Security, Risk and Compliance of Your Cloud Journey - Tel Aviv Summit 2018

© 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved© 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved © 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved.
Gili Lev
Cloud Executive Security Advisor
AWS Professional Services
Global Security, Risk & Compliance
Security, Risk & Compliance of Your
Cloud Journey
SESSION LS203

© 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved© 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved
My Cloud Journey Story

Your AWS Cloud Journey

AWS Cloud Adoption Framework (AWS CAF)
The AWS CAF helps organizations understand how cloud adoption
transforms the way they work, by identifying the stakeholders
that are critical to cloud adoption and groups them into six
Perspectives

AWS CAF Security Perspective
Security Perspective
Directive
Preventative Detective
Responsive

Enterprise Stages of AWS Adoption
Project
Foundation
Migration
Reinvention
Discovery
Targeted
At Scale
ClientValue
Cloud Adoption Over Time

AWS Stages of Cloud Adoption
CUSTOMER CLOUD CENTER OF EXCELLENCE (CCOE)
PROJECT FOUNDATION
MIGRATION
REINVENTION
INNOVATION RETIRE TECH
DEBT
Value
Time
DISCOVERY
AWS CLOUD ADOPTION FRAMEWORK

Enterprise Governance for Cloud Adoption
• Develop Cloud Governance Program
• Review Data Classification
• Review Company policies
• Build Security Standards Control Framework
• Develop a Cloud Security Strategy
Ø Get executive buy-in
Ø Communicate and educate

Don’t plan for Everything… before doing Something
Classify your application portfolio to understand your total cloud opportunity
Hardware appliance Already virtualized x86 Horizontally scalable Microservices
architecture
Non-x86 workload Well-defined
application boundaries
Leverages services
(e.g. SOA, API’s, etc.)
“API- first” design
Non-cloud friendly
licensing model
Cloud-friendly
licensing model
“12 factor”
applications
Fault tolerance built in
Location-specific or
latency intolerant on-
premise dependency
Known dependencies
on applications & data
Software vendor-
provided cloud image
(AMI, CloudFormation)
Bundled metrics &
proactive failure testing
Not Cloud
Now
Eligible Friendly
SaaS/
Native

AWS Shared Responsibility Model

Security is a Shared Responsibility
AWS foundation services
Compute Storage Database Networking
AWS Global
Infrastructure Regions
Availability Zones
Edge locations
Client-side data encryption
Server-side data
encryption
Network traffic protection
Platform, applications, identity and access management
Operating system, network, and firewall configuration
Customer content
AWS is responsible
for the security OF
the cloud
Customers are
responsible for their
security and
compliance IN the
cloud

Infrastructure Services
Customer Content
Platform and application management
Client-side data encryption
and data integrity
authentication
encryption/
integrity/identity
Server-side encryption
file system and/or data
Optional – Opaque data: 0’s and 1’s (in transit/at rest)
CustomerIAM
AWS
endpoints
AWSIAM
NetworkingDatabasesStorageCompute
Edge
locations
Availability
Zones
Regions
AWS Global Infrastructure
Foundation
services
Managed by
customers
Managed by

Container Services
Customer Content
Client-side data encryption and data
integrity authentication
encryption/integrity/identity
Optional—opaque data: 0’s and 1’s (in transit/at rest)
Customer
IAM
AWS
endpoints
AWSIAM
Edge
locations
Availability
Zones
Regions
Foundation
services
Managed by
customers
Managed by
Firewall
configuration
Operating system and network configuration

Abstracted Services
Customer Content
Client-side data encryption and data integrity
authentication
AWS
endpoints
AWSIAM
Edge
locations
Availability
Zones
Regions
Foundation
services
Managed by
customers
Managed by
Optional—opaque data: 0’s and
1’s (in transit/at rest)
Data protection provided by the platform for data
at rest
Network traffic protection provided by the platform
protection of data in transit

AWS Security Epics Program

AWS Security Epics
Frequent iteration via sprints lead to increased maturity while retaining flexibility
to adapt to business pace and demand.
First sprint example
Define the account structure and
implement the core set of best
practices
Second sprint example
Implement federation
Third sprint example
Expand account management to
cater to multiple accounts

