What is the Security Pillar of AWS Well-Architected Framework

If you’ve considered Amazon’s Web Services (AWS), you’re probably familiar with its Well-Architected Framework. You know the framework consists of five pillars, which are designed to help companies get the most out of AWS. These pillars include:

• Operational Excellence
• Security
• Reliability
• Performance
• Efficiency
• Cost Optimization

To ensure you receive the maximum benefit from AWS, review each pillar carefully, but take special care to scrutinize the security pillar.

In AWS terms, web service security is a shared responsibility that varies depending on the services a company uses. Before your company embarks on an AWS project, be sure you know what your security responsibilities are.

Let’s take a look at the five areas of cloud security as outlined in AWS Well-Architected Framework.

• Identity and Permission Management
• Detection
• Infrastructure protection
• Data protection
• Incident response

Analyzing these security requirements can help ensure safe and secure implementation. In each of these areas, AWS offers products or services to address the requirements. In some instances, third-party solutions are also available. Before implementing a solution, be sure to determine the best choice for your needs.

Identity and Permission Management

AWS strongly recommends using a centralized identity provider to create a more secure single sign-on (SSO) environment using federated logins. With a centralized system, it’s easier to create, manage, and revoke access. It also means individuals do not have to maintain multiple credentials to access shared resources.

Identity Management

People and applications make requests to AWS services. Users may be administrators, developers, or employees. External users, such as consumers, suppliers, or vendors, may need access to specific resources. Those resources may be development tools, work applications, or databases. They must be identified to prevent unauthorized access, for example, from an external application.

When designing your identification process, keep the following in mind:

• Leverage user groups. Add users to existing groups with similar security requirements. Make sure that access controls, such as location or position, are current.
• Require strong authentication. Remind users to create strong passwords and consider multi-factor authentication (MFA) for an extra security layer.
• Use temporary credentials. Evaluate the use of temporary credentials for customers or guests needing access to your resources.
• Audit credentials. Make sure your authentication process is operating as designed. Tools exist to help with credential auditing.

Entities requesting access to your resources must be properly identified before permission is granted. AWS uses SAML 2.0 protocols for the exchange of security information.

Permission Management

Following the principle of least-privilege restricts users to the minimal set of functions needed to perform their tasks. In AWS, identities have no permissions, which means users must have access rights assigned explicitly. Access rights should be evaluated frequently to ensure that the least-privilege principle is being applied.

Always analyze public and cross-account access. Using policies attached to resources should only be used intentionally, especially if you make that resource public. Making a resource public means everyone has access. Sharing resources should only be granted when you can ensure secure access. When shared access is no longer needed, be sure to remove access from all users.

Detection

Detection is the process of identifying potential security risks resulting from misconfigurations, cyber threats, or unauthorized behavior. Two AWS-recommended detection methods are:

• Logs
• Alerts

AWS provides a base set of tools for logging, such as Amazon GuardDuty, AWS Config, and AWS Security Hub, as well as third-party solutions.

Logs

The foundational piece of detection is logging. Configuring logging functions to create a comprehensive record of activities is one way to gain an enterprise-wide look at your implementation. But, manually sorting through logs can be counter-productive because the data volume is too great to process promptly.

Deploy tools that consolidate logs so that they can be analyzed. Identify which events should trigger automated alerts to personnel who can begin investigating immediately. Processing data should result in actionable insights.

Alerts

Alerting someone to a potential threat or anomaly is only the first step. You should have specific instructions on what to do if a particular alert is received. For example, what should IT personnel do when notified of multiple failed logins? Should they disable the account immediately? Whatever the process, it should be easy to access and follow.

Companies should consider automating responses to defined events. An alert could be issued if a day-end process does not complete or a workflow appears to have aborted. If it is security-related, an alert could be forwarded to a cybersecurity specialist. Speed is crucial when addressing possible security threats.

Infrastructure protection

Protecting the systems and services against unintended and unauthorized access is crucial for any information security program. A well-protected infrastructure can also protect against vulnerabilities. AWS encourages infrastructure protection through careful network and usage planning for implementations existing in or out of a virtual private cloud (VPC).

