Amazon AWS re:invent 2014. Cloud security for Enterprise

Amazon AWS re:invent 2014 from infosec point of view in one sentence:

 Giant step towards  Enterprise market and by adding following services.

- AWS Directory Service:  

             "AWS Directory Service is a managed service that allows you to connect your AWS resources with an existing on-premises Microsoft Active Directory or to set up a new, stand-alone directory in the AWS Cloud." 

Details: http://aws.amazon.com/directoryservice

- AWS Key Management Service

      " AWS Key Management Service (KMS) is a managed service that makes it easy for you to create and control the encryption keys used to encrypt your data, and uses Hardware Security Modules (HSMs) to protect the security of your keys."

Details: http://aws.amazon.com/kms/

Nor forget about AWS CloudHSMservice: http://aws.amazon.com/cloudhsm/

- AWS Config

Finaly! - configuration management for AWS. "WS Config is a fully managed service that provides you with an AWS resource inventory, configuration history, and configuration change notifications to enable security and governance."

Details: http://aws.amazon.com/config/

- AWS Service Catalog

 Narrow variety of AWS services to the list of services your company use and present this as a cusom portal for your employee. " AWS Service Catalog is a service that allows administrators to create and manage approved catalogs of resources that end users can then access via a personalized portal."

Details: http://aws.amazon.com/servicecatalog/

The following two services allows you to build centralized log collectors with kind very primitive  SIEM (Cloudwatch alarms) in AWS:

Amazon CloudWatch Logs : "You can now use Amazon CloudWatch to monitor and troubleshoot your systems and applications using your existing system, application, and custom log files. You can send your existing log files to CloudWatch Logs and monitor these logs in near real-time."

Details: http://aws.amazon.com/about-aws/whats-new/2014/07/10/introducing-amazon-cloudwatch-logs/

AWS CloudTrail integration with CloudWatch:  "This integration enables you to receive SNS notifications from CloudWatch, triggered by specific API activity captured by CloudTrail. With SNS notifications, you can take immediate action when a pattern of interest is detected."

Details: http://aws.amazon.com/blogs/aws/cloudtrail-cloudwatch-integration-partners-too/

Encryption on any storage:

Amazon EBS encryption now  (may 2014) available: http://aws.amazon.com/about-aws/whats-new/2014/05/21/Amazon-EBS-encryption-now-available/

Details: http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/EBSEncryption.html

S3 data encryption 

Details:http://docs.aws.amazon.com/AmazonS3/latest/dev/UsingEncryption.html

http://aws.amazon.com/blogs/aws/s3-encryption-with-your-keys/

RDS (Relationship Database service) encryption:

1. Using EBS built-in encryption

2. Use DB specific encryption: 

Oracle Transparent Encryption http://aws.amazon.com/about-aws/whats-new/2013/04/18/amazon-rds-oracle-encryption/

Microsoft SQL Transparent Data Encryption http://aws.amazon.com/blogs/aws/amazon-rds-for-microsoft-sql-server-transparent-data-encryption-tde-/

Infosec certifications: SAS70, ISO27001, PCI DSS, DoD CSM

Details: http://aws.amazon.com/compliance/