Getting Started With AWS Security
•
5 gefällt mir•1,077 views
Introduction of tools and features to help you to meet your security objectives.
Empfohlen
Empfohlen
Weitere ähnliche Inhalte
Was ist angesagt?
Was ist angesagt? (20)
Andere mochten auch
Andere mochten auch (20)
Ähnlich wie Getting Started With AWS Security
Ähnlich wie Getting Started With AWS Security (20)
Mehr von Amazon Web Services
Mehr von Amazon Web Services (20)
Kürzlich hochgeladen
Kürzlich hochgeladen (20)
Getting Started With AWS Security
- 1. © 2016 AWS and affiliates, all rights reserved Security Architecture Loft Getting Started with AWS Security Don Edwards Security Solutions Architect
- 2. © 2016 AWS and affiliates, all rights reserved Prescriptive Approach Understand AWS Security Practice Build Strong Compliance Foundations Integrate Identity and Access Management Enable Detective Controls Establish Network Security Implement Data Protection Optimize Change Management Automate Security Functions
- 3. © 2016 AWS and affiliates, all rights reserved Understand AWS Security Practice
- 4. © 2016 AWS and affiliates, all rights reserved Why is Enterprise Security Traditionally Hard? Lack of visibility Low degree of automation
- 5. © 2016 AWS and affiliates, all rights reserved AND Move Fast Stay Secure
- 6. © 2016 AWS and affiliates, all rights reserved Making life easier Choosing security does not mean giving up on convenience or introducing complexity.
- 7. © 2016 AWS and affiliates, all rights reserved Security ownership as part of DNA • Promotes culture of “everyone is an owner” for security • Makes security a stakeholder in business success • Enables easier and smoother communication Distributed Embedded
- 8. © 2016 AWS and affiliates, all rights reserved Strengthen your security posture Get native functionality and tools Over 30 global compliance certifications and accreditations Leverage security enhancements gleaned from 1M+ customer experiences Benefit from AWS industry leading security teams 24/7 Security infrastructure built to satisfy military, global banks, and other high-sensitivity organizations
- 9. © 2016 AWS and affiliates, all rights reserved AWS Foundation Services Compute Storage Database Networking AWS Global Infrastructure Regions Availability Zones Edge Locations Client-Side Data Encryption Server-Side Data Encryption Network Traffic Protection Platform, Applications, Identity and Access Management Operating System, Network and Firewall Configuration Customer content Customers Security is a shared responsibility Customers are responsible for their security IN the cloud AWS is responsible for the security OF the cloud
- 10. © 2016 AWS and affiliates, all rights reserved Security Training Security Fundamentals on AWS (Free online course) Security Operations on AWS (3-day class) Details at aws.amazon.com/training
- 11. © 2016 AWS and affiliates, all rights reserved Build Strong Compliance Foundations
- 12. © 2016 AWS and affiliates, all rights reserved AWS Assurance Programs AWS maintains a formal control environment • SOC 1 Type II • SOC 2 Type II and public SOC 3 report • ISO 27001, 27017, 27018 Certification • Certified PCI DSS Level 1 Service Provider • FedRAMP Authorization • Architect for HIPAA compliance
- 13. © 2016 AWS and affiliates, all rights reserved AWS Trusted Advisor AWS Trusted Advisor
- 14. © 2016 AWS and affiliates, all rights reserved Integrate Identity and Access Management
- 15. © 2016 AWS and affiliates, all rights reserved AWS Identity and Access Management IAM Users IAM Groups IAM Roles IAM Policies
- 16. © 2016 AWS and affiliates, all rights reserved Account Governance – New Accounts InfoSec’s Cross-Account Roles AWS Account Credential Management (“Root Account”) Federation Baseline Requirements Actions and Conditions Map Enterprise Roles
- 17. © 2016 AWS and affiliates, all rights reserved Enable Detective Controls
- 18. © 2016 AWS and affiliates, all rights reserved AWS CloudTrail and Amazon CloudWatch AWS CloudTrail Amazon CloudWatch • Enable Globally for All AWS Regions • Encryption and Integrity Validation • Archive and Forward • Amazon CloudWatch Logs • Metrics and Filters • Alarms and Notifications
- 19. © 2016 AWS and affiliates, all rights reserved Establish Network Security
- 20. © 2016 AWS and affiliates, all rights reserved AWS Global Infrastructure 14 AWS Regions • North America • Europe • Asia Pacific • South America Each region has at least two Availability Zones • 35 Availability Zones (AZs) 63 AWS Edge Locations • North America • Europe • Asia Pacific • South America Availability Zone A Availability Zone B Availability Zone C Copyright © 2016 AWS and affiliates, all rights reserved
- 21. © 2016 AWS and affiliates, all rights reserved VPC Public Subnet 10.10.1.0/24 VPC Public Subnet 10.10.2.0/24 VPC CIDR 10.10.0.0/16 VPC Private Subnet 10.10.3.0/24 VPC Private Subnet 10.10.4.0/24 VPC Private Subnet 10.10.5.0/24 VPC Private Subnet 10.10.6.0/24 AZ A AZ B Public ELB Internal ELB RDS Master Autoscaling Web Tier Autoscaling Application Tier Internet Gateway RDS Standby Snapshots Multi-AZ RDS Data Tier Existing Data Center Virtual Private Gateway Customer Gateway VPN Connection Direct Connect Network Partner Location Administrators and Corporate Users Amazon Virtual Private Cloud
