AWS Security & Compliance

Transcription

1 AWS Public Sector Jerusalem 19 Nov 2014 AWS Security & Compliance CJ Moses General Manager, Government Cloud Solu3ons

2 Security Is Our No.1 Priority Comprehensive Security Capabilities to Support Virtually Any Workload PHYSICAL SECURITY NETWORK SECURITY PLATFORM SECURITY PEOPLE & PROCEDURES

3 SECURITY IS SHARED

4 WHAT NEEDS TO BE DONE TO KEEP THE SYSTEM SAFE

5 WHAT WE DO FOR YOU WHAT YOU DO YOURSELF

6 EVERY CUSTOMER HAS ACCESS TO THE SAME SECURITY CAPABILITIES CHOOSE WHAT S RIGHT FOR YOUR ENTERPRISE

7 Based on our experience, I believe that we can be even more secure in the AWS cloud than in our own data centers Tom Soderstrom CTO NASA JPL

8 IDC Survey APtudes and Percep3ons Around Security and Cloud Services Nearly 60% of organiza3ons agreed that CSPs [Cloud Service Providers] provide beyer security than their own IT organiza3on Source: IDC 2013 U.S. Cloud Security Survey Doc #242836, September 2013

9 AWS SECURITY OFFERS MORE VISIBILITY AUDITABILITY CONTROL

10 MORE VISIBILITY

11 CAN YOU MAP YOUR NETWORK? WHAT IS IN YOUR ENVIRONMENT RIGHT NOW?

12

13

14 TRUSTED ADVISOR

15

16 MORE AUDITABILITY

17

18 LOGS OBTAINED, RETAINED, ANALYZED

19 AWS CLOUDTRAIL You are making API calls... On a growing set of services around the world CloudTrail is continuously recording API calls And delivering log files to you

20 Security Analysis Use log files as an input into log management and analysis solu3ons to perform security analysis and to detect user behavior payerns. Track Changes to AWS Resources Track crea3on, modifica3on, and dele3on of AWS resources such as Amazon EC2 instances, Amazon VPC security groups and Amazon EBS volumes. Troubleshoot Issues Quickly iden3fy the most recent changes made to resources in your environment. Compliance Aid Easier to demonstrate compliance with internal policies and regulatory standards.

21 MORE CONTROL

22 Defense in Depth Mul3 level security Physical security of the data centers Network security System security Data security DATA

23 AWS Security Delivers More Control & Granularity Customize the implementa3on based on your business needs AWS IAM Amazon VPC AWS Storage Gateway AWS Direct Connect AWS CloudHSM Defense in depth Rapid scale for security Automated checks with AWS Trusted Advisor Fine grained access controls Server side encryption Multi-factor authentication Dedicated instances Direct connection, Storage Gateway HSM-based key storage

24 LEAST PRIVILEGE PRINCIPLE AT AWS

25 LEAST PRIVILEGE PRINCIPLE CONFINE ROLES ONLY TO THE MATERIAL REQUIRED TO DO SPECIFIC WORK

26 LEAST PRIVILEGE PRINCIPLE SEPARATE NETWORKS FOR CORPORATE WORK VS. ACCESSING CUSTOMER DATA

27 LEAST PRIVILEGE PRINCIPLE MUST HAVE A BUSINESS NEED- TO- KNOW ABOUT SENSITIVE INFORMATION LIKE DATA CENTER LOCATIONS

28 LEAST PRIVILEGE PRINCIPLE MUST HAVE A BUSINESS NEED- TO- KNOW IN ORDER TO ACCESS DATA CENTERS

29 SIMPLE SECURITY CONTROLS ARE THE EASIEST TO GET RIGHT, EASIEST TO AUDIT, AND EASIEST TO ENFORCE

30

31 AWS IAM IDENTITY & ACCESS MANAGEMENT

32 CONTROL WHO CAN DO WHAT WITH YOUR AWS ACCOUNT

33

34 MFA DELETE PROTECTION

35

36 YOUR DATA STAYS WHERE YOU PUT IT

37 AWS Global Infrastructure! 11 Regions 28 Availability Zones 54 Edge Locations

38 USE MULTIPLE AZs AMAZON S3 AMAZON DYNAMODB AMAZON RDS MULTI- AZ AMAZON EBS SNAPSHOTS

39 ENCRYPT YOUR DATA AWS CLOUDHSM AWS Key Management Service AMAZON EBS AMAZON S3 SSE AMAZON GLACIER AMAZON REDSHIFT AMAZON RDS

40 DATA ENCRYPTION CHOOSE WHAT S RIGHT FOR YOU: Automated AWS manages encryp3on (e.g. S3 SSE) Enabled user manages encryp3on using AWS (e.g. AWS CloudHSM, AWS KMS) Client- side user manages encryp3on using their own means

41 AWS CloudHSM Managed and monitored by AWS, but you control the keys AWS CloudHSM Increase performance for applications that use HSMs for key storage or encryption Comply with stringent regulatory and contractual requirements for key protection EC2 Instance AWS CloudHSM

42 AWS Key Management Service Managed service that makes it easy for you to create and control the encryp3on keys used to encrypt your data, and uses Hardware Security Modules (HSMs) to protect the security of your keys. Integrated with other AWS services including Amazon EBS, Amazon S3, Amazon Redshim and AWS CloudTrail to provide you with logs of all key usage to help meet your regulatory and compliance needs.

43 AWS CodeDeploy AWS CodeDeploy is a service that automates code deployments to Amazon EC2 instances. AWS CodeDeploy makes it easier for you to rapidly release new features, helps you avoid down3me during deployment, and handles the complexity of upda3ng your applica3ons. You can use AWS CodeDeploy to automate deployments, elimina3ng the need for error- prone manual opera3ons, and the service scales with your infrastructure so you can easily deploy to one EC2 instance or thousands. AWS CodeCommit AWS CodeCommit is a secure, highly scalable, managed source control service that hosts private Git repositories. CodeCommit eliminates the need for you to operate your own source control system or worry about scaling its infrastructure. You can use CodeCommit to store anything from code to binaries, and it supports the standard func3onality of Git allowing it to work seamlessly with your exis3ng Git- based tools. Your team can also use CodeCommit s online code tools to browse, edit, and collaborate on projects. CodeCommit will be available in early AWS CodePipeline AWS CodePipeline is a con@nuous delivery and release automa@on service that aids smooth deployments. You can design your development workflow for checking in code, building the code, deploying your applica3on into staging, tes3ng it, and releasing it to produc3on. You can integrate 3rd party tools into any step of your release process or you can use CodePipeline as an end- to- end solu3on. CodePipeline enables you to rapidly deliver features and updates with high quality through the automa3on of your build, test, and release process. CodePipeline will be available in early 2015.

44 MORE AUDITABILITY MORE VISIBILITY MORE CONTROL

45 AWS Security Whitepapers AUDITING SECURITY CHECKLIST SECURITY BEST PRACTICES SECURITY PROCESSES RISK & COMPLIANCE

46 AWS Government Jerusalem 19 Nov 2014! Thank You! CJ Moses General Manager, Government Cloud Solu3ons AWS.AMAZON.COM / SECURITY