Building Energy Security Framework

Size: px
Start display at page:

Download "Building Energy Security Framework"

Transcription

1 Building Energy Security Framework Philosophy, Design, and Implementation Building Energy manages multiple subsets of customer data. Customers have strict requirements for regulatory compliance, privacy safeguards, and data integrity. Building Energy takes these requirements very seriously and has architected the Building Energy application system to be extremely secure. This document describes the security philosophy, design, and implementation of the system including the risks mitigated, security controls in place, and contingency plans for extenuating circumstances. Less is More The key mantra of Internet security is Less is More. Fewer moving pieces and exposed points of access means fewer opportunities to access a system in an uncontrolled manner. From an external viewpoint, the Building Energy website is exposed as a web application accessible only via HTTPS for logged-in users with valid accounts or API access keys. There are no other ingress points for access by application users and no other components of the application are exposed to the public Internet. 1

2 Security Layers The Building Energy application is segregated into three layers: Layers 1, 2 and 3. The security layers are arranged like layers of an onion: Layer 3 wraps Layer 2, which in turn wraps Layer 1. Layer 1 is the innermost and Layer 3 is the outermost. Layer 3 cannot access Layer 1; interactions must pass through Layer 2. The following diagram illustrates the logical layered nature of the application. Layer 3 Only Layer 3 is exposed to Internet traffic. This outer layers consists of only two components: an Amazon Web Services (AWS) Elastic Load Balancer (ELB) that handles user HTTPS traffic, and an OpenVPN server that is accessible only by Building Energy developers who have valid VPN keys and valid two-factor authentication device access codes. For key management purposes, the OpenVPN server can only be accessed via SSH from the Building Energy physical office network and requires valid SSH keys and two-factor authentication device access codes. All other access protocols are denied by AWS access firewall rules. Layer 2 Layer 2 contains the web application and data processing resources. It is only accessible via the AWS ELB or the VPN server. AWS network firewall rules prevent all other possible points of Internet traffic ingress from accessing the application resources. Layer 2 applications can make egress access to the Internet, so resources can be updated, patched, and can fetch external data, but no external systems can make ingress traffic to the application other than via the ELB or VPN server. 2

3 Layer 1 Layer 1 is the core layer of the system which contains the master and replica database systems. Layer 1 is firewall accessible only via the application resources in Layer 2. No external ingress or egress traffic from the Internet is permitted to Layer 1 in any way. It is physically impossible for an external actor to access the database resources in Layer 1 without first defeating the AWS ELB system or the VPN server, then defeating the access controls to the application Layer 2, then defeating the access controls to the database Layer 1. Risk Assessment for Defeating Layers As detailed above, defeating Building Energy s security framework would requires multiple access factors to penetrate multiple layers. To defeat Layer 3, and attack would have to either defeat Amazon s industry leading Elastic Load Balancer system, or defeat Building Energy s VPN server. This document will work on the assumption that Amazon takes their ELB security very seriously and that defeating the ELB is a risk mitigated by Amazon s considerable security personnel and is essentially impossible. Even if it were the case the ELB could be defeated, it would go no further than the upstream HTTP port on the Building Energy application, which would provide no unauthorized data access. Attacks on the BE VPN would require multiple attack angles. First, the attacker would need to procure a valid BE VPN key. These keys are stored on encrypted, password-protected hard drives of the BE developer s laptops. Second, the attack would need a valid two-factor authentication device code. Last, the attacker would need a valid SSH key to access the application servers in Layer 2. This means an attacker would need five discrete, separate physical and data resources to succeed: 1. A Building Energy developer s laptop 2. That specific developer s hard drive password 3. That specific developer s VPN key 4. That specific developer s two-factor authentication device 5. That specific developer s SSH key All five of these factors MUST be acquired by an attacker in order to succeed. If any one or more of these factors are not present then the attack has no access to Layers 3 or 2. Layer 1 is protected by physical firewall rules that allows only access to the computing resources in Layer 2. Database access is also password protected, and encrypted over SSL. All traffic between Layers 2 and 1 are passed only on private /24 IP addresses, completely unroutable and inaccessable by external Internet traffic. 3

4 Physical Network Security Amazon provides powerful network security and isolation tools that Building Energy leverages to the maximum to ensure total system security (http://aws.amazon.com/security/). The first layer of security provided by AWS is Identity and Access Management (IAM All access to the Amazon management console is controlled via IAM users and roles. All Building Energy developer and security teams must use two-factor authentication devices to access the console, and only the minimal permissions necessary to manage their role in the system are provided to users. Furthermore, automated deployment tools are also users in a sense via the Amazon API. Deployment tools are granted only the very minimum permissions necessary to deploy a Building Energy stack. For example deployment tools can create specific resources, but they cannot create or change any user privileges. The second layer of physical security provided by AWS is called a Virtual Private Cloud (VPC VPC are isolated network containers, that cannot be accessed by any other AWS customers or systems. Resources on the VPC do not have public IP addresses, but instead have private network addresses in the /24 private network block. This block is unroutable by public Internet routers as defined in RFC The third layer of security provided by AWS are called Availability Zones (AZ ml). AZs are physically separate facilities managed by Amazon, physical access to one AZ cannot be accessed via another. Amazon physical security requires strict measures, including biometric access to physical resources, so that only valid and authorized Amazon personnel ever have access to physical computing resources. Building Energy spreads its resources between AZs to leverage this strong level of physical access control. The fourth layer of physical security provided by AWS are called Subnets (http://docs.aws.amazon.com/amazonvpc/latest/userguide/vpc_subnets.html). Subnets divide up VPCs into separately managed and firewalled network segments. Using firewall rules, access between subnets can be strictly controlled, so that subnets that contain, for example, Layer 2 application resources, can only talk to Layer 1 database resources, and all other access modes are denied. The Building Energy system is contained in a VPC, and broken down into three subnets as detailed in diagram 2. The Layer 2 subnet is considered Public because it can be accessed via Internet traffic coming from the ELB or VPN. The other two subnets are marked Private because they are inaccessible by any external systems. 4

