Netop Environment Security. Unified security to all Netop products while leveraging the benefits of cloud computing

Transcription

1 Netop Environment Security Unified security to all Netop products while leveraging the benefits of cloud computing

2 Contents Introduction... 2 AWS Infrastructure Security... 3 Standards - Compliancy... 3 Physical and Environmental Security... 3 Fire Detection... 4 Power Supply and Backup Power... 4 Building Management System... 4 Storage Device Decommissioning... 4 Business Continuity Management... 4 Availability... 4 Incident Response... 5 Communication... 5 Network Security... 5 Secure Access Points... 5 Transmission Protection... 5 Network Monitoring and Protection... 6 AWS Access... 6 Account Review and Audit... 6 Background Checks... 6 Credentials Policy... 6 Change Management... 6 AWS Account Security... 7 AWS Identity and Access Management (AWS IAM)... 7 Temporary Security Credentials... 7 AWS Multi-Factor Authentication (AWS MFA)... 7 AWS Trusted Advisor Security Checks... 7 AWS Service-Specific Security... 8 References... 9 Copyright Netop All rights reserved 1

3 Introduction Netop created a flexible and secure IT infrastructure using Amazon Cloud, one of the best cloud platforms, which provides a complete set of capabilities (not limited to these): Copyright Netop All rights reserved 2

4 AWS Infrastructure Security The AWS infrastructure comprises the facilities, network, hardware and operational software which together are used to provision a variety of computing resources (both processing and storage). Standards - Compliancy With AWS, Netop will build web architecture on top of the most secure computing infrastructure in the world; compliant with: Physical and Environmental Security Physical access to AWS data centers is strictly controlled by professional security staff, using video surveillance and intrusion detection systems. While authorized personnel must pass a two-factor authentication to access data center floors, visitors and contractors are registered at the entrance point and escorted by authorized staff. Once an employee no longer should have access to the data centers, his or hers card will be revoked. Copyright Netop All rights reserved 3

5 Fire Detection All AWS data center environments are protected against fire with fire detection and suppression equipment which includes, but not limited to smoke detection sensors, mechanical and infrastructure spaces, chiller rooms and generator equipment rooms. Power Supply and Backup Power The data center electrical power systems are designed to be fully redundant and maintainable without impact to operations, 24 hours a day, and seven days a week. Uninterruptible Power Supply (UPS) units provide back-up power in the event of an electrical failure for critical and essential loads in the facility. Moreover, generators provide back-up power for the data centers entire facility. Building Management System Personnel and systems monitor and control climate to maintain optimal temperature for servers and other hardware within the data center environments. AWS monitors electrical, mechanical, and life support systems and equipment so that any issues are immediately identified. Preventative maintenance is performed to maintain the continued operability of equipment. Storage Device Decommissioning When a storage device has reached its end of life, AWS procedures include a decommissioning process that is designed to prevent customer data from being exposed to unauthorized individuals. All decommissioned magnetic storage devices are degaussed and physically destroyed in accordance with industry-standard practices. Business Continuity Management Amazon s load balancing infrastructure has a high level of availability allowing customers to deploy a resilient IT architecture. Availability In case of system or hardware failure, clustered AWS data centers allow automated processes to move customer data traffic to safe load-balanced sites. Although AWS provides availability zones which are redundantly connected to multiple tier-1 transit providers, we will distribute applications across multiple availability zones in order to remain resilient in front of failures. Copyright Netop All rights reserved 4

6 Incident Response The Amazon Incident Management team provide 24x7x365 coverage to detect incidents and to manage the impact and resolution. Communication AWS gives significant importance to both internal and external communication. AWS personnel is always informed of individual roles and responsibilities, major events that occur within the organization through orientation and training programs, regular management meetings and electronic means (video conferences, s or posting on the Amazon intranet). In order to support customers, AWS has developed a Service Health Dashboard to alert customers of major issues that might impact their systems. A Security and Compliance Center was created to provide a unified point of access to AWS security and compliance details. Network Security Although AWS network permits selecting the level of security, its infrastructure is carefully monitored and managed. Secure Network Architecture Network devices, including firewall and other boundary devices, monitor and control communications at the external boundary of the network and at key internal boundaries within the network. Secure Access Points In order to better monitor inbound and outbound communication and network traffic, AWS has strategically placed a limited number of customer access points (API endpoints) to the EC2 cloud. The API endpoints allow secure HTTP access (HTTPS), which allow establishing a secure communication session with storage or compute instances within AWS. To support customers with FIPS requirements, the Amazon Virtual Private Cloud VPN endpoints and SSL-terminating load balancers in AWS GovCloud (US) operate using FIPS level 2-validated hardware. Moreover, AWS has implemented network devices dedicated to managing interfacing communications with Internet service providers (ISPs). Transmission Protection Connection to an AWS access point is done via HTTP or HTTPS using Secure Sockets Layer (SSL). For additional layers of network security, AWS offers the Amazon Virtual Private Cloud (VPC), which provides a private subnet within the AWS cloud, and the ability to use an IPsec Virtual Private Network (VPN) device to provide an encrypted tunnel between the Amazon VPC and your data center. Copyright Netop All rights reserved 5

