Build on AWS

1. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Hugh Barrett, VP Technical Solution, CISSP, CSSLP
Telos Corporation
Performing A Security Assessment of The Cloud
Using Tools, Best Practices and The Risk
Management Framework: A Case Study

2. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Agenda
Setting the Stage
Risk Management Framework, A Brief Overview
Air-Gap Region
Assessment “of” The Cloud
Common Control Providers: Assessment “packages of” The
CloudAssessment of your Workloads
Xacta 360, The Automated Tool of Choice

3. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
The Risk Management Framework

4. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Risk Management Framework
Step 2: Select Security Controls
Step 5: Authorize Systems
Step 4: Assess Security Controls
Step 3: Implement Controls
Step 6: Monitor Security Controls
Step 1: Categorize Systems
Gathering information about
the system or application
Tailor your controls
Apply overlays
Apply inheritance
How does my system or
application implement each
applicable security controls
Independent validation that your
system has implemented all controls
Your risk exec and
authorizing officials review
and grant Authorization To
Operate (ATO)
Continuously monitor the
system’s health as it pertains
to the acceptable risk and
mission/business

5. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Confidentiality, Integrity and Availability
Confidentiality = Low, Moderate or High
• How sensitive is the data that is processed by the system?
• What is the impact to the mission/business if the data is compromised or
stolen?
Integrity = Low, Moderate or High
• How accurate is your data and how it impacts the mission/business if
altered incorrectly?
Availability = Low, Moderate or High
• What is the impact to the mission/business if the data is not available
when needed?

6. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
NIST 800-53 Base Control Set
AC-1.a.1.a
AC-1.a.1.b
AC-1.a.1.c
AC-1.a.2.a
AC-1.a.2.b
AC-1.a.2.c
AC-1.b.1.a
AC-1.b.1.b
AC-1.b.2.a
AC-1.b.2.b
Control Id Control ValidatorAC-1

7. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
NIST 800-53 EXT More Granular Control Set
AC-1
AC-1.a.1
AC-1.a.2
AC-1.b.1
AC-1.b.2
AC-1.a.1.a
AC-1.a.1.b
AC-1.a.1.c
AC-1.a.2.a
AC-1.a.2.b
AC-1.a.2.c
AC-1.b.1.a
AC-1.b.1.b
AC-1.b.2.a
AC-1.b.2.b

8. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Information Type / Control Association
Security Controls
Confidentiality Integrity Availability
L M H L M H L M H
AC-1.a.1 - Access Control Policy and Procedures x x x x x x x x x
AC-2 (1) - Automated System Account Management x x x x x
AT-2 (2) - Insider Threat x x x x x
AT-3.c - Role-Based Security Training x x x x x x
AU-1.a.1 - Audit and Accountability Policy and Procedures x x x x x x x x x
CA-7.c - Continuous Monitoring x x x x
CM-3.b - Configuration Change Control x x x x x x
CP-2 (6) - Alternate Processing / Storage Site x x x x
IA-2 (1) - Network Access To Privileged Accounts x x x x x x x
IR-9.f - Information Spillage Response x x

9. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Information Type Categorization
Data Type Confidentiality Integrity Availability
Business Example
Financial Data M H L
Employee Salary M L M
Trade Secrets H H L
Suppliers M L M
Mission Example
Targeting Data H H H
Counter Intelligence H M M
Mapping Data M H L
Personal identifying Info H H L

10. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
The Use Of Overlays
Overlays are used to alter organizational defined control sets
• Use alter controls based on specific business requirements
• Add more rigor to the assessment
• Require more stringent organizational values
Example of overlays
• Privacy
• Financial
• Defense
• Intelligence

11. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Common Control Providers
Usually associated with enterprise systems or services
• Authentication services
• Corporate policies
• Physical security
Why have Common Control Providers
• Reduces the amount of work associated with your assessment
• Huge time saver
• With the use of AWS shared responsibility model, it gets your
systems to the cloud faster

12. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Applicable Controls

13. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Isolated Region

14. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Isolated Regions
Air-gap Cloud 1Air-gap Cloud 2

15. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Air-Gapped
Network is physically isolated from unsecured networks
Reason
• Complete control over who has access
• Complete control over what workloads are deployed
• Ability to enforce a process for vetting workloads before
deployment
• in addition
• Ability to take advantage of all that the AWS cloud has to
offer

16. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Assessment of the Air-gap Region
We needed automation, so we decided to use Xacta® 360 and
Xacta® Continuum
• Define a process
• Enforce the process
• Collaborate with AWS
compliance team
• Apply the Risk
Management
Framework
• Supported multiple
standard

17. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Assessment of The Air-gap Region
Steps performed to assess the air-gap region and services:
1. Detailed documentation of the region
2. Categorization of the data that will processed and stored
3. Select the controls and overlays
4. Needed a detailed description of how the air-gap region met each
control
5. Each implementation must be independently validated by your
assessors
6. Leadership has to assess risk associated with each failed control

18. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Using Inheritance To Expedite the Assessment
Air-gap
Infrastructure
Regions
Edge Locations
Availability Zones
Storage Database NetworkingCompute
Infrastructure assessed
separately
Security
Package
Inherited
controls
Inherited
controls
Inherited
controls
Security
Package
Each service assessed
separately Required RMF
documentation
Required RMF
documentation
Security Assessment of Your Air-Gap Region
Security assessment
“of” the Cloud
856 Controls
737 Inherited Controls
119 Controls

19. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
AWS Infrastructure Common Control Providers
Infrastructure
Security Package
EC2
Security Package
IAM
Security Package
EBS
Security Package
RDS
Security Package
Workspaces
Security Package
S3
Security Package
Security “packages”
“of” the Cloud
Provided
controls
Provided
controls
Provided
controls
Provided
controls
Provided
controls
Provided
controls
Responsible for
security “in” the Cloud
CustomerCustomer Workloads Inherit Controls
From the “Packages of The Cloud”

20. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Responsible for
security “in” the Cloud
Customer
Customer Implements
Their Own Controls
Responsible for
security “of” the Cloud
AWS
Shared Controls
Provided Through Assessment Packages
Leverage the AWS Shared Responsibility Model for faster cloud compliance and deployment. While AWS manages security of the cloud,
security in the cloud is the responsibility of the AWS customer. Xacta inherits the AWS security controls while enabling you to implement
and manage security compliance for your own content, platform, applications, systems, and networks.
Common Controls
PE, MP, MA
Implementing the AWS Shared Responsibility
Model

21. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Assessing Your Workload

22. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Assessing Your Workload
Steps performed to assess your workload:
1. Documentation of the system
2. Categorization of the data that will processed and stored
3. Select the controls and overlays
4. Utilize the AWS shared responsibility (Control Providers)
5. Detailed description of how the system meet each control
6. Each implementation must be independently validated by your
assessors
7. Assess risk associated with each failed control

23. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Assessing Your Workload
Storage Database NetworkingComputeConsumer
Facing Service
Shared
controls
Shared
controls
Shared
controls
My Workload
Workload will inherit some number
of controls from the infrastructure
EC2
S3
WorkSpaces
IAM
CloudTrail RDS
Security
Baseline
Access Control
Audit Control
Media Protection
Config Management
Physical Control
CloudFormation

24. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Continuous Monitoring of Your Workload
Identify Critical Controls
Set up a schedule for reviewing controls
Periodic vulnerability scans
Monitor configuration changes

25. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Tools Used

26. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
OutoftheBox
implementationoftheAWSshared
responsibilitymodel
Xacta360
Provider Projects
C-I-A, Low Moderate, High
Data Categorization
Support International Standards/Regulations
Risk Management
Risk Calculations
ISO, NIST, CSF
Automated Validation

27. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Categorize your Information System

28. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Select Control Set

29. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Control Inheritance

30. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Implementation

31. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Assess Security Controls

32. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Useful RMF Document
SP 800-37 - RMF Framework
SP 800-39 - Managing Information Security Risk
SP 800-30 - Guide For Conducting Risk Management
SP 800-53 - Controls
SP 800-137 - Continuous Monitoring
SP 800-60 - Data Categorization
SP 800-171 - Industrial Security

33. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Thank You!
Now Open for Questions
Stop by our Booth #xxx for more information
Risk Management and Xacta 360