The document discusses applying lessons from historical epidemics like cholera to cloud security. It suggests that as scale increases in cloud computing, risks and responses must also change. It recommends avoiding poorly designed architectures, as threats evolve defenses must also evolve, and incidents can spread quickly requiring rapid response. The document outlines several AWS security services and best practices to implement things like access management, detection and response, infrastructure security, and data protection based on lessons from historical epidemics.

1. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved
Pop-up Loft
John Snow: Security is Coming
Applying the lessons of an epidemic to cloud security
William Reid,
Leader, Security and Compliance
Solution Architecture

2. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved
Soho, London, England, 1850s

3. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved
Increased Scale Changes Risk and Response:
• Manage across Accounts with AWS Organizations
• Federate Identities with AWS Directory Service and AWS
Identity and Access Management
• Automate where possible with AWS Lambda, AWS
CloudFormation templates
• Instrument with Amazon GuardDuty, Amazon Macie, and
Amazon CloudWatch

4. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved
London Water

5. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved
Avoid poorly designed architectures that can
create or amplify vulnerabilities.
• Conduct AWS Well-Architected reviews
• Use AWS Security Best Practices white papers
• Deploy with AWS Quick Starts reference architectures (PCI
DSS, HIPAA, CIS Benchmark)
• Check and control deployments with Amazon Inspector,
AWS Config, AWS CloudFormation

6. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved
Cholera (Vibro cholerae)

7. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved
Threats evolve and “learn”, therefore so must
defenses
• Deploy Amazon GuardDuty across accounts to apply
updated threat intel to new risks
• Use Amazon Macie to learn and detect access patterns to
valued S3 data assets and send findings to Amazon
CloudWatch Events.

8. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved
The Outbreak

9. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved
Incidents occur suddenly and quickly spread,
leaving little time to act
• Plan and rehearse: Game Days, Chaos Engineering
• Use AWS Systems Manager to automate operational
actions like system patching, configuration management
• Back up instances, data and test the restoration
• Automate responses with AWS CloudTrail, AWS
CloudWatch Events, and AWS Lambda
• Get your forensic tools ahead and practice using them

10. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved
John Snow (and Rev. Whitehead)

11. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved
Apply different thinking to cloud security
• Invest in training your teams – can they code?
• Study changing regulation – GDPR?
• Apply new methods of analysis – signatures, sure, but
what about ML and AI?
• Learn from best practices, connect with fellow
professionals
• Build upon your existing Governance, Risk and
Compliance frameworks, but appreciate the changes
from cloud.

12. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved
The Map

13. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved
Organize information to understand system
behaviors
• Log comprehensively with AWS CloudTrail, Amazon
CloudWatch Logs, and AWS Config
• Deploy services that help make sense of behaviors –
Amazon Macie, Amazon GuardDuty
• Analyze your findings in new ways – Amazon Athena,
Amazon EMR, Amazon Elasticsearch Service, Amazon
Quicksight

14. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved
The Broad Street Pump Handle

15. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved
Containment is critical – remove “pump handles”
• Use security groups and ACLs to control access
• Leverage AWS Identity and Access Management Roles
• Apply Elastic Load Balancing to redirect traffic from
compromised resources
• Use AWS Lambda to run code in response to events
• Limit DDoS impact with AWS Shield
• Filter malicious web traffic with AWS WAF
• Protect data with AWS Key Management Service
• Ensure quality code is deployed with Amazon Inspector

16. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved
What did we learn from history
• Increased Scale changes risks and responses
• Avoid poorly designed architectures that can create or amplify vulnerabilities
• Threats evolve and “learn” – therefore so must defenses
• Incidents occur suddenly and quickly spread, leaving little time to act
• Apply different thinking to cloud security
• Organize information to understand system behavior
• Containment is critical – remove “pump handles“

17. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved
AWS Security Solutions—Well Architected and CAF
AWS Identity & Access
Management (IAM)
AWS Organizations
Amazon Cognito
AWS Directory Service
AWS CloudTrail
AWS Config
Amazon
CloudWatch
Amazon GuardDuty
VPC flow logs
Amazon EC2
Systems Manager
AWS Certificate Manager
(ACM)
AWS Shield
AWS WAF
Amazon Inspector
Amazon Virtual Private
Cloud (Amazon VPC)
AWS Key Management
Service (AWS KMS)
AWS CloudHSM
Amazon Macie
AWS Certificate Manager
(ACM)
AWS Config
AWS Lambda
Identity & access
management
Detective
control
Infrastructure
security
Incident
response
Data
protection

18. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved
Moving to AWS can strengthen your security posture
Automate with deeply integrated
security tools and services
Inherit comprehensive security &
compliance controls
Build on high standards for privacy
and data security
Access broad network of
security partners and
solutions
Scale with visibility & control that satisfies
the most risk-sensitive orgs

19. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved
Pop-up Loft
aws.amazon.com/activate
Everything and Anything Startups
Need to Get Started on AWS