Amazon Web Services Security & Compliance Overview Attila Lengyel Enterprise Account Manager Dob Todorov Principal Security & Compliance Architect EMEA

undifferentiated heavy lifting

utility computing

Deployment & Administration AWS Global Infrastructure AWS provides broad and deep services to support any cloud workload Deployment & Administration Application Services This is a simple view of the set of services that we offer. At the core is the compute, storage and data services that are the heart of our offering. We then surround these offerings with a range of supporting components like management tools, networking services and application services. All these capabilities are hosted within our global data center footprint that allows you to consume services without having to build out your own facilities or procure hardware equipment. Compute Storage Database Networking AWS Global Infrastructure

Hundreds of Thousands of Customers in 190 Countries…

Every Imaginable Use Case Free steak campaign Facebook page Mars exploration ops Consumer social app Ticket pricing optimization SAP & Sharepoint Securities Trading Data Archiving Gene sequencing Marketing web site Interactive TV apps Financial markets analytics R&D data analysis Consumer social app Big data analytics Web site & media sharing Disaster recovery Media streaming Web and mobile apps Streaming webcasts Facebook app Consumer social app

“AWS is the overwhelming market share leader, with more than five times the compute capacity in use than the aggregate total of the other fourteen providers.” AWS has been named a leader in the Gartner MQ for Cloud IaaS third year in a row. Not only that Gartner notes that AWS is the overwhelming market share leader, with more than five times the compute capacity in use than the aggregate total of the other fourteen providers Gartner “Magic Quadrant for Cloud Infrastructure as a Service,” Lydia Leong, Douglas Toombs, Bob Gill, Gregor Petri, Tiny Haynes, August 19, 2013. This Magic Quadrant graphic was published by Gartner, Inc. as part of a larger research note and should be evaluated in the context of the entire report.. The Gartner report is available upon request from Steven Armstrong (asteven@amazon.com). Gartner does not endorse any vendor, product or service depicted in its research publications, and does not advise technology users to select only those vendors with the highest ratings. Gartner research publications consist of the opinions of Gartner's research organization and should not be construed as statements of fact. Gartner disclaims all warranties, expressed or implied, with respect to this research, including any warranties of merchantability or fitness for a particular purpose.

Notable Financial Services Stories

Dutch National Bank (regulator)

(Northern California) GovCloud (US ITAR Region) US West (Northern California) US West (Oregon) US East (Northern Virginia) South America (Sao Paulo) EU (Ireland) Asia Pacific (Singapore) Asia Pacific (Tokyo) Asia Pacific (Sydney) AWS Regions AWS Edge Locations

(Northern California) EU West (Dublin) US East (Virginia) Asia Pacific (Tokyo) Asia Pacific (Australia) A B C A B C A B C A B A B A B A B A B US West (Northern California) US West (Oregon) South America (Sao Paolo) Asia Pacific (Singapore)

Personal Data Protection in Europe EC Directive 95/46/EC: Personal Data Protection Use Amazon Web Services Dublin Region Safe Harbour EU Compliant Safe Harbour Switzerland Compliant

The Shared Responsibility Model in the Cloud Customer Data Platform, Applications, Identity & Access Management Operating System, Network & Firewall Configuration Client-side Data Encryption & Data Integrity Authentication Server-side Encryption (File System and/or Data) Network Traffic Protection (Encryption/Integrity/Identity) Optional -- Opaque Data: 0s and 1s (in flight/at rest) Foundation Services Compute Storage Database Networking AWS Global Infrastructure Availability Zones Edge Locations Regions

The Shared Responsibility Model in the Cloud Security IN the Cloud Customer Data Platform, Applications, Identity & Access Management Operating System, Network & Firewall Configuration Client-side Data Encryption & Data Integrity Authentication Server-side Encryption (File System and/or Data) Network Traffic Protection (Encryption/Integrity/Identity) Optional -- Opaque Data: 0s and 1s (in flight/at rest) Security OF the Cloud Foundation Services Compute Storage Database Networking AWS Global Infrastructure Availability Zones Edge Locations Regions

Customer-managed Controls on Amazon EC2 Data Applications Platforms Security IN the Cloud Operating Systems OS-level Firewalls/IDS/IPS Systems/Deep Security Network Security Security OF the Cloud Security Groups & Network Access Control Lists Encryption of data in Flight Industry Standard Protocols: IPSec, SSL, SSH Encryption of Data at Rest OS-level: Encrypted File System, Bitlocker, dm-crypt, Secure Cloud