5 This physical diagram maps to the logical diagram discussed at the beginning of this document. The security layers are divided by firewall dashed lines. The three firewalls in this document correlate to the three layers in the logical diagram above. System Software Security The foundation of Building Energy s system software security is AWS. Amazon has an extensive security framework in place that safeguards both Amazon and its customers, including: HIPAA SOC 1/SSAE 16/ISAE 3402 (formerly SAS70) SOC 2 SOC 3 PCI DSS Level 1 ISO FedRAMP(SM) DIACAP and FISMA ITAR FIPS CSA 5

6 MPAA Building Energy leverages AWS resources as much as possible in order to take advantage of these security enhancements (http://aws.amazon.com/compliance/). For example, the Building Energy database is hosed in Layer 3 on an AWS Relational Database Service (RDS) resource. This resource is managed entirely by Amazon, which has access to pre-disclosure security exploit patches and works closely with the Postgres and Linux security teams to ensure that the systems are patched before exploits are released into the wild. Combined with the layered security features described above, this makes for an extremely secure database system. Another resource Building Energy leverages from Amazon is ElastiCache. Instead of running, maintaining, patching and monitoring our own cache servers, Building Energy offloads that work to the AWS teams, which in turn have much higher levels of security resources and access to developers to prevent exploits from ever being exposed on AWS. Like the RDS above, Building Energy also keeps these cache resources in Layer 1, preventing unauthorized access. The Building Energy Application is the only resource not managed by AWS, but Building Energy still applies the same security procedures that Amazon does. Building Energy runs on the most recent and stable Ubuntu Linux release, Upstream security patches are automatically applied every day. Building Energy uses industry-standard application security tools (AppArmor) and intrusion detection tools (tripwire) to ensure that applications cannot break out of their security containers, and that no system files changes or additions are made by unauthorized actors. In the event of an unauthorized change or addition to the system, the tripwire intrusion detection system will alert the Building Energy security team, whose mitigation policy is to suspend and isolate the system, restore the system from a point in time before the intrusion detection, and do post mortem analysis of the intrusion vector and what steps need to be taken to address the issue. It is important to point out that an intrusion has never been detected on the Building Energy system, and is highly unlikely given the multi factor authentication required to access system. A final physical defense is the replication of database snapshots across multiple AWS regions. In the extremely unlikely event of total regional failure a new Building Energy site can be bootstraped and deployed in less than three hours. Application Level Security 6

7 All user access to the Building Energy Application requires a valid login and password. These credentials are sent via HTTPS only, and cannot be intercepted in the clear by network intrusion or man-in-the-middle attacks. The application is developed with the Django python web application framework, which has extensive use in the industry by thousands of large-scale production websites and is considered to be highly secure. Building Energy also takes a proactive approach to mitigating newly revealed security vulnerabilities. First, all system software, packages, and kernels are scanned every day to ensure that they are up-to-date with the latest upstream security patches from the OS vendor, who has access to security vulnerability reports before they are made public. Building Energy also does file integrity scans on all servers every hour to ensure that critical system files do not change and that no new files are installed on the system without authorization. Last Building Energy performs network port scans to ensure that only the HTTPS port is exposed on its site and that there are no other points of access. Perhaps the most common form of web application attack is SQL injection. Building Energy uses several techniques to render this style of attack harmless. First, Building Energy generates no SQL code all code and parameters are passed in via the Django framework, which very carefully quotes all SQL parameters so they can never be interpreted as code. Additionally, Python s runtime dynamic-typed nature means that common attack techniques like buffer overflows and stack-busting are essentially impossible. Idle users are automatically logged out after 15 minutes of inactivity, and all HTTPS traffic connections at the TCP level are disconnected after 60 seconds of idle time. Denial of Service attacks, distributed or not, are mitigated by the Amazon ELB technology. Building Energy takes a proactive approach to mitigating application security risks when it develops software. For example, the following site details the top 10 risks encountered by the Open Web Application Security Project: (https://www.owasp.org/index.php/top_10_2013-top_10). When designing, coding, testing, reviewing, and deploying the application, Building Energy is always making sure that these common risks are not introduced into its system. All changes to the implementation, configuration, and deployment of the system are always reviewed by at least two other developers before being committed. Finally the Building Energy user system is configured to be secure against users leaving their computers unattended and over-the-shoulder attacks. Users are logged out after 15 minutes automatically, and passwords have a minimum complexity requirement. And after 3 failed login attempts, the user account is locked to prevent brute-force password attacks. Conclusion Building Energy uses advanced, industry standard security practices to ensure complete security of customer data, compliance with regulations, and that customer data is valid and 7

8 uncorrupted. By taking an approach of minimal exposure and layering security access controls according to risk and value, Building Energy can assure its customers that their data are safe. 8

Famly ApS: Overview of Security Processes

Famly ApS: Overview of Security Processes Famly ApS: Overview of Security Processes October 2015 Please consult http://famly.co for the latest version of this paper Page 1 of 10 Table of Contents 1. INTRODUCTION TO SECURITY AT FAMLY... 3 2. PHYSICAL

More information

Simone Brunozzi, AWS Technology Evangelist, APAC. Fortress in the Cloud

Simone Brunozzi, AWS Technology Evangelist, APAC. Fortress in the Cloud Simone Brunozzi, AWS Technology Evangelist, APAC Fortress in the Cloud AWS Cloud Security Model Overview Certifications & Accreditations Sarbanes-Oxley (SOX) compliance ISO 27001 Certification PCI DSS

