AWS Security — Myths Dispelled

Cloud Security — Myths Dispelled

Security should be job zero, instead of being job 10

Security on cloud can be segregated in three major segments:

• General Cloud Security

• Service Security

• Data Security

General Cloud Security — Myths

Compliance issues

• AWS has over fifty compliance related certifications

• These meet country specific compliance and global compliance

When data is moved to cloud, ownership is lost

• Customer always has the ownership

• Accessibility and trace ability lies with customer

• AWS has no access on any data stored on cloud

Public cloud is not as secure as Private Cloud

• Security is setup at multiple levels, like data center perimeter, access control and logging.

• Monitoring in place where any untoward incident is reported, alerted and taken care of in less than a minute using automation

Cannot do security testing on cloud

• AWS follows shared responsibility model where infra is their responsibility and instances is customers

• Customer needs to get approval from AWS

• Once approved security testing, penetration testing can be carried out

• AWS inspector can also we used

Storing sensitive personal data

• AWS encryption meets the strictest industry requirements, FIPs validated (140–2)

• Also offers HSM (hardware security module) for use cases where needed

Service Security — Myths

Serverless services are not secure

• Strong security is built into core serverless services

• Cross account lambda functions don’t run on same EC2

Secure keys being stolen/lost

• Setup MFA

• Use guard duty to get alerts of any unauthorized usage

• Use IAM roles instead of keys

Customer data can be accessed by anyone

• Storage is secure by default and follows no access to anyone, except customer policy

Operating system patching is managed by AWS

• AWS manages all applications up till hypervisor level, anything above that is managed by customer

Data Security — Myths

One customer can access other customers data due to shared tenancy

• Deep level of isolation is present to avoid this

• Xen (hypervisor) is customized by AWS to be more secure

Malicious insider from AWS can look at customer data

• AWS has strict policies to keep human away from data

• Automation is in place to handle things where data is involved

Government can access customer data

• Data is not shared unless it is legally binding

• If data is encrypted by customer key, then even if it shared it is use less for anyone without the key