Sicurezza e conformità al GDPR con AWS

© 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.© 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Navigating GDPR
Compliance on AWS
Diego Natali
AWS Solutions Architect

© 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
What is the GDPR?

What is the GDPR?
• The “GDPR” is the General Data Protection Regulation, a significant new
EU Data Protection Regulation
• Introduces robust requirements that will raise and harmonize standards
for data protection, security, and compliance across the EU
• The GDPR is enforceable May 25, 2018 and it replaces the EU Data
Protection Directive (Directive 95/46/EC)
• In scope: organizations established in the EU and organizations without
an EU presence who target or monitor EU individuals

Content versus Personal Data
= anything that a customer (or any
user) stores, or processes using AWS
services, including:
Software ǀ Data ǀ Text ǀ Audio ǀ Video
Content Personal data
= information from which a
living individual may be identified
or identifiable (under EU data
protection law)
Customer’s “content” might include
“personal data”

Data Controller vs Data Processor
= determines the purposes and means
of the processing of personal data
Data Controller Data Processor
= processes personal data on behalf of
the controller

The right to be
forgotten
Privacy by design
Data breach
notification
Individuals have the right to a copy of all the personal
data that controllers have regarding him or her. It also
must be provided in a way that facilitates reuse.
What Else Comes with GDPR?
The right to data
portability

The right to be
forgotten
Privacy by design
Data breach
notification
This gives individuals the right to have certain personal
data deleted so third parties can no longer trace them.
The right to data
portability

The right to be
forgotten
Privacy by design
Data breach
notification
This helps to facilitate the inclusion of policies, guidelines,
and work instructions related to data protection in the
earliest stages of projects including personal data.
The right to data
portability

The right to be
forgotten
Privacy by design
Data breach
notification
Controllers must report personal data breaches to the
relevant supervisory authority within 72 hours. If there is
a high risk to the rights and freedoms of data subjects,
they must also notify the data subjects.
The right to data
portability

How AWS Can Help Customers
Achieve GDPR Compliance

Data Protection— A Shared Responsibility
Managed by
AWS customers
Managed
by AWS
Foundation
Services
AWS Global
Infrastructure
Client-side data encryption and
data integrity authentication
Server-side encryption
File System and/or data
Network Traffic Protection
Encryption/integrity/identity
AWSIAM
Customer data
Platform and application management
Operating system, network, and firewall configuration
CustomerIAM
Optional—opaque data: 0s and 1s (in transit/at rest)
Compute Storage Databases Networking
Regions
Availability
zones
Edge
locations
AWS
endpoints

Data subjects Customer as controller AWS as processor
Controllers and processors have obligations under GDPR

Data subjects
Customer‘s customer
as controller
Customer as processor AWS as processor

Legal Compliance
(Both controllers and processors)
System Security and Data Protection by Design
(Both controllers and processors; AWS has tooling to help)
Records of Processing Activities
Encryption
Security of Personal Data
(Controller responsibility)
Managing Data Subject Consent
Managing Personal Data Deletion
Managing Personal Data Portability
GDPR is Also a Shared Responsibility

GDPR in Practice: Implementing TOMs
1
Pseudonymization
and encryption of
personal data
2
Ensure ongoing
confidentiality,
integrity, availability,
and resilience of
processing systems
and services
3
Ability to restore
availability and access
to personal data in a
timely manner in the
event of a physical or
technical incident
4
Process for regularly
testing, assessing, and
evaluating the
effectiveness of TOMs
Under GDPR, Controllers and Processors are required to implement appropriate
Technical and Organization Measures (“TOMs”)…

AWS Services Already Comply with the GDPR
AWS completed the entirety of our GDPR service readiness audit on
March 26, 2018—validating that all generally available services and
features adhere to the high privacy bar and data protection standards
required of data processors by the GDPR.
What does this mean to you?
Customers can deploy AWS services as a key part of their GDPR
compliance plans.

Implementing TOMs—What AWS Provides to You
Tools and services Compliance framework Partner network Data protection terms

Implementing TOMs with AWS Services
“Security of processing”“Data protection by design and default”
“Records of processing activities”
AWS Storage
Gateway
Amazon Virtual
Private Cloud (VPC)
Amazon API
Gateway
AWS
KMS
AWS
CloudHSM
Amazon S3 Server-
Side Encryption
AWS Identity and
Access Management
AWS
CloudFormation
AWS
WAF
Amazon
CloudWatch
AWS
CloudTrail
AWS
Config

Implementing TOMs with AWS Services—Examples
Monitoring of access
activities
Data encryption
Strong compliance
framework
The controller “shall implement appropriate technical and organizational
measures for ensuring that, by default, only personal data that are necessary
for each specific purpose of the processing are processed.”
AWS Identity and Access Management
API-Request Authentication
Temporary Access Tokens
Data access control

IAM/STS
Resources
Data Access Control
IAM User
Parent account Child account
1. Authenticate
with access keys
2. Pass MFA info to get
temporary security credentials
3. Call AWS APIs using
temporary security credentials

