This presentation is an introduction to Emind Systems' in-house best practice for an ultra-secure application deployment on the AWS cloud. This best practice is based on Emind's experience in performing dozens of infrastructure projects based on the Amazon Web Services’ platform.

1. Ultra Secure Data Center
on Amazon Cloud
Lahav Savir, Architect & CEO
Emind systems ltd.
lahavs@emind.co

2. About
Lahav Savir
• 15+ years in on-line industry
• Architect and CEO @ Emind Systems
Emind Systems (est. 2006)
• Boutique system integrator
• AWS solution provider
• 100+ AWS customers

3. Amazon (AWS) Certification
Amazon Solution Provider
& Consulting Partner
https://aws.amazon.com/solution-providers/si/emind-systems-ltd

4. What is secure data center ?
• Isolated and controlled • Data encryption
• Firewalled • Antivirus
• Secure access • Frequent updates
– VPN • User management
– SSL – One time password
• Audited • One spot for monitoring
• Intrusion detection & – Centralized alerts and
prevention notifications
• Configuration analysis • Regulatory compliance

5. Emind’s best practice

6. Access Management
• Control the data flow
– AWS VPC
– ACL
– Routing
– Handle all in/out traffic
• Access control
– Security groups
• Identity access management
– One-time-password
– AWS IAM with MFA

7. ACL & Routing in the VPC

8. Emind’s best practice

9. Traffic Control
• Log in / out traffic
• Terminate encrypted connection
• Sanitize in / out packets
– Real-time decisions
– Accept / reject connections
– Rate limiting

10. Emind’s best practice

11. Anomalies detection
• Host based IDS
– Detect configuration changes
– Track running processes
– Track file access
– Resource access
– Detect abnormal behavior !
• OS hardening
• App cleanup

12. Emind’s best practice

13. Data Protection
• In-flight
– SSL encryption
– IPSec
• In-rest
– Storage level encryption
– Data base encryption

14. Emind’s best practice

15. Data aggregation
• Need to aggregate
– VPN access logs
– Traffic audit logs
– Network IDS logs
– Host IDS logs
– Anti virus logs
• Detect patterns

16. Emind’s best practice

17. Security lifecycle management
• Ongoing log discovery & analysis
– Access
– Traffic
– IDS
– Anti virus
– Encryption keys
• Act on analysis result
• Revel and solve cloud infrastructure settings
• Make them all orchestrate together !

18. • goCloud – Emind’s optimal road to the cloud
– Secure cloud architecture
– Scalable & high-availability design
– Customized system deployment
– Orchestrating cloud and software
– Cloud operation team
– Monitoring and alerting
– 24x7 SLA

19. Contact me, lahavs@emind.co
054-4321688