More information

AWS Security. Security is Job Zero! CJ Moses Deputy Chief Information Security Officer. AWS Gov Cloud Summit II

AWS Security. Security is Job Zero! CJ Moses Deputy Chief Information Security Officer. AWS Gov Cloud Summit II AWS Security CJ Moses Deputy Chief Information Security Officer Security is Job Zero! Overview Security Resources Certifications Physical Security Network security Geo-diversity and Fault Tolerance GovCloud

More information

VIEWABILL. Cloud Security and Operational Architecture. featuring RUBY ON RAILS

VIEWABILL. Cloud Security and Operational Architecture. featuring RUBY ON RAILS VIEWABILL Cloud Security and Operational Architecture featuring RUBY ON RAILS VAB_CloudSecurity V1 : May 2014 Overview The Viewabill.com cloud is a highly-secure, scalable and redundant solution that enables

More information

319 MANAGED HOSTING TECHNICAL DETAILS

319 MANAGED HOSTING TECHNICAL DETAILS 319 MANAGED HOSTING TECHNICAL DETAILS 319 NetWorks www.319networks.com Table of Contents Architecture... 4 319 Platform... 5 319 Applications... 5 319 Network Stack... 5 319 Cloud Hosting Technical Details...

More information

KeyLock Solutions Security and Privacy Protection Practices

KeyLock Solutions Security and Privacy Protection Practices KeyLock Solutions Overview KeyLock Solutions hosts its infrastructure at Heroku. Heroku is a cloud application platform used by organizations of all sizes to deploy and operate applications throughout

More information

PCI COMPLIANCE ON AWS: HOW TREND MICRO CAN HELP

PCI COMPLIANCE ON AWS: HOW TREND MICRO CAN HELP solution brief PCI COMPLIANCE ON AWS: HOW TREND MICRO CAN HELP AWS AND PCI DSS COMPLIANCE To ensure an end-to-end secure computing environment, Amazon Web Services (AWS) employs a shared security responsibility

More information

Table of Contents. FME Cloud Architecture Overview. Secure Operations. Application Security. Shared Responsibility.

Table of Contents. FME Cloud Architecture Overview. Secure Operations. Application Security. Shared Responsibility. FME Cloud Security Table of Contents FME Cloud Architecture Overview Secure Operations I. Backup II. Data Governance and Privacy III. Destruction of Data IV. Incident Reporting V. Development VI. Customer

More information

Application Security Best Practices. Matt Tavis Principal Solutions Architect

Application Security Best Practices. Matt Tavis Principal Solutions Architect Application Security Best Practices Matt Tavis Principal Solutions Architect Application Security Best Practices is a Complex topic! Design scalable and fault tolerant applications See Architecting for

More information

Infor CloudSuite. Defense-in-depth. Table of Contents. Technical Paper Plain talk about Infor CloudSuite security

Infor CloudSuite. Defense-in-depth. Table of Contents. Technical Paper Plain talk about Infor CloudSuite security Technical Paper Plain talk about security When it comes to Cloud deployment, security is top of mind for all concerned. The Infor CloudSuite team uses best-practice protocols and a thorough, continuous

More information

Live Guide System Architecture and Security TECHNICAL ARTICLE

Live Guide System Architecture and Security TECHNICAL ARTICLE Live Guide System Architecture and Security TECHNICAL ARTICLE Contents 1. Introduction... 2 2. Hosting Environment... 2 2.1. Standards - Compliancy... 3 2.2. Business Continuity Management... 3 2.3. Network

More information

PCI COMPLIANCE ON AWS: HOW TREND MICRO CAN HELP

PCI COMPLIANCE ON AWS: HOW TREND MICRO CAN HELP SOLUTION BRIEF PCI COMPLIANCE ON AWS: HOW TREND MICRO CAN HELP The benefits of cloud computing are clear and compelling: no upfront investment, low ongoing costs, flexible capacity and fast application

More information

Anypoint Platform Cloud Security and Compliance. Whitepaper

Anypoint Platform Cloud Security and Compliance. Whitepaper Anypoint Platform Cloud Security and Compliance Whitepaper 1 Overview Security is a top concern when evaluating cloud services, whether it be physical, network, infrastructure, platform or data security.

More information

Netop Environment Security. Unified security to all Netop products while leveraging the benefits of cloud computing

Netop Environment Security. Unified security to all Netop products while leveraging the benefits of cloud computing Netop Environment Security Unified security to all Netop products while leveraging the benefits of cloud computing Contents Introduction... 2 AWS Infrastructure Security... 3 Standards - Compliancy...

More information

Live Guide System Architecture and Security TECHNICAL ARTICLE

Live Guide System Architecture and Security TECHNICAL ARTICLE Live Guide System Architecture and Security TECHNICAL ARTICLE Contents 1. Introduction... 2 2. Hosting Environment... 2 2.1. Standards - Compliancy... 3 2.2. Business Continuity Management... 3 2.3. Network

More information

THE BLUENOSE SECURITY FRAMEWORK

THE BLUENOSE SECURITY FRAMEWORK THE BLUENOSE SECURITY FRAMEWORK Bluenose Analytics, Inc. All rights reserved TABLE OF CONTENTS Bluenose Analytics, Inc. Security Whitepaper ISO 27001/27002 / 1 The Four Pillars of Our Security Program

More information

Securing Amazon It s a Jungle Out There

Securing Amazon It s a Jungle Out There ANALYST BRIEF Securing Amazon It s a Jungle Out There PART 1 CONTROLS AND OPTIONS OFFERED BY AMAZON Author Rob Ayoub Overview Infrastructure as a service (IaaS) is a foundational component of modern cloud

More information

PATCH MANAGER what does it do?

