This session will cover how operating on the AWS cloud helps you manage risk and remain competitive in an ever changing landscape. We will review how to manage confidentiality, integrity, compliance and availability on AWS. Speaker: David Kaplan, Security Specialist, Amazon Web Services

1. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
David Kaplan
Security Specialist, Amazon Web Services
Level 200
© 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Why You Are More Secure
in the AWS Cloud

2. Agenda
• Introduction – What’s the Story, Success.
• Cloud Risk Management
• Cloud Security to Exceed Requirements of:
– Confidentiality
– Integrity
– Availability
– Compliance
• Conclusion & Next Steps

3. Introduction
• Why Are You Here
• Who Are We
• What is the Required Outcome
– What does Security, Risk & Compliance success look like

4. The Story – We’ll Get Back to this in a Moment…
A famous author once said all good stories need a beginning,
a middle & a twist
• The story is of a customer journey to running securely @ peak
efficiency on the cloud, meeting all requirements:
– Risk Management
– Confidentiality, Integrity, Availability (CIA)
– Compliance

5. Success
Strategy Confidence in
Cloud Service
Provider
Technology Risk
Adaption
Methodology
AWS Artifact AWS
Service Catalog

6. Success – Automate Out the Weakest Links
http://1funny.com/weakest-link /

7. Source: http://www.laingorourke.com/our-projects/all-projects/lawrence-hargrave-drive.aspx
Success – Implement Guardrails not Gates

8. Success – Implement Guardrails not Gates

9. Success Security is Job Zero
Network
Security
Physical
Security
Platform
Security
People &
Procedures

10. Success AWS Security & Compliance –
Every Customer benefits
AWS Foundation Services
Compute Storage Database Networking
AWS Global
Infrastructure Regions
Availability Zones
Edge
Locations
AWS is
responsible for
the security OF
the Cloud

11. Success
• AWS Cloud Adoption Framework (CAF) Security Epics
• Enables you to move fast while being secure!

12. The Story / The Players
A famous author once said all good stories need a beginning,
a middle & a twist
• The story is of a customer journey to running securely @ peak
efficiency on the cloud, meeting all requirements:
– Risk Management
– Confidentiality, Integrity, Availability (CIA)
– Compliance
• The twists:
– You’ll likely have some objections to handle
– Treat everything as Code and automate your way to security success

13. The Story / The Players
The Players
• Regulators. Two examples:
– Government – ASD / ISM via IRAP
– FSI - APRA
• Security
• Information Technology (Not security focused)
• DevOps
• Traditional Operations - TradOps

14. Regulator – Risk & Compliance Requirements
• Regulated customer: “Can I audit your DC?”
• Which services are certified to what level?
• Controls, Documents, Controls effectiveness
• How will your organisations risk profile change &
how will you manage risk?

15. Security
• “It used to require multiple separate people (from > 2 orgs) to open a
connection to the internet ...”
• Why should I / how can trust the AWS? Do all the certs add up to...
• The API driven platform is biggest advantage but also biggest risk.
Must get tooling right. Abuse looks normal, mistake can be amplified.

16. Information Technology (Not security focused)
• Aren’t you just another DC?
• People and cultural changes needed?

17. DevOps – Get out of the Way…
• I want to use all the toys... Now!
Side Note: DevSecOps or is SecDevOps or DevOpsSec

18. Traditional (Security) Operations
• Where’s my GUI?
• I’ve lost control / visibility?
• How do I ...?

19. The Elephant(s) in the Room
• What’s the MOST secure network?
• Secure & Competitive (speed & cost)?
• After you handle objections
Why You Are More Secure in the AWS Cloud
Source: New Yorker Cartoon By: Leo Cullum Item #: 8545100

20. When You Follow Best Practices!
Why You Are More Secure in the AWS Cloud
The Elephant(s) in the Room
Source: New Yorker Cartoon By: Leo Cullum Item #: 8545100

21. So Everything’s Changed… Right?
• Well… not everything
• Change Management is key
• Technology risk adoptions
process… to deal with ~3
changes per day!
Source: https://m.isaca.org/Knowledge-Center/BMIS/Pages/Business-Model-for-Information-Security.aspx

22. Cloud Risk Management

23. Cloud Risk Management
• There is no single standard / framework
• Applicable guidance:
– ISO
– PCI
– CSA
– ASD
– APRA
– NIST
– Others, see references

