Security & Compliance are very important for most businesses. Learn how AWS enables you to securely use the cloud for you most vital business applications and how you can ensure that you are compliant with a large set of security standards and government regulations like GDPR.

1. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Security & Compliance
Paul Ahlgren, Partner Solutions Architect, Nordics & Baltics region

2. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Cloud Security Myths
The cloud is not secure
The cloud is still too new to be trusted
The cloud is great for productivity apps, but not for securing the network
Cloud solutions requires re-educating IT-teams
Cloud solutions can’t help with compliance

3. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
UK MoJ CTO David Rogers
“You should probably start engaging with the idea
that the cloud can be considerably more secure
than the private cloud or your own data centre, and
start engaging with the risks that are building in the
spaces where you haven't moved to the cloud yet.”
The Guardian: http://bit.ly/1HXS321
(emphasis added)

4. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Analyst’s Perspective
“CIOs and CISOs need to stop obsessing over unsubstantiated cloud
security worries, and instead apply their imagination and energy to
developing new approaches to cloud control, allowing them to securely,
compliantly and reliably leverage the benefits of this increasingly
ubiquitous computing model.”
Clouds Are Secure: Are You Using Them Securely?
Published: 22 September 2015

5. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Security

6. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
AWS Foundation Services
Compute Storage Database Networking
AWS Global
Infrastructure Regions
Availability Zones
Edge Locations
Client-side Data
Encryption
Server-side Data
Encryption
Network Traffic
Protection
Platform, Applications, Identity & Access Management
Operating System, Network & Firewall Configuration
Customer content
Customers
AWS Shared Responsibility Model
Customers are
responsible for
their security and
compliance IN
the Cloud
AWS is
responsible for
the security OF
the Cloud

7. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Security Products

8. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Identity
AWS Identity and Access
Management
AWS Organizations
AWS Cognito
AWS Directory Services
AWS Single Sign-On

9. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Detective Control
AWS Cloudtrail
AWS Config
AWS Cloudwatch
AWS GuardDuty
VPC Flow Logs

10. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Infrastructure Security
Amazon EC2 Systems Manager
AWS Shield
AWS Web Application Firewall
(WAF)
Amazon Inspector
Amazon Virtual Private Cloud
(VPC)

11. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Data Protection
AWS Key Management Service
(KMS)
AWS CloudHSM
Amazon Macie
AWS Certificate Manager
Server Side Encryption

12. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Incident Response
AWS Config Rules
AWS Lambda

13. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Security Enhancing Products
AWS Trusted Advisor
AWS Cloudformation
AWS API Gateway
AWS Service Catalog

14. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Information Security &
Compliance

15. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Data Sovereignty
Customer chooses where to place data
AWS regions are geographically isolated by design
Data is not replicated to other AWS regions and doesn’t move
unless customer chooses to move it
Customers manage access to their customer content and AWS
services and resources
Customers choose how their content is secured
https://aws.amazon.com/compliance/data-privacy-faq/

16. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Data Privacy and Assurance
Certifications / Attestations Laws, Regulations, and Privacy Alignments and Frameworks
C5 [Germany] CISPE CIS
Cyber Essentials Plus [UK] DNB [Netherlands] CJIS
DoD SRG EU Model Clauses CSA
FedRAMP FERPA ENS [Spain]
FIPS GLBA EU-US Privacy Shield
IRAP [Australia] HIPAA FISC [Japan]
ISO 9001 HITECH FISMA
ISO 27001 IRS 1075 G-Cloud [UK]
ISO 27017 ITAR GxP (FDA CFR 21 Part 11)
ISO 27018 My Number Act [Japan] ICREA
MLPS Level 3 [China] U.K. DPA - 1988 IT Grundschutz [Germany]
MTCS [Singapore] VPAT / Section 508 MITA 3.0
PCI DSS Level 1 EU Data Protection Directive [EU] MPAA
SEC Rule 17-a-4(f) Privacy Act [Australia & New Zealand] NIST
SOC 1 PDPA - 2010 [Malaysia] PHR
SOC 2 PDPA - 2012 [Singapore] Uptime Institute Tiers
SOC 3 PIPEDA [Canada] UK Cloud Security Principles
Spanish DPA Authorization

17. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
New generation of compliance tools
Amazon GuardDuty

18. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
GDPR

19. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
AWS and the General Data Protection Regulation
It aims to strengthen the security and protection of personal data
in the EU, and harmonize EU data protection law. GDPR will
replace the EU Data Protection Directive, as well as all local
laws relating to it.
GDPR is the biggest change in data protection laws in Europe
since the introduction of the EU Data Protection Directive, in
1995.
AWS services will comply with the GDPR when it
becomes enforceable on May 25, 2018.
Data Privacy Security by Design AWS Certifications, Programs,
Reports, and Attestations

20. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
What does GDPR contain?
Data Subject Rights
1. The right to be informed
2. The right of access
3. The right to rectification
4. The right to erasure
5. The right to restrict processing
6. The right to data portability
7. The right to object
8. Rights in relation to automated decision making and profiling

21. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
AWS and the General Data Protection Regulation
Access Control
Allow only authorized
administrators, users
and applications
Monitoring and Logging
Get an overview about
activities on your AWS
resources
Encryption Encrypt
Data on AWS
Navigating GDPR Compliance on AWS
aws.amazon.com/compliance/gdpr-center/
Download Whitepaper

22. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
AWS and GDPR
https://aws.amazon.com/compliance/gdpr-center/

23. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Resources
AWS GDPR Resource Center
AWS GDPR Blog
AWS EU Data Protection landing page
AWS DPA Request Page (Console Sign-in required)
AWS GDPR Whitepaper

24. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Public Sector

25. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
AWS in the Public Sector
7,000+
educational
institutions
2,300+
government
agencies
22,000+
nonprofit
organizations
25

26. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Government Agencies and Educational Institutions Use AWS
Worldwide
26

27. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Resources
Security and compliance pages
https://aws.amazon.com/compliance/
https://aws.amazon.com/security/
Keep yourself updated here:
https://aws.amazon.com/complianc
e/compliance-latest-news/

28. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Thank you!