The document discusses automating security governance in the cloud. It recommends establishing foundational security controls by leveraging native AWS services for identity, visibility, and encryption. It also advocates implementing continuous compliance by automating assessments using AWS Config and other services. The "governance layer cake" model involves assessing AWS services, implementing baseline controls, and adding workload-specific controls to provide automated yet flexible governance that scales with the cloud.

1. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.© 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
The Automation of Supervision:
Governance in the Cloud
Brian Wagner, Compliance Specialist
AWS Financial Services

2. Common Pattern
Framework Policies Business Outcomes Manage Risks

3. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Security governance is meant to support business objectives by defining
policies & controls to manage risk

4. Traditional governance flow
Project Team Governance Check
Policy Archive
Policy Audit
Release!
Strategy Governance

5. AUTOMATING SUPERVISION

6. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Compliance Data
Automated Checks
Release!
Ops
Audit
Project Team
Strategy Governance
Policy

7. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Compliance Data
Automated Checks
Release!
Ops
Audit
Project Team
Strategy Governance
Policy

8. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.

9. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
AWS CodeBuild AWS Lambda
AWS CloudFormation AWS Config
AWS CodePipeline

10. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.© 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
NormalizeRecordChanging
Resources
AWS Config
Deliver
Stream
Snapshot (ex. 2014-11-05)
AWS Config
APIs
Store
History

11. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.© 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
NormalizeRecordChanging
Resources
AWS Config & Config Rules
Deliver
Stream
Snapshot (ex. 2014-11-05)
AWS Config
APIs
Store
History
Rules

12. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Awareness at Scale

13. Multi-Account structure
Dev Pre-Prod
BU/Product/Resource Accounts
Developer Accounts
Security
Core Accounts
AWS Organizations Account
Billing
Tooling
Shared
Services
Sandbox
Networking
Internal
Audit
Logging
Prod
Shared
Services
Developer
Sandbox
Data Center
Orgs: Account management
Logging: Centralized logs
Security: AWS Config Rules, security
tools
Shared services: Directory, DNS,
limit monitoring
Billing Tooling: Cost monitoring
Sandbox: Experiments
Dev: Development
Pre-Prod: Staging
Prod: Production

14. Leveraging the AWS Account Boundary
Organizations account:
Account Provisioning
Account Access (SSO)
Shared Services account:
Active Directory
Log Analytics
Logging account:
CloudTrail/Config logs
Security account:
Audit/Break-glass
AWS
Organizations
AWS SSMAWS
Service Catalog
Core OU
SharedServices account Logging account Security account
AWS Organizations account
Network
Baseline
Account Baseline Account Baseline
Account Baseline Security Cross-
Account Roles
AWS Microsoft
AD
Aggregate CloudTrail
and Config Logs
Log
Reporting
Amazon S3 bucket
(manifest file)
AWS
CodePipeline
Stacksets
AWS
SSO

15. AWS Service
Catalog
Account Vending
Machine
New AWS Account
Network Baseline
Account Baseline
AWS
Organizations
OUCore
Security Account
Security Roles
Logging Account
Audit Bucket
Shared Services Account
Shared
Network
Account Vending Machine
• Account Vending Machine (AWS Service
Catalog)
• Account creation UI
• Account Baseline Versioning
• Launch Constraints
• Creates/Updates AWS Account
• Apply Account Baseline stack sets
• Create Network Baseline
• Apply account Security Control Policy

16. Deployment and configuration update pipeline

17. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.

18. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Benefits of the AWS Automated Landing Zone
Automated Scalable Self-Service
Guardrails
NOT Blockers
Auditable Flexible

19. ENTER THE LAYER CAKE
The governance model is key

20. Governance At The Speed Of Cloud
Governance
layer cake

21. Layer Cake
AWS Shared Responsibility model & compliance documents

22. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.© 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Shared Responsibility Model

23. Layer Cake
AWS Shared Responsibility model & compliance documents
Service assessment and foundational security controls

24. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Service Governance - compliance
ISO 27001
SOC Reports
• Especially SOC2
Understand how the service is run
White papers & public documents
Your friendly AWS contact
AWS Artifact

25. • IAM Policies for API
access
• Service Role
Definition
• User Identity
Management
• API Calls
• Application Logging
• Default Config Rules
• VPC Flow Logs
• Guard Duty
• VPC Endpoints
• Private Link
• Security Groups
• Edge Services
• KMS Integration
• Client Side
Requirements
• Tokenisation
• AWS Config
Rules
• Automated
Remediation
• SIEM
• SecOps
Identity
Detective
control
Infrastructure
security
Incident
response
Data
protection
Assessment Criteria

26. Quickly get to controls for the service
IAM
AWS
CloudTrail
AWS
Config
Amazon
VPC
AWSKMS
AWS
Lambda

27. BUILDERS
Security people have to become

28. What’s in a platform?
Direct
Connect
Dev Pre-Prod
BU/Product/Resource Accounts
Security
Enterprise Accounts
AWS Organizations Master
Billing
Identity
PoC
Evil Account
Data Center
Logging
Prod
Shared
Services
Orgs: Account management
Logging: Centralized logs
Security: AWS Config Rules,
security tools
Shared services: Directory, DNS,
AMI Factory
PoC: Experiments
Dev: Development
Pre-Prod: Staging
Prod: Production
Evil: Security Testing

29. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Platform – foundational controls
• Federate all the users
• Leverage native encryption
services
• Ubiquitous logging
• Trusted AMI builds
• Default networking –
application patterns
• Standardised Edge Services
• When a service is enabled so
are the config rules
Foundational
security
controls

30. Layer Cake – the tasty topping
AWS Shared Responsibility model & compliance documents
Service assessment and foundational security controls
Workload specific security governance and controls

31. Workload specifics
Testing in the pipeline
Project
Team
Automated Checks
Communicate the
requirements
Policy

32. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
On Nutrition
• Atomic assessment of AWS services defines the controls
• Bake as many into the platform as possible
• Automation helps scale
• Don’t let the governance process become a blocking one
• Communication is critical
Governance
layer cake

33. YOU NEED TO GET RIGHT
Three things

34. Foundations in the platform
Identity
Federation is the basis for the identity controls
Removing long lived API keys/IAM users raises the bar
Role broker & self-service for ephemeral resources
Identity lifecycle
Roles for coarse grained access can also map to
Splunk/Jira/GitHub

35. Foundations in the platform
Visibility
Monitor all the things
As you add services, add the config rules
Analytics for feedback
Someone’s fulltime job needs to be SecOps
Private link helps with plumbing

36. Foundations in the platform
Encryption
KMS is awesome – volumes & credentials
SEC405: Ubiquitous Encryption (Wednesday)
Keep the humans away from the data
Identity for KMS functions
Account boundary for data leakage
Pay attention to data replication & backup

37. MECHANISMS

38. Continuous Compliance
Get started with CIS Benchmarks accelerator
Automate compliance using AWS native services
Let the data drive your policy decisions

39. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Security governance is meant to support business objectives by defining
policies & controls to manage risk

40. Conclusion
Foundational
security
controls
Continuous
compliance
Governance
layer cake

41. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.© 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Thank you
Brian Wagner, Compliance Specialist
AWS Financial Services