the 2014 aws enterprise summit - understanding aws security

AWS Security

Bill Shinn billshin@amazon.com

Principal Solutions Architect - Security, Amazon Web Services

Sami Zuhuruddin, samiz@amazon.com

Solutions Architect, Amazon Web Services

Different customer viewpoints on security

PR execkeep out of the news

CEOprotect shareholder

value

CI{S}Opreserve the

confidentiality, integrity and availability of data

Security is Our No.1 PriorityComprehensive Security Capabilities to Support Virtually Any Workload

Customer Ecosystem

Partner Ecosystem

Every Customer Benefits

Physical Security

People & Procedures

Network Security

Platform Security

SECURITY IS SHARED

WHAT NEEDS TO BE DONE TO KEEP THE SYSTEM SAFE

WHAT WE DO

FOR YOU

WHAT YOU DO YOURSELF

EVERY CUSTOMER HAS ACCESS TO THE SAME SECURITY CAPABILITIES

CHOOSE WHAT’S RIGHT FOR YOUR BUSINESS

“Based on our experience, I believe that we can be even more secure in the AWS cloud than in our own data centers”

Tom Soderstrom – CTO – NASA JPL

AWS Security Offers More…

Visibility Auditability Control

MORE VISIBILITY

• Can you map your network?

• What is in your environment right now?

TRUSTED ADVISOR

MORE AUDITABILITY

Certifications and Accreditations for Workloads That Matter

Security control objectives

1. Security organization

2. Amazon user access

3. Logical security

4. Secure data handling

5. Physical security and environmental safeguards

6. Change management

7. Data integrity, availability and redundancy

8. Incident handling

AWS CLOUDTRAIL

You are making API calls...

On a growing set of services around

the world…

CloudTrail is continuously recording API

calls…

And delivering log files to you

Security AnalysisUse log files as an input into log management and analysis solutions to perform security analysis and to detect user behavior patterns.

Track Changes to AWS ResourcesTrack creation, modification, and deletion of AWS resources such as Amazon EC2 instances, Amazon VPC security groups and Amazon EBS volumes.

Troubleshoot Operational IssuesQuickly identify the most recent changes made to resources in your environment.

Compliance AidEasier to demonstrate compliance with internal policies and regulatory standards.

‣ CloudTrail records API calls and delivers a log file to your S3 bucket.

‣ Typically, delivers an event within 15 minutes of the API call.

‣ Log files are delivered approximately every 5 minutes.

‣ Multiple partners offer integrated solutions to analyze log files.

LOGSOBTAINED, RETAINED, ANALYZED

PROTECT YOUR LOGS WITH IAMARCHIVE YOUR LOGS

MORE CONTROL

Defense in DepthMulti level security

• Physical security of the data centers• Network security• System security• Data security

DATA

AWS Security Delivers More Control & Granularity

AWS CloudHSM

Defense in depth

Rapid scale for security

Automated checks with AWS Trusted

Advisor

Fine grained access controls

Server side encryption

Multi-factor authentication

Dedicated instances

Direct connection, Storage Gateway

HSM-based key storage

AWS IAM

Amazon VPC

AWS Direct Connect

AWS Storage Gateway

Customize the implementation based on your business needs

LEAST PRIVILEGE PRINCIPLE AT AWS

Least Privilege Principle

Confine roles only to the material required to do specific work

Least Privilege Principle

Separate networks for corporate work vs. accessing customer data

Least Privilege Principle

Must have a business need-to-know about sensitive information like data center

locations

Least Privilege Principle

Must have a business need-to-know in order to access data centers

Simple Security Controls

Are the easiest to get right, easiest to audit, and easiest to enforce

MORE CONTROLON IDENTITY & ACCESS

Use AWS Identity & Access Management (IAM)

Control who can do what with your AWS account

Best Practice

AWS IAM: Recent InnovationsSecurely control access to AWS services and resources

• Delegation– Roles for Amazon EC2– Cross-account access

• Powerful integrated permissions– Resource level permissions:

Amazon EC2, Amazon RDS, Amazon DynamoDB, AWS CloudFormation

– Access control policy variables– Policy Simulator– Enhanced IAM support: Amazon

SWF, Amazon EMR, AWS Storage Gateway, AWS CloudFormation, Amazon Redshift, Elastic Beanstalk

• Federation– Web Identity Federation– AD and Shibboleth

examples– Partner integrations– Case study: Expedia

• Strong authentication– MFA-protected API access– Password policies

• Enhanced documentation and videos

ACCESS TOSERVICE APIs

Amazon DynamoDB Fine Grained Access Control

Directly and securely access application data in Amazon DynamoDB

Specify access permissions at table, item and attribute levels

With Web Identity Federation, completely remove the need for proxy servers to perform authorization

MORE CONTROLOF YOUR DATA

MFA Delete Protection

Your data stays where you put it

Best Practice

It’s Not Just Having Services in a Couple of Regions

Hundreds of thousands of customers across 190 countries

800+ government agencies

3,000+ educational institutions

10 regions

26 availability zones

52 edge locations

Everyday, AWS adds enough new server capacity to support Amazon.com when it was a $7 billion global enterprise.

Use Multiple AZs

Amazon S3Amazon DynamoDBAmazon RDS Multi-AZAmazon EBS snapshots

Best Practice

Data Encryption

Choose what’s right for you…• Automated – AWS manages encryption • Enabled – user manages encryption using AWS• Client-side – user manages encryption using

their own mean

AWS CloudHSM

Managed and monitored by AWS, but you control the keys

Increase performance for applications that use HSMs for key storage or encryption

Comply with stringent regulatory and contractual requirements for key protection

EC2 Instance

AWS CloudHSM

AWS CloudHSM

Encrypt Your Data

AWS CloudHSMAmazon S3 SSEAmazon GlacierAmazon RedshiftAmazon RDS…

Best Practice

More Auditability

More Visibility

More Control

IDC Survey

• Attitudes and perceptions around security and cloud services

• Nearly 60% of organizations agreed that CSPs [Cloud Service Providers] provide better security than their own IT organization

Source: IDC 2013 U.S. Cloud security survey

Doc #242836, September 2013

AWS.AMAZON.COM / SECURITY

AWS SECURITY WHITEPAPERS

RISK & COMPLIANCE

AUDITING SECURITY CHECKLIST

SECURITY PROCESSES

SECURITY BEST PRACTICES

AWS MARKETPLACE

SECURITY SOLUTIONS