Understanding AWS security
•
4 gefällt mir•1,313 views
The AWS cloud infrastructure has been architected to be one of the most flexible and secure cloud computing environments available today. Security for AWS is about three related elements: visibility, auditability and control. You have to know what you have and where it is before you can assess the environment against best practices and internal or compliance standards. Controls enable you to place precise, well-understood limits on the access to your information. Did you know, for example, that you can define a rule that says: "Tom is the only person who can access this data object that I store with Amazon, and he can only do so from his corporate desktop on the corporate network, from Monday-Friday 9-5 and when he uses MFA?" That's the level of granularity you can choose to implement if you wish.
Empfohlen
Weitere ähnliche Inhalte
Was ist angesagt?
Was ist angesagt? (20)
Andere mochten auch
Andere mochten auch (20)
Ähnlich wie Understanding AWS security
Ähnlich wie Understanding AWS security (20)
Mehr von Amazon Web Services
Mehr von Amazon Web Services (20)
Understanding AWS security
- 1. AWS Summit 2014 Understanding AWS Security Jean-Pierre Le Goaller Principal Solutions Architect @jplegoal
- 2. We’ll also see organizations adopt cloud services for the improved security protections and compliance controls that they otherwise could not provide as efficiently or effectively themselves. Security’s Cloud Revolution is Upon Us Forrester Research, Inc., August 2, 2013
- 3. EVERY CUSTOMER HAS ACCESS TO THE SAME SECURITY CAPABILITIES CHOOSE WHAT’S RIGHT FOR YOUR BUSINESS
- 5. WHAT NEEDS TO BE DONE TO KEEP THE SYSTEM SAFE
- 6. WHAT WE DO WHAT YOU HAVE TO DO
- 7. Shared Responsibility • AWS • Facility operations • Physical Security • Physical Infrastructure • Network Infrastructure • Virtualization Infrastructure • Customer • Guest OS Management • Application Configuration • Account Management • Security Groups • ACLs • Identity Management
- 8. Different customer viewpoints on security • CEO: protect shareholder value • PR exec: keep out of the news • CI{S}O: preserve the Confidentiality, Integrity and Availability (CIA) of data
- 9. AWS SECURITY OFFERS MORE VISIBILITY CONTROL AUDITABILITY
- 10. MORE VISIBILITY
- 11. CAN YOU MAP YOUR NETWORK? WHAT IS IN YOUR ENVIRONMENT RIGHT NOW?
- 14. Visibility • Logs == one component of visibility – Obtain – Retain – Analyze
- 15. TRUSTED ADVISOR
- 19. MORE CONTROL
- 20. Defense in Depth – Multi level security • Physical security of the data centers • Network security • System security • Data security
- 21. LEAST PRIVILEGE PRINCIPLE CONFINE ROLES ONLY TO THE MATERIAL REQUIRED TO DO A SPECIFIC WORK
- 22. MORE CONTROL ON YOUR NETWORK
- 30. Use Amazon Virtual Private Cloud (VPC)
- 31. Private Subnet Private Subnet Availability Zone A VPC CIDR: 10.1.0.0 /16 Private Subnet Private Subnet Availability Zone B 10.1.1.11 /24 10.1.3.33 /24 10.1.2.22 /24 10.1.4.44 /24
- 32. Private Subnet Private Subnet Availability Zone A VPC CIDR: 10.1.0.0 /16 Private Subnet Private Subnet Availability Zone B Instance A 10.1.1.11 /24 Instance C 10.1.3.33 /24 Instance B 10.1.2.22 /24 Instance D 10.1.4.44 /24
- 33. Public Subnet Private Subnet Availability Zone A VPC CIDR: 10.1.0.0 /16 Public Subnet Private Subnet Availability Zone B Instance A 10.1.1.11 /24 Instance C 10.1.3.33 /24 Instance B 10.1.2.22 /24 Instance D 10.1.4.44 /24 Internet Gateway Route Table Destination Target 10.1.0.0/16 local 0.0.0.0/0 IG
- 34. Public Subnet Private Subnet Availability Zone A VPC CIDR: 10.1.0.0 /16 Public Subnet Private Subnet Availability Zone B Instance A 10.1.1.11 /24 Instance C 10.1.3.33 /24 Instance B 10.1.2.22 /24 Instance D 10.1.4.44 /24 Internet Gateway Virtual Private Gateway VPN connection Customer data center Customer data center AWS Direct Connect Route Table Destination Target 10.1.0.0/16 local Internal CIDR VGW
- 35. EVEN MORE CONTROL ON YOUR NETWORK
- 36. Additional Network Security Control available from AWS Partners AWS Marketplace: http://aws.amazon.com/marketplace – 1-Click Launch into VPC of appliances from: – aiScaler – Barracuda – Brocade – Checkpoint – Cisco – Citrix – Dome9 – F5 – Imperva – Riverbed – Sophos – Trend Micro And many more…
