Insights for CTOs: Part 2 – Enable Good Decisions at Scale with Robust Security
AWS Architecture BlogInsights for CTOs: Part 2 – Enable Good Decisions at Scale with Robust Securityby Syed Jaffry and Paul Hawkins | on17 DEC 2021| inArchitecture,AWS Well-Architected,Security|Permalink|ShareIn my role as a Senior Solutions Architect, I have spoken to chief technology officers (CTOs) and executive leadership of large enterprises like big banks, software as a service (SaaS) businesses, mid-sized enterprises, and startups.In this 6-part series, I share insights gained from various CTOs and engineering leaders during their cloud adoption journeys at their respective organizations. I have taken these lessons and summarized architecture best practices to help you build and operate applications successfully in the cloud. This series will also cover topics onbuilding and operating cloud applications, security, cloud financial management, modern data and artificial intelligence (AI), cloud operating models, and strategies for cloud migration.In part 2, my colleague Paul Hawkins and I will show you how to effectively communicate organization-wide security processes. This will ensure you can make informed decisions to scale effectively. We also describe how to establish robust security controls using best practices from theSecurity Pillarof theWell-Architected Framework.Effectively establish and communicate security processesTo ensure your employees, customers, contractors, etc., understand your organization’s security goals, make sure that people know the what, how, and why behind your security objectives:Whatare the overall objectives they need to meet?Howdo you intend for the organization and your customers to work together to meet these goals?Whyare meeting these goals important to your organization and customers?Having well communicated security principles gives a common understanding of overall objectives. Once you communicate these goals, you can get more specific in terms of how those objectives can be achieved.The next sections discuss best practices to establish your organization’s security processes.Create a “path to production” processA “path to production” process is a set of consistent and reusable engineering standards and steps that each new cloud workload must adhere to prior to production deployment. Using this process will increase delivery velocity while reducing business risk by ensuring strong compliance to standards.Classify your data for better access controlUnderstanding the type of data that you are handling and where it is being handled is critical to understanding what you need to do to appropriately protect it. For example, the requirements for a public website are different than a payment processing workload. By knowing where and when sensitive data is being accessed or used, you can more easily assess and establish the appropriate controls.Figure 1 shows a scale that will help you determine when and how to protect sensitive data. It shows that you would apply stricter access controls for more sensitive data to reduce the risk of inappropriate access. Detective controls allow you to audit and respond to unexpected access.By simplifying the baseline control posture across all environments and layering on stricter controls where appropriate, you will make it easier to deliver change more swiftly while maintaining the right level of security.Figure 1. Data classification and control scaleIdentify and prioritize how to address risks using a threat modelAs shown in theHow to approach threat modelingblog post, threat modeling helps workload teams identify potential threats and develop or implement security controls to address those threats.Threat modeling is most effective when it’s done at the workload (or workload feature) level. We recommend creating reusable threat modeling templates. This will help ensure quicker time to production and a consistent security control posture for your systems.Create feedback cyclesSecurity, like other areas of architecture and design, is not static. You don’t implement security processes and walk away, just like you wouldn’t ship an application and never improve its availability, performance, or ease of operation.Implementation of feedback cycles will vary depending on your organizational structure and processes. However, one common way we have seen feedback cycles being implemented is with a collaborative, blame-free root cause analysis (RCA) process. It allows you to understand how many issues you have been able to prevent or effectively respond to and apply that knowledge to make your systems more secure. It also demonstrates organizational support for an objective discussion where people are not penalized for asking questions.Security controlsProtect your applications and infrastructureTo secure your organization, build automation that delivers robust answers to the following questions:Preventative controls – how well can you block unauthorized access?Detective controls – how well can you identify unexpected activity or unwanted configuration?Incident response – how quickly and effectively can you respond and recover from issues?Data protection – how well is the data protected while being used and stored?Preventative controlsStart with robust identity and access management (IAM). For human access, avoid having to maintain separate credentials between cloud and on-premises systems. It does not scale and creates threat vectors such as long-lived credentials and credential leaks.Instead, use federated authentication within a centralized system for provisioning and deprovisioning organization-wide access to all your systems, including the cloud. For AWS access, you can do this withAWS Single Sign-On (AWS SSO), direct federation to IAM, or integration with partner solutions, such asOktaorActive Directory.Enhance your trust boundary with the principles of “zero trust.” Traditionally, organizations tend to rely on the network as the primary point of control. This can create a “hard shell, soft core” model, which doesn’t consider context for access decisions. Zero trust is about increasing your use of identity as a means to grant access in addition to traditional controls that rely on network being private.Apply “defense in depth” to your application infrastructure with a layered security architecture. The sequence in which you layer the controls together can depend on your use case. For example, you can apply IAM controls either at the database layer or at the start of user activity—or both. Figure 2 shows a conceptual view of layering controls to help secure access to your data. Figure 3 shows the implementation view for a web-facing application.Figure 2. Defense in depthFigure 3. Defense in depth applied to a web applicationDetective controlsDetective controls allow you to get the information you need to respond to unexpected changes and incidents. Tools likeAmazon GuardDutyandAWS Configcan integrate with your security information and event monitoring (SIEM) system so you canrespond to incidentsusing human and automated intervention.Incident responseWhen security incidents are detected, timely and appropriate response is critical to minimize business impact. A robust incident response process is a combination of human intervention steps and automation. TheAWS Security Hub Automated Response and Remediationsolution provides an example of how you can build incident response automation.Protect data with robust controlsRestrict access to your databases with private networking and strong identity and access control. Apply data encryption in transit (TLS) and at rest. A common mistake that organizations make is not enabling encryption at rest in databases at the time of initial deployment.It is difficult to enable database encryption after the fact without time-consuming data migration. Therefore, enable database encryption from the start and minimize direct human access to data by applying principles of least privilege. This reduces the likelihood of accidental disclosure of information or misconfiguration of systems.Ready to get started?As a CTO, understanding the overall posture of your security processes against the foundational security controls is beneficial. Tracking key metrics on the effectiveness of the decision-making process, overall security objectives, and the improvement in posture over time should be regularly evaluated by the CTO and CISO organizations.Embedding the principles of robust security processes and controls into the way your organization designs, develops, and operates workloads makes it easier to consistently make good decisions quickly.To get started, look at workloads where engineering and security are already working together or bootstrap an initiative for this. Use theWell Architected Tool’sSecurity Pillar to create and communicate a set of objectives that demonstrate value.Other blogs in this seriesInsights for CTOs: Part 1 – Building and Operating Cloud ApplicationsLooking for more architecture content?AWS Architecture Centerprovides reference architecture diagrams, vetted architecture solutions,Well-Architectedbest practices, patterns, icons, and more!TAGS:Insights for CTOs seriesSyed JaffrySyed Jaffry is a Sr. Solutions Architect with AWS. He works with a range of companies from mid-sized organizations to large enterprises, financial services to ISVs, in helping them build and operate secure, resilient, scalable, and high performance applications in the cloud.Paul HawkinsPaul Hawkins works in the Office of the CISO. He guides customers to understand how to think about security in the cloud and helps AWS service teams build services that make it easier for customers to achieve their security, risk, and compliance goals. He believes that an optimistic and collaborative approach to security is the best way to help everyone be more secure.
In my role as a Senior Solutions Architect, I have spoken to chief technology officers (CTOs) and executive leadership of large enterprises like big banks, software as a service (SaaS) businesses, mid-sized enterprises, and startups. In this 6-part series, I share insights gained from various CTOs and engineering leaders during their cloud adoption journeys at […]
Syed Jaffry
Architecture AWS Well-Architected Security