrom

1. How to Protect Your
IoT data on AWS
Lahav Savir
Co-founder and CTO
AllCloud

2. A Global Leader in Cloud
Transformation and Adoption for
SaaS, ISV and Enterprises

3. “AWS Managed Service Partners
are skilled at cloud infrastructure
and application migration, and
deliver value to customers by
offering proactive monitoring,
automation, and management of
their customer’s environment.”
https://aws.amazon.com/partners/msp/
http://www.emind.co/msp
AWS Next-Gen (v3) Managed Service Partner (MSP)

4. A “Cloud-native” MSP
Market Guide for Managed Service Providers on Amazon Web Services (Lydia Leong, Oct. 2015)
“Amazon Web Services does not offer
managed services, but many customers want
to use AWS as a cloud IaaS and PaaS platform,
while outsourcing IT operations or application
management. AWS's ecosystem of MSP
partners can fulfill this need.”
https://www.gartner.com/doc/3157620/market-guide-managed-service-providers
“Common Types of MSPs (on AWS) with
Example References
● Cloud-native MSPs. These MSPs were
either founded specifically to provide
services on cloud IaaS, or pivoted to
entirely focus their business on these
services. Many of these MSPs are
AWS-specific. Examples include 2nd
Watch, Cloudnexa, Cloudreach,
Emind and Minjar”

6. 360° Solution for
vending business
● 100s of thousands connected
devices around the world
● GPRS / 3G / Wifi
● Real-Time Data
● PCI-DSS Certified
http://www.emind.co/case-study/nayax-partners-with-emind-to-migr
ate-cashless-service-solutions-to-amazon-cloud/

7. More Than Just A Wireless
Charging Solution.
● 1000s of locations
worldwide
● Driving more traffic to
businesses
● Big-data and real-time
analytics
http://www.emind.co/case-study/powermat-partners-with-emind-to-
fully-manage-their-wireless-charging-services-on-aws/

8. Where there is more data,
there are bound to be more
data breaches!

9. Security
in the
Cloud
Security
of the
Cloud

10. Assessing the Risk:
Yes, the Cloud Can Be
More Secure Than Your
On-Premises Environment
IDC, July 2015

11. Why the Cloud
is more Secure?
● More segmentation
● More encryption
● Stronger
authentication
● More logging and
monitoring
● More managed
platforms

12. Top Topics
● Infrastructure
Security
● Network Security
● Host Security
● Data Encryption
● Identity Management
● Monitoring &
Auditing

13. Identity Federation

14. Why do you
need
Single Identity?
● Multiple AWS
Accounts
● Multiple Security
Policies
● Multiple Entry Points
● Many Resources
● Multiple 3rd Party
Services

15. Single Identity
Provider
● Single Password
Policy
● Single Lock Policy
● Single OTP
● Single Login Audit
● Same username used
across all resources

16. Organization users accessing:
AWS Resources
● AWS Console
● AWS API
● Network Access / VPN
● EC2 Instances
Other Resources
● New Relic
● Datadog
● Pingdom
● Google Apps
● Office 365
● Jira
● Github
● Logz.io
● ...

17. ● Don't mix Corporate
and Cloud Resources
● Minimize Replication
● Maximize Federation

18. Corporate
● Corporate Active Directory
● Mix of users and desktops / servers
● 3rd Party SSO / Federation Services
Cloud
● Cloud Active Directory
● Cloud Resources Only
Integration
● One Way Trust between Corp AD and
Cloud AD

19. Login Scenarios
● AWS Console
○ SAML Federation
● VPN
○ Radius
● Jumpbox on EC2
○ Radius / LDAP
● Windows instance on EC2
○ Kerberos / LDAP
● Linux instance on EC2
○ Kerberos / LDAP
You can avoid the IAM Users

21. Network Access

22. Networking
● Public Internet
● VPN / IPSec
Tunnel
● DirectConnect

23. Direct Connect
Options
● Private Virtual Interface –
Access to VPC
○ Note: VPC Endpoints are
not transitive via VPC
Peering
● Public Virtual Interface –
Access to the region IP
address space (non-VPC
Services)

24. SSL VPN
Options
● OpenVPN
● Fortinet Fortigate
● CheckPoint
● Sophos
● pfSense
● … Others

25. Don’t assume your corporate
network is secure and expose your
production networks to all users

26. Smart Separation

27. Inbound Layer
Application Layer
Outbound Layer

28. ● Create a controlled environment
that minimizes human mistakes
● Inspect inbound and outbound
traffic

29. Host Security

30. What’s Host
Security ?
● OS Hardening
● Anti Virus
● Malware Protection
● Host Based IPS
● File Integrity Monitoring
● Vulnerability Scanning

31. Data Encryption

32. AWS Encryption Options
Data at Rest
● EBS Encryption (inc. root device)
● S3 Client / Server Side Encryption
● RDS / Redshift Storage
Encryption
● DynamoDB Client Side
Encryption
https://d0.awsstatic.com/whitepapers/aws-securing-data
-at-rest-with-encryption.pdf
Data in Transit
● API’s are TLS Encrypted
● Service Endpoints are TLS
Encrypted
● Elastic Load Balancer supports
TLS
● CloudFront supports TLS
● IPSec VPN

33. Encrypt all your data, you never
know who and when someone will
request access to the data

34. Centrally Monitor and Audit

35. Events Sources
● CloudTrail
● ELB / S3 / CloudFront
Access Logs
● VPC Flow logs
● AWS Inspector
● Host AV & IPS
● Network WAF & IPS
● Evident.io / Dome9
● Observable

40. ● Create Clear Visibility
● Set Governance Rules
● Define Actions

41. © 2016 AllCloud
Join our Fastlane to a
Successful Cloud Deployment
Contact me: lahav.savir@allcloud.io