the aws shared responsibility model in practice - nirav kothari, aws
TRANSCRIPT
![Page 1: The AWS Shared Responsibility Model in Practice - Nirav Kothari, AWS](https://reader031.vdocuments.site/reader031/viewer/2022021922/586fdf6c1a28ab18428b6fdf/html5/thumbnails/1.jpg)
©2015, Amazon Web Services, Inc. or its affiliates. All rights reserved
The AWS Shared Security Responsibility Model in
Practice
Nirav Kothari
Principal Consultant, AWS Professional Services
12/15/2016
![Page 2: The AWS Shared Responsibility Model in Practice - Nirav Kothari, AWS](https://reader031.vdocuments.site/reader031/viewer/2022021922/586fdf6c1a28ab18428b6fdf/html5/thumbnails/2.jpg)
AWS Global Footprint
![Page 3: The AWS Shared Responsibility Model in Practice - Nirav Kothari, AWS](https://reader031.vdocuments.site/reader031/viewer/2022021922/586fdf6c1a28ab18428b6fdf/html5/thumbnails/3.jpg)
AWS Global Footprint
US West (N.California)
US West (Oregon)
GovCloud
US East (Virginia)
EU West (Ireland)
Asia Pacific (Tokyo)
Asia Pacific (Singapore)
Asia Pacific (Sydney)
China (Beijing)
São Paulo
EU Central (Frankfurt)Asia Pacific (Seoul)
![Page 4: The AWS Shared Responsibility Model in Practice - Nirav Kothari, AWS](https://reader031.vdocuments.site/reader031/viewer/2022021922/586fdf6c1a28ab18428b6fdf/html5/thumbnails/4.jpg)
AWS Global Footprint
US West (N.California)
US West (Oregon)
GovCloud
US East (Virginia)
EU West (Ireland)
Asia Pacific (Tokyo)
Asia Pacific (Singapore)
Asia Pacific (Sydney)
São Paulo
EU Central (Frankfurt)
Asia Pacific (Tokyo)
China (Beijing)
Asia Pacific (Seoul)
Region
An independent collection of AWS
resources in a defined geography
A solid foundation for meeting location-
dependent privacy and compliance
requirements
![Page 5: The AWS Shared Responsibility Model in Practice - Nirav Kothari, AWS](https://reader031.vdocuments.site/reader031/viewer/2022021922/586fdf6c1a28ab18428b6fdf/html5/thumbnails/5.jpg)
AWS Global Footprint
US West (N.California)
US West (Oregon)
GovCloud
US East (Virginia)
EU West (Ireland)
Asia Pacific (Tokyo)
Asia Pacific (Singapore)
Asia Pacific (Sydney)
China (Beijing)
São Paulo
EU Central (Frankfurt)Asia Pacific (Seoul)
![Page 6: The AWS Shared Responsibility Model in Practice - Nirav Kothari, AWS](https://reader031.vdocuments.site/reader031/viewer/2022021922/586fdf6c1a28ab18428b6fdf/html5/thumbnails/6.jpg)
AWS Global Footprint
US West (N.California)
US West (Oregon)
GovCloud
US East (Virginia)
EU West (Ireland)
Asia Pacific (Tokyo)
Asia Pacific (Singapore)
Asia Pacific (Sydney)
China (Beijing)
São Paulo
EU Central (Frankfurt)Asia Pacific (Seoul)
Availability Zone
Designed as independent failure zones
Physically separated within a typical
metropolitan region
![Page 7: The AWS Shared Responsibility Model in Practice - Nirav Kothari, AWS](https://reader031.vdocuments.site/reader031/viewer/2022021922/586fdf6c1a28ab18428b6fdf/html5/thumbnails/7.jpg)
AWS Global Footprint
![Page 8: The AWS Shared Responsibility Model in Practice - Nirav Kothari, AWS](https://reader031.vdocuments.site/reader031/viewer/2022021922/586fdf6c1a28ab18428b6fdf/html5/thumbnails/8.jpg)
AWS Global Footprint
Edge Location
collections of servers in geographically
dispersed data centers
deliver content to end users with lower latency
![Page 9: The AWS Shared Responsibility Model in Practice - Nirav Kothari, AWS](https://reader031.vdocuments.site/reader031/viewer/2022021922/586fdf6c1a28ab18428b6fdf/html5/thumbnails/9.jpg)
AWS Global Footprint
![Page 10: The AWS Shared Responsibility Model in Practice - Nirav Kothari, AWS](https://reader031.vdocuments.site/reader031/viewer/2022021922/586fdf6c1a28ab18428b6fdf/html5/thumbnails/10.jpg)
AWS Global Footprint
16 Regions
42 Availability Zones
63 Edge locations
Over 1 million active customers
Every day, AWS adds enough new server
capacity to support Amazon.com when it was a
$7 billion global enterprise.
