AWS Security Essential Services
Welcome to this session on AWS security.
In this presentation, we'll explore the
core AWS security services that help
safeguard
cloud environments.
We'll also briefly cover compliance and
the shared responsibility model.
By the end, you will have a clear
introductory understanding of the
essential AWS security services
What is AWS security?
AWS security is based on the shared
responsibility model.
AWS secures the cloud infrastructure while
customers secure their own workloads and
data
AWS protects the infrastructure that runs
its services, while customers remain
responsible
for protecting their applications and
data.
Security is applied in layers, often
called defense in depth, covering networks
identities, encryption, and monitoring.
AWS aligns with global security standards
to ensure consistent worldwide protection
Now let's understand in brief how AWS
handles security.
AWS ensures strong physical security at
its data centers with restricted access
and surveillance
AWS provides network protections like
virtual private clouds, firewalls, and
built-in
DDoS mitigation.
Identity and access management helps
control who can do what within AWS
accounts
AWS offers encryption for data both at
rest and in transit using services
like KMS and TLS.
Monitoring and logging tools continuously
capture activity, allowing early detection
of threats
Let's understand about compliance.
Compliance means adhering to laws,
regulations, and industry standards that
govern IT
practices.
It builds trust with customers and
industries by showing that data is handled
responsibly.
Common compliance frameworks include GDPR
for privacy, HIPAA for healthcare, PCIDSS
for payments, and SOC 2 for auditing.
Let's talk about how AWS handles
compliance.
AWS itself maintains certifications and
attestations with recognized
global standards.
Through AWS Artifact, customers can
directly access compliance reports and
certifications
By building on AWS customers inherit this
certified infrastructure.
But just like security, compliance is
shared.
AWS handles the infrastructure while
customers configure applications to remain
compliant
Now, let's take a quick intro of essential
AWS security services.
IAM manages users, groups and roles,
enforcing fine-grained
access control.
KMS provides centralized encryption and
key management.
Cloud trail captures all API activity for
auditing and compliance.
Guard duty uses machine learning to detect
unusual or malicious activities.
AWS WAIF, web application firewall, and
shield protect applications from web
attacks
and DDoS events.
Security Hub aggregates security findings
from across AWS.
Inspector automatically scans workloads
for vulnerabilities.
Macy detects and classifies sensitive data
in Amazon S3.
Detective helps investigate alerts and
discover root causes.
Config tracks configuration changes and
enforces compliance rules.
Organizations applies governance across
multiple AWS accounts.
We will now take a high-level overview of
each of the services we just introduced.
Let's start with IAM.
IAM defines and manages users, groups, and
roles for controlled access.
It enforces permissions with Jason-based
policies for precise control.
IM supports multi-factor authentication
and identity federation for extra
security.
Cloud Trail records all API calls and
activities across your AWS account.
Logs are delivered to Amazon S3 or
streamed to CloudWatch for monitoring.
Cloud trail is essential for compliance
audits and forensic investigations.
Guard duty uses machine learning and
threat intelligence to detect suspicious
activity.
It identifies patterns like unauthorized
logins or crypto mining attempts.
Guard duty can be enabled across multiple
accounts for centralized detection.
AWS WAIF protects web applications from
SQL injection, cross-site scripting
and other exploits.
Shield Standard automatically provides
DDoOS protection for all AWS customers
Shield Advanced offers stronger defenses,
extra features, and AWS support
during attacks.
Security Hub gives a single view of all
security findings in your AWS environment.
It consolidates results from services like
guard duty, inspector, and Macy.
It also performs automated compliance
checks against standards like PCIDSS, CIS
and HIPAA.
Inspector continuously scans workloads for
vulnerabilities.
It covers EC2 instances, lambda functions,
and container workloads.
Inspector identifies common
vulnerabilities and exposures, providing
remediation advice
Macy's scans Amazon S3 to find sensitive
or regulated data.
It detects personally identifiable
information such as credit cards or Social
Security numbers
This supports compliance with regulations
like GDPR and HIPAA.
Detective ingests data from guard duty,
cloud trail, and VPC flow logs for deeper
analysis.
It shows visual graphs that link
suspicious activities together.
Detective helps identify the root cause of
security incidents.
Config monitors and records the
configurations of AWS resources.
It evaluates those resources against
compliance rules that you define.
Config can also trigger auto remediation
when it detects non-compliance.
Organizations simplifies the management of
multiple AWS accounts.
It uses service control policies to
enforce governance across accounts.
Organizations consolidates billing for
efficiency and cost visibility.
In summary, AWS security begins with a
shared responsibility model.
AWS applies security at multiple layers,
network, identity, encryption
and monitoring.
Compliance ensures organizations follow
regulations and maintain customer trust.
And core AWS security services provide the
tools needed to keep workloads secure.
