Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

AWS Data Specialty > Security > Flashcards

Security Flashcards

1
Q

O que acontece na criptografia em trânsito?

A
  • Os dados são criptografados antes do envio e descriptografados após o recebimento
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

O certificados TLS ajudam na criptografia HTTPS?

A

Sim, os certificados TLS (Transport Layer Security) são um dos principais componentes que ajudam a garantir a segurança da criptografia HTTPS (Hypertext Transfer Protocol Secure) entre cliente e servidor.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

O que é MITM atack?

A

MITM (Man-in-the-middle) é um tipo de ataque cibernético em que um invasor intercepta a comunicação entre duas partes, fazendo-se passar por um dos lados, a fim de obter informações confidenciais ou executar ações maliciosas.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

O que é criptografia Server-side encryption at rest?

A

método de criptografia de dados utilizado para proteger dados armazenados em um serviço em nuvem. Nesse método, os dados são criptografados antes de serem armazenados no disco, somente as pessoas autorizadas podem acessá-los.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Why encryption?
Server-side encryption at rest

A
  • Data is encrypted after being received by the server
  • Data is decrypted before being sent
  • It is stored in an encrypted form thanks to a key (usually a data key)
  • The encryption / decryption keys must be managed
    somewhere, and the server must have access to it
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Encryption in flight (TLS / SSL)

A
  • Data is encrypted before sending and decrypted after receiving
  • TLS certificates help with encryption (HTTPS)
  • Encryption in flight ensures no MITM (man in the middle attack)
    can happen
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Server-side encryption at rest

A
  • Data is encrypted after being received by the server
  • Data is decrypted before being sent
  • It is stored in an encrypted form thanks to a key (usually a data
    key)
  • The encryption / decryption keys must be managed
    somewhere, and the server must have access to it
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Client-side encryption

A
  • Data is encrypted by the client and never decrypted by the server
  • Data will be decrypted by a receiving client
  • The server should not be able to decrypt the data
  • Could leverage Envelope Encryption
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

S3 Encryption for Objects

A
  • There are 4 methods of encrypting objects in S3
  • SSE-S3: encrypts S3 objects using keys handled & managed by AWS
  • SSE-KMS: leverage AWS Key Management Service to manage
    encryption keys
  • SSE-C: when you want to manage your own encryption keys
  • Client Side Encryption
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

SSE-S3

A
  • SSE-S3: encryption using keys handled & managed by Amazon S3
  • Object is encrypted server side
  • AES-256 encryption type
  • Must set header: “x-amz-server-side-encryption”: “AES256”
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

SSE-KMS

A
  • SSE-KMS: encryption using keys handled & managed by KMS
  • KMS Advantages: user control + audit trail
  • Object is encrypted server side
  • Must set header: “x-amz-server-side-encryption”: ”aws:kms”
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

SSE-C

A
  • SSE-C: server-side encryption using data keys fully managed by the customer outside of AWS
  • Amazon S3 does not store the encryption key you provide
  • HTTPS must be used
  • Encryption key must provided in HTTP headers, for every HTTP request made
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Client Side Encryption S3

A
  • Client library such as the Amazon S3 Encryption Client
  • Clients must encrypt data themselves before sending to S3
  • Clients must decrypt data themselves when retrieving from S3
  • Customer fully manages the keys and encryption cycle
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Amazon S3 - Encryption in transit (SSL/TLS)

A
  • Amazon S3 exposes:
  • HTTP endpoint: non encrypted
  • HTTPS endpoint: encryption in flight
  • You’re free to use the endpoint you want, but HTTPS is
    recommended
  • Most clients would use the HTTPS endpoint by default
  • HTTPS is mandatory for SSE-C
  • Encryption in flight is also called SSL / TLS
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

AWS KMS (Key Management Service)

A
  • Anytime you hear “encryption” for an AWS service, it’s most likely
    KMS
  • Easy way to control access to your data, AWS manages keys for us
  • Fully integrated with IAM for authorization
  • Seamlessly integrated into:
  • Amazon EBS: encrypt volumes
  • Amazon S3: Server side encryption of objects
  • Amazon Redshift: encryption of data
  • Amazon RDS: encryption of data
  • Amazon SSM: Parameter store
  • Etc…
  • But you can also use the CLI / SDK
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