7 Network Monitoring and Protection AWS uses a variety of automated monitoring systems to provide high performance services and availability. The tools monitor server and network usage, scan port activities, application usage and unauthorized intrusion attempts. They also allow setting up performance thresholds for unusual activity. Moreover, alarms inform AWS operations and management personnel when warning thresholds are crossed on key operational metrics. The AWS network provides protection against traditional network security issues: Distributed Denial of Service (DDoS), Man in the Middle (MITM) Attacks, IP Spoofing, port scanning, packet sniffing by other tenants and many more. AWS Access The AWS Production network is segregated from the Amazon Corporate network and requires a separate set of credentials for logical access. The Amazon Corporate network relies on user IDs, passwords, and Kerberos, while the AWS Production network requires SSH public-key authentication through a bastion host. AWS developers and administrators on the Amazon Corporate network who need to access AWS cloud components must explicitly request access through the AWS access management system. All requests are reviewed and approved by the appropriate owner or manager. Account Review and Audit All accounts are reviewed every 90 days; explicit re-approval is required or access to the resource is automatically revoked. All account changes display in the Amazon permissions management tool audit log. Background Checks AWS performs background and criminal screening on all employees and according to established policies and procedures decides the level of access to AWS platform and infrastructure hosts. Credentials Policy AWS Security has established a credentials policy with required configurations and expiration intervals. Passwords must be complex and are forced to be changed every 90 days. Change Management All updates to the AWS infrastructure are done to minimize any impact on the customer and the use of services. AWS will communicate to customers when service use is likely to be severe affected. AWS performs periodic self-audits of changes to key services to monitor quality, maintain high standards, and facilitate continuous improvement of the change management process. Copyright Netop All rights reserved 6

8 Exceptions are analyzed to determine the root cause, and appropriate actions are taken to bring the change into compliance or roll back the change if necessary. AWS Account Security Beside various ways for identifying and securely accessing the AWS Account, AWS also provides additional security options that enable us to further protect the AWS Account and control access: AWS Identity and Access Management (AWS IAM), key management and rotation, temporary security credentials, and multi-factor authentication (MFA). AWS Identity and Access Management (AWS IAM) AWS IAM allows us to create multiple users and manage the permissions for each of these users within the AWS Account. AWS IAM is integrated with the AWS Marketplace, therefore we can control who within the organization can subscribe to the software and services offered in the Marketplace. Since subscribing to certain software in the Marketplace launches an EC2 instance to run the software, this is an important access control feature. Temporary Security Credentials AWS IAM enables us to grant any user temporary access to your AWS resources by using security credentials that are valid only for a limited amount of time. These credentials provide enhanced security due to their short life-span (the default expiration is 12 hours) and the fact that they cannot be reused after they expire. This can be particularly useful in providing limited, controlled access in certain situations: Federated (non-aws) User Accounts and Single Sign-On. AWS Multi-Factor Authentication (AWS MFA) AWS Multi-Factor Authentication (AWS MFA) is an additional layer of security for accessing AWS services. When enabling this optional feature, we will provide a six-digit single-use code in addition to our standard user name and password credentials before access is granted to the AWS Account settings or AWS services and resources. We will get the token (single-use code) from an authentication device that we own. The multi-factor authentication consists in checking multiple authentication factors before access is granted: a password and the token. We will enable MFA devices or the AWS Account as well as for others users we will create under the AWS Account with AWS IAM. AWS Trusted Advisor Security Checks We decided to pay for the AWS Trusted Advisor customer support service as the Trusted Advisor will inspect our AWS environment and will make recommendations regarding the cloud performance and resiliency and the cloud security. Copyright Netop All rights reserved 7

9 AWS Service-Specific Security AWS secures its infrastructure and available services which allow us to protect sensitive data and applications. Read more about service-specific security on AWS Security Whitepaper, starting with page 17. The matrix below lists the AWS build-in security features that best suits Netop needs. Amazon Elastic Compute Cloud (Amazon EC2) Security Amazon Elastic Load Balancing Security Amazon Virtual Private Cloud (Amazon VPC) Security Amazon Direct Connect Security Amazon Simple Storage Service (Amazon S3) Security Amazon Web Services AWS Glacier Security AWS Storage Gateway Security AWS Import/Export Security Amazon Simple Database (SimpleDB) Security Amazon DynamoDB Security Amazon Relational Database Service (Amazon RDS) Security Amazon RedShift Security Amazon Web Services Amazon ElastiCache Security Amazon Simple Queue Service (Amazon SQS) Security Amazon Simple Notification Service (Amazon SNS) Security Amazon Simple Workflow Service (Amazon SWF) Security Amazon Simple Service (Amazon SES) Security Amazon Elastic Transcoder Service Security Amazon CloudWatch Security Amazon CloudFront Security Amazon Elastic MapReduce (Amazon EMR) Security Amazon Route 53 Security Amazon CloudSearch Security AWS Elastic Beanstalk Security AWS CloudFormation Security AWS OpsWorks Security AWS CloudHSM Security Note: if the development and Operational teams decide we should extend to other services, we will. Copyright Netop All rights reserved 8

10 References Copyright Netop All rights reserved 9