PATCH MANAGER what does it do? PATCH MANAGER what does it do? PATCH MANAGER SAAS maps all your physical assets and physical infrastructure such as network and power cabling, racks, servers, switches, UPS and generators. It provides

More information

74% 96 Action Items. Compliance

74% 96 Action Items. Compliance Compliance Report PCI DSS 2.0 Generated by Check Point Compliance Blade, on July 02, 2013 11:12 AM 1 74% Compliance 96 Action Items Upcoming 0 items About PCI DSS 2.0 PCI-DSS is a legal obligation mandated

More information

SonicWALL PCI 1.1 Implementation Guide

SonicWALL PCI 1.1 Implementation Guide Compliance SonicWALL PCI 1.1 Implementation Guide A PCI Implementation Guide for SonicWALL SonicOS Standard In conjunction with ControlCase, LLC (PCI Council Approved Auditor) SonicWall SonicOS Standard

More information

Kenna Platform Security. A technical overview of the comprehensive security measures Kenna uses to protect your data

Kenna Platform Security. A technical overview of the comprehensive security measures Kenna uses to protect your data Kenna Platform Security A technical overview of the comprehensive security measures Kenna uses to protect your data V2.0, JULY 2015 Multiple Layers of Protection Overview Password Salted-Hash Thank you

More information

CONTENTS. PCI DSS Compliance Guide

CONTENTS. PCI DSS Compliance Guide CONTENTS PCI DSS COMPLIANCE FOR YOUR WEBSITE BUILD AND MAINTAIN A SECURE NETWORK AND SYSTEMS Requirement 1: Install and maintain a firewall configuration to protect cardholder data Requirement 2: Do not

More information

Digital, Transparent & Secure

Digital, Transparent & Secure Digital, Transparent & Secure Table of Contents Overview... 4 Overbond Platform... 4 Data Encryption... 4 Transit... 4 Storage... 4 Cloud Platform Security... 5 Amazon Web Services - AWS... 5 Antivirus

More information

Alfresco Enterprise on AWS: Reference Architecture

Alfresco Enterprise on AWS: Reference Architecture Alfresco Enterprise on AWS: Reference Architecture October 2013 (Please consult http://aws.amazon.com/whitepapers/ for the latest version of this paper) Page 1 of 13 Abstract Amazon Web Services (AWS)

More information

BMC s Security Strategy for ITSM in the SaaS Environment

BMC s Security Strategy for ITSM in the SaaS Environment BMC s Security Strategy for ITSM in the SaaS Environment TABLE OF CONTENTS Introduction... 3 Data Security... 4 Secure Backup... 6 Administrative Access... 6 Patching Processes... 6 Security Certifications...

More information

Using Skybox Solutions to Achieve PCI Compliance

Using Skybox Solutions to Achieve PCI Compliance Using Skybox Solutions to Achieve PCI Compliance Achieve Efficient and Effective PCI Compliance by Automating Many Required Controls and Processes Skybox Security whitepaper August 2011 1 Executive Summary

More information

Security Document. Issued April 2014 Updated October 2014 Updated May 2015

Security Document. Issued April 2014 Updated October 2014 Updated May 2015 Security Document Issued April 2014 Updated October 2014 Updated May 2015 Table of Contents Issued April 2014... 1 Updated October 2014... 1 Updated May 2015... 1 State-of-the-art Security for Legal Data...

More information

Building A Secure Microsoft Exchange Continuity Appliance

Building A Secure Microsoft Exchange Continuity Appliance Building A Secure Microsoft Exchange Continuity Appliance Teneros, Inc. 215 Castro Street, 3rd Floor Mountain View, California 94041-1203 USA p 650.641.7400 f 650.641.7401 ON AVAILABLE ACCESSIBLE Building

More information

Appalachian Regional Commission Evaluation Report. Table of Contents. Results of Evaluation... 1. Areas for Improvement... 2

Appalachian Regional Commission Evaluation Report. Table of Contents. Results of Evaluation... 1. Areas for Improvement... 2 Report No. 13-35 September 27, 2013 Appalachian Regional Commission Table of Contents Results of Evaluation... 1 Areas for Improvement... 2 Area for Improvement 1: The agency should implement ongoing scanning

More information

Security Controls for the Autodesk 360 Managed Services

Security Controls for the Autodesk 360 Managed Services Autodesk Trust Center Security Controls for the Autodesk 360 Managed Services Autodesk strives to apply the operational best practices of leading cloud-computing providers around the world. Sound practices

More information

The Education Fellowship Finance Centralisation IT Security Strategy

The Education Fellowship Finance Centralisation IT Security Strategy The Education Fellowship Finance Centralisation IT Security Strategy Introduction This strategy outlines the security systems in place to optimise, manage and protect The Education Fellowship data and

More information

DATA SECURITY & PCI DSS COMPLIANCE PROTECTING CUSTOMER DATA

DATA SECURITY & PCI DSS COMPLIANCE PROTECTING CUSTOMER DATA DATA SECURITY & PCI DSS COMPLIANCE PROTECTING CUSTOMER DATA WHAT IS PCI DSS? PAYMENT CARD INDUSTRY DATA SECURITY STANDARD A SET OF REQUIREMENTS FOR ANY ORGANIZATION OR MERCHANT THAT ACCEPTS, TRANSMITS

More information

Clever Security Overview

Clever Security Overview Clever Security Overview Clever Security White Paper Contents 3 Introduction Software Security 3 Transport Layer Security 3 Authenticated API Calls 3 Secure OAuth 2.0 Bearer Tokens 4 Third Party Penetration

