USING THE PUBLIC CLOUD LEGITIMATELY LEADS US TO QUESTION COMPLIANCE WITH THE SECURITY REQUIREMENTS OF COMPANIES AND REGULATIONS.
AWS security topics are broadly the same as for an on-premise infrastructure, but require a specific analysis linked to the technical and organisational particularities of the Cloud, and also to the power of the tools offered by AWS.
Relying on a shared responsibility model, AWS takes charge of securing the lower layers and the infrastructure, and provides its customers with the tools to secure their applications and data. It is therefore up to each company using the AWS Cloud to optimise the security of its platform and its applications.
To do so, the various resources offered by AWS must be implemented according to the needs and constraints of each organisation.
DISCOVER 7 MAIN KEYS TO ACTIVATE TO BOOST THE SECURITY OF YOUR AWS CLOUD.
TABLE OF CONTENTS
- #1 Implement security policies across the entire perimeter
- #2 Automate audits
- #3 Restrict access
- #4 Manage access identities for the Cloud and applications
- #5 Encrypt data and control the encryption keys
- #6 Track activity on the Cloud
- #7 Detect threats & application security
#1 IMPLEMENT SECURITY POLICIES ACROSS THE ENTIRE PERIMETER
The first principle for ensuring greater security is the scope of action: it is essential to secure the environment at every layer and to make sure this is the case in depth with various security controls (for example, edge network, VPC, subnet, load balancer, each instance, operating system and applications). The most common error would be to focus exclusively on the outermost layer.
All AWS services implement their own security mechanisms, relying on a common structure and common tools (IAM Policies in particular).
The creation of these secure architectures, and in particular the implementation of security, can and must be managed as code in versioned and controlled templates. This guarantees the traceability of changes and makes any rollbacks easier.
#2 AUTOMATE SECURITY AUDITS
It is important to audit the compliance of your AWS resource configurations regularly. This makes it possible to monitor and control the settings that are under your responsibility (see introduction). You therefore need to check that you have the right configurations for services and applications against your wishes and your internal compliance guidelines.
Given the large number of states and parameters to check, it is strongly recommended to automate the verification of compliance with security “best practices”: these automated security audits improve your ability to scale securely, faster and at lower cost. You are then able to identify the origin of the security flaw and correct it quickly.
Prepare for security incidents and breaches: for example by having an incident management process with different scenarios according to their criticality, matching the requirements of your organisation. Run incident response simulations and use tools to increase your speed of detection, investigation and recovery.
In addition, the AWS Config tool makes it possible to record and evaluate the configurations of your resources and their changes. It is also possible to set up continuous monitoring and automatic assessment. This service provides a history of changes, a security analysis and a diagnosis of operational failures.
Migration - Premaccess Services
#3 RESTRICT ACCESS
To err is human and, as a result, it is recommended to limit access to data as much as possible. Create mechanisms and tools to reduce or eliminate the need for direct access or manual processing of data. This considerably reduces the risks of loss or alteration and of human error when processing sensitive data.
Depending on the use cases, it is relevant for your company to bring several AWS accounts into service, or several Virtual Private Clouds, in order to partition data. This partitioning makes it possible to define new configurations, such as different connectivity options according to the sections concerned. Moreover, this segmentation makes it possible to put in place varying levels of security according to the confidentiality and sensitivity of the data involved.
Each Virtual Private Cloud (VPC) can be configured as you wish : including public or private subnets, with or without internet access, with the security layers determined, …
These VPCs can easily be connected in a robust and secure way to on premise networks or datacenters.
The use of multiple AWS accounts is also a way to improve security, by giving administrators specific rights in each of the accounts, and by ensuring, for example, that the logs (see paragraph #6) can only be accessed and, above all, purged by a very restricted number of people.