Data Access Control

activities
Data encryption
Strong compliance
framework
“Each controller and, where applicable, the controller’s representative, shall
maintain a record of processing activities under their responsibility.”
AWS CloudTrail
Amazon Inspector
Amazon Macie
AWS Config
Data access control

AWS CloudTrail
Monitoring of access activities—AWS CloudTrail
Management console
CLI
SDK
AWS resources
Archive and audit
Troubleshoot
Monitor, alarm,
and react
Amazon
CloudWatch
S3 Bucket
AWS CloudTrail

Monitoring of access activities—Amazon GuardDuty
Amazon
GuardDuty

Security service that uses machine
learning to continuously and
automatically discover, classify, and
protect sensitive data in AWS
Recognizes and classify
sensitive data such as
Personally identifiable information (PII)
Intellectual property
Sensitive AWS account information

activities
Data encryption
Strong compliance
framework
Organizations must “implement appropriate technical and organizational measures
to ensure a level of security appropriate to the risk, including the pseudonymisation
and encryption of personal data.”
Encryption of data at rest
(Amazon EBS, Amazon S3, Amazon Glacier, Amazon RDS, etc.)
Centralized Regional Key Management with AWS KMS
Dedicated HSM in the cloud with AWS CloudHSM
IPsec VPN to your AWS environment with Virtual Private Gateway
Data access control

In transit data encryption
For distributed applications
Open-source encryption functionality
In transit data encryption
For EMRFS traffic between S3 and
cluster nodes (enabled automatically)
TLS encryption
At-rest data encryption
For EMRFS on S3
Server-side or client-side encryption
(SSE-S3, SSE-KMS, CSE-KMS,
or CSE-Custom)
At-rest data encryption
For cluster nodes (EC2 instance volumes)
Open-source HDFS encryption, LUKS encryption
EMR
S3
HSFS
(Block-transfer
and RPC)
Local volumes
(instance
store/EBS)
Data encryption at rest

activities
Data encryption
Strong compliance
framework
Appropriate technical and organizational measures may need to include
“the ability to ensure the ongoing confidentiality, integrity, availability,
and resilience of the processing systems and services.”
SOC 1/SSAE 16/ISAE 3402 (formerly SAS 70)/SOC 2/SOC 3
PCI DSS Level 1
ISO 9001/ISO 27001/ISO 27017/ISO 27018
NIST FIPS 140-2
Common Cloud Computing Controls Catalog (C5)
Data access control

Meet Your Own Security Objectives
AWS Global Infrastructure
AWS Foundation Services
Your own
accreditation
Your own
certifications
Your own
external audits
GDPR
Code of
Conduct
Customer scope and
effort is reduced
Better results through
focused efforts
Built on AWS consistent
baseline controls

GDPR—Code of Conduct
CISPE Code (Cloud Infrastructure
Service Providers in Europe)
The CISPE Code of Conduct:
An effective, easily accessed framework for complying
with the EU’s GDPR
Excludes the reuse of customer data
Enables data storage and processing exclusively within the EU
Identifies cloud infrastructure services suitable
for different types of data processing
Helps citizens retain control of their personal and sensitive data
AWS CISPE certified
CISPE Code of Conduct in evaluation by Article 29 WP

Continuous Validation
Amazon Trusted Advisor
Helps you reduce cost, increase performance,
and improve security by providing real-time
guidance to help you provision your resources
following AWS best practices

Comes with baked-in controls for
Unrestricted security groups
MFA not on root accounts
Publically exposed AWS credentials

Integrated with CloudWatch Events
Build automation for things like:
Exposed keys
Auto disable?
Security groups
Alert?

Amazon and OSS
Example:
CIS AWS benchmarks
Purpose:
Enables you to continuously or spot
evaluate the configuration of resources
and account settings of an AWS
account against the CIS AWS
Foundation Benchmark

Provides
Assess against 48 control statements, including:
No multi-factor authentication (MFA) usage on the root account
Overly open IAM policies
Lack of enabled logging on the account

AWS Partner Network (APN) and GDPR
Technology partnersConsulting partners
APN Technology Partners
offer security and identity
solutions to help with GDPR
APN Consulting Partners
can help your customers
get ready for GDPR

AWS Marketplace:
Your One Stop Shop for Familiar Tools
Advanced
threat analytics
Application
security
Identity and
access
management
Server and
endpoint
protection
Network
security
Encryption
and key
management
Vulnerability
and pen
testing

AWS GDPR Center
https://aws.amazon.com/compliance/gdpr-center/

Data subjects Customer as controller AWS as processor
Recap: Data Protection—a Shared Responsibility

AWS Provides Assistance for Your GDPR Journey
Tools and services Compliance framework Partner network Data protection terms

Thank You!

Sicurezza e conformità al GDPR con AWS

Recomendados

Recomendados

Mais conteúdo relacionado

Mais procurados

Mais procurados (20)

Semelhante a Sicurezza e conformità al GDPR con AWS

Semelhante a Sicurezza e conformità al GDPR con AWS (20)

Mais de Amazon Web Services

Mais de Amazon Web Services (20)

Sicurezza e conformità al GDPR con AWS