Please enable JavaScript.

Coggle requires JavaScript to display documents.

Security :lock: - Coggle Diagram

- - - - Customer data
      - Platform
      - Applications
      - Identity and access management
      - Operating System
      - Network and Firewall Configuration
      - Client-side data encryption
      - Server-side encryption
      - Networking traffic protection
    - - You, the customer, maintain complete control over your content
        
        You are responsible for managing security requirements for your content
        
        Which content you choose to store on AWS
        
        Who has access to that content
        
        Which AWS services you use
        
        How access rights are granted, managed, and revoked
    - - Selecting, configuring, and patching
        
        The operating systems that will run on Amazon EC2 instances
      - Configuring security groups
      - Managing user accounts
  - - - Software
      - Compute
      - Storage
      - Database
      - Networking
      - Hardware/AWS Global Infrastructure
      - Regions
      - Availability Zones
      - Edge locations
    - - This includes areas such as
        
        The host operating system
        
        The virtualization layer
        
        The physical security of the data centers from which services operate
      - AWS is responsible for protecting the global infrastructure
        
        That runs all of the services offered in the AWS Cloud
        
        AWS Regions
        
        Availability Zones
        
        Edge locations
      - AWS provides several reports from third-party auditors of AWS Data centers
        
        These auditors have verified its compliance with a variety of computer security standards and regulations
    - - Physical security of data centers
      - Hardware and software infrastructure
      - Network infrastructure
      - Virtualization infrastructure
- - - - By using a combination of IAM features
        
        IAM users, groups, and roles
        
        AWS account root user
        
        This identity is given to you when you first create an AWS account
        
        Is accessed by signing in with the email address and password that you used to create your AWS account
        
        It has complete access to all the AWS services and resources in the account
        
        Best practice
        
        Do not use the root user for everyday tasks
        
        Use the root user to create your first IAM user and assign it permissions to create other users
        
        Continue to create other IAM users, and access those identities for performing regular tasks throughout AWS
        
        Only use the root user when you need to perform a limited number of tasks that are only available to the root user
        
        IAM users
        
        An IAM user is an identity that you create in AWS
        
        Consists of a name and credentials
        
        It represents the person or application that interacts with AWS services and resources
        
        When you create a new IAM user in AWS
        
        By default
        
        It has no permissions associated with it
        
        1 more item...
        
        Best practice
        
        Create individual IAM users for each person who needs to access AWS
        
        Even if you have multiple employees who require the same level of access
        
        1 more item...
        
        IAM groups
        
        An IAM group is a collection of IAM users
        
        When you assign an IAM policy to a group
        
        All users in the group are granted permissions specified by the policy
        
        Add IAM users to the group
        
        Then attach permissions at the group level
        
        Assigning IAM policies at the group level
        
        Makes it easier to adjust permissions when an employee transfers to a different job
        
        This ensures that employees have only the permissions that are required for their current role
        
        IAM roles
        
        An IAM role is an identity that you can assume to gain temporary access to permissions
        
        Before
        
        An IAM user, application, or service can assume an IAM role
        
        1 more item...
        
        When someone assumes an IAM role
        
        They abandon all previous permissions that they had under a previous role
        
        Assume the permissions of the new role
        
        Best practice
        
        IAM roles are ideal for situations in which access to services or resources needs to be granted temporarily
        
        Instead of long-term
        
        IAM policies
        
        An IAM policy is a document that allows or denies permissions to AWS services and resources
        
        Enable you to customize users’ levels of access to resources
        
        Best practice
        
        Follow the security principle of least privilege when granting permissions
        
        By following this principle
        
        You help to prevent users or roles from having more permissions than needed to perform their tasks
        
        Multi-factor Authentication (MFA)
        
        Provides an extra layer of security for your AWS account in IAM
        
        First, when a user signs in to an AWS website, they enter their IAM user ID and password
        
        Next, the user is prompted for an authentication response from their AWS MFA device
        
        This device could be
        
        A hardware security key
        
        A hardware device
        
        An MFA application on a device such as a smartphone
        
        When the user has been successfully authenticated
        
        They are able to access the requested AWS services or resources
        
        Best practice
        
        Enable MFA for the root user and all IAM users in your account
        
        By doing this, you can keep your AWS account safe from unauthorized access
- - - - Enable you to place restrictions on
        
        AWS services
        
        Resources
        
        That users and roles in each account can access
        
        Individual API actions
  - - - Which is the parent container for all the accounts in your organization
  - - - To make it easier to manage accounts with similar business or security requirements
        
        When you apply a policy to an OU
        
        All the accounts in the OU automatically inherit the permissions specified in the policy
        
        By organizing separate accounts into OUs
        
        You can more easily isolate workloads
        
        More easily isolate applications that have specific security requirements
        
        Even though you have placed these accounts into OUs
        
        You can continue to provide access for users, groups, and roles through IAM
- - - - AWS Artifact consists of two main sections
        
        AWS Artifact Agreements
        
        You can review, accept, and manage agreements
        
        For an individual account
        
        For all your accounts in AWS Organizations
        
        Different types of agreements are offered to address the needs of customers who are subject to specific regulations
        
        AWS Artifact Reports
        
        Provide compliance reports from third-party auditors
        
        These auditors have tested and verified that AWS is compliant with a variety of standards and regulations to several scales
        
        Global
        
        Regional
        
        Industry-specific security
        
        AWS Artifact Reports remains up to date with the latest reports released
        
        You can provide the AWS audit artifacts to your auditors or regulators as evidence of AWS security controls
  - - - You can read customer compliance stories
        
        Discover how companies in regulated industries have solved various challenges dealing with
        
        Compliance
        
        Governance
        
        Audit
      - You can also access compliance whitepapers and documentation on topics such as
        
        AWS answers to key compliance questions
        
        An overview of AWS risk and compliance
        
        An auditing security checklist
      - Includes an auditor learning path
        
        Designed for individuals in roles like
        
        Auditing
        
        Compliance
        
        Legal
        
        To learn more about how their internal operations can demonstrate compliance using the AWS Cloud
- - - - Can come from a group of attackers, or even a single attacker
        
        The single attacker can use multiple infected computers (also known as “bots”) to send excessive traffic to a website or application
    - - A service that protects applications against DDoS attacks
        
        AWS Shield provides two levels of protection
        
        AWS Shield Standard
        
        Automatically protects all AWS customers at no cost
        
        Protects your AWS resources from the most common, frequently occurring types of DDoS attacks
        
        AWS Shield Standard uses a variety of analysis techniques to detect malicious traffic in real time and automatically mitigates it
        
        AWS Shield Advanced
        
        A paid service that provides detailed attack diagnostics and the ability to detect and mitigate sophisticated DDoS attacks
        
        Integrates with other services such as
        
        Amazon CloudFront
        
        Amazon Route 53
        
        Elastic Load Balancing
        
        You can integrate AWS Shield with AWS WAF by writing custom rules to mitigate complex DDoS attacks
- - - - A cryptographic key is a random string of digits used for locking (encrypting) and unlocking (decrypting) data
    - - You can also control the use of keys across a wide range of services and in your applications
        
        You can choose the specific levels of access control that you need for your keys
        
        You can temporarily disable keys
        
        Your keys never leave AWS KMS, and you are always in control of them
  - - - AWS WAF works together with Amazon CloudFront and an Application Load Balancer
        
        AWS WAF works by using a web access control list (ACL) to protect your AWS resources
  - - - It checks applications for security vulnerabilities and deviations from security best practices
        
        Such as
        
        Open access to Amazon EC2 instances
        
        Installations of vulnerable software versions
        
        After Amazon Inspector has performed an assessment
        
        Provides you with a list of security findings
        
        The list prioritizes by severity level including
        
        A detailed description of each security issue
        
        A recommendation for how to fix it
        
        AWS does not guarantee that following the provided recommendations resolves every potential security issue
        
        Under the shared responsibility model
        
        1 more item...
  - - - Identifies threats by continuously monitoring the network activity and account behavior within your AWS environment
        
        After you have enabled GuardDuty for your AWS account
        
        GuardDuty begins monitoring your network and account activity
        
        GuardDuty then continuously analyzes data from multiple AWS sources
        
        VPC Flow Logs
        
        DNS logs
        
        If GuardDuty detects any threats
        
        You can review detailed findings about them from the AWS Management Console
        
        Findings include recommended steps for remediation
        
        You can also configure AWS Lambda functions to take remediation steps automatically
        
        1 more item...