The AWS Shared Responsibility Model in Practice (Scott Ward)

1. ©2018, Amazon Web Services, Inc. or its affiliates. All rights reserved
The AWS Shared Security
Responsibility Model in Practice
Scott Ward
Principal Solutions Architect
June 2018

2. AWS Global Footprint
18 Regions
54 Availability Zones
105 Edge locations
Over 1 million active customers
12 more Availability Zones and four more Regions in Bahrain,
Hong Kong, Sweden, and a second AWS GovCloud Region in
the US are coming

3. AWS Global Footprint

4. Data Locality
Customer chooses where to place data
AWS regions are geographically isolated by design
Data is not replicated to other AWS regions and
doesn’t move unless you choose to move it

5. Shared Responsibility
Who manages which parts?

6. AWS Foundation Services
Compute Storage Database Networking
AWS Global
Infrastructure Regions
Availability Zones
Edge Locations
Client-side Data
Encryption
Server-side Data
Encryption
Network Traffic
Protection
Platform, Applications, Identity & Access Management
Operating System, Network & Firewall Configuration
Customer content
Customers
AWS Shared Responsibility Model
Customers are
responsible for
their security and
compliance IN
the Cloud
AWS is
responsible for
the security OF
the Cloud

7. AWS Shared Responsibility Model – Deep Dive
▪ Will one model work for all services?
Infrastructure
Services
Container
Services
Abstract
Services

8. Network Traffic Protection
Encryption / Integrity / Identity
AWS Foundation Services
Compute Storage Database Networking
AWS Global
Infrastructure Regions
Availability Zones
Edge Locations
Optional – Opaque data: 1’s and 0’s (in transit/at rest)
Platform & Applications Management
Customer content
Customers
AWS Shared Responsibility Model:
for Infrastructure Services
Managed by
Managed by
Client-Side Data encryption
& Data Integrity Authentication
AWSIAMCustomerIAM
Operating System, Network & Firewall Configuration
Server-Side Encryption
Fire System and/or Data
APIEndpoints
Mgmt
Protocols
API
Calls

9. Infrastructure Service
Example – EC2
• Foundation Services — Networking, Compute, Storage
• AWS Global Infrastructure
• AWS API Endpoints
AWS
• Customer Data
• Customer Application
• Operating System
• Network & Firewall
• Customer IAM (Corporate
Directory Service)
• High Availability, Scaling
• Instance Management
• Data Protection (Transit, Rest,
Backup)
• AWS IAM (Users, Groups,
Roles, Policies)
Customers
RESPONSIBILITIES

10. AWS Foundation Services
Compute Storage Database Networking
AWS Global
Infrastructure Regions
Availability Zones
Edge Locations
Optional – Opaque data: 1’s and 0’s (in transit/at rest)
Firewall
Configuration
Platform & Applications Management
Operating System, Network Configuration
Customer content
Customers
AWS Shared Responsibility Model:
for Container Services
Managed by
Managed by
Client-Side Data encryption
& Data Integrity Authentication
Network Traffic Protection
Encryption / Integrity / Identity
AWSIAMCustomerIAM
APIEndpoints
Mgmt
Protocols
API
Calls

11. Container Service
Example – RDS
• Foundational Services –
Networking, Compute,
Storage
• AWS Global Infrastructure
• AWS API Endpoints
• Operating System
• Platform / Application
• High Availability
AWS
• Customer Data
• Firewall (VPC)
• Customer IAM (DB Users, Table
Permissions)
• AWS IAM (Users, Groups, Roles,
Policies)
• Data Protection (Transit,
Rest, Backup)
• Scaling
Customers
RESPONSIBILITIES