More information

Passing PCI Compliance How to Address the Application Security Mandates

Passing PCI Compliance How to Address the Application Security Mandates Passing PCI Compliance How to Address the Application Security Mandates The Payment Card Industry Data Security Standards includes several requirements that mandate security at the application layer. These

More information

VMware vcloud Air Security TECHNICAL WHITE PAPER

VMware vcloud Air Security TECHNICAL WHITE PAPER TECHNICAL WHITE PAPER The Shared Security Model for vcloud Air The end-to-end security of VMware vcloud Air (the Service ) is shared between VMware and the customer. VMware provides security for the aspects

More information

Executive Summary and Purpose

Executive Summary and Purpose ver,1.0 Hardening and Securing Opengear Devices Copyright Opengear Inc. 2013. All Rights Reserved. Information in this document is subject to change without notice and does not represent a commitment on

More information

Deploy Remote Desktop Gateway on the AWS Cloud

Deploy Remote Desktop Gateway on the AWS Cloud Deploy Remote Desktop Gateway on the AWS Cloud Mike Pfeiffer April 2014 Last updated: May 2015 (revisions) Table of Contents Abstract... 3 Before You Get Started... 3 Three Ways to Use this Guide... 4

More information

QuickBooks Online: Security & Infrastructure

QuickBooks Online: Security & Infrastructure QuickBooks Online: Security & Infrastructure May 2014 Contents Introduction: QuickBooks Online Security and Infrastructure... 3 Security of Your Data... 3 Access Control... 3 Privacy... 4 Availability...

More information

White Paper How Noah Mobile uses Microsoft Azure Core Services

White Paper How Noah Mobile uses Microsoft Azure Core Services NoahMobile Documentation White Paper How Noah Mobile uses Microsoft Azure Core Services The Noah Mobile Cloud service is built for the Microsoft Azure platform. The solutions that are part of the Noah

More information

Chapter 11 Cloud Application Development

Chapter 11 Cloud Application Development Chapter 11 Cloud Application Development Contents Motivation. Connecting clients to instances through firewalls. Chapter 10 2 Motivation Some of the questions of interest to application developers: How

More information

Logz.io See the logz that matter

Logz.io See the logz that matter See the logz that matter How Logz.io Secures Customer Log Data White Paper A certain amount of confidence is needed when relying on third party vendors to manage and handle your online data and log files

More information

With Eversync s cloud data tiering, the customer can tier data protection as follows:

With Eversync s cloud data tiering, the customer can tier data protection as follows: APPLICATION NOTE: CLOUD DATA TIERING Eversync has developed a hybrid model for cloud-based data protection in which all of the elements of data protection are tiered between an on-premise appliance (software

More information

CLOUD COMPUTING WITH AWS An INTRODUCTION. John Hildebrandt Solutions Architect ANZ

CLOUD COMPUTING WITH AWS An INTRODUCTION. John Hildebrandt Solutions Architect ANZ CLOUD COMPUTING WITH AWS An INTRODUCTION John Hildebrandt Solutions Architect ANZ AGENDA Todays Agenda Background and Value proposition of AWS Global infrastructure and the Sydney Region AWS services Drupal

More information

Securing the Microsoft Platform on Amazon Web Services

Securing the Microsoft Platform on Amazon Web Services Securing the Microsoft Platform on Amazon Web Services Tom Stickle August 2012 (Please consult http://aws.amazon.com/whitepapers/ for the latest version of this paper) Page 1 of 22 Abstract Deploying Microsoft

More information

Course: Information Security Management in e-governance. Day 1. Session 5: Securing Data and Operating systems

Course: Information Security Management in e-governance. Day 1. Session 5: Securing Data and Operating systems Course: Information Security Management in e-governance Day 1 Session 5: Securing Data and Operating systems Agenda Introduction to information, data and database systems Information security risks surrounding

More information

Security Whitepaper. NetTec NSI Philosophy. Best Practices

Security Whitepaper. NetTec NSI Philosophy. Best Practices Security Whitepaper NetTec NSI provides a leading SaaS-based managed services platform that to efficiently backup, monitor, and troubleshoot desktops, servers and other endpoints for businesses. Our comprehensive

More information

NSFOCUS Web Application Firewall White Paper

NSFOCUS Web Application Firewall White Paper White Paper NSFOCUS Web Application Firewall White Paper By NSFOCUS White Paper - 2014 NSFOCUS NSFOCUS is the trademark of NSFOCUS Information Technology Co., Ltd. NSFOCUS enjoys all copyrights with respect

More information

Amazon Web Services: Risk and Compliance January 2013

Amazon Web Services: Risk and Compliance January 2013 Amazon Web Services: Risk and Compliance January 2013 (Please consult http://aws.amazon.com/security for the latest version of this paper) Page 1 of 59 This document intends to provide information to assist

More information

University of Pittsburgh Security Assessment Questionnaire (v1.5)

University of Pittsburgh Security Assessment Questionnaire (v1.5) Technology Help Desk 412 624-HELP [4357] technology.pitt.edu University of Pittsburgh Security Assessment Questionnaire (v1.5) Directions and Instructions for completing this assessment The answers provided

More information

CONTENTS. Security Policy

CONTENTS. Security Policy CONTENTS PHYSICAL SECURITY (UK) PHYSICAL SECURITY (CHICAGO) PHYSICAL SECURITY (PHOENIX) PHYSICAL SECURITY (SINGAPORE) SYSTEM SECURITY INFRASTRUCTURE Vendor software updates Security first policy CUSTOMER

More information

Servers. Servers. NAT Public Subnet: 172.30.128.0/20. Internet Gateway. VPC Gateway VPC: 172.30.0.0/16

