Best Practices in Secure Cloud Migration

Best Practices in Secure Cloud Migration

• 1.
  Best Practices inSecure Cloud Migration Secureworld Web Conference - October 30th, 2018 Patrick Hannah, VP of Engineering, CloudHesive
• 2.
  AWS Shared ResponsibilityModel
• 3.
  Who is usingAWS (US and Abroad)? • Federal Government • Government-Sponsored Enterprise • State • Local • Higher Education • K-12 • Non-Profit • Private Sector
• 4.
  GovCloud • Additional AssurancePrograms Above and Beyond other AWS Regions – ITAR – FedRAMP ATO (High for GovCloud, Medium for us-east/west) – DoD SRG (2,4,5 for GovCloud, 2 for us-east/west) • General – Separate Endpoints (utilize FIPS 140-2 approved cryptographic modules) – Separate Namespace – Separate Authentication (Tied to a non-GovCloud account for billing purposes - no Root Account) – 46 of the 127 AWS Services Available (EC2 Classic not Available) – US Citizen only Access • Physical Location – Northwestern US – Eastern US (forthcoming)
• 5.
  Cloud Adoption Framework •Perspectives – Business • Value Realization – People • Roles & Readiness – Governance • Prioritization & Control – Platform • Applications & Infrastructure – Security • Risk & Compliance – Operations • Manage & Scale
• 6.
  Security • Directive – AccountOwnership and contact information – Change and asset management – Least privilege access • Preventive – Identity and access – Infrastructure protection – Data protection • Detective – Logging and monitoring – Asset inventory – Change detection • Responsive – Vulnerabilities – Privilege escalation – DDoS attack
• 7.
  Well Architected Framework •Operational Excellence • Security • Reliability • Performance Efficiency • Cost Optimization
• 8.
  Security • Design Principles –Implement a strong identity foundation – Enable traceability – Apply security at all layers – Automate security best practices – Protect data in transit and at rest – Prepare for security events • Best Practices – Identity and Access Management – Detective Controls – Infrastructure Protection – Data Protection – Incident Response
• 9.
  Sample Implementation • “NISTQuickstart” • Based on Cybersecurity Framework, SP 800-53, SP 800-37 • Corresponding Guide + Controls Matrix • CIS and PCI Variants Available • Good starting point
• 10.
  How does theVormetric platform integrate with AWS? • Securely Generate Key Material and Import into KMS – Use KMS with VTE and VAE agents for tiered data protection/separation of duties • Protect Managed Services via Application Encryption or Tokenization – Use in place of agent VTE on data persistence tier • Enterprise Certificate Authority – Use PKCS#11 Extensions with nShield
• 11.
  How have othercustomers leveraged the Vormetric platform to protect workloads on AWS? • Protect On Premises with Public Cloud based Appliances – Virtual appliances provide FIPS 140-2 Level 1 protection of workloads in the cloud and on premises – Separates keys from data protected by keys, and optionally ring-fences via Tokenization – Provides future path for total public cloud migration – Enforces separation of duties • Project Public Cloud with On Premises based Appliances – Physical appliances provide FIPS 140-2 Level 3 protection of workloads in the cloud and on premises – Also separates keys from data protected by keys , and optionally ring-fences via Tokenization – Provides future path for hybrid cloud – Enforces separation of duties • Protect On Premises and Public Cloud with On Premises based Appliances – Physical appliances provide FIPS 140-2 Level 3 protection of workloads in the cloud and on premises – Also separates keys from data protected by keys , and optionally ring-fences via Tokenization – Enforces separation of duties • Protect On Premises and Public Cloud with Public Cloud based Appliances – Virtual appliances provide FIPS 140-2 Level 1 protection of workloads in the cloud and on premises – Separates keys from data protected by keys , and optionally ring-fences via Tokenization – Enforces separation of duties
• 12.
  Pool – Yourencryption usage on AWS • I… – Leverage KMS – Leverage first generation CloudHSM – Leverage second generation CloudHSM – Leverage the Vormetric Platform – Leverage the nShield Platform – Leverage a home grown solution
• 13.
  Supporting Services • VPC:Security Groups (Stateful Firewall) + NACLs (Stateless Firewall) • VPC: Flow Logs (NetFlow) • VPC: VGW (Point to Point and IPSEC Connectivity) + Peering (VPC to VPC Connectivity) + Endpoints (Private Connectivity to AWS Services) • EC2: Patch Manager (OS and above patching + auditing) • EC2: Parameter Store (Secure Storage of Service Accounts)
• 14.
  Supporting Services • S3/Glacier:File based storage with AAA, versioning, secure delete + policy based retention • Code Commit/ECS: Secure Application and Artifact Repository • Code Deploy/Run Command: “Hands off” OS and configuration management + application deployment • CloudWatch Logs: OS and above log management • CloudWatch Events + Lambda: Event triggered code • CloudTrail: Audit Trail, Exportable as JSON to idempotent storage
• 15.
  Supporting Services • Config:Point in time snapshots of configuration items, Exportable as JSON to idempotent storage • OpsWorks + Elastic Beanstalk: “Hands off” infrastructure management • CloudFormation: Infrastructure automation described as JSON/YAML, Version Controllable • IAM + Directory Service + SSO: Standalone and Federated AAA • KMS: FIPS 140-2 Certified cryptographic module with integration to various AWS services, provides expiration and ability to provide self-generated cryptographic material
• 16.
  Supporting Services • Workspaces:Secure Bastion • WAF: Layer 7 WAF • Shield + AutoScaling + ELB + Cloud Front: DoS/DDoS Protection • Tags: Built-in asset + inventory marking and tracking on configuration items • Service Catalog: Predefined configurations available to end users, can be integrated to ITSM system
• 17.
  Enforcement • AWS – GuardDuty – Inspector – Macie – Trusted Advisor – Config Rules – Various “Widgets” • Third Party – CIS CAT – CloudCheckr – AlertLogic – Tenable
• 18.
  Recommended Reading • AWSWell Architected Framework – https://aws.amazon.com/architecture/well-architected/ • AWS Cloud Adoption Framework – https://aws.amazon.com/professional-services/CAF/ • AWS Cloud Transformation Maturity Model – https://d0.awsstatic.com/whitepapers/AWS-Cloud-Transformation-Maturity-Model.pdf • Shared Responsibility Model – https://aws.amazon.com/compliance/shared-responsibility-model/ • Operational Checklists for AWS – https://d1.awsstatic.com/whitepapers/aws-operational-checklists.pdf • Introduction to Auditing the Use of AWS – https://d1.awsstatic.com/whitepapers/compliance/AWS_Auditing_Security_Checklist.pdf
• 19.
  Further Learning • GettingStarted: https://aws.amazon.com/getting-started • General Reference: http://docs.aws.amazon.com/general/latest/gr • Global Infrastructure: https://aws.amazon.com/about-aws/global-infrastructure/ • FAQs: https://aws.amazon.com/faqs • Documentation: https://aws.amazon.com/documentation/ • Architecture: https://aws.amazon.com/architecture • Whitepapers: https://aws.amazon.com/whitepapers • Security: https://aws.amazon.com/security • Blog: https://aws.amazon.com/blogs • Service Specific Pages: https://aws.amazon.com/service • AWS Answers: https://aws.amazon.com/answers/ • AWS Knowledge Center: https://aws.amazon.com/premiumsupport/knowledge-center/ • SlideShare: http://www.slideshare.net/AmazonWebServices • Github: https://github.com/aws and https://github.com/awslabs