AWS KMS 101

A
  • Anytime you need to share sensitive information… use KMS
  • Database passwords
  • Credentials to external service
  • Private Key of SSL certificates
  • The value in KMS is that the CMK used to encrypt data can never be
    retrieved by the user, and the CMK can be rotated for extra security
  • Never ever store your secrets in plaintext, especially in your code!
  • Encrypted secrets can be stored in the code / environment variables
  • KMS can only help in encrypting up to 4KB of data per call
  • If data > 4 KB, use envelope encryption
  • To give access to KMS to someone:
  • Make sure the Key Policy allows the user
  • Make sure the IAM Policy allows the API calls
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

AWS KMS (Key Management Service)

A
  • Able to fully manage the keys & policies:
  • Create
  • Rotation policies
  • Disable
  • Enable
  • Able to audit key usage (using CloudTrail)
  • Three types of Customer Master Keys (CMK):
  • AWS Managed Service Default CMK: free
  • User Keys created in KMS: $1 / month
  • User Keys imported (must be 256-bit symmetric key): $1 / month
  • pay for API call to KMS ($0.03 / 10000 calls)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

How does KMS work?

A

API – Encrypt and Decrypt

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Encryption in AWS Services

A
  • Requires migration (through Snapshot / Backup): * EBS Volumes * RDS databases * ElastiCache * EFS network file system * In-place encryption: * S3
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

KMS Automatic Key Rotation

A
  • For Customer-managed CMK (not AWS managed CMK)
  • If enabled: automatic key rotation happens every 1 year
  • Previous key is kept active so you can decrypt old data
  • New Key has the same CMK ID (only the backing key is changed)
21
Q

KMS Manual Key Rotation

A
  • When you want to rotate key every 90 days, 180 days, etc…
  • New Key has a different CMK ID
  • Keep the previous key active so you can decrypt old data
  • Better to use aliases in this case (to hide the change of key for the application)
  • Good solution to rotate CMK that are not eligible for automatic rotation (like asymmetric CMK)
22
Q

KMS Alias Updating

A
  • Better to use aliases in this case (to hide the change of key for the application)
23
Q

CloudHSM

A
  • KMS => AWS manages the software for encryption
  • CloudHSM => AWS provisions encryption hardware
  • Dedicated Hardware (HSM = Hardware Security Module)
  • You manage your own encryption keys entirely (not AWS)
  • HSM device is tamper resistant, FIPS 140-2 Level 3 compliance
  • CloudHSM clusters are spread across Multi AZ (HA) – must setup
  • Supports both symmetric and asymmetric encryption (SSL/TLS keys)
  • No free tier available
  • Must use the CloudHSM Client Software
  • Redshift supports CloudHSM for database encryption and key
    management
  • Good option to use with SSE-C encryption
24
Q

IAM permissions:

A
  • CRUD an HSM Cluster
    CloudHSM Software:
  • Manage the Keys
  • Manage the Users
25
Q

Security - Kinesis Data Streams

A
  • Kinesis Data Streams
  • SSL endpoints using the HTTPS protocol to do encryption in flight
  • AWS KMS provides server-side encryption [Encryption at rest]
  • For client side-encryption, you must use your own encryption libraries
  • Supported Interface VPC Endpoints / Private Link – access privately
  • KCL – must get read / write access to DynamoDB table
26
Q

Security - Kinesis Data Firehose

A
  • Attach IAM roles so it can deliver to S3 / ES / Redshift / Splunk
  • Can encrypt the delivery stream with KMS [Server side encryption]
  • Supported Interface VPC Endpoints / Private Link – access privately
  • Kinesis Data Analytics
  • Attach IAM role so it can read from Kinesis Data Streams and reference
    sources and write to an output destination (example Kinesis Data Firehose)
27
Q

Security - SQS

A
  • Encryption in flight using the HTTPS endpoint
  • Server Side Encryption using KMS
  • IAM policy must allow usage of SQS
  • SQS queue access policy
  • Client-side encryption must be implemented manually
  • VPC Endpoint is provided through an Interface
28
Q

Security – AWS IoT

A
  • AWS IoT policies:
  • Attached to X.509 certificates or Cognito Identities
  • Able to revoke any device at any time
  • IoT Policies are JSON documents
  • Can be attached to groups instead of individual Things.
  • IAM Policies:
  • Attached to users, group or roles
  • Used for controlling IoT AWS APIs
  • Attach roles to Rules Engine so they can perform their actions
29
Q