24. • Monoliths / Legacy
• Long development cycles
• Big releases
• Complexity
• Low / No Automation
• CI / CD / DevOps
• Infrastructure is easier and
more accessible
• High Automation
• Self-service, empowerment
• Everything as Code
Old Way New Way

25. Preventative Controls Detective / Corrective Controls
Two Sides of Managing Risk
• Risk guardrails to contain
blast radius
• Preventive control &
automated testing / validation
• Training and services to help
teams operate cloud
infrastructure
• Hyper-Visibility
• Real-time assurance of
risk policies
• Automated corrective action with
fast response

26. Success; CAF Security Epics

28. Security as Code / CI/CD / DevSecOps
Best Practices/Turn
On/Use
Services/Tools Outcomes
 Regulators
• Everything as
Code
• Secure coding and
testing
• Secure CI/CD
Pipeline; changes
→ Code repo
 Security  Not Sec  DevOps  TradOps
AWS
CloudFormation
AWS
Organizations
AWS
CodeCommit
AWS
CodeDeploy
AWS
CodePipeline
AWS
CodeBuild
 Provably Secure
 Confidentiality
 Integrity
 Availability
 Compliance

29. DevSecOps Pipeline

31. Identity & Access Management
Best Practices/Turn
On/Use
Services/Tools Outcomes
 Regulators
• Accounts for
segmentation
• Temporary
credentials
• Federations
• Least Privilege,
SoD
 Security  Not Sec  DevOps  TradOps
 Confidentiality
 Integrity
 Availability
 ComplianceAWS
Organizations IAM
AWS Directory
Service
AWS STS

32. AWS Native Tools and 3rd Party Innovation
IAM Access Advisor NetFlix Repoman

34. Logging & Monitoring
Best Practices/Turn
On/Use
Services/Tools Outcomes
 Regulators
• Platform, OS and
Apps
• Central, secure
access
• Aggregate, alerting,
enrichment, search
platform,
visualisation,
• Search, visualise,
workflow & ticketing
for closed-loop
response
 Security  Not Sec  DevOps  TradOps
 Integrity
 Availability
 ComplianceAmazon
S3
AWS
CloudTrail
Amazon
CloudWatch
Logs & Events
Amazon
SNS

35. Visibility via Support API / Trusted Advisor

36. Cloud Security Information & Event Mgt (SIEM)
VPC subnet
Availability Zone
Security group
VPC subnet
Availability Zone
Security group
Virtual
Gateway
Corporate
data centre
Users
Data centre router
Update
Servers
Connectivity
CloudTrail
CloudWatch
SIEM
Aggregator

38. Infrastructure Security
Best Practices/Turn
On/Use
Services/Tools Outcomes
 Regulators
• Threat Prevention
Layer with DDoS
Mitigation
• Segmentation;
Account, Network,
Firewall (SG)
• Severless, Patch &
Replace, Vulnerability
Management
 Security  Not Sec  DevOps  TradOps
 Integrity
 Availability
 ComplianceAWS
Organizations
AWS WAF
AWS
Shield
Amazon
VPC
VPC flow
logs
Amazon
CloudFront
AWS
Lambda
Amazon
Inspector

39. https://www.example.com
AWS Edge Locations
AWS WAFAmazon
Route 53
Amazon
CloudFront
AWS Shield Advanced
CloudTrail
us-east-1a
us-east-1bProxies
NAT
RDS
DB
DMZSubnet
PrivateSubnet
PrivateSubnet
Proxies
Bastion
RDS
DB
AWS
Config
CloudWatch Alarms
Archive
Logs
Bucket
S3
Lifecycle
Policies
to Glacier
PrivateSubnet
PrivateSubnet
AWS Account
Virtual Private Cloud (VPC)
Infrastructure Security
Well-Architected via a NIST High Quick Start

41. Data Protection
Best Practices/Turn
On/Use
Services/Tools Outcomes
 Regulators
• Classify
• Encrypt in Transit
• Encrypt at Rest
• Audit, Automate
detection or better
still enforcement
 Security  Not Sec  DevOps  TradOps
 Confidentiality
 Integrity
 Availability
 Compliance
AWS
KMS
AWS
CloudHSM
IAM
AWS
Certificate
Manager
AWS
CloudTrail
AWS
Config

