How moving to AWS improves security for your entire organisation.
There are many good reasons why so many large organisations have moved their operations to the Amazon Web Service (AWS) cloud platform. We touched on a few of them in this blog last week. But possibly the most important benefit AWS offers organisations is a first-rate security framework, security being one of the 5 pillars we’ve touched on before.
The security pillar of AWS is designed to “protect information, systems, and assets while delivering business value through risk assessments and mitigation strategies”.
7 DESIGN PRINCIPLES
The security pillar is based on the following seven design principles:
1) Implement a strong identity foundation: Implement the principle of least privilege and enforce separation of duties with appropriate authorization for each interaction with your AWS resources. Centralize identity management, and aim to eliminate reliance on long-term static credentials.
2) Enable traceability: Monitor, alert, and audit actions and changes to your environment in real time. Integrate log and metric collection with systems to automatically investigate and take action.
3) Apply security at all layers: Apply a defense in depth approach with multiple security controls. Apply to all layers (for example, edge of network, VPC, load balancing, every instance and compute service, operating system, application, and code).
4) Automate security best practices: Automated software-based security mechanisms improve your ability to securely scale more rapidly and cost-effectively. Create secure architectures, including the implementation of controls that are defined and managed as code in version-controlled templates.
5) Protect data in transit and at rest: Classify your data into sensitivity levels and use mechanisms, such as encryption, tokenization, and access control where appropriate.
6) Keep people away from data: Use mechanisms and tools to reduce or eliminate the need for direct access or manual processing of data. This reduces the risk of mishandling or modification and human error when handling sensitive data.
7) Prepare for security events: Prepare for an incident by having incident management and investigation policy and processes that align to your organizational requirements. Run incident response simulations and use tools with automation to increase your speed for detection, investigation, and recovery.
5 FOCUS AREAS
The design principles lay the foundation for the five focus areas of the security pillar:
1) Identity and access management
2) Detective controls
3) Infrastructure protection
4) Data protection
5) Incident response
There is plenty of overlap through these focus areas so it is important to consider how each area can build on or influence others. They should be viewed together as integrated components of your security program rather than individual siloed processes.
Why should all this matter to your organisation?
AWS offers a level of investment and expertise in cloud security that most organisations could not hope to achieve on their own. A few benefits include:
1) The most advanced digital security available.
2) AWS is scalable in every respect, so if there’s a change to your security needs, you can be sure you won’t “outgrow” AWS and need to look for another provider.
3) AWS customers number the tens of thousands, including leading financial organisations and government agencies, so you can be sure that your data is the safest it can be.
Cloud security is top-of-mind for organisations moving their workloads to the cloud or managing an existing application in the cloud. Reviewing an existing or planned application against the principles of the Security Pillar can help you determine what action your organisation needs to take to improve deficiencies and be as secure as possible.