12. AWS Foundation Services
Compute Storage Database Networking
AWS Global
Infrastructure Regions
Availability Zones
Edge Locations
Platform & Applications Management
Operating System, Network & Firewall Configuration
Customer content
Customers
AWS Shared Responsibility Model:
for Abstract Services
Managed by
Managed by
Data Protection by the Platform
Protection of Data at Rest
Network Traffic Protection by the Platform
Protection of Data at in Transit
(optional)
Opaque Data: 1’s and 0’s
(in flight / at rest)
Client-Side Data Encryption
& Data Integrity Authentication
APIEndpoints
AWSIAM
API Calls

13. • Foundational Services
• AWS Global Infrastructure
• AWS API Endpoints
• Operating System
• Platform / Application
• Data Protection (Rest - SSE,
Transit)
• High Availability / Scaling
AWS
• Customer Data
• Data Protection (Rest – CSE)
• AWS IAM (Users, Groups, Roles, Policies)
CustomersAbstract Service
Example – S3, Lambda

14. Summary of Customer Responsibility in the Cloud
Customer IAM
AWS IAM
Firewall
Data
AWS IAM
Data
Applications
Operating System
Networking/Firewall
Data
Customer IAM
AWS IAM
Infrastructure
Services
Container
Services
Abstract
Services

15. Shared Responsibility
What about security OF the cloud?

16. Security Shared Responsibility Model
AWS is responsible
for the security OF
the cloud
AWS Foundation Services
Compute Storage Database Networking
AWS Global
Infrastructure Regions
Availability Zones
Edge Locations

17. Auditing - Comparison
on-prem vs on AWS
Start with bare concrete
Functionally optional – you can build a secure
system without it
Audits done by an in-house team
Accountable to yourself
Typically check once a year
Workload-specific compliance checks
Must keep pace and invest in security innovation
on-prem
Start on base of accredited services
Functionally necessary – high watermark of
requirements
Audits done by third party experts
Accountable to everyone
Continuous monitoring
Compliance approach based on all workload
scenarios
Security innovation drives broad compliance
on AWS

18. What this means
You benefit from an environment built for the most security sensitive
organizations
AWS manages 2,600+ security controls so you don’t have to
You get to define the right security controls for your workload
sensitivity
You always have full ownership and control of your data

19. Key AWS Certifications and Assurance Programs

20. AWS Foundation Services
Compute Storage Database Networking
AWS Global
Infrastructure Regions
Availability Zones
Edge Locations
Meet your own security objectives
Customer scope and
effort is reduced
Better results through
focused efforts
Built on AWS
consistent baseline
controls
Your own
external audits
Customers
Your own
accreditation
Your own
certifications

21. Navigating Shared Responsibility
Achieving accreditation or certification on
AWS is possible but how can we help?

22. Industry Best Practices for
Securing AWS Resources
CIS Amazon Web Services Foundations
Architecture agnostic set of security
configuration best practices
provides set-by-step implementation and
assessment procedures

23. AWS Quickstart
ComplianceArchitectures
NIST 800-53
HIPAA
PCI-DSS
UK-Official CIS
CIS Benchmark
CJIS Security Policy
http://docs.aws.amazon.com/quickstart/latest/accelerator-nist/welcome.html

24. Compliance Resources – AWS Artifact
https://aws.amazon.com/compliance/resources/

25. Education — AWS Security & Compliance
AWS Security Fundamentals
3 hour eLearning course
Target audience – Security Auditors/Analysts
It’s Free ☺
AWS Certified Security – Specialty
Validates and demonstrates knowledge of how to secure the
AWS platform
AWS Security Operations
3 day Instructor Lead Training
Target audience – Security Engineer/Architects
12 Modules + Labs
https://aws.amazon.com/training/course-
descriptions/

26. Helpful Resources
Compliance Resources: https://aws.amazon.com/compliance/resources
Risk & Compliance Whitepaper: https://aws.amazon.com/whitepapers/overview-of-
risk-and-compliance/
Compliance Center Website: https://aws.amazon.com/compliance
Security Center: https://aws.amazon.com/security
Security Blog: https://blogs.aws.amazon.com/security/
Auditor Learning Path:
https://aws.amazon.com/compliance/auditor-learning-path/

27. Thank you!!!