#4 MANAGE ACCESS IDENTITIES FOR THE CLOUD AND APPLICATIONS
AWS makes it possible to put in place strict and robust rules concerning identity management:
- Apply the principle of minimum and sufficient rights,
- Enforce the separation of task execution with the appropriate authorisation for each interaction with your AWS resources,
- Centralise the management of permissions,
- Reduce and, if possible, eliminate the dependency on long-term credentials.
When deploying an architecture on AWS, your company must seek to optimise data security by controlling access to it. Indeed, different rights are to be established according to several categories of users. As they do not all have the same needs, they must not have the same access to the infrastructure.
The features of AWS Identity and Access Management (IAM) make it possible to restrict access for different groups. Some people only need read permissions. Others must be able to deploy virtual machines or to access advanced features. Applications also need rights to access data. IAM also makes it possible to delegate authentication to a corporate directory in order to consolidate the management of permissions, and mechanically limit the risks of inconsistency and error.
In addition, AWS Cognito makes it possible to manage the users of mobile applications on an industrial scale. And AWS also offers a managed implementation of industry-standard directories.
With a migration to the AWS Cloud, it is possible to grant identities according to each user or application in order to maintain a maximum level of security.
#5 ENCRYPT DATA AND CONTROL THE ENCRYPTION KEYS
It is essential to protect data in transit and at rest: after classifying your data according to its confidentiality, it is necessary to implement mechanisms such as encryption, tokenisation and access control, where appropriate.
To optimise the security of AWS Cloud data, it is imperative to put in place key management that complies with your needs or with regulations. Best practices include in particular determining key rotation, restricting the users who have access to them and monitoring their use.
The AWS Key Management Service (KMS) makes it possible to create and manage keys. It is fully managed, allowing you to concentrate on encrypting your stored data. You can easily rotate them automatically, import them from your own infrastructure, determine the conditions of use or track their activity. The keys can under no circumstances be retrieved in plain text, in order to guarantee their total security. They can be temporarily disabled or deleted as needed.
These keys can then be used to encrypt the data of 52 AWS services, among which we obviously find the data of servers and managed databases.
#6 TRACK ACTIVITY ON THE CLOUD
Enable traceability: monitor, alert on and audit the actions and the changes made to your environment in real time. Integrate metrics into systems to respond and take action automatically.
To protect your AWS Cloud, it is important to establish tracking of user activity and of application usage. Risk management and compliance guarantees are central missions for your entire network. It is necessary to be able to detect threats to the security of your infrastructure by identifying vulnerabilities.
AWS CloudTrail is the service for continuous tracking of the actions carried out on your infrastructure. It presents a history of the events of your AWS account, which will simplify compliance audits. All activity is recorded, making it possible to identify problems in the change history. With Amazon CloudWatch Events, the detection of weaknesses is made easier with the help of workflows.
#7 DETECT THREATS & APPLICATION SECURITY
Threat detection is a preventive approach that makes it possible to react quickly to hostile external actions, and to put in place countermeasures that render those actions ineffective.
This detection must cover the technical perimeter and also the applications, which are equally concerned by the exposure of vulnerabilities.
AWS offers 5 services that make it possible to put prevention mechanisms in place, whose common point is to require an extremely short implementation time. This has been made possible in particular by the introduction of the machine learning algorithm coupled with an intelligence feed to identify the signatures of infrastructure attacks (AWS GuardDuty) or application attacks (AWS Inspector), or to identify objects containing data subject to a specific regulation (AWS Macie). In addition, AWS WAF makes it possible to restrict access to applications by applying filtering specific to them and AWS Shield protects against DDOS attacks.
GET SUPPORT FROM AWS EXPERTS!
Security is a complex subject and must not be taken lightly, it is often necessary to be supported by organisations whose business and field of expertise this is.
With these 7 decisive tips, you are able to effectively improve the data security of your AWS Cloud. Do not forget, however, to embed these activities in a long-term practice with regular updates in order to capitalise fully on all their benefits.
Contact us!