With the ongoing expansion of cloud transformation, the different stages of cloud adoption become instrumental in achieving successful adoption of cloud infrastructure and services. When considering each stage, it’s important to overlay the proper security framework alongside continuous monitoring to provide the necessary security outcomes for an optimal security posture. In this session, we describe how to deliver outcomes of continuous security and compliance through a security wrapper delivered through infrastructure as code. This presentation is brought to you by AWS partner, Armor Cloud Security.

1. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
The Evolution of Continuous Security
and Compliance
Stan Golubchik
Head of Alliances
Armor Cloud Security
D E M 0 5 - S

2. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Agenda
• The Transformative Force of the Cloud
• The Challenges of the Modern Cloud CISO
• Using the Cloud to your Security Advantage
• Secure Cloud Infrastructure-as-Code
• CWPP + CSPM + CASB – the Cloud Security Trinity
• 3 Major Takeaways

3. S U M M I T © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.

4. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Digital Disruption Scale
DD5:
REVOLUTIONIZE
DD4:
REINVENT
DD3:
TRANSFORM
DD2:
EXTEND
DD1:
ENHANCE
2007
2012
2017
2022 DOMINANCE
EXPANSION
APPEARANCE
ELEMENTS AFFECTED: TECHNOLOGY INDUSTRY BUSINESS SOCIETY

5. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Marketplace Evolution
TIME
MSSP
MDRs
PERFORMANCCE
SECaaS
CWPP
Public cloud adoption will challenge traditional
managed services based on on-premise models.
Speed to Value
Simplicity
Flexibility
Lower Cost

6. S U M M I T © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.

7. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
How We’re Evolving
ON-PREMISE
Networking
Storage
Servers
Virtualization
O/S
Middleware
Runtime
Data
Applications
IaaS
Networking
Storage
Servers
Virtualization
O/S
Middleware
Runtime
Data
Applications
PaaS
Networking
Storage
Servers
Virtualization
O/S
Middleware
Runtime
Data
Applications
SaaS
Networking
Storage
Servers
Virtualization
O/S
Middleware
Runtime
Data
Applications
CSP MANAGESYOU MANAGE

8. S U M M I T © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.

9. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
3 Major Challenges of Today’s Cloud CISO
Talent
Shortages in
DevOps and
Security
Vendor, Tool,
and Alert
Overload
How Do I
Keep Pace
with Rate of
Innovation

10. S U M M I T © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Which means, Security in the cloud is not a
technology problem but an operations
problem…

11. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Vendors Should Solve Problems and Stop Pitching
Technologies
Top Problems of CISOs in Today’s Cloud Era:
• Identity and access management
• Ever-evolving “network perimeter” in a mobile, SaaS-ified world
• Compliance
• Hybrid cloud visibility and security policy management

12. S U M M I T © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.

13. S U M M I T © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.

14. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Infrastructure as Code
Terraform
Type: "AWS::S3::Bucket"
Properties:
BucketName: my-secret-phi
BucketEncryption:
ServerSideEncryptionConfiguration:
- ServerSideEncryptionByDefault:
SSEAlgorithm: "AES256"
LoggingConfiguration:
DestinationBucketName: "my-secret-phi-logs"
LogFilePrefix: "phi"
VersioningConfiguration:
Status: "Enabled""
Tags:
- Key: "environment"
Value: "production"
- Key: "managed-by"
Value: "cloudformation"
- Key: "owner"
Value: "privo"
CloudFormation

15. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Collaborating and Expanding
• Embrace DevOps with a cloud-
native strategy.
• Partner with a Solutions
Provider for hands-on training
and growth.
• Start off with ready to scale.
• Don’t be afraid to try
something new!
Terraform
CloudFormation

16. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Auto-Scaling
Group
Aurora
Multi-AZ
Availability Zone 1 Availability Zone 2
Private Subnet
Secure, Cloud-Native Infrastructure
Terraform
CloudFormation
CloudTrail
GuardDuty
VPC FlowLogs
DNS Queries
Config
KMS
Transit Gateway
Route 53CloudFrontWAF
Public Subnet
Data Subnet
Private
Link
NAT NATELB
App Server
AWS Cloud

17. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Benefits of Infrastructure and Security-as-Code to Clients
Limits complex
deployment tasks
SIMPLIFICATION
& REPEATABILITY
OF DEPLOYMENT
Ease of sharing and
collaboration
DISTRIBUTION
OF CONFIRMED
GOLDEN IMAGE
DEPLOYMENTS
Start simple and build
over time
DISASTER
RECOVERY
Customize resources
STANDARDIZATION
WITH BENEFITS OF
CUSTOMIZABILITY
Validated compliance
controls
OUT OF
THE BOX
COMPLIANCE