Security – Amazon S3

A
  • IAM policies * S3 bucket policies * Access Control Lists (ACLs) * Encryption in flight using HTTPS * Encryption at rest * Server-side encryption: SSE-S3, SSE-KMS, SSE-C
  • Client-side encryption – such as Amazon S3 Encryption Client
  • Versioning + MFA Delete * CORS for protecting websites * VPC Endpoint is provided through a Gateway * Glacier – vault lock policies to prevent deletes (WORM)
30
Q

Security – DynamoDB

A
  • Data is encrypted in transit using TLS (HTTPS) * DynamoDB tables are encrypted at rest * KMS encryption for base tables and secondary indexes * AWS owned key (default) * AWS managed key (aws/dynamodb) * AWS customer managed key (your own) * Access to tables / API / DAX using IAM * DynamoDB Streams are encrypted * VPC Endpoint is provided through a Gateway
31
Q

Security - RDS

A
  • VPC provides network isolation
  • Security Groups control network access to DB Instances
  • KMS provides encryption at rest
  • SSL provides encryption in-flight
  • IAM policies provide protection for the RDS API
  • IAM authentication is supported by PostgreSQL and MySQL
  • Must manage user permissions within the database itself
  • MSSQL Server and Oracle support TDE (Transparent Data
    Encryption)
32
Q

Security - Aurora

A
  • (very similar to RDS)
  • VPC provides network isolation
  • Security Groups control network access to DB Instances
  • KMS provides encryption at rest
  • SSL provides encryption in-flight
  • IAM authentication is supported by PostgreSQL and MySQL
  • Must manage user permissions within the database itself
33
Q

Security - Lambda

A
  • IAM roles attached to each Lambda function * Sources * Targets * KMS encryption for secrets * SSM parameter store for configurations * CloudWatch Logs * Deploy in VPC to access private resources
34
Q

Security - Glue

A
  • IAM policies for the Glue service * Configure Glue to only access JDBC through SSL * Data Catalog: Encrypted by KMS * Connection passwords: Encrypted by KMS * Data written by AWS Glue – Security Configurations: * S3 encryption mode: SSE-S3 or SSE-KMS * CloudWatch encryption mode * Job bookmark encryption mod
35
Q

Security - EMR

A
  • Using Amazon EC2 key pair for SSH credentials
  • Attach IAM roles to EC2 instances for:
  • proper S3 access
  • for EMRFS requests to S3
  • DynamoDB scans through Hive
  • EC2 Security Groups
  • One for master node
  • Another one for cluster node (core node or task node)
  • Encrypts data at-rest: EBS encryption, Open Source HDFS Encryption, LUKS + EMRFS
    for S3
  • In-transit encryption: node to node communication, EMRFS, TLS
  • Data is encrypted before uploading to S3
  • Kerberos authentication (provide authentication from Active Directory)
  • Apache Ranger: Centralized Authorization (RBAC – Role Based Access) – setup on
    external EC2
  • https://aws.amazon.com/blogs/big-data/best-practices-for-securing-amazon-emr/
36
Q

Security – ElasticSearch Service

A
  • Amazon VPC provides network isolation
  • ElasticSearch policy to manage security further
  • Data security by encrypting data at-rest using KMS
  • Encryption in-transit using SSL
  • IAM or Cognito based authentication
  • Amazon Cognito allow end-users to log-in to Kibana through
    enterprise identity providers such as Microsoft Active Directory
    using SAML
37
Q

Security - Redshift

A
  • VPC provides network isolation
  • Cluster security groups
  • Encryption in flight using the JDBC driver enabled with SSL
  • Encryption at rest using KMS or an HSM device (establish a connection)
  • Supports S3 SSE using default managed key
  • Use IAM Roles for Redshift
  • To access other AWS Resources (example S3 or KMS)
  • Must be referenced in the COPY or UNLOAD command
    (alternatively paste access key and secret key creds)
38
Q

Security - Athena

A
  • IAM policies to control access to the service
  • Data is in S3: IAM policies, bucket policies & ACLs
  • Encryption of data according to S3 standards: SSE-S3, SSEKMS, CSE-KMS
  • Encryption in transit using TLS between Athena and S3 and JDBC
  • Fine grained access using the AWS Glue Catalog
39
Q

Security - Quicksight

A
  • Standard edition:
  • IAM users
  • Email based accounts
  • Enterprise edition:
  • Active Directory
  • Federated Login
  • Supports MFA (Multi Factor Authentication)
  • Encryption at rest and in SPICE
  • Row Level Security to control which users can see which rows
40
Q

