Tips on managing security in the AWS cloud
By: Jacek Biernat
Tags: Security, Privacy, Technology, Information Security, Cybersecurity

Whether you use your own resources or those, which create your company, there’s something more on your mind in relation to their safety. We need to be more careful with how to implement best practices on the first level of designing the environment in the cloud. As if it goes for me, I’m an experienced Solutions Architect and DevOps working on AWS Cloud for a couple of years now. So, I can share with you a few tips on how to thoughtfully manage the security in the AWS cloud.

Photo by Matthew Henry on Unsplash

Firstly, we should think about the auditing process and what it gives you? Mainly because of risk management, which also is a very essential part of keeping your environment secure. What’s funny that we don’t need to invent any sophisticated methodologies or procedures to manage all these actions. I assume that you heard about DevOps practices, but to be more formal let’s see how AWS defines it:

Photo by Fabian Grohs on Unsplash

“DevOps is a combination of cultural philosophies, practices and tools that increase the organization’s ability to deliver applications and services at high speed: they evolve and improve products at a faster rate than organizations use in traditional software development processes and infrastructure management. This speed allows organizations to better serve customers and compete more effectively in the market. “

As we are familiar with DevOps definition, it’s good to know DevSecOps as well. It complements the practices and focuses on security issues. The definition says:

“The purpose and intention of DevSecOps are to build a mentality that “everyone is responsible for security” with a view to securely separating safety decisions at a fast pace and matching those who maintain the highest level of context without sacrificing the required security.”

My team has prepared a nice blog post on our website. But let’s go back to business. When managing security, we can use the principles that DevOps practices suggest. That are risk modelling and continuous integration and security assessment.

“Designed by snowing / Freepik”

When keeping in mind a good risk model, we need to focus on the process of developing safety control mechanisms. Our priority should be collecting all the info about threats, their analysis as well as their counteracting and current status. This will be helpful during the assessment of hazards and probabilities of their occurrence.

There are a few tools, which surely help you with this task. Such tools can be STRIDE, Trike or PASTA. There are a few more, which you can see at AWS post.

To stay on track while creating your risk rules and developing safety mechanism it’s good to keep best practices in mind. Worth reading is the documentation prepared by AWS — Cloud Adoption Framework. There you will find tips on the coordination of various parts of the organization, e.g. migrating data to the cloud. The CAF guidelines are divided into several areas ( important for the implementation of systems based on the AWS cloud), which can be very helpful.

CAF Framework scheme by LCloud

These guidelines aim to improve and ensure the proper development of security controls. Every regulation should be carefully formulated to avoid ambiguity. It usually has a form of a single instruction requiring some action or configuration. The tips mean that the risk is documented or completely eliminated. There is also some residual risk that can be managed further by using other security controls.

Next step and rule we chose to keep to is continuous integration and security assessment. Once you have security controls created, you can go to the next stage. To the creation of a scenario of acceptance criteria for users’ actions, which then undergo a test of the correctness of operation. Then we need to make some test. After it, we enter the remaining criteria as rules into the AWS Config service. This allows us for continuous evaluation of the entire AWS account in terms of compliance. Remember that as a rule, compliance with the control rules needs to be based on the time segment (<15 min). The defined elements can be placed in the CI / CD Pipeline, thanks to which security controls will be as fast as the rate of innovation in the DevOps process.

“Designed by mindandi / Freepik”

The applied solution has many advantages. In contrast to the traditional approach continuity of integration and security assessment allow you to be consistent with the legal regulations at all times. In order to save time for labour-intensive audits, it is worth using the AWS Config service. Easy access to its panel, allows you to quickly launch simple operating procedures. We receive immediate information on the compliance of our activities with our control rules, and thus with legal regulations. Developers receive feedback on the proposed solutions in advance.

Cloud solutions are slowly starting to become popular. Therefore, the technological development of other components complementary to cloud computing is extremely important. The DevOps practices allow for fast and efficient creation of solutions, with a high level of security.