Security Flashcards
Describe the Shared Responsibility Model - Customer responsibilities
1) “Security in the cloud”
2) The customer is responsible for the security of everything created and put in the AWS Cloud
3) Have complete control over content:
* Which content choose to store
* Which AWS services use
* Who has access to the content
4) Have control over how access rights are granted, managed and revoked
5) Security steps depends on factors:
* The services used
* The complexity of the systems
* Company’s specific operational and security needs
6) Security steps include:
* Selecting, configuring and patching the operations systems that will run on Amazon EC2 instances
* Configuring security groups
* Managing user accounts
Describe the Shared Responsibility Model - AWS responsibilities
1) Security of the cloud
2) Operates, manages and controls the components at all layers of infrastructure
3) Includes:
* Host operating system
* Virtualization layer
* Physical security of the data centers from which services operate
4) Protecting the global infrastructure that runs all of the services offered in the AWS Cloud: AWS Regions, Availability Zones, edge locations
5) Physical infrastructure that hosts the resources
* Physical security of data centers
* Hardware and software infrastructure
* Network infrastructure
* Virtualization infrastructure
Describe AWS Identify and Access Management (IAM)
1) Enables to manage access to AWS services and resources securely
2) Gives flexibility to configure access based on a company’s specific operational and security needs
3) Use:
* IAM users, groups and roles
* IAM policies
* Multi-factor authentication (MFA)
Describe the AWS Account Root User
1) When create an AWS account, begin with an identity know as the root user
2) Root user is accessed by signing in with the email address and password that were used to create the AWS account
3) Has complete access to all the AWS services and resources in the account
BEST PRACTICE
* Do not use the root user for every day tasks
* Use the root user to create the first IAM user and assign it permissions to create other users
* Only use the root user when need to perform a limited number of tasks that are only available to the root user
* Examples: Changing the root user email address and changing the AWS support plan
Describe IAM Users
1) An identity that created in AWS
2) Represents the person or application that interacts with AWS services and resources
3) Consists of a name and credentials
4) When create, it has o permissions associated with it
5) To allow the IAM user to perform specific actions in AWS, must grant the IAM user the necessary permissions
BEST PRACTICE:
* Create an individual IAM user for each person who needs to access with AWS
* Provides additional security by allowing each IAM user to have a unique set of security credentials
Describe IAM Polices
1) Document that allows or denies permissions to AWS services and resources
2) Enables to customize users’ levels of access to resources
3) Example: Allow users to access all of the Amazon S3 buckets w/in the AWS account, or only a specific bucket
BEST PRACTICE:
* Follow the security principle of least privilege when granting permissions
Describe IAM Groups
1) Collection of IAM users
2) When assign an IAM policy to a group, all users in the group are granted permissions specified by the policy
3) Easier to adjust permissions when an employee transfers to a different job -> remove from group for original job and then add to group for new job
Describe IAM Roles
1) An identity that can assume to gain temporary access to permissions
2) Before an IAM user, application or service can assume an IAM role, they must be granted permissions to switch to the role
3) When someone assumes an IAM role, they abandon all previous permissions that they had under a previous role and assume the permissions of the new role
BEST PRACTICE
* IAM roles are ideal for situations in which access to services or resources needs to be granted temporarily, instead of long-term
Describe Multi-factor Authentication (MFA)
1) Extra layer of protection on top of user name and password
2) When a user signs in to an AWS Management Console, they are prompted for their user name and password (the first factor - what they know), as well as for an authentication code from their AWS MFA device (the second factor what they have)
Describe AWS Organizations
1) Consolidate and manage multiple AWS accounts within a central location
2) Can centrally control permissions for the accounts by using service control policies (SCPs)
Describe Service Control Policies (SCPs)
1) Enable to place restrictions on the AWS services, resources and individual API actions that users and roles in each account can access
2) Can apply to:
* Organizational root account
* Individual member account
* Organizational Unit (OU)
Describe Organizational Units (OU)
1) Group accounts
2) Makes it easier to manage accounts with similar business or security requirements
3) When apply a policy to an OU, all the accounts in the OU automatically inherit the permissions specified in the policy
4) More easily isolate workloads or applications that have specific security requirements
Describe AWS Artifact
1) Service that provides on-demand access to AWS security and compliance reports and select online agreements.
2) Consists of two main sections:
* AWS Artifact Agreements
- Review, accept and manage agreements for an individual account and for all accounts in AWS Organizations
- Different types of agreements (HIPAA)
* AWS Artifact Reports
- Provide compliance reports from third-party auditors
Describe Denial-of-service attacks (DoS) & Distributed denial-of-service attacks (DDos)
DoS
1) Deliberate attempt to make a website or application unavailable to users
2) Attacker might flood a website or application w/excessive network traffic until the targeted website or application becomes overloaded and is no longer able to respond
DDos
1) Multiple sources are used to start an attack that aims to make a website or application unavailable
2) Group of attackers or single attacker using multiple infected computers (bots)
Describe AWS Shield
1) Service that protects applications against DDos attacks
2) Two levels of protection
* AWS Shield Standard
- Automatically protects all AWS customers at no cost
- It protects your AWS resources from the most common, frequently occurring types of DDoS attacks
- Uses a variety of analysis techniques to detect malicious traffic in real time and automatically mitigates it
* AWS Shield Advanced
- Paid service that provides detailed attack diagnostics and the ability to detect and mitigate sophisticated DDoS attacks
- Integrates with other services such as Amazon CloudFront, Amazon Route 53 and Elastic Load Balancing
- Can integrate AWS with AWS WAF by writing custom rules to mitigate complex DDoS attacks
