‫Now that we have created users and groups,
‫it is time for us to protect these users and groups
‫from being compromised.
‫So for this we can have two defense mechanisms.
‫The first one is to define what's called a Password Policy.
‫Why?
‫Well, because the stronger the password you use
‫the more security for your accounts.
‫So in AWS, you can set up a password policy
‫with different options.
‫The first one is you can set a minimum password length,
‫and you can require specific character types,
‫for example, you may want to have an uppercase letter,
‫lowercase letter, number, non-alphanumeric characters,
‫for example a question mark and so on.
‫Then you can allow or not, IAM users
‫to change their own passwords
‫or you can require users to change their password,
‫after some time, to make your password expired, for example,
‫to say every 90 days, users have to change their passwords.
‫Finally, you can also prevent password reuse
‫so that users when they change their passwords,
‫don't change it to the one they already have
‫or change it to the one they had before.
‫So this is great, a password policy, really is helpful,
‫against brute force attacks on your accounts.
‫But there's a second defense mechanism
‫that you need to know, going into the exam,
‫and this is the Multi Factor Authentication or MFA.
‫It is possible you already to use it, on some websites,
‫but on AWS it's a must and it's very recommended to use it.
‫So, users have access to your account,
‫and they can possibly do a lot of things,
‫especially if they're, administrators,
‫they can change configuration, delete resources
‫and other things.
‫So you absolutely want to protect at least
‫your Root Accounts and hopefully all your IAM users.
‫So how do you protect them on top of the password?
‫Well, you use an MFA device.
‫So what is MFA?
‫MFA is using the combination of a password that you know,
‫and a security device that you own,
‫and these two things together,
‫have a much greater security than just a password.
‫So for example, let us take Alice.
‫Alice knows her password,
‫but she also has an MFA generating token,
‫and by using these things together while logging in,
‫she is going to be able to do a successful login on MFA.
‫So the benefit of MFA is that even if Alice
‫has lost her password, because it's stolen or it's hacked,
‫the account will not be compromised because the hacker,
‫will need to also get a hold of the physical device
‫of Alice that could be a phone for example to do a login.
‫Obviously, that is much less likely.
‫So what are the MFA devices option in AWS
‫and you should know them going to the exam
‫but don't worry they're quite simple.
‫The first one is a Virtual MFA device,
‫this is what we'll be using in the hands on
‫and so you can use Google Authenticator,
‫which is just working on one phone at a time,
‫or using Authy which is multi-device
‫they both work the same except one is multi-device.
‫And personally I use Authy because I like the fact that
‫I can use it on my computer and on my phones.
‫So, for Authy you have support
‫for multiple tokens on a single device.
‫So, that means that with a Virtual MFA device,
‫you can have your root account, your IAM user,
‫and another account, and another IAM user,
‫its up to you, you can have as many users
‫and accounts as you want on your Virtual MFA device,
‫which make it a very easy solution to use.
‫Now we have another thing called
‫a Universal 2nd Factor or U2F Security Key,
‫and that is a physical device, for example,
‫a YubiKey by Yubico and Yubico is a 3rd party to AWS,
‫this is mot the AWS that provided, this is a 3rd party
‫and we use a physical device,
‫because maybe it's super easy, you put it your Key Fobs
‫and you're good to go.
‫So this YubiKey supports multiple root and IAM users
‫using a single security so you don't need as many keys
‫as users otherwise that will be a nightmare.
‫Then your other options,
‫you have a Hardware Key Fob MFA device
‫for example this one provided by Gemalto
‫which is also a third party to AWS
‫and finally, if you are using the cloud of the government
‫in the US, the AWS GovCloud then you have a special Key Fob,
‫that looks like this, that is provided by SurePassID
‫which is also a 3rd party.
‫So that's it, we've seen the theory
‫on how to protect your account,
‫but let's go to the next lecture to implement that.
‫So I will see you in the next lecture.