Protecting Networks

A well-designed network makes for a robust architecture in which to operate. With a VPC, many resources inherit the VPC’s security properties, so intentional inspection backed by automated tools is essential to ensure network integrity. Three ways to protect networks are:

• Creating Layers. Parts of a network can be segmented to form subnets, which minimizes the impact of a single layer failure. Using a VPC with AWS Transit Gateway, for example, can mitigate external attacks leading to distributed denial of service (DDoS).
• Controlling Traffic. Analyze the connectivity requirements for each network component and apply multiple controls to protect against unauthorized access. Properly configured firewalls, subnets, and routing tables provide an in-depth approach to traffic control.
• Automating Protection. Self-defending networks that use automated tools can protect networks by adapting to current threats. Automated responses such as blocking requests from known threat actors, add another layer of protection.

The fundamental concept of network protection is segmentation with multi-layer protection.

Protecting Code

The computing mechanisms of your AWS implementation can pose security risks. Operating systems may have vulnerabilities that require patching. Unused components expose more of your network to possible attacks. Whenever possible, automate the processes to protect your computational assets.

• Manage vulnerabilities through scanning and patching of code.
• Deploy automated tools to detect and protect against possible weaknesses.
• Remove unused components such as libraries or external services to reduce the potential access points.
• Minimize interactive access by using a change management workflow that can reduce human error.
• Use managed services to reduce maintenance tasks that are part of your shared responsibility.
• Focus on securing applications through code signing and checksums to ensure that applications are from trusted sources.

Systematic maintenance of computational assets should be a part of any security program. Rapid deployment without proper security measures can result in unwanted attacks.

Data Protection

Protecting your infrastructure from unwanted attacks is the first step in protecting your data. Classifying your data according to sensitivity, is the next step. Separating data enables you to apply different levels of security based on compliance or regulatory guidelines. AWS suggests using data classification and at-rest and in-transit data protection to keep data secure.

Data Classification

Data classification organizes your data based on a set of criteria such as personal identifiable information (PII) or intellectual property. The data types should determine the level of control. AWS recommends the following approaches to data classification:

• Identify Your Data. Knowing the types of data within your organization makes it easier to assign security controls. Not every piece of data needs to be encrypted or masked.
• Set Protection Controls. AWS uses resource tags, sensitivity accounts, and community controls to restrict access according to a least-privilege policy.
• Define Data Lifecycles. Data does not need to live forever. By reducing the amount of accessible data, you limit the possibility of unauthorized access. Be sure to include the lifecycle requirements during data classification.
• Automate Processes. Using tools to identify and classify data minimizes the need for human intervention.

Classifying data for security purposes is crucial to the successful implementation of any data protection plan.

At Rest

Anytime you persist data at a location on your network, you have data at rest. It may be in databases, archives, or IoT devices. Wherever it is located, persisted data represents an opportunity for unauthorized access. Tokenizing, masking, and encrypting data are three ways to protect data at rest.

• Tokenization. Tokens represent sensitive information. A token is assigned to protected information, so the token is used rather than the sensitive data.
• Encryption. A secret key is used to transform data into an unreadable form before storing it. The data cannot be decrypted without the secret key, making the data unusable to threat vectors.
• Masking. Masking redacts data until the visible data is no longer sensitive. For example, PCI-DSS requires masking of card numbers, except for the last four digits.

Securing encryption keys using a defined process protects against possible exposure. You may want to consider a hardware security module (HSM) that generates encryption keys according to regulatory and compliance guidelines.

In Transit

Data that is sent from one system to another is in-transit. Ensuring its integrity is critical to secure operations. Use the following steps to protect in-transit data.

• Make sure you store encryption keys and certificates in secure locations.
• Rotate keys and certificates at set intervals.
• Use network protocols that support authentication, such as Transport Layer Security (TLS).
• Find tools that help detect unauthorized movement of data.

Securely passing information from one system to another is essential in meeting compliance and regulatory standards.

Incident Response

As part of your shared responsibility, you should review AWS’s incident response recommendations. According to AWS, you need to educate, prepare, simulate, and iterate for a successful incident response.

• Educate. Keep your staff up-to-date on cloud technologies.
• Prepare. Have a documented process for detecting and responding to incidents.
• Simulate. Perform vulnerability and penetration testing.
• Iterate. Repeat the process as needed based on the simulation results.

The NIST SP 800-61 Computer Security Incident Handling Guide provides additional information on incident reporting.

With careful review of AWS’s Security Pillar documentation and the NIST’s Guide, you can develop a comprehensive plan that addresses the shared security responsibilities of AWS.