AWS CAF Security Perspective
CORE 5
• IAM
• Detective Controls
• Infs. Security
• Data Protection
• Incident Response
Increase agility and ability to perform actions faster, at a larger scale while validating information
security principles and ensuring your environment maintains strong security footing:

Identity and Access Management
(IAM)
The CORE 5:

Account Governance & Ownership
AWS
Organizations
AWS Identity
& Access
Management
Policy-based
management for
multiple AWS
accounts with security
and automation
settings
Securely control
access to AWS
services and
resources for
your users
Amazon
Cognito
Mobile Sign-
up, sign-in and
access control
with various
IDPs via SAML
2.0
ü MFA
ü Root
ü Federation

Detective Controls
The CORE 5:

Audit & Visibility
AWS
CloudTrail
AWS
Config
Amazon
CloudWatch
VPC Flow
logs
Record AWS API calls
Enable Governance,
Compliance & Auditing
Monitor resources &
your applications on
AWS. Collect metrics,
set alarms, and
automatically
react to changes
Resource inventory,
configuration history,
and configuration
change notifications
to enable security and
governance
Capture information about
the IP traffic going to and
from network interfaces in
your VPC
Account Resources Network
Amazon
GuardDuty
Intelligent threat
detection &
continuous
monitoring to
protect your AWS
accounts and
workloads

Infrastructure Security
The CORE 5:

Infrastructure Protection
Amazon
VPC
AWS
CloudFormation
Security
Groups
AWS WAF
AWS
Shield
Stateful host based
firewalls for explicit
traffic control
Provision your resources in
a safe, predictable manner.
Infrastructure as code is
your source of truth
Provision a logically isolated
section of AWS cloud where you
can launch AWS resources in a
virtual network that you define
Managed DDoS protection
service that safeguards
web applications
running on AWS
Protects your web
applications from
common web exploits
ensuring availability
and security
R e s o u r c e s N e t w o r k
Amazon
Inspector
Automatically assesses
applications for
vulnerabilities or deviations
from best practices

Data Protection
The CORE 5:

Data Protection
• Deep integration
with AWS Services
• CloudTrail
• AWS SDK for
application
encryption
AWS KMSAmazon CloudHSM V2
• Tamper resistant secure
key storage for
cryptographic operations
• Standards-compliant
• FIPS 140-2 Level 3
AWS Certificate Manager
• Provision, manage, and
deploy TLS certificates
• Use with Amazon ELB or
Amazon CloudFront
distribution
Amazon Macie
Machine learning-
powered security
service to discover,
classify, and protect
sensitive data

Incident Response
The CORE 5:

Auditability
AWS Config
rule
AWS Trusted Advisor
Create rules that
automatically take
action in response to
changes in your
environment
Real time guidance to provision
your resources following AWS best
practices.
- reduce cost
- increase performance
- improve security
AWS Lambda
Serverless compute
service that runs code
so you can scale your
programmed,
automated response to
incidents

AWS Pace of Innovation

2011
82
722
1,430
280
2013 2015 2017
AWS has been continually expanding its services to support
virtually any cloud workload, and it now has more than 90
services that range from compute, storage, networking, database,
analytics, application services, deployment, management,
developer, mobile, Internet of Things (IoT), Artificial Intelligence
(AI), security, hybrid and enterprise applications. AWS has
launched a total of total of 4,343 new features and/or services
since inception in 2006.
AWS Pace of Innovation

AWS Security Team
Operations
Application Security
Engineering
Aligned for agility

Security ownership as part of DNA
• Promotes culture of “everyone is an owner” for security
• Makes security a stakeholder in business success
• Enables easier and smoother communication
Distributed Embedded

AND
Move Fast
Stay Secure

Getting to cloud is a journey.
Your journey will be unique.

Thank you!

Security, Risk and Compliance of Your Cloud Journey - Tel Aviv Summit 2018

Recommended

Recommended

More Related Content

What's hot

What's hot (20)

Similar to Security, Risk and Compliance of Your Cloud Journey - Tel Aviv Summit 2018

Similar to Security, Risk and Compliance of Your Cloud Journey - Tel Aviv Summit 2018 (20)

More from Amazon Web Services

More from Amazon Web Services (20)

Security, Risk and Compliance of Your Cloud Journey - Tel Aviv Summit 2018