- 22. © 2016 AWS and affiliates, all rights reserved Availability Zone A Private subnet Public subnet Private subnet Availability Zone B Public subnet Private subnet ELB Web Back end VPC CIDR 10.1.0.0/16 ELB Web Back end VPC sg_ELB_FrontEnd (ELB Security Group) sg_Web_Frontend (Web Security Group) Security Groups sg_Backend (Back-End Security Group)
- 23. © 2016 AWS and affiliates, all rights reserved Implement Data Protection
- 24. © 2016 AWS and affiliates, all rights reserved Cryptographic Services Amazon CloudHSM • Deep integration with AWS Services • CloudTrail • AWS SDK for application encryption • Dedicated HSM • Integrate with on-premises HSMs • Hybrid Architectures AWS KMS
- 25. © 2016 AWS and affiliates, all rights reserved Optimize Change Management
- 26. © 2016 AWS and affiliates, all rights reserved AWS Config and Config Rules AWS Config Config Rules • Record configuration changes continuously • Time-series view of resource changes • Archive and compare • Enforce best practices • Automatically roll back unwanted changes • Trigger additional workflow
- 27. © 2016 AWS and affiliates, all rights reserved AWS Config Partners
- 28. © 2016 AWS and affiliates, all rights reserved AWS CloudFormation – Infrastructure as Code Template StackAWS CloudFormation • Orchestrate changes across AWS Services • Use as foundation to Service Catalog products • Use with source code repositories to manage infrastructure changes • JSON-based text file describing infrastructure • Resources created from a template can be updated • Updates can be restricted
- 29. © 2016 AWS and affiliates, all rights reserved Change Sets – Create Change Set
- 30. © 2016 AWS and affiliates, all rights reserved Change Sets
- 31. © 2016 AWS and affiliates, all rights reserved Change Sets
- 32. © 2016 AWS and affiliates, all rights reserved Automate Security Functions
- 33. © 2016 AWS and affiliates, all rights reserved Evolving the Practice of Security Architecture Security architecture as a separate function can no longer exist. Static position papers, architecture diagrams, and documents UI-dependent consoles and technologies Auditing, assurance, and compliance are decoupled, separate processes Current Security Architecture Practice
- 34. © 2016 AWS and affiliates, all rights reserved Evolving the Practice of Security Architecture Security architecture can now be part of the ‘maker’ team. Architecture artifacts (design choices, narrative, etc.) committed to common repositories Complete solutions account for automation Solution architectures are living audit/compliance artifacts and evidence in a closed loop Evolved Security Architecture Practice AWS CodeCommit AWS CodePipeline Jenkins
- 35. © 2016 AWS and affiliates, all rights reserved AWS Marketplace Security Partners Infrastructure Security Logging and Monitoring Identity and Access Control Configuration and Vulnerability Analysis Data Protection
- 36. © 2016 AWS and affiliates, all rights reserved Prescriptive Approach – Get Started! Understand AWS Security Approach Build Strong Compliance Foundations Integrate Identity and Access Management Enable Detective Controls Establish Network Security Implement Data Protection Optimize Change Management Automate Security Functions
Hinweis der Redaktion
- It’s intentionally hard because you want to know when things change – if stuff changes and you don’t know about it, a control might fail. And … Because if you screw something up, you can’t easily change it once they are underway – part of this is circular reasoning and infinitely regressive. “We have a process so that we don’t screw it up because if we screw it up, we have to repeat a bunch of other processes we don’t own.” /…./ Madness. Change detection is actually hard: Relies on near perfect asset control Relies on mapping assets to business risk or data classification Requires that systems react to stimulus and inform you when they are changed. You get sick, you vomit, if you break an arm, it hurts. If your infrastructure changes it should tell you. Also, in traditional infrastructure security doing the actual changes is hard: Most of the security processes are manual not conducive to automation Vendor selection tends to be a long tail based purely on feature and functionality, not just the finance and RFP stuff we discussed. You have to roll out vendor products (appliances, software, etc.) It’s actually physical stuff in many cases It’s hard break down security projects into smaller batches consisting of iterative, low-risk changes – these are big projects, such as expanding a data center, reconfiguring trust zones, redeploying application, redeploying servers. So enterprise security comes first … … because it’s enterprise security is hard and … because it requires so