42. Ubiquitous Encryption
EBS
RDS
Amazon
Redshift
S3
Amazon
Glacier
Encrypted in transit
Fully auditable
Restricted access
and at rest
Fully managed
keys in KMS
Your KMIturn it on

44. Incident Response
Best Practices/Turn
On/Use
Services/Tools Outcomes
 Regulators
• Review & cloud
optimise; Preparation
• Detection & Analysis
• Containment,
Eradication and
Recovery
(Response)
• Post-Incident Activity
 Security  Not Sec  DevOps  TradOps
 Confidentiality
 Integrity
 Availability
 Compliance
Amazon
S3
AWS
CloudTrail
Amazon
CloudWatch
Logs & Events
Amazon EBS
snapshot
VPC

45. Incident Response as a Service (IR-aaS)

47. Compliance
• … is not security
• Proving above
• Process
• Automation of … more
• Examples:
– ISM
– APRA

48. Challenges for Compliance
• Multiple complex documentation requirements
• One off or Periodic surveys
• Few truly automated controls
• Sample testing
• Lack of repeatability
And now to architect for compliance in the Cloud

49. Build on a Solid Foundation
Certification provides assurance that AWS has in place the
applicable controls of the ASD’s ISM (Australian Signals
Directorate’s Information Security Manual) and is the
immediate precursor in accrediting AWS for Australian
government workloads.

50. Australian Prudential Regulatory Authority
• OUTSOURCING INVOLVING SHAREDCOMPUTING SERVICES
(INCLUDING CLOUD) 6 July 2015
• Prudential Standard SPS/CPS 231:
– Board approved Policy, material systems, (viability, stock value),
systems of record (single source of truth), business activities sufficient
monitoring & binding contract, consult with and notify APRA
– Articulate how changes affect risk posture and how risk will
be managed

51. Leverage Best Practices and Automate
• Compliance Quick Starts
• CAF Security perspective
• Growing Security services
and feature portfolio

52. Leverage Best Practices
from Accenture & AWS:
The Accenture Security Framework
for AWS provides a mechanism for
FSIs to:
• Adopt AWS services and use them in a
manner that helps organisations address
the technology-compliant controls
described within the APRA guidelines.
• Secure both sensitive and non-sensitive
data as setup and classified pertaining to
CPG 235 – “Managing Data Risk,” while
leveraging the flexibility, agility and cost
savings of the cloud.

53. Re-cap the Story / Players
 Regulators:
 Government – ASD / ISM via IRAP
 FSI - APRA
 Security
 Information Technology (Not security focused)
 DevOps
 Traditional Operations

54. Conclusions & Call to Action
•     
• Do the right things; Just turn on the capabilities
– Demonstratively more secure, less errors and effort
• Trusted Advisor
• Cloud Adoption Framework
• Well-Architected Framework
• Enjoy the rest of the event; further information other security
sessions follows
turn it on

55. Resources
AWS Cloud
Adoption Framework
http://bit.ly/AWS-CAF
AWS Well
Architected Framework
http://bit.ly/WellArchF
AWS Quick Start
Guides
http://bit.ly/AWSQSG
Code 01 = ZW1haWwg

56. Further Reading and References
AWS Compliance: http://amzn.to/2nYbDvO
AWS Security: http://amzn.to/2ol0QYC
ISACA Cloud RM: http://bit.ly/2nKBKpC
ASD: http://bit.ly/2n0AF9r
APRA: http://bit.ly/2nY6sZA
CIS *2: http://bit.ly/2obIl90 and http://bit.ly/AWSCIS
NIST: http://bit.ly/2obVQFO

57. Related Sessions
Today:
1445 – 1515: DDoS Protection/Edge Services
1530 – 1600: Wrangling Multiple AWS Accounts from Security to Finance
1630 – 1700: Ubiquitous Encryption on AWS
1715 – 1745: Implementing DevSecOps
Tomorrow:
1215 – 1300: Well-Architected for Security: Advanced Session
1445 – 1515: Serverless Authentication and Authorisation
1530 – 1600: Best Practices for Security at Scale
1630 – 1700: A Serverless Approach to Operational Log Visualisation and Analytics
1715 – 1745: Securing your Containers on AWS

58. Thank you!