18. S U M M I T © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.

19. S U M M I T © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.

20. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Development / Production VPC
Armor Anywhere
S3 Lifecycle Policies
to Amazon Glacier
Accelerating Cloud Transformation
AWS Cloud
Users
Archive
Logs Bucket
AvailabilityZoneAvailabilityZone
PrivateSubnetPrivateSubnet
PrivateSubnet
PrivateSubnet
Proxies
NAT
PrivateSubnet
Log Collector
NAT
PrivateSubnet
Armor Anywhere
us-east-1bus-east-1c
Primary DB
Secondary DB
Flow logs
AutoScalingGroupAutoScalingGroup

21. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
The Calendar of Unfortunate Incidents
MAY30
JUNE
JUNE8
JUNE20
SEPTEMBER
SEPTEMBER17
20182017
DOW JONES
& COMPANY
DEEP ROOT
ANALYTIC
-
RNC
NICE
SYSTEMS
-
VERIZON
DECEMBER20
FEBRUARY3
FEBRUARY5
FEBRUARY18
AUGUST
RECRUITING
VENDOR
-
TIGERSWAN
PATIENT HOME
MONITORING
CORP
ACCENTURE ALTERYX
-
EXPERIAN
MBM
COMPANY
-
WALMART
BONGO
INTERNATIONAL
-
FEDEX
LOCAL BOX
-
SCRAPED
CONTENT
GODADDY
THE ACCIDENTAL
# of records exposed.
386 M
# of incidents that involved
data exposed via an affiliate,
partner or “customer.”
6 OUT OF 11
of incidents involved
an unsecured S3 bucket
in AWS.
100%
were either “concerned or very concerned that in the next 12 months,
misconfigured systems, such as server workloads and cloud services, could
lead to a successful attack that threatened their infrastructure, data assets,
and business operations.*”
57% OF SURVEY RESPONDENTS
*Source: Oracle & KPMG

22. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
CSPM tools act
as a ‘checks and
balances’ on overall
adherence to
security policy.
The Accidental
ADHERE TO POLICY
DRIFT / RISK
DRIFT / RISK

23. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Key Characteristics of Cloud Security Posture
Management (CSPM)
CAPABILITIES
Out-of-the-Box Compliance
Checks
Cloud Native Integrations
Continuous Security and
Compliance Monitoring
Unified Visibility
Workload Discovery and
Visibility
Automated Remediation Policy Management 24/7 Mgmt & Monitoring
SECaaS
DELIVERY MODEL
Simple to Turn Up Fast Turn Up Easily Scalable Pay As You Go
Address IT, IT Security & DevOps Needs
ANY WORKLOAD (Public and Private Cloud, Virtualized, Servers, Containers)

24. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Managing an
increasing attack
surface that is
fundamentally
unfamiliar to many
IT and IT Security
professionals.
The Intentional
681M ATTACKS /
1,200 ORGANIZATIONS
BRUTE FORCE
WEB APP
ATTACKS
IOT
ATTACKS
VULN EXPLOITS

25. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Key Characteristics of Cloud Workload Protection (CWPP)
CAPABILITIES
Host-Based Protections Security Compliance Unified Visibility
Containers Native Tools Integration App Control & Whitelist 24/7 Mgmt & Monitoring
SECaaS
DELIVERY MODEL
Simple to Turn Up Fast Turn Up Easily Scalable Pay As You Go
Address IT, IT Security & DevOps Needs
ANY WORKLOAD (Public and Private Cloud, Virtualized, Servers, Containers)

26. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Understanding The Rising Demand for CASB
1427
# of distinct cloud services
that an average enterprise
uses*
36
# of distinct cloud services
that an average employee
uses at work*
18.1%
of file uploads into cloud-
based services contained
sensitive data*
*https://www.skyhighnetworks.com/cloud-security-blog/12-must-know-statistics-on-cloud-usage-in-the-enterprise/

27. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Key Characteristics of Cloud Access Security Brokers
(CASB)
CAPABILITIES
Data Security DLP Secure Shadow IT Unified Visibility
Insider Threat Detection Native Tools Integration IAM and Integrations 24/7 Mgmt & Monitoring
SECaaS
DELIVERY MODEL
Simple to Turn Up Fast Turn Up Easily Scalable Pay As You Go
Address IT, IT Security & DevOps Needs
ANY WORKLOAD (Public and Private Cloud, Virtualized, Servers, Containers)

28. S U M M I T © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.

29. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
3 Big Takeaways
1. Cloud has changed everything – we must secure our workloads
against accidental and intentional threats.
2. The hard part of security is not a technology problem; it’s an
operations problem.
3. You can use the cloud to deliver continuous security and
compliance.

30. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Thank you!
S U M M I T © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Stan Golubchik
@STANGOLUBCHIK