![Page 11: The AWS Shared Responsibility Model in Practice - Nirav Kothari, AWS](https://reader031.vdocuments.site/reader031/viewer/2022021922/586fdf6c1a28ab18428b6fdf/html5/thumbnails/11.jpg)
Data Locality
Customer chooses where to place data
AWS regions are geographically isolated by
design
Data is not replicated to other AWS regions
and doesn’t move unless you choose to move it
![Page 12: The AWS Shared Responsibility Model in Practice - Nirav Kothari, AWS](https://reader031.vdocuments.site/reader031/viewer/2022021922/586fdf6c1a28ab18428b6fdf/html5/thumbnails/12.jpg)
Data Locality in practice
Block level storage
Instance Storage (Elastic Cloud Compute - EC2)
Elastic Block Storage (EBS)
Object level storage
Simple Storage Service (S3)
Database storage
Relational Database Service (RDS)
NoSQL (DynamoDB)
Columnar (Redshift)
Caching (Elasticache)
![Page 13: The AWS Shared Responsibility Model in Practice - Nirav Kothari, AWS](https://reader031.vdocuments.site/reader031/viewer/2022021922/586fdf6c1a28ab18428b6fdf/html5/thumbnails/13.jpg)
Shared Responsibility
Who manages which parts?
![Page 14: The AWS Shared Responsibility Model in Practice - Nirav Kothari, AWS](https://reader031.vdocuments.site/reader031/viewer/2022021922/586fdf6c1a28ab18428b6fdf/html5/thumbnails/14.jpg)
AWS Foundation Services
Compute Storage Database Networking
AWS Global Infrastructure Regions
Availability Zones
Edge Locations
Client-side Data Encryption
Server-side Data Encryption
Network Traffic Protection
Platform, Applications, Identity & Access Management
Operating System, Network & Firewall Configuration
Customer contentC
ust
om
ers
AWS Shared Responsibility Model
Customers are
responsible for
their security and
compliance IN
the Cloud
AWS is
responsible for
the security OF
the Cloud
![Page 15: The AWS Shared Responsibility Model in Practice - Nirav Kothari, AWS](https://reader031.vdocuments.site/reader031/viewer/2022021922/586fdf6c1a28ab18428b6fdf/html5/thumbnails/15.jpg)
AWS Shared Responsibility Model – Deep Dive
Will one model work for all services?
Infrastructure
Services
Container
Services
Abstract
Services
![Page 16: The AWS Shared Responsibility Model in Practice - Nirav Kothari, AWS](https://reader031.vdocuments.site/reader031/viewer/2022021922/586fdf6c1a28ab18428b6fdf/html5/thumbnails/16.jpg)
Network Traffic ProtectionEncryption / Integrity / Identity
AWS Foundation Services
Compute Storage Database Networking
AWS Global Infrastructure Regions
Availability ZonesEdge Locations
Optional – Opaque data: 1’s and 0’s (in transit/at rest)
Platform & Applications Management
Customer content
Cu
sto
mer
s
AWS Shared Responsibility Model:for Infrastructure Services
Managed by
Managed by
Client-Side Data encryption & Data Integrity Authentication
AW
S IAM
Cu
stom
er IA
M
Operating System, Network & Firewall Configuration
Server-Side EncryptionFire System and/or Data
AP
I End
po
ints
![Page 17: The AWS Shared Responsibility Model in Practice - Nirav Kothari, AWS](https://reader031.vdocuments.site/reader031/viewer/2022021922/586fdf6c1a28ab18428b6fdf/html5/thumbnails/17.jpg)
Infrastructure ServiceExample – EC2
• Foundation Services — Networking, Compute, Storage
• AWS Global Infrastructure
• AWS API Endpoints
AW
S
• Customer Data
• Customer Application
• Operating System
• Network & Firewall
• Customer IAM (Corporate Directory
Service)
• High Availability, Scaling
• Instance Management