Servers. Servers. NAT Public Subnet: 172.30.128.0/20. Internet Gateway. VPC Gateway VPC: 172.30.0.0/16 .0 Why Use the Cloud? REFERENCE MODEL Cloud Development April 0 Traditionally, deployments require applications to be bound to a particular infrastructure. This results in low utilization, diminished efficiency,

More information

WALKME SOLUTION ARCHITECTURAL WHITE PAPER

WALKME SOLUTION ARCHITECTURAL WHITE PAPER WALKME SOLUTION ARCHITECTURAL WHITE PAPER WHAT IS WALKME FOR SALESFORCE? WalkMe enables Salesforce to build and overlay interactive Walk-Thrus that intuitively guide users to self-task successfully with

More information

GoodData Corporation Security White Paper

GoodData Corporation Security White Paper GoodData Corporation Security White Paper May 2016 Executive Overview The GoodData Analytics Distribution Platform is designed to help Enterprises and Independent Software Vendors (ISVs) securely share

More information

PCI Requirements Coverage Summary Table

PCI Requirements Coverage Summary Table StillSecure PCI Complete Managed PCI Compliance Solution PCI Requirements Coverage Summary Table January 2013 Table of Contents Introduction... 2 Coverage assumptions for PCI Complete deployments... 2

More information

PCI DSS Requirements - Security Controls and Processes

PCI DSS Requirements - Security Controls and Processes 1. Build and maintain a secure network 1.1 Establish firewall and router configuration standards that formalize testing whenever configurations change; that identify all connections to cardholder data

More information

Best Practices for Security and Compliance with Amazon Web Services. A Trend Micro White Paper I April 2013

Best Practices for Security and Compliance with Amazon Web Services. A Trend Micro White Paper I April 2013 Best Practices for Security and Compliance with Amazon Web Services A Trend Micro White Paper I April 2013 Contents Executive Summary...2 Defining Cloud Computing...2 SERVICE MODELS...3 DEPLOYMENT MODELS...5

More information

Addressing the SANS Top 20 Critical Security Controls for Effective Cyber Defense

Addressing the SANS Top 20 Critical Security Controls for Effective Cyber Defense A Trend Micro Whitepaper I February 2016 Addressing the SANS Top 20 Critical Security Controls for Effective Cyber Defense How Trend Micro Deep Security Can Help: A Mapping to the SANS Top 20 Critical

More information

Druva Phoenix: Enterprise-Class. Data Security & Privacy in the Cloud

Druva Phoenix: Enterprise-Class. Data Security & Privacy in the Cloud Druva Phoenix: Enterprise-Class Data Security & Privacy in the Cloud Advanced, multi-layer security to provide the highest level of protection for today's enterprise. Table of Contents Overview...3 Cloud

More information

T2 IaaSand PCI Compliance. Robert Zigweid, IOActive

T2 IaaSand PCI Compliance. Robert Zigweid, IOActive T2 IaaSand PCI Compliance Robert Zigweid, IOActive Introduction Robert M. Zigweid Principal Compliance Consultant at IOActive, Inc. PCI QSA, PCI PA-QSA QSA for Amazon Web Services 2 Creating a PCI Compliant

More information

Virtual Private Cloud - Lab. Hands-On Lab: AWS Virtual Private Cloud (VPC)

Virtual Private Cloud - Lab. Hands-On Lab: AWS Virtual Private Cloud (VPC) Virtual Private Cloud - Lab Hands-On Lab: AWS Virtual Private Cloud (VPC) 1 Overview In this lab we will create and prepare a Virtual Private Cloud (VPC) so that we can launch multiple EC2 web servers

More information

Primex Wireless OneVue Architecture Statement

Primex Wireless OneVue Architecture Statement Primex Wireless OneVue Architecture Statement Secure, cloud-based workflow, alert, and notification platform built on top of Amazon Web Services (AWS) 2015 Primex Wireless, Inc. The Primex logo is a registered

More information

Intrusion Detection and Cyber Security Monitoring of SCADA and DCS Networks

Intrusion Detection and Cyber Security Monitoring of SCADA and DCS Networks Intrusion Detection and Cyber Security Monitoring of SCADA and DCS Networks Dale Peterson Director, Network Security Practice Digital Bond, Inc. 1580 Sawgrass Corporate Parkway, Suite 130 Sunrise, FL 33323

More information

Cloud S ecurity Security Processes & Practices Jinesh Varia

Cloud S ecurity Security Processes & Practices Jinesh Varia Cloud Security Processes & Practices Jinesh Varia Overview Certifications Physical Security Backups EC2 Security S3 Security SimpleDB Security SQS Security Best Practices AWS Security White Paper Available

More information

TONAQUINT DATA CENTER, INC. CLOUD SECURITY POLICY & PROCEDURES. Tonaquint Data Center, Inc Cloud Security Policy & Procedures 1

TONAQUINT DATA CENTER, INC. CLOUD SECURITY POLICY & PROCEDURES. Tonaquint Data Center, Inc Cloud Security Policy & Procedures 1 TONAQUINT DATA CENTER, INC. CLOUD SECURITY POLICY & PROCEDURES Tonaquint Data Center, Inc Cloud Security Policy & Procedures 1 Table of Contents 1. Operational Security 2. Physical Security 3. Network

More information

Achieving PCI Compliance with Red Hat Enterprise Linux. June 2009

Achieving PCI Compliance with Red Hat Enterprise Linux. June 2009 Achieving PCI Compliance with Red Hat Enterprise Linux June 2009 CONTENTS EXECUTIVE SUMMARY...2 OVERVIEW OF PCI...3 1.1. What is PCI DSS?... 3 1.2. Who is impacted by PCI?... 3 1.3. Requirements for achieving

