Security is paramount for media storage and workloads and can directly impact a studio's bottom line. As core media workloads move to the cloud, it’s imperative to examine the security implications of a multi-tenant public cloud environment in light of various asset classifications, content production, and delivery scenarios, as well as content handling during production workloads. In this session, we address questions and concerns about security in the cloud in the context of tier-1 (pre-released) studio content, as well as the MPAA. We highlight a studio's journey to meet Marvel’s security requirements and run a tier-1 content workflow in the cloud and discuss what it took to approve the environment on AWS.

1. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
AWS re:Invent
Designing for Disney/Marvel Studio-
Grade Security
K E I T H R I T L O P | S r . M a n a g e r – S t u d i o T e c h n o l o g y & R i s k A s s e s s m e n t
E L I M E Z E I | E x e c u t i v e P a r t n e r – I n d e p e n d e n t S e c u r i t y E v a l u a t o r s
U S M A N S H A K E E L | W W . T e c h L e a d e r M & E a t A W S
M A E 4 0 1
N o v e m b e r 2 7 , 2 0 1 7

2. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
M&E: Security
Common security requirements
• MPAA
• CDSA
• Major studio requirements (Disney/Marvel)
CSA, standard audit parties ISO, SOC
Third-party audits

3. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Is Cloud more secure for my high valued
Content?
Yes
“Through 2020, public cloud infrastructure as a service (IaaS) workloads will suffer at least 60%
fewer security incidents than those in traditional data centers”
“By 2018, the 60% of enterprises that implement appropriate cloud visibility and control tools will
experience one-third fewer security failures”
– Gartner January 23, 2017

4. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Cloud Security Best Practices
What:
• A set of guidelines based on ISO, OWASP, CSA, PCI, NIST800-53, SANS and industry
best practices
• Consists of Application Security and Cloud Security guidelines
How:
• Not an Audit rather an ‘assessment’ or ‘inspection’
• Self Assessment
• Infrastructure and Application assessment

5. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
The Scenario
Keith Ritlop
Sr. Manager – Studio
Technology & Risk Assessment
Studio
Content Owner VFX House
Service Provider
Cloud-Based
RenderfarmControl
Visibility
Scale
Flexibility
Cost
Auditability
Eli Mezei
Executive Partner – Independent Security Evaluators
3rd Party Auditor
Content Owner

6. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Governance/
Control
Auditability
Monitoring
Baseline AWS Concepts ( S e l e c t i v e I n g r e d i e n t s )
AWS
Config
Amazon EC2
Systems Manager
Amazon
CloudWatch
AWS
CloudTrail
IAM
Amazon
Inspector
AWS
Organizations
AWSKMS VPC
peering
endpoints
Amazon
Cloud Directory

7. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
WORKFLOWS DRIVE SECURITY
Security must support the workflow, not the other way
around
The workflow must be understood in depth before
security controls can be defined
The simplest solution is generally the most secure

8. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
TRUST MODEL VS. THREAT MODEL

9. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
KNOW YOUR ADVERSARY

10. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
A Simplified Production Workflow
1. Content Creation and Capture
2. On-Location Production – Uses Cloud Based tools
3. Post Production - Relies Heavily on
Cloud based Collaboration Tools

11. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Zooming in on the Workflow
On-Location Set
Editorial
Prepare Editorial Framework
Editing
Finalize
On-Set Director, VFX-Editorial
Post Production
Departments
Film Lab VFX
Isolated Network
ISIS ISIS
Mount and Move of Original Video to
staging area
Prepare Editorial Tools for Editing
Edit Film Scenes
Edit Film Sequences
Cut in VFX, Art, and Second Unit Footage
Prepare Review Cut
On Location Post Production
Off-Site Crew
Studio HQ
WAN
VFX Vendor
Commercial Cloud
Collaboration Services
PixsFotokem Shotgun

12. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
On-Premises VFX rendering

13. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
The Challenge
What are we trying to solve?
SPEED
Storage
S P A C E
Security

14. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Example Cloud-Based VFX Render Workflow -
AWS
Private Compute and Storage Subnet 10.0.2.0/24
AWS Batch
Spot Fleet
Spot Instances
instances
VPN Subnet 10.0.1.0/24
router
Bastion ServerAmazon CloudWatch
AWS KMS
Content Ingress/
Egress
Amazon EFS
route table
On-premises network
192.168.0.0/16
customer gateway
Active
Directory
Region
Amazon VPC
VPN gateway
VPN connection
route table
Compute Subnet
Render Farm Compute
Domain
Controller
AD
Connect
Sync
Access Control

15. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Principals of Secure Design in Content
Production workflows

16. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
INDUSTRY PRINCIPALS
• Secure Design Principle: those upon which systems resilient against
attacks are built
• Principal of secure design should apply to all production technology
• Controls are workflow dependent, but interchangeable with minimal
customization

17. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
PRINCIPAL: LEAST PRIVILIGE

18. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
PRINCIPAL: PRIVILIGE SEPARATION

19. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Core Services for Least Privilege and
Privilege Segregation
AWS Accounts Structure
IAM
AWS Organizations
S3 bucket policies

20. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
aws iam create-role --role-name Key_OP --assume-role-policy-document file://Test-Role-
Trust-Policy.json
Content of the JSON:
{ "Role": {
"AssumeRolePolicyDocument": "<URL-encoded-JSON>",
"RoleId": "Key_OP",
"CreateDate": "2017-10-07T20:43:32.821Z",
"RoleName": "Key_OP",
"Path": "/",
"Arn": "arn:aws:iam::123456789012:role/Backend-Rendering"
}
}
Create IAM Role
- Control access on as needed basis – assume role
- Cross Account Access
- Revoke access once task is done

21. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
aws iam create-policy --policy-name my-policy --policy-document
file://key_use_policy
{ "Policy": {
"PolicyName":, "key_use_policy",
"CreateDate": "2015-06-01T19:31:18.620Z",
"AttachmentCount": 0,
"IsAttachable": true,
"PolicyId": "ZXR6A36LTYANPAI7NJ5UV",
"DefaultVersionId": "v1",
"Path": "/",
"Arn": "arn:aws:iam::0123456789012:policy/my-policy",
"UpdateDate": "2015-06-01T19:31:18.620Z”
}
}
Create KMS Policy

22. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
aws iam attach-role-policy --policy-arn
arn:aws:iam::aws:policy/ReadOnlyAccess --role-name Key_OP
aws iam attach-user-policy --policy-arn
arn:aws:iam::aws:policy/AdministratorAccess --user-name Key-
Man
Attach a Policy to the Role
- Can be attached to any IAM Role
- Secure means to pass the encryption keys without any human involvement
- Logged and fully managed
- Automated and as-needed basis
- Customer controls the Master key

23. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
########This is the S3 bucket policy that requires use of a kms encryption for upload:########
{"Version": "2012-10-17",
"Id": "PutObjPolicy",
"Statement": [
{ "Sid": "DenyIncorrectEncryptionHeader",
"Effect": "Deny",
"Principal": "*",
"Action": "s3:PutObject",
"Resource": "arn:aws:s3:::Backend-Rendering-Bucket /*",
"Condition": { "StringNotEquals": {"s3:x-amz-server-side-encryption":"aws:kms"} } },
{"Sid": "DenyUnEncryptedObjectUploads",
"Effect": "Deny",
"Principal": "*",
"Action": "s3:PutObject",
"Resource": "arn:aws:s3:::Backend-Rendering-Bucket /*",
"Condition": { "Null": {"s3:x-amz-server-side-encryption": true}}
}]}
Set KMS Requirement

24. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Bucket Policy for role:
{"Version": "2012-10-17",
"Statement": [{
"Effect": "Deny",
"Principal": "*",
"Action": "s3:*",
"Resource": [
"arn:aws:s3:::Backend-Rendering-Bucket",
"arn:aws:s3:::Backend-Rendering-Bucket/*”
],
"Condition": { "StringNotLike": { “aws:userId": [ “AROAUNIQUEROLEIDENTIFIER:*” ] }}
}]
}
CREATE RESTRICITVE KMS RULE

25. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Architectural Pattern: achieve Privilege
Control
Subnet
AWS KMS
Region
IAM
Amazon VPC
route table
IAM
S3 Bucket
role
permissions
Users
Define
role
User
policy
permissions
permissions
Encryption
keys
AWS CloudFormation
Access Data
Monitor
Attach policy

26. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Architectural Pattern: Encryption & Key
Management
AWS KMS

27. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
PRINCIPAL: DEFENSE IN DEPTH

28. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
VPC Segmentation
• Allows you to treat services, and
apps, and storage as distinct zones
with logical controls
• Traffic generally controlled through
an app or a portal
• Audit and monitor critical apps/VPCs

29. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
• Extends trust and controls
to Counterparties
• Restricts access to only
known infrastructure
• Used for workflows that
involve trusted
counterparties
& shared infrastructure
VPC Peering

30. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
• Trust is completely
centralized
• Tantamount to restricting
access via a corporate
LAN
• Very restrictive trust
model
• Incredibly robust Logging
and monitoring capability
VPC Sub-Account

31. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
PRINCIPAL: TRUST RELUCTANCE

32. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Robust Logging, Monitoring
Virtual private cloud
Amazon VPC
flow logs
Amazon CloudWatch
bucket
AWS CloudTrail
Monitor API
VPC Logs
Asset Subnet
AWS KMS
route table
S3 Bucket
Encryption
keys
Logging data
Key Logging
Logging data
instance with
CloudWatch
Amazon
Elasticsearch
Service
Event drive
analytics
analytics'
Amazon RedshiftData warehouse
queries
AWS Lambda
Centralized Logging Proxy
Proxy Server
Administrator
Log
Management
API Calls

33. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Summing it all up

34. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Secure Design is Interchangeable

35. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
How do I achieve Studio Security?
Reach out to studio stakeholders/content owners to inform
them of your design and plan
Get buy-in from the stakeholder
Request the template via AWS Artifacts and get the
implementation audited quickly
Innovate

36. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Questions…

37. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Thank you!