- 38. MORE CONTROL ON IDENTITY & ACCESS
- 39. USE AWS IAM IDENTITY & ACCESS MANAGEMENT
- 40. CONTROL WHO CAN DO WHAT IN YOUR AWS ACCOUNT
- 44. ACCESS TO SERVICE APIs
- 45. MULTI-FACTOR AUTHENTICATION: MFA DELETE PROTECTION MFA-PROTECTED API ACCESS
- 47. MFA-PROTECTED API ACCESS { "Version": "2012-10-17", "Statement": [{ "Effect": "Allow", "Action": [ "ec2:StopInstances", "ec2:TerminateInstances" ], "Resource": ["*"], "Condition": {"Null": {"aws:MultiFactorAuthAge": "false"}} }] }
- 48. SSO and IDENTITY FEDERATION with SAML 2.0
- 49. MORE CONTROL ON YOUR DATA
- 50. YOUR DATA STAYS WHERE YOU PUT IT
- 51. Regions and Availability Zones Australia
- 52. DATA ENCRYPTION Server-side encryption: managed by AWS • Amazon Elastic Block Store (EBS) • Amazon Redshift • Amazon S3 • Amazon Glacier • AWS Storage Gateway • AWS Relational Database Service TDE (Oracle and SQL Server)
- 53. DATA ENCRYPTION Client-side encryption: managed by Customer • Open-source solutions: • Block: Loop-AES, dm-crypt, TrueCrypt • File: eCryptfs, EncFS • Commercial solutions: • Trend Micro Secure Cloud • Safenet Protect V • Customer-managed Key Management Infrastructure
- 54. AWS CloudHSM Powered by Luna SA HSM appliance from Safenet Managed and monitored by AWS, but you control the keys Increase performance for applications that use HSMs for key storage or encryption Comply with stringent regulatory and contractual requirements for key protection EC2 Instance AWS CloudHSM AWS CloudHSM
- 56. “GAME DAYS” INSERT ARTIFICIAL SECURITY INCIDENTS. MEASURE SPEED OF DETECTION AND EXECUTION.
- 58. AWS CLOUDTRAIL
- 59. You are making API calls... On a growing set of services around the world… CloudTrail is continuously recording API calls… And delivering log files to you
- 60. Use Cases enabled by CloudTrail • Troubleshoot Operational Issues • Track Changes to AWS Resources • Security Analysis • Compliance Aid
- 61. VULNERABILITY & PENETRATION TESTING
- 62. VULNERABILITY & PENETRATION TESTING
- 64. Security and HIPAA on AWS © 2010 Orbograph Ltd. – All rights reserved Ran Rothschild September 17, 2014
- 65. Orbotech (ORBK) Quality control for world’s largest electronics manufacturers $440M PUBLICALLY TRADED FIRM EMPLOYEES IN MORE THAN 40 OFFICES 1650+ 6 R&D CENTERS WORLDWIDE Key enabler of advanced electronic devices 30+ YEARS OF LEADERSHIP AT THE © 2010 Orbograph Ltd. – All rights reserved CUTTING-EDGE OF INNOVATION PATENTS AND PATENT APPLICATIONS 500+
- 66. Lines of Business NEXT GENERATION RECOGNITION 18 Years of Continual Process Improvements… Check Processing Automation HEALTHCARE PAYMENTS AUTOMATION CENTER 3+ Years of Innovation… Delivering Healthcare Payments Automation within Revenue Cycle Management (RCM) © 2010 Orbograph Ltd. – All rights reserved (HPAC)
- 67. Challenges/Problems We needed to build an infrastructure that was Dynamic, Elastic, Cost Effective and Secure that would fully comply with HIPAA. © 2010 Orbograph Ltd. – All rights reserved
- 68. © 2010 Orbograph Ltd. – All rights reserved
- 69. The Fluidity of HIPAA © 2010 Orbograph Ltd. – All rights reserved
- 70. © 2010 Orbograph Ltd. – All rights reserved WE WERE CONCERNED
- 71. © 2010 Orbograph Ltd. – All rights reserved The Solution
- 72. LEVERAGE © 2010 Orbograph Ltd. – All rights reserved
- 73. The Implementation methodology We use best of breed layered security 1. Optimal security solutions 2. Different solutions 3. Hybrid – AWS and external © 2010 Orbograph Ltd. – All rights reserved
- 74. Some examples © 2010 Orbograph Ltd. – All rights reserved AWS out of the box: VPC Subnets IAM Security Groups Trusted Advisor AWS Audited Security Processes
- 75. Some examples © 2010 Orbograph Ltd. – All rights reserved External: Porticor - Full disk encryption – Combining and splitting encryption keys Sophos for IDS/IPS DOME9 - Security Group management MFA
- 76. The Power of Architecture Planning Governance Constant evaluation and adaptation © 2010 Orbograph Ltd. – All rights reserved
- 77. © 2010 Orbograph Ltd. – All rights reserved
- 78. THANK YOU FOR LISTENING Email: ran.rothschild@orbograph.com LinkedIn: il.linkedin.com/in/ranrothschild/ © 2010 Orbograph Ltd. – All rights reserved
- 80. 92% of private clouds are still falling short of the core requirements: self-service, full automation, tracking and monitoring.