much planning which takes so long and … because there are so many processes and … because it’s hard to detect change and ensure low-impact changes and failures .. Because change is not automated and the size or complexity of change is too large. Yes! I think by focusing on how we can improve the visibility of changes and the ability to make course corrections quickly or automatically /…./ and with low risk, we can greatly improve security. The underlying reason enterprise security is top of mind in cloud adoption is because you want to know when controls change /…./ and because It’s currently very hard to repair a control /…./ or course correct a project if a control will be impacted. You could say “it comes first because I don’t want to get hacked” – riiiiiight… that’s supposed to be the reason we have all this planning and process in place in the first place– but that’s not working otherwise we’d all say it was easy. It’s certainly not as fun as it should be…
- For a long time, most organizations have had to make a choice between moving fast or maintaining a high degree of security However, one of the fundamental benefits of the cloud is that it let’s you do both.
- We look after the security OF the cloud, and you look after your security IN the cloud.
- TALKING POINTS: We’ve released a new security curriculum with two new classes. · Security Fundamentals on AWS – free, online course for security auditors and analysts This self-paced course is designed to introduce you to fundamental cloud computing and AWS security concepts including AWS access control and management, governance, logging, and encryption methods. It also covers security-related compliance protocols and risk management strategies, as well as procedures related to auditing your AWS security infrastructure. · Security Operations on AWS – 3-day class for Security engineers, architects, analysts, and auditors This course teaches you how to stay secure and compliant in the AWS cloud. It covers AWS best practices for securing data and systems in the cloud, and addresses security features of key AWS services. This course also teaches you about regulatory compliance standards and use cases for running regulated workloads on AWS. You also get practice using tools for automation and continuous monitoring—taking your security operations to the next level.
- Map your internal framework to our certifications – inheritence! ISO 27017 – cloud specific control ISO 27018 – protections on personal data
- Just cover the basics, we aren’t going into a lot of depth on IAM today.
- Workforce Lifecycle integration AssumeRole APIs baked into the heart of developer behavior, federation, cross-account governance Use SAML 2.0 Just-in-time access. Use APIs to only open up the network for management when necessary. Change and break/fix ticketing executes scripts to build bastions or open up Security Groups upon approval or stage.
- Demo - console
- Customer retain control and ownership of their data. Wherever the Customer put his data, the data doesn’t move. Each region is completely independent and is designed to be completely isolated from the other regions. This achieves the greatest possible fault tolerance and stability.
- Security Groups serve as a layer-4 firewall and are logically defined within a VPC. Security groups provide stateful inspection Security groups span across a VPC at the regional level, meaning they go across subnets and AZ’s …. Providing a natural, logical way to group the assets in an application.
- Author custom rules using AWS Lambda Invoked automatically for continuous assessment Use dashboard for visualizing compliance and identifying offending changes
- View of a simple VPC
- Can tie to CM system with name and/or tags as options passed into change set.
- Can tie to CM system with name and/or tags as options passed into change set.
- AWS Security Partners offer hundreds of industry-leading products that are equivalent, identical to, or integrate with existing controls in your on-premises environments. These products complement the existing AWS services to enable you to deploy a comprehensive security architecture and a more seamless experience across your cloud and on-premises environments. Infrastructure Security Designed to identify and protect your applications and data from cyber-attacks and other advanced threats vectors. Logging & Monitoring Maintain visibility and auditability of activity in your application infrastructure, while providing policy-driven alerting, and reporting. Identity & Access Control Help define and manage access policies to enforce business governance including, user authentication, SSO, and enforcement. Configuration & Vulnerability Analysis Help inspect your application deployments for security risks and vulnerabilities, while providing priorities and advice to assist with for remediation. Data Protection Assist with safeguarding your data from unauthorized disclosure and modification, through encryption, key management, and policy-driven controls.