welcome back to Backspace Academy in this lecture I'm going to run through 2
data security we've already gone through I am and VPC networking the security 3
issues around that we're going to look now at actually data security and how we 4
ensure that our data is secure at rest when it's stored and in transit when 5
we're communicating over the Internet so we'll look at the AWS compliance program 6
and how AWS is compliant with certain standards and how we can actually launch 7
applications or deploy applications that will be compliant with certain standards 8
we'll also look at monitoring and protection in relation to security we'll 9
look at the different types of credentials that we have and that we 10
need to secure we'll look at storage and managing encryption keys and then we'll 11
look at protecting our data at rest and in transit so the AWS compliant program 12
AWS is compliant with a number of standards which we have listed them but 13
it also allows clients to deploy solutions that meet other standards so 14
for example there we've got the HIPAA standard the Health Insurance 15
Portability and Accountability Act AWS isn't actually compliant with that 16
because there is no compliance specification for infrastructure in 17
regards to HIPAA but AWS does allow you to by using AWS it does allow you to 18
deploy solutions or deploy applications that are HIPAA compliant so although 19
there is no actual compliance program for a cloud infrastructure that is 20
specified by HIPAA AWS does allow you to deploy solutions that meet HIPAA and 21
that's a difference between a device been compliant with the actual standard 22
and having AWS as a means for achieving a standard 23
AWS monitoring and protection now we've already gone through in previous 24
lectures we've gone through cloud watch and implementing alarms for certain 25
situations but out of us itself also provides monitoring and protection as 26
part of that shared responsibility they have a responsibility and they take that 27
seriously to monitor and protect the infrastructure so AWS monitors for 28
server and network usage if there's any unusual activity going on there it will 29
monitor for port scanning activities it will monitor application usage and it 30
will also monitor for unauthorized intrusion attempts so other URLs 31
provides protection against distributed distributed denial of service or DDoS 32
attacks man-in-the-middle attacks IP spoofing port scanning now if you would 33
like to do penetration testing then you need to contact AWS to allow you to do 34
that penetration testing otherwise they will they will see that as being an 35
attack on your infrastructure they also provide protection against packet 36
sniffing by other tenants so we have a number of AWS credentials and different 37
types that are required to access and use the AWS services subtly the first 38
one is going to be our password for our to access to our AWS management console 39
and we can also attach multi-factor authentication to that now multi-factor 40
authentication can also be detailed in our a in policies and it supports 41
hardware tokens and virtual MFA device applications and it conforms to RFC 42
6238 standard for time-based at one time password 43
we also have access keys and they are used for digitally signing requests to 44
AWS API so that could be request to the AWS or using the AWS software 45
development kits the command-line interface or directly using the API for 46
REST Web Services requests and it's a signature that is calculated using the 47
HMAC sha-256 protocol we also have key pairs and their use with our ec2 48
instances so we create public and private key pairs for signing into our 49
ec2 instances via SSH we also have x.509 certificates and then mainly use for 50
site based requests so the AWS API is a rest Web Services API so you wouldn't be 51
using it for that but there are some services for example certain services 52
within s3 that that can take advantage of x.509 certificates it is one thing to 53
encrypt data but you also need to make sure that your encryption keys are 54
stored and managed securely otherwise you defeat the purpose of encrypting 55
that data so you can use your own key management processes or you can use AWS 56
server-side encryption your keys should be stored securely 57
in hardware security modules AWS to also provide the AWS cloud HSM service which 58
is a cloud-based HSM or you can use on premise of storage and access those keys 59
via and IPSec VPN but you need to make sure those encryption keys are secure 60
AWS also provides a very good key management service see AWS kms and that 61
can create and at the same time secure those encryption key 62
for you protecting data at rest or protecting data when it is being stored 63
I'm just going to quickly go through the main AWS services and what it's built 64
into those services for protecting data at rest and what additional options we 65
can use for further protecting that data at rest so the Amazon s3 service 66
obviously has bucket policies it also has I am policies that we can 67
implement for permissions at the bucket level we can also look at protecting at 68
the object level through access control lists we can look at implementing 69
versioning or enabling versioning on our buckets and also Amazon s3 as we know 70
has a high degree of replication so it's highly available and it's highly durable 71
so that is built into Amazon s3 and there is also server-side encryption 72
available for Amazon s3 to aes-256 additional to that we can look at doing 73
client-side encryption so making sure that on our side of things that we 74
encrypt out before it goes to Amazon s3 before it goes to a bucket and we can 75
also look at backup software additional - - what is available if we would like 76
to have our service backed up in another region or off-site or whatever 77
EBS has replication built into it so there are two copies of an EBS volume 78
within an availability zone that is not cross region so there is replication 79
within an availability zone so if a region goes down you will still lose 80
that data we also have iedf snapshots - Amazon s3 and we have a number of 81
encryption options available for us depending on whether we're using Linux 82
or Windows so with windows we have EFS or BitLocker available to us and with 83
Linux we have DM crypt available built-in we can also 84
look at block-level cross region replications so in the event that we 85
want to have availability even if we have an entire region go out then we 86
need to look at our own solution to do that through our application or through 87
our own solution to do brock level replication to another region we have a 88
number of other options available for encryption as well from third parties 89
that includes TrueCrypt and SafeNet protectively RDS has automated backups 90
to s3 and DB snapshots to back to to Amazon s3 as we know from our RDS 91
lecture those DBS snapshots will not be deleted if they manually implement it 92
that will not be deleted upon termination of that RDS instance and we 93
have a number of encryption options available to us depending on what the 94
database we are actually using so with Oracle we can have the Oracle 95
transparent data encryption service and that is available to us if we bring our 96
own license across to Amazon Web Services we also have transact SQL for 97
sequel server instances we can also look at application level encryption so 98
making our applique our application responsible for the encryption of data 99
Glacia by default has server-side encryption to aes-256 100
dynamodb doesn't necessarily have automated backups as such but we can 101
always export a table to Amazon s3 and we can also look at using the dynamodb 102
cross region replication library to replicate to a different replicated data 103
to a another region we can also look at the Amazon data pipeline and that will 104
create an EMR cluster that will export or will backup data to Amazon s3 force 105
and we can also again look at application level encryption and elect 106
it elastic MapReduce so our data that he used by elastic MapReduce in Amazon s3 107
we can have server-side encryption on that and we can also look at application 108
level encryption for that when communicating with our AWS services we 109
also need to make sure that if that communication is intercepted that our 110
data is also secure so making sure that our data is protected while it is in 111
transit with our general internet communication we obviously have built in 112
our VPN we have SSL we also have SSH that we use when we're communicating 113
with our Linux ec2 instances and we have RDP when we're communicating with our 114
Windows ec2 instances additional to that if we are looking for protection against 115
peer identity compromised for identity spoofing or man-in-the-middle attacks we 116
can use IPSec with internet key exchange with pre-shared keys we can use x.509 117
certificates for verification of identity and we can use ssl with service 118
certificate authentication based on the server common name or alternative name 119
for Amazon s3 RDS and dynamo DB and for elastic MapReduce communication with 120
that with those services is through HTTP and we also as with any ec2 instance 121
when we're communicating with an EMR cluster or our Hadoop cluster on the 122
elastic MapReduce service communication with that will be through SSH so that is 123
how we protect our data both in transit and at rest and I will see you in the 124
next lesson