More information

CONTENT OUTLINE. Background... 3 Cloud Security... 3. Instance Isolation:... 4. SecureGRC Application Security... 5

CONTENT OUTLINE. Background... 3 Cloud Security... 3. Instance Isolation:... 4. SecureGRC Application Security... 5 Page 2 Disclaimer THIS DOCUMENT AND THE SOFTWARE DESCRIBED IN THIS DOCUMENT ARE FURNISHED UNDER AND ARE SUBJECT TO THE TERMS OF THE LICENSE AGREEMENT OR NON-DISCLOSURE AGREEMENT. EXCEPT AS EXPRESSLY SET

More information

Locking down a Hitachi ID Suite server

Locking down a Hitachi ID Suite server Locking down a Hitachi ID Suite server 2016 Hitachi ID Systems, Inc. All rights reserved. Organizations deploying Hitachi ID Identity and Access Management Suite need to understand how to secure its runtime

More information

Analyzing Security for Retailers An analysis of what retailers can do to improve their network security

Analyzing Security for Retailers An analysis of what retailers can do to improve their network security Analyzing Security for Retailers An analysis of what retailers can do to improve their network security Clone Systems Business Security Intelligence Properly Secure Every Business Network Executive Summary

More information

Achieving PCI-Compliance through Cyberoam

Achieving PCI-Compliance through Cyberoam White paper Achieving PCI-Compliance through Cyberoam The Payment Card Industry (PCI) Data Security Standard (DSS) aims to assure cardholders that their card details are safe and secure when their debit

More information

WORKSTATION SECURITY STANDARD

WORKSTATION SECURITY STANDARD WORKSTATION SECURITY STANDARD Security Standards are mandatory security rules applicable to the defined scope with respect to the subject. Overview Scope Standard Improperly configured computer systems

More information

NETASQ & PCI DSS. Is NETASQ compatible with PCI DSS? NG Firewall version 9

NETASQ & PCI DSS. Is NETASQ compatible with PCI DSS? NG Firewall version 9 NETASQ & PCI DSS Is NETASQ compatible with PCI DSS? We have often been asked this question. Unfortunately, even the best firewall is but an element in the process of PCI DSS certification. This document

More information

Our Key Security Features Are:

Our Key Security Features Are: September 2014 Version v1.8" Thank you for your interest in PasswordBox. On the following pages, you ll find a technical overview of the comprehensive security measures PasswordBox uses to protect your

More information

Amazon Web Services: Risk and Compliance January 2011

Amazon Web Services: Risk and Compliance January 2011 Amazon Web Services: Risk and Compliance January 2011 (Please consult http://aws.amazon.com/security for the latest version of this paper) 1 This document intends to provide information to assist AWS customers

More information

Vendor Questionnaire

Vendor Questionnaire Instructions: This questionnaire was developed to assess the vendor s information security practices and standards. Please complete this form as completely as possible, answering yes or no, and explaining

More information

October 2013 702P00860. Xerox App Studio. Information Assurance Disclosure. Version 2.0

October 2013 702P00860. Xerox App Studio. Information Assurance Disclosure. Version 2.0 October 2013 702P00860 Xerox App Studio Information Assurance Disclosure Version 2.0 2013 Xerox Corporation. All rights reserved. Xerox and Xerox and Design and ConnectKey are trademarks of Xerox Corporation

More information

A Sumo Logic White Paper. Sumo Logic Security Model. Secure by Design

A Sumo Logic White Paper. Sumo Logic Security Model. Secure by Design A Sumo Logic White Paper Sumo Logic Security Model Secure by Design Entrusting your data to a third-party service provider requires rigorous security measures. At Sumo Logic, the security and integrity

More information

Security Practices, Architecture and Technologies

Security Practices, Architecture and Technologies Security Practices, Architecture and Technologies CONTACT: 36 S. Wall Street Columbus, OH 43215 1-800-VAB-0300 www.viewabill.com 1 CONTENTS End-to-End Security Processes and Technologies... 3 Secure Architecture...

More information

BeBanjo Infrastructure and Security Overview

BeBanjo Infrastructure and Security Overview BeBanjo Infrastructure and Security Overview Can you trust Software-as-a-Service (SaaS) to run your business? Is your data safe in the cloud? At BeBanjo, we firmly believe that SaaS delivers great benefits

More information

Architecture Overview

Architecture Overview Architecture Overview Design Fundamentals The networks discussed in this paper have some common design fundamentals, including segmentation into modules, which enables network traffic to be isolated and

More information

Trend Micro. Advanced Security Built for the Cloud

Trend Micro. Advanced Security Built for the Cloud datasheet Trend Micro deep security as a service Advanced Security Built for the Cloud Organizations are embracing the economic and operational benefits of cloud computing, turning to leading cloud providers

More information

A Decision Maker s Guide to Securing an IT Infrastructure

A Decision Maker s Guide to Securing an IT Infrastructure A Decision Maker s Guide to Securing an IT Infrastructure A Rackspace White Paper Spring 2010 Summary With so many malicious attacks taking place now, securing an IT infrastructure is vital. The purpose

More information

Apteligent White Paper. Security and Information Polices

Apteligent White Paper. Security and Information Polices Apteligent White Paper Security and Information Polices Data and Security Policies for 2016 Overview Apteligent s Mobile App Intelligence delivers real-time user experience insight based on behavioral

More information

Security Essentials & Best Practices

Security Essentials & Best Practices Security Essentials & Best Practices Overview Overview of the AWS cloud security concepts such as the AWS security center, Shared Responsibility Model, and Identity and Access Management. 1 AWS Security

More information

Cyber Security In High-Performance Computing Environment Prakashan Korambath Institute for Digital Research and Education, UCLA July 17, 2014