Data Protection at Rest and in Flight Application-level Encryption Applications Platform-level Encryption Platforms Operating Systems OS-level Firewalls/IDS/IPS Systems/Deep Security Network Security Security Groups & Network Access Control Lists Encryption of data in Flight Network Traffic Encryption Industry Standard Protocols: IPSec, SSL, SSH Encryption of Data at Rest OS-level: Encrypted File System, Bitlocker, dm-crypt, Secure Cloud Volume-level Encryption

AWS Certifications & Accreditations ISO 27001 Security IN the Cloud SOC 1 (SSAE 16 & ISAE 3402) Type II Audit SOC 2 SOC 3 Audit (new in 2013) Security OF the Cloud Payment Card Industry Data Security Standard (PCI DSS) Level 1 Service Provider

Q&A

User Identification, Authentication and Authorisation in the Cloud Enterprise Applications Active Directory/ LDAP Corporate Systems AD/LDAP Users EC2 DynamoDB Amazon Identity & Access Management S3 IAM Users

User Identification, Authentication and Authorisation in the Cloud Enterprise Applications Corporate Systems Active Directory/ LDAP AD/LDAP Users EC2 DynamoDB Access Token for Federated Access Amazon Identity & Access Management S3

User Identification, Authentication and Authorisation in the Cloud Enterprise Applications Shibboleth Corporate Systems AD/LDAP Users EC2 DynamoDB Access Token for Federated Access Amazon Identity & Access Management S3

SLAs, RTOs/RPOs CBA Business Processes Defined by Business RTO RPO System Design System SLAs Managed by AWS EC2 SLA S3 SLA CloudFront SLA RDS SLA

Physical Security Amazon has been building large-scale data centers for many years Important attributes: Non-descript facilities Robust perimeter controls Strictly controlled physical access 2 or more levels of two-factor auth Controlled, need-based access All access is logged and reviewed Separation of Duties employees with physical access don’t have logical privileges Maps to an Availability Zone ISO 27001 Payment Card Industry Data Security Standard (PCI DSS) Level 1 Service Provider

Storage Device Decommissioning All storage devices go through this process Uses techniques from DoD 5220.22-M (“National Industrial Security Program Operating Manual”) NIST 800-88 (“Guidelines for Media Sanitization”) Ultimately degaussed physically destroyed

AWS CloudHSM Dedicated access to HSM appliances managed & monitored by AWS, but you control the keys Increase performance for applications that use HSMs for key storage or encryption Comply with stringent regulatory and contractual requirements for key protection AWS CloudHSM EC2 Instance AWS CloudHSM

Security of Data at Rest Server side encryption (AES-256) – per object keys managed by AWS Client-side asymmetric encryption – integrated within APIs Client-side encryption: Amazon stores 0s and 1s EC2 + EBS Enable partition/disk level encryption Windows: use EFS (local certificates/centralised X.509) Linux: use cryptsetup/dm-crypt/others RDS MySQL Use SQL native encryption (server side) Client side encryption RDS Oracle Client-side encryption

Security of Data in Flight AWS APIs are Web services SOAP over HTTPS REST over HTTPS User and data authentication through request signatures User access to Web Console Admin access to Servers Use SSH with asymmetric keys, or X.509 certificates Use RDP + MPPE or SSL protection Secure Application-level Protocols

Network Traffic Flow Security Security Groups Inbound traffic must be explicitly specified by protocol, port, and security group VPC adds outbound filters VPC also adds Network Access Control Lists (ACLs): inbound and outbound stateless filters OS Firewall (e.g., iptables) may be implemented completely user controlled security layer granular access control of discrete hosts logging network events Inbound & Outbound Traffic Amazon Security Groups OS Firewall Encrypted File System Encrypted Swap File

Amazon EC2 Instance Isolation Physical Interfaces Customer 1 Hypervisor Customer 2 Customer n … Virtual Interfaces Firewall Security Groups

Multi-tier Security Approach Example Web Tier Application Tier Database Tier Ports 80 and 443 only open to the Internet Engineering staff have ssh access to the App Tier, which acts as Bastion Amazon EC2 Security Group Firewall Sync with on-premises database All other Internet ports blocked by default

Amazon VPC Network Security Controls

Layered Defence

AWS Multi-Factor Authentication Helps prevent anyone with unauthorized knowledge of your e-mail address and password from impersonating you Additional protection for account information Works with Master Account IAM Users Integrated into AWS Management Console Key pages on the AWS Portal S3 (Secure Delete)

Available Programmatically via AWS Support APIs AWS Trusted Advisor Available Programmatically via AWS Support APIs

Manage and Monitor Your Environments from Anywhere

Security & Compliance Resources Answers to many security & privacy questions Security Whitepaper Risk and Compliance Whitepaper Security Best Practices Whitepaper AWS Auditing Checklist Security Blog Security bulletins Penetration Testing http://aws.amazon.com/security/ http://aws.amazon.com/compliance/