• Data Protection (Transit, Rest, Backup)
• AWS IAM (Users, Groups, Roles,
Policies)
Custo
mers
RESPONSIBILITIES
![Page 18: The AWS Shared Responsibility Model in Practice - Nirav Kothari, AWS](https://reader031.vdocuments.site/reader031/viewer/2022021922/586fdf6c1a28ab18428b6fdf/html5/thumbnails/18.jpg)
AWS Foundation Services
Compute Storage Database Networking
AWS Global Infrastructure Regions
Availability ZonesEdge Locations
Optional – Opaque data: 1’s and 0’s (in transit/at rest)
Firew
all C
on
figuratio
n
Platform & Applications Management
Operating System, Network Configuration
Customer content
Cu
sto
mer
s
AWS Shared Responsibility Model:for Container Services Managed by
Managed by
Client-Side Data encryption & Data Integrity Authentication
Network Traffic ProtectionEncryption / Integrity / Identity
AW
S IAM
Cu
stom
er IA
M
AP
I End
po
ints
![Page 19: The AWS Shared Responsibility Model in Practice - Nirav Kothari, AWS](https://reader031.vdocuments.site/reader031/viewer/2022021922/586fdf6c1a28ab18428b6fdf/html5/thumbnails/19.jpg)
Container ServiceExample – RDS
• Foundational Services –
Networking, Compute, Storage
• AWS Global Infrastructure
• AWS API Endpoints
• Operating System
• Platform / Application
AW
S
• Customer Data
• Firewall (VPC)
• Customer IAM (DB Users, Table
Permissions)
• AWS IAM (Users, Groups, Roles,
Policies)
• High Availability
• Data Protection (Transit, Rest,
Backup)
• Scaling
Custo
mers
RESPONSIBILITIES
![Page 20: The AWS Shared Responsibility Model in Practice - Nirav Kothari, AWS](https://reader031.vdocuments.site/reader031/viewer/2022021922/586fdf6c1a28ab18428b6fdf/html5/thumbnails/20.jpg)
AWS Foundation Services
Compute Storage Database Networking
AWS Global Infrastructure Regions
Availability ZonesEdge Locations
Platform & Applications Management
Operating System, Network & Firewall Configuration
Customer content
Cu
sto
mer
s
AWS Shared Responsibility Model:for Abstract Services
Managed by
Managed by
Data Protection by the PlatformProtection of Data at Rest
Network Traffic Protection by the PlatformProtection of Data at in Transit
(optional)
Opaque Data: 1’s and 0’s
(in flight / at rest)
Client-Side Data Encryption & Data Integrity Authentication
AP
I End
po
ints
AW
S IAM
![Page 21: The AWS Shared Responsibility Model in Practice - Nirav Kothari, AWS](https://reader031.vdocuments.site/reader031/viewer/2022021922/586fdf6c1a28ab18428b6fdf/html5/thumbnails/21.jpg)
• Foundational Services
• AWS Global Infrastructure
• AWS API Endpoints
• Operating System
• Platform / Application
• Data Protection (Rest - SSE, Transit)
• High Availability / Scaling
AW
S
• Customer Data
• Data Protection (Rest – CSE)
• AWS IAM (Users, Groups, Roles, Policies)
Custo
mers
Abstract ServiceExample – S3
![Page 22: The AWS Shared Responsibility Model in Practice - Nirav Kothari, AWS](https://reader031.vdocuments.site/reader031/viewer/2022021922/586fdf6c1a28ab18428b6fdf/html5/thumbnails/22.jpg)
Summary of Customer Responsibility in the Cloud
Customer IAM
AWS IAM
Firewall
Data
AWS IAM
Data
Applications
Operating System
Networking/Firewall
Data
Customer IAM
AWS IAM
Infrastructure
Services
Container
Services
Abstract
Services
![Page 23: The AWS Shared Responsibility Model in Practice - Nirav Kothari, AWS](https://reader031.vdocuments.site/reader031/viewer/2022021922/586fdf6c1a28ab18428b6fdf/html5/thumbnails/23.jpg)
Shared Responsibility
What about security OF the cloud?
![Page 24: The AWS Shared Responsibility Model in Practice - Nirav Kothari, AWS](https://reader031.vdocuments.site/reader031/viewer/2022021922/586fdf6c1a28ab18428b6fdf/html5/thumbnails/24.jpg)
Security Shared Responsibility Model
AWS is responsible
for the security OF
the cloud
AWS Foundation Services
Compute Storage Database Networking
AWS Global Infrastructure Regions
Availability Zones
Edge Locations
![Page 25: The AWS Shared Responsibility Model in Practice - Nirav Kothari, AWS](https://reader031.vdocuments.site/reader031/viewer/2022021922/586fdf6c1a28ab18428b6fdf/html5/thumbnails/25.jpg)
Auditing - Comparisonon-prem vs on AWS
Start with bare concrete
Functionally optional – you can build a secure
system without it
Audits done by an in-house team
Accountable to yourself
Typically check once a year
Workload-specific compliance checks
Must keep pace and invest in security innovation
on-prem
Start on base of accredited services
Functionally necessary – high watermark of
requirements
Audits done by third party experts
Accountable to everyone
Continuous monitoring
Compliance approach based on all workload
scenarios
Security innovation drives broad compliance
on AWS
![Page 26: The AWS Shared Responsibility Model in Practice - Nirav Kothari, AWS](https://reader031.vdocuments.site/reader031/viewer/2022021922/586fdf6c1a28ab18428b6fdf/html5/thumbnails/26.jpg)
What this means
You benefit from an environment built for the most security
sensitive organizations
AWS manages 1,800+ security controls so you don’t have to
You get to define the right security controls for your workload
sensitivity
You always have full ownership and control of your data
![Page 27: The AWS Shared Responsibility Model in Practice - Nirav Kothari, AWS](https://reader031.vdocuments.site/reader031/viewer/2022021922/586fdf6c1a28ab18428b6fdf/html5/thumbnails/27.jpg)
AWS Assurance Programs
![Page 28: The AWS Shared Responsibility Model in Practice - Nirav Kothari, AWS](https://reader031.vdocuments.site/reader031/viewer/2022021922/586fdf6c1a28ab18428b6fdf/html5/thumbnails/28.jpg)
AWS Foundation Services
Compute Storage Database Networking
AWS Global Infrastructure Regions
Availability Zones
Edge Locations
Meet your own security objectives
Customer scope and
effort is reduced
Better results through
focused efforts
Built on AWS
consistent baseline
controls
Your own external audits
Cu
sto
mer
s Your own accreditation
Your own certifications
![Page 29: The AWS Shared Responsibility Model in Practice - Nirav Kothari, AWS](https://reader031.vdocuments.site/reader031/viewer/2022021922/586fdf6c1a28ab18428b6fdf/html5/thumbnails/29.jpg)
Navigating Shared Responsibility
Achieving accreditation or certification on
AWS is possible but how can we help?
![Page 30: The AWS Shared Responsibility Model in Practice - Nirav Kothari, AWS](https://reader031.vdocuments.site/reader031/viewer/2022021922/586fdf6c1a28ab18428b6fdf/html5/thumbnails/30.jpg)
AWS Enterprise Accelerator: Compliance Architectures
Sample Architecture –
Security Controls Matrix
Cloudformation Templates
5 x templates
User Guide
http://docs.aws.amazon.com/quickstart/latest/accelerator-nist/welcome.html
![Page 31: The AWS Shared Responsibility Model in Practice - Nirav Kothari, AWS](https://reader031.vdocuments.site/reader031/viewer/2022021922/586fdf6c1a28ab18428b6fdf/html5/thumbnails/31.jpg)
Compliance Resources
https://aws.amazon.com/compliance/resources/
![Page 32: The AWS Shared Responsibility Model in Practice - Nirav Kothari, AWS](https://reader031.vdocuments.site/reader031/viewer/2022021922/586fdf6c1a28ab18428b6fdf/html5/thumbnails/32.jpg)
Education — AWS Security & Compliance
AWS Security Fundamentals
3 hour eLearning course
Target audience – Security Auditors/Analysts
It’s Free
AWS Security Operations
3 day Instructor Lead Training
Target audience – Security Engineer/Architects
12 Modules + Labs
Self paced labs available on http://qwiklabs.com
https://aws.amazon.com/training/course-descriptions/
![Page 33: The AWS Shared Responsibility Model in Practice - Nirav Kothari, AWS](https://reader031.vdocuments.site/reader031/viewer/2022021922/586fdf6c1a28ab18428b6fdf/html5/thumbnails/33.jpg)
Helpful Resources
Compliance Enablers: https://aws.amazon.com/compliance/compliance-enablers/
Risk & Compliance Whitepaper: https://aws.amazon.com/whitepapers/overview-of-risk-and-compliance/
Compliance Center Website: https://aws.amazon.com/compliance
Security Center: https://aws.amazon.com/security
Security Blog: https://blogs.aws.amazon.com/security/
AWS Audit Training: [email protected]
![Page 35: The AWS Shared Responsibility Model in Practice - Nirav Kothari, AWS](https://reader031.vdocuments.site/reader031/viewer/2022021922/586fdf6c1a28ab18428b6fdf/html5/thumbnails/35.jpg)
©2015, Amazon Web Services, Inc. or its affiliates. All rights reserved
Thank You