Cyber Security In High-Performance Computing Environment Prakashan Korambath Institute for Digital Research and Education, UCLA July 17, 2014 Cyber Security In High-Performance Computing Environment Prakashan Korambath Institute for Digital Research and Education, UCLA July 17, 2014 Introduction: Cyber attack is an unauthorized access to a computer

More information

IT Best Practices Audit TCS offers a wide range of IT Best Practices Audit content covering 15 subjects and over 2200 topics, including:

IT Best Practices Audit TCS offers a wide range of IT Best Practices Audit content covering 15 subjects and over 2200 topics, including: IT Best Practices Audit TCS offers a wide range of IT Best Practices Audit content covering 15 subjects and over 2200 topics, including: 1. IT Cost Containment 84 topics 2. Cloud Computing Readiness 225

More information

Cloud Portal Office Security Whitepaper. October 2013

Cloud Portal Office Security Whitepaper. October 2013 Cloud Portal Office Security Whitepaper October 2013 Table of Contents Introduction... 2 Accessing Cloud Portal Office... 2 Account Authentication and Authorization... 2 Strong Password Policies... 3 Single

More information

Where every interaction matters.

Where every interaction matters. Where every interaction matters. Peer 1 Vigilant Web Application Firewall Powered by Alert Logic The Open Web Application Security Project (OWASP) Top Ten Web Security Risks and Countermeasures White Paper

More information

DiamondStream Data Security Policy Summary

DiamondStream Data Security Policy Summary DiamondStream Data Security Policy Summary Overview This document describes DiamondStream s standard security policy for accessing and interacting with proprietary and third-party client data. This covers

More information

The Panoptix Building Efficiency Solution: Ensuring a Secure Delivery of Building Efficiency

The Panoptix Building Efficiency Solution: Ensuring a Secure Delivery of Building Efficiency logo The Panoptix Building Efficiency Solution: Ensuring a Secure Delivery of Building Efficiency Understanding the Multiple Levels of Security Built Into the Panoptix Solution Published: October 2011

More information

FINAL DoIT 04.01.2013- v.8 APPLICATION SECURITY PROCEDURE

FINAL DoIT 04.01.2013- v.8 APPLICATION SECURITY PROCEDURE Purpose: This procedure identifies what is required to ensure the development of a secure application. Procedure: The five basic areas covered by this document include: Standards for Privacy and Security

More information

Amazon Web Services: Risk and Compliance July 2012

Amazon Web Services: Risk and Compliance July 2012 Amazon Web Services: Risk and Compliance July 2012 (Please consult http://aws.amazon.com/security for the latest version of this paper) 1 This document intends to provide information to assist AWS customers

More information

Running Oracle Applications on AWS

Running Oracle Applications on AWS Running Oracle Applications on AWS Bharath Terala Sr. Principal Consultant Apps Associates LLC June 09, 2014 Copyright 2014. Apps Associates LLC. 1 Agenda About the Presenter About Apps Associates LLC

More information

TECHNOLOGY WHITE PAPER Jan 2016

TECHNOLOGY WHITE PAPER Jan 2016 TECHNOLOGY WHITE PAPER Jan 2016 Technology Stack C# PHP Amazon Web Services (AWS) Route 53 Elastic Load Balancing (ELB) Elastic Compute Cloud (EC2) Amazon RDS Amazon S3 Elasticache CloudWatch Paypal Overview

More information

BAE Systems PCI Essentail. PCI Requirements Coverage Summary Table

BAE Systems PCI Essentail. PCI Requirements Coverage Summary Table BAE Systems PCI Essentail PCI Requirements Coverage Summary Table Introduction BAE Systems PCI Essential solution can help your company significantly reduce the costs and complexity of meeting PCI compliance

More information

PCI DSS Policies Outline. PCI DSS Policies. All Rights Reserved. ecfirst. 2010. Page 1 of 7 www.ecfirst.com

PCI DSS Policies Outline. PCI DSS Policies. All Rights Reserved. ecfirst. 2010. Page 1 of 7 www.ecfirst.com Policy/Procedure Description PCI DSS Policies Install and Maintain a Firewall Configuration to Protect Cardholder Data Establish Firewall and Router Configuration Standards Build a Firewall Configuration

More information

Application Reviews and Web Application Firewalls Clarified. Information Supplement: PCI Data Security Standard (PCI DSS) Requirement:

Application Reviews and Web Application Firewalls Clarified. Information Supplement: PCI Data Security Standard (PCI DSS) Requirement: Standard: Version: Date: Requirement: Author: PCI Data Security Standard (PCI DSS) 1.2 October 2008 6.6 PCI Security Standards Council Information Supplement: Application Reviews and Web Application Firewalls

More information

Client Security Risk Assessment Questionnaire

Client Security Risk Assessment Questionnaire Select the appropriate answer from the drop down in the column, and provide a brief description in the section. 1 Do you have a member of your organization with dedicated information security duties? 2

More information

WALKME WHITEPAPER. WalkMe Architecture

WALKME WHITEPAPER. WalkMe Architecture WALKME WHITEPAPER WalkMe Architecture Introduction WalkMe - the Enterprise Class Guidance and Engagement Platform - drives users to action as they use software or websites. WalkMe is used by Enterprises

More information

Request for Proposal INFORMATION SECURITY ASSESSMENT SERVICES RFP #12-680-004. Addendum 1.0

Request for Proposal INFORMATION SECURITY ASSESSMENT SERVICES RFP #12-680-004. Addendum 1.0 Request for Proposal INFORMATION SECURITY ASSESSMENT SERVICES RFP #12-680-004 Addendum 1.0 ISSUE DATE: February 23, 2012 Receipt of this addendum should be acknowledged on the Proposal Form. Inquiries

More information