AWS STS – Security Token Service

A
  • Allows to grant limited and temporary access to AWS resources.
  • Token is valid for up to one hour (must be refreshed)
  • Cross Account Access
  • Allows users from one AWS account access resources in another
  • Federation (Active Directory)
  • Provides a non-AWS user with temporary AWS access by linking users Active Directory credentials
  • Uses SAML (Security Assertion markup language)
  • Allows Single Sign On (SSO) which enables users to log in to AWS console without assigning IAM credentials
  • Federation with third party providers / Cognito
  • Used mainly in web and mobile applications
  • Makes use of Facebook/Google/Amazon etc to federate them
41
Q

Cross Account Access

A
  • Define an IAM Role for another account to access
  • Define which accounts can access this IAM Role
  • Use AWS STS (Security Token Service) to retrieve credentials
    and impersonate the IAM Role you have access to (AssumeRole API)
  • Temporary credentials can be valid between 15 minutes to 1 hour
42
Q

What’s Identity Federation?

A
  • Federation lets users outside of AWS to assume temporary role for accessing AWS resources.
  • These users assume identity provided access role.
  • Federation assumes a form of 3rd party authentication
  • LDAP
  • Microsoft Active Directory (~= SAML)
  • Single Sign On
  • Open ID
  • Cognito
  • Using federation, you don’t need to create IAM users (user management is outside of AWS)
43
Q

SAML Federation For Enterprises

A
  • To integrate Active Directory / ADFS with AWS (or any SAML 2.0)
  • Provides access to AWS Console or CLI (through temporary)
44
Q

Custom Identity Broker Application For Enterprises

A
  • Use only if identity provider is not compatible with SAML 2.0
  • The identity broker must determine the appropriate IAM policy
    https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_
    common-scenarios_federated-users.html
45
Q

AWS Cognito - Federated Identity Pools For Public Applications

A
  • Goal:
  • Provide direct access to AWS Resources from the Client Side
  • How:
  • Log in to federated identity provider – or remain anonymous
  • Get temporary AWS credentials back from the Federated Identity Pool
  • These credentials come with a predefined IAM policy stating their
    permissions
  • Example:
  • provide (temporary) access to write to S3 bucket using Facebook Login
  • Note:
  • Web Identity Federation is an alternative to using Cognito but AWS recommends against it
46
Q

Policies – leveraging AWS variables

A
  • https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_
    policies_variables.html
  • ${aws:username} : to restrict users to tables / buckets
  • ${aws:principaltype} : account, user, federated, or assumed role
  • ${aws:PrincipalTag/department} : to restrict using Tags
  • https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_
    policies_iam-condition-keys.html#condition-keys-wif
  • ${aws:FederatedProvider} : which IdP was used for the user (Cognito,
    Amazon..)
  • ${www.amazon.com:user_id} , ${cognitoidentity.amazonaws.com:sub}
    …
  • ${saml:sub}, ${sts:ExternalId}
47
Q

Policies - Advanced

A
  • For S3 - let’s analyze the policies at:
    https://docs.aws.amazon.com/AmazonS3/latest/dev/examplebucket-policies.html
  • For DynamoDB – let’s analyze the policies at:
    https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/specifying-conditions.html
  • Note for RDS – IAM policies don’t help with in-database security, as
    it’s a proprietary technology and we are responsible for users &
    authorization
48
Q

AWS CloudTrail

A
  • Provides governance, compliance and audit for your AWS
    Account
  • CloudTrail is enabled by default!
  • Get an history of events / API calls made within your AWS
    Account by:
  • Console
  • SDK
  • CLI
  • AWS Services
  • Can put logs from CloudTrail into CloudWatch Logs
  • If a resource is deleted in AWS, look into CloudTrail first!
  • CloudTrail shows the past 90 days of activity
  • The default UI only shows “Create”, “Modify” or “Delete” events
  • CloudTrail Trail:
  • Get a detailed list of all the events you choose
  • Ability to store these events in S3 for further analysis
  • Can be region specific or global
  • CloudTrail Logs have SSE-S3 encryption when placed into S3
  • Control access to S3 using IAM, Bucket Policy, etc…
49
Q

VPC

A

Endpoints * Endpoints allow you to connect to AWS
Services using a private network instead of the public www network
* They scale horizontally and are redundant * They remove the need of IGW, NAT, etc… to access AWS Services
* Gateway: provisions a target and must be used in a route table
ONLY S3 and DynamoDB
* Interface: provisions an ENI (private IP address) as an entry point (must attach security group)
– most AWS services
Also called VPC PrivateLink

AWS Data Specialty (20 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions