Building Highly Sophisticated Environments for Security and Compliance on AWS
Download as PPTX, PDF0 likes355 views
The document outlines the implementation of a highly secure and compliant omnichannel payment platform on AWS, achieved through strategic decision-making and adherence to PCI-DSS standards. Key learnings emphasize the importance of collaboration, continuous adaptation, incremental project management, and team care. The successful integration enhances security through various AWS services while improving compliance metrics significantly.
Building Highly Sophisticated Environments for Security and Compliance on AWS
- 1. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Building Highly Sophisticated Environments for Security and Compliance on AWS September 2018 Boyan Dimitrov Director Platform Engineering Sixt @nathariel
- 3. Q1 2018: Brand New Omnichannel Payment Platform
- 4. Early 2017 Redesign our payment channels Adapt business processes Communicate to partners and third parties Plan & Coordinate Teams Early 2017 Payment Environment
- 5. Early 2017Requirements In Production in 8 months Integrated to our business Highly Secure Scalable Modular PCI-DSS Compliant
- 6. What is PCI-DSS Compliance • Standard for cardholder data environments composed of security best practices and controls. • It’s all about maintaining a secure environment • If you are handling credit card data – this applies to you too!
- 7. Build and Maintain a Secure Network 1. Install and maintain a firewall configuration to protect cardholder data 2. Do not use vendor-supplied defaults for system passwords and other security parameters Protect Cardholder Data 3. Protect stored cardholder data 4. Encrypt transmission of cardholder data across open, public networks Maintain a Vulnerability Management Program 5. Use and regularly update anti-virus software or programs 6. Develop and maintain secure systems and applications Implement Strong Access Control Measures 7. Restrict access to cardholder data by business need to know 8. Assign a unique ID to each person with computer access 9. Restrict physical access to cardholder data Regularly Monitor and Test Networks 10. Track and monitor all access to network resources and cardholder data 11. Regularly test security systems and processes Maintain an Information Security Policy 12. Maintain a policy that addresses information security for all personnel PCI Goals and Requirements
- 8. Early 2017Decision to be made Build On The Cloud Build in our DCs Outsource to third party
- 9. Security in the Cloud is a Shared Responsibility https://aws.amazon.com/compliance/shared-responsibility-model/
- 10. Build and Maintain a Secure Network Protect Cardholder Data Maintain a Vulnerability Management Program Implement Strong Access Control Measures Regularly Monitor and Test Networks Maintain an Information Security Policy PCI Requirements mapped to AWS Services VPC Security Group Amazon EC2 Cloudformation S3 EBS CloudHSM KMSRDS Security Group ELB VPN WAF CloudFront Cognito Directory ServiceIAM S3Cloudtrail Inspector Config Lambda Lambda Lambda Lambda
- 11. AWS services in scope by PCI-DSS compliance of all services are PCI- Compliant > 55% 47,6% Increase from prev. year 26 In 2016 62 In 2018 42 In 2017
- 12. Early 2017Our Decision Build On The Cloud Build in our DCs Outsource to third party
- 13. Outcome Learning 1: Bring the right people together early on
- 14. Execution Strategy: Learnings from the past https://en.wikipedia.org/wiki/OODA_loop#/media/File:OODA.Boyd.svg Patrick Edwin Moran
- 15. OODA in an AWS security context Observe Orient Decide ACT VPC Flow Logs Inspector Agent CloudWatch Insights CloudTrail Config More CloudWatch Inspector Lambda Shield ShieldShieldWAF Machine Learning Config Policies Config Policies CloudWatchWAF WAF SNS Lambda Lambda More MoreMore Guard Duty
- 16. VPC Flow Logs CloudWatch Insights CloudTrail Config CloudWatch Config Policies Protected Accounts Security Account Trails Logs Observe…
- 17. Orient, Decide, Act! CloudWatch Logs / Events S3 SIEM Config Policies Protectedaccounts Lambda Trails Logs SNS Security Team Security Account OPS Active Scans Corrective Actions
- 18. The Controlling Core CloudWatch Logs / Events S3 SIEM Config Policies Protectedaccounts Active Scans Lambda SNS Security Team Security Account Corrective Actions OPS Trails Logs
- 19. Learning 2: Have a strategy
- 20. Changes had to be made on the way ECSLambda
- 21. Learning 3: Break down large projects into small iterations
- 22. End to end automation Engineers CodePipeline CodeBuild ECR ECS Deployment Approval Code Review Code Minutes
- 23. Learning 4: Know and leverage the ecosystem
- 24. Learning 5: Take care of your team
- 25. Summary 1. Bring the right people together early on 2. Have a strategy 3. Break down large projects into small iterations 4. Know and leverage the ecosystem 5. Take care of your team
- 26. Thank You
Editor's Notes
- #7: Payment Card Industry Data Security Standard