Well Architected Framework WP - Security

Question 1

Design Principles

Answer 1

Apply security at all layers

Enable traceability

Automate responses to security events

Automate security best practices

Focus on securing your system (your responsibilities in shared model)

Question 2

Definition, remember for exam

Answer 2

Security in the cloud consists of 4 areas

Data protection
Privilege management
Infrastructure protection
Detective controls

Question 3

Data Protection Pillar

Answer 3

Data should be classified before you architect security practices

Organize and classify data, i.e. what’s public and what’s private, user access roles, privileges, etc.

Encrypt everything at rest and in transit

Question 4

Data Protection best practices

Answer 4

AWS makes it easy to encrypt with KMS
Detailed logging is available
AWS storage systems are highly resilient
Customers have full control of their data

Versioning can protect against accidental harm

AWS never initiates moving data between regions. Customers might do it, but not AWS

Question 5

Data Protection questions for yourself

Answer 5

How are you encrypting data at rest and transit

Question 6

Privilege Management

Answer 6

Ensures only authorized users can access resources, and in the way intended

Includes ACLs, Roles, password policies

Question 7

Privilege Management questions for yourself

Answer 7

How are you protecting access to and use of AWS root account?

How are you defining roles and responsibilities of users to control access to Console and API’s?

How are you limiting automated access to AWS resources (ie from apps, scripts, 3rd party tools and services)

How are you managing keys and credentials

Question 8

Infrastructure Protection

Answer 8

How do you protect your data center (physical controls, which aWS provides

Security groups, NACL’s

Question 9

Infrastructure Protection questions

Answer 9

How are you enforcing network and host protection

How are you enforcing AWS service level protection

How are you protecting integrity of OS on instances

Question 10

Detective Controls best practices

Answer 10

Use detective controls to ID a breach

AWS Tools for this:
Cloudtrail
Cloudwatch
AWS Config
S3
Glacier

Question 11

Detective Control questions

Answer 11

how are you capturing and analyzing Cloudwatch / AWS logs

Question 12

Key AWS Services for security

Answer 12

Data Protection:
encrypt data using ELB, EBS, S3, RDS

Privilege Mgmt:
IAM, MFA

Infrastructure Protection:
VPC, Security Groups, NACLs, NAT instances

Detective Controls:
Cloudtrail, AWS Config, Cloudwatch