- 81. What are customers really looking for ?
- 82. PRIVATE COMPUTE PRIVATE STORAGE PRIVATE NETWORK PRIVATE KEY MANAGEMENT GOVERNANCE
- 83. PRIVATE COMPUTE PRIVATE STORAGE PRIVATE NETWORK PRIVATE KEY MANAGEMENT GOVERNANCE
- 84. INTEGRATION WITH ON-PREMISES RESOURCES Integrated networking Integrated access control Integrated cloud backups Single pane of glass # 192.168.1.11 # 192.168.1.10 Microsoft Active Directory Custom LDAP App 1 AWS Storage Gateway
- 85. MORE VISIBILITY MORE CONTROL MORE AUDITABILITY
- 86. “Based on our experience, I believe that we can be even more secure in the AWS cloud than in our own data centers” Tom Soderstrom – CTO – NASA JPL
- 87. Attitudes and Perceptions Around Security and Cloud Services Nearly 60% of organizations agreed that CSPs [cloud service providers] provide better security than their own IT organizations. Source: IDC 2013 U.S. Cloud Security Survey, doc #242836, September 2013
- 90. Thank You! AWS EXPERT? GET CERTIFIED! Jean-Pierre Le Goaller aws.amazon.com/certification Principal Solutions Architect @jplegoal
Hinweis der Redaktion
- Auditability to us is our way to have a conversation with a customer about the way we practice the art and science of security. The way we have that conversation with customers requires a common language, just as we all speak different languages. there are many different languages spoken on the audit world as well. out of a audit process comes out a series of artifacts. those artifacts are the proof that we are doing what we are saying. and that proof is made available to the auditors who act on behalf of our customers to examine what we do and how we do it. all the things that are control objects that appear in that list, are items our auditors evaluate during the proccess of the soc1 or the soc2 audit. so they will come to our facilities and see that you have camera at 67 different locations here, show me the view from the camera 25 that hows the locking door number one. and we have to pull it up and show to them. they say ok. now i wanna see the video recorded from that camera on june 24 from 9am to 10am and we have to pull it up and show to them. to demonstrate that we actually have the recordings we say we do and we keep them for the amount of time that we say we do. AUDITABLE Don’t trust me, trust the independent 3rd party auditors (Ernst & Young)
- Lets talk about private clouds… Old guard hardware and software companies like to talk about how easy it is to building something that resembles AWS inside a customer’s data center… of course this usually involves buying more hardware and more software… the problem here is that the reality of the customer experience is typically very different from the private cloud dream that these companies are being sold.
- According to research from Forrester, a vast majority of customers are struggling mightily to build on-premises environments that deliver even the most basic core functionality that end users expect from clouds… things like self-service provisioning, automation, resource tracking and monitoring.
- Now why are companies trying to build private clouds in the first place? Lets look at the functional requirements that we hear the most from our conversations with customers.
- They’re looking for a private network, private compute, private storage, private management of their encryption keys and then governance functionality so that they can maintain the control they expect over resources.
- the good news is that you can get all of this in the cloud with AWS Goversnance: fine grained access control, auditability (CloudTrail) etc…
- AWS has a wide range of data protection capabilities. With S3, encrypting all of your data is as easy checking a box in the AWS management console. With EBS, you can use an encrypted file system of your choice to provide encrypted block storage for your EC2 instances. For customers with requirements for single-tenant, isolated encryption key management, we offer a service called CloudHSM: generate, use and store encryption keys. AWS staff does not have access to these keys. Uses SafeNet Luna. Independently validated devices. For customers with regulatory requirements for single-tenant object or block storage, we offer the capability to connect their EC2 instances to dedicated storage arrays over a private, low-latency connection.
- For customers who want a cloud with private compute capabilities, we offer a range of options to isolate their compute resources from other AWS customers. For further isolation of your compute resources, you can logically isolate your instances in a private network using VPC For customers with regulatory or compliance requirements for single-tenant hardware, we have EC2 dedicated instances that provide physical isolation.
- For customers who want a cloud with private networking, we have VPC, which lets customers define their own private, isolated network and with AWS direct connect, customers can bypass the public Internet and connect to AWS through private and dedicated network connections.
- AWS also give you the ability to support enterprise governance requirements. With our IAM service, we give customers fine-grained control over what employees can access and what they can do with those resources. Our CloudTrail service logs user activities to enable audits of employee use of your AWS account. And, we give you full control over where your data is stored so you can easily comply with data residency compliance requirements