In this workshop, senior security management, IT, and business executive teams participate in an experiential exercise that illuminates the key decision points of a successful and secure cloud journey. During the team-based, game-like simulation, participants leverage an industry case study and make strategic decisions and investments around security, risk, and compliance. Participants experience the impact of these investments and decisions on the critical aspects of their secure cloud adoption. They also learn applicable decision and investment approaches to specific secure cloud adoption journeys. They walk through real-life examples, receive practical advice from AWS facilitators, and they leave with an understanding of the major success factors for building security, risk, and compliance in the cloud. This workshop is designed for executives who are leading a secure cloud journey, including the CISO, senior security and risk management leaders, and CIO/CTO. Non-IT participants who are key to executing the cloud security strategy are also encouraged to attend.

1. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
AWS Executive Security Simulation
Gili Lev
Cloud Executive Security Advisor
AWS
F N D 2 0 1

2. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Agenda
Duration Session
10 min. Welcome: Opening note, key principles
45 min. Simulation round 1
5 min. Simulation 1 debrief
40 min. Simulation round 2
5 min. Simulation 2 debrief
15 min. Secure journey key points, epics program

3. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
AWS Cloud Adoption Framework (AWS CAF)
The AWS CAF helps organizations understand how cloud adoption transforms the
way they work by identifying the stakeholders that are critical to cloud adoption
and grouping them into six perspectives

4. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
AWS CAF security perspective
Security Perspective
Directive
Preventative Detective
Responsive

5. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Project
Foundation
Migration
Reinvention
Discovery
Targeted
At scale
Clientvalue
Cloud adoption over time
Enterprise stages of AWS adoption

6. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
AWS stages of cloud adoption
Customer Cloud Center of Excellence (CCOE)
Project Foundation
Migration
Reinvention
Innovation Retire tech
debt
Value
Time
Discovery
AWS CAF

7. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Experience what it takes to lead a secure cloud journey for
your organization
A competitive, immersive experience
The AWS Executive Security Simulation is an engaging exercise that
illuminates keys to success for enabling a secure cloud journey for your
organization
For security leaders driving major change
The simulation is best delivered in person to participants leading a
secure cloud journey, including the CISO, senior security management,
and other CxOs
Impactful lessons and experience
Participants walk away with an understanding of the major success
factors for delivering security in the cloud

8. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
What to expect from the session
UNDERSTANDING REAL CUSTOMER EXPERIENCES – You will be reviewing the case study and
experience scenarios and their impacts to accomplish a secure cloud migration
EXPERIENTIAL WORKSHOP –Based on real experience and observation, you will be actively
participating with table teammates
LEADERSHIP DECISION MAKERS – You and your table teammatesare an IT Security
Leadership Team
A COMPETITION – You will be competing against the other tables
GOAL – Progress your organization through the stages of adoption in a secure and compliant
manner. Understand the key success factors for a secure cloud journey
LEADERSHIP DECISION MAKERS – You and your table teammates are an IT Security Leadership
Team

9. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Striking a balance
RealitySimplicity

10. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
1
2
3
4
5

11. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Participant guide

12. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Event, option, and consequence cards

13. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.

14. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
1. What did I learn in round 1 that I will take back to my
company?
2. Identify three actionable items. What will I do next?
In two days
(just something)
In two weeks
(kick something off)
In two months
(tangible
progress/results)
Round 1 debrief

15. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.

16. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Round 2 debrief
What are my lessons learned from today’s journey?

17. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Round 2 debrief
I will select 3 strategic initiatives that require the most attention in my
organization, and I will put them into practice.

18. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
AWS pace of innovation
AWS has been continually expanding its services to
support virtually any cloud workload, and it now has
more than 90 services that range from compute,
storage, networking, database, analytics, application
services, deployment, management, developer,
mobile, Internet of Things (IoT), artificial intelligence
(AI), security, hybrid, and enterprise applications. AWS
has launched a total of 4,343 new features and/or
services since inception in 2006.
2012
160
1,017
1,957
516
2014 2016 2018

19. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
AWS security team
Operations
Application security
Engineering
Aligned for agility

20. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Security ownership as part of DNA
• Promotes culture of “everyone is an owner” for security
• Makes security a stakeholder in business success
• Enables easier and smoother communication
Distributed Embedded

21. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
and
Move fast
Stay secure

22. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.

23. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Security is a shared responsibility
AWS foundation services
Compute Storage Database Networking
AWS global
infrastructure Regions
Availability zones
Edge locations
Client-side
data encryption
Server-side
data encryption
Network traffic protection
Platform, applications, identity and access management
Operating system, network, and firewall configuration
Customer content
AWS is responsible
for the security of
the cloud
Customers are responsible
for their security and
compliance in the cloud

24. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Infrastructure services
Customer content
Platform and application management
Operating system, network, and firewall configuration
Client-side data encryption
and data integrity
authentication
Network traffic protection
encryption/
integrity/identity
Server-side encryption
file system and/or data
Optional – opaque data: 0s and 1s (in transit/at rest)
CustomerIAM
AWS
endpoints
AWSIAM
NetworkingDatabasesStorageCompute
Edge
locations
Availability
zones
Regions
AWS global
infrastructure
Foundation
services
Managed by
customers
Managed by
AWS

25. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Container services
Client-side data encryption and data
integrity authentication
Network traffic protection
encryption/integrity/identity
Optional – opaque data: 0s and 1s (in transit/at rest)
Customer
IAMAWSIAM
NetworkingDatabasesStorageCompute
Edge
locations
Availability
zones
RegionsAWS global
infrastructure
Foundation
services
Managed by
customers
Managed by AWS
Platform and application management
Firewall
configuration
Operating system and network configuration
Customer content
AWS
endpoints

26. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Abstracted services
Client-side data encryption and
data integrity authentication
AWSIAM
NetworkingDatabasesStorageCompute
Edge
locations
Availability
zones
Regions
AWS global
infrastructure
Foundation
services
Managed by
customers
Optional – opaque data:
0s and 1s (in transit/at rest)
Data protection provided by the platform
for data at rest
Network traffic protection provided by
the platform protection of data in transit
Platform and application management
Operating system, network, and firewall configuration
Customer content
AWS
endpoints
Managed by AWS

27. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.

28. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
AWS security epics
Frequent iteration via sprints leads to
increased maturity while retaining
flexibility to adapt to business pace
and demand

29. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
AWS security epics
Frequent iteration via sprints leads to
increased maturity while retaining
flexibility to adapt to business pace
and demand
First sprint example
Define the account structure, and implement the
core set of best practices

30. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
AWS security epics
Frequent iteration via sprints leads to
increased maturity while retaining
flexibility to adapt to business pace
and demand
First sprint example
Define the account structure, and implement the
core set of best practices
Second sprint example
Implement federation

31. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
AWS security epics
Frequent iteration via sprints leads
to increased maturity while retaining
flexibility to adapt to business pace
and demand
First sprint example
Define the account structure, and implement the
core set of best practices
Second sprint example
Implement federation
Third sprint example
Expand account management to cater
to multiple accounts

32. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
AWS CAF security perspective
Increase agility and ability to perform actions faster and at a larger scale while
validating information security principles and ensuring that your environment
maintains a strong security footing
Core 5
• IAM
• Detective controls
• Infrastructure security
• Data protection
• Incident response

33. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.

34. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Account governance & ownership
AWS
Organizations
AWS Identity
and Access
Management
Policy-based management
for multiple AWS accounts
with security and
automation settings
Securely control
access to AWS
services and
resources for
your users
Amazon
Cognito
Mobile sign-up,
sign-in, and
access control
with various IdPs
via
SAML 2.0
✓ MFA
✓ Root
✓ Federation

35. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.

36. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Audit and visibility
AWS
CloudTrail
AWS
Config
Amazon
CloudWatch
VPC flow logs
Record AWS API calls
Enable governance,
compliance, & auditing
Monitor resources
and your applications
on AWS; collect
metrics, set alarms,
and automatically
react to changes
Resource inventory,
configuration history,
and configuration
change notifications to
enable security and
governance
Capture information about
the IP traffic going to and from
network interfaces in your VPC
Account Resources Network
Amazon
GuardDuty
Intelligent threat
detection and
continuous
monitoring to
protect your AWS
accounts and
workloads

37. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.

38. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Infrastructure protection
Amazon
VPC
AWS
CloudFormation
Security
groups
AWS WAF
AWS
Shield
Stateful host-based
firewalls for explicit
traffic control
Provision your resources in
a safe, predictable manner
Infrastructure as code is your
source of truth
Provision a logically isolated section
of the AWS Cloud where you can
launch AWS resources in a virtual
network that you define
Managed DDoS protection service
that safeguards web applications
running on AWS
Protects your web applications from
common web exploits, ensuring
availability and security
R e s o u r c e s N e t w o r k
Amazon
Inspector
Automatically assesses
applications for vulnerabilities
or deviations from best
practices

39. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.

40. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Data protection
• Deep integration
with AWS services
• AWS CloudTrail
• AWS SDK for application
encryption
AWSKMS
• Tamper-resistant secure
key storage for cryptographic
operations
• Standards-compliant
• FIPS 140-2 Level 3
Amazon CloudHSM V2AWS Certificate Manager
• Provision, manage, and
deploy TLS certificates
• Use with Elastic Load
Balancing (ELB) or Amazon
CloudFront distribution
Machine learning-
powered security service
to discover, classify, and
protect sensitive data
AmazonMacie

41. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.

42. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Auditability
AWS Config rule
AWS Trusted Advisor
Create rules that
automatically take
action in response
to changes in your
environment
Real-time guidance to provision
your resources following AWS
best practices
• Reduce cost
• Increase performance
• Improve security
AWS Lambda
Serverless compute
service that runs code
so that you can scale your
programmed, automated
response to incidents

43. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Getting to the cloud is a journey.
Your journey will be unique.

44. Thank you!
© 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Gili Lev
gililev@amazon.com