Let’s Architect! Security in software architectures
AWS Architecture BlogLet’s Architect! Security in software architecturesby Luca Mezzalira, Federica Ciuffo, Vittorio Denti, and Zamira Jaupaj | on16 AUG 2023| inAmazon Elastic Container Service,Amazon Elastic Kubernetes Service,Architecture,AWS Secrets Manager,Containers,Security, Identity, & Compliance,Thought Leadership|Permalink|Comments|ShareSecurity is fundamental for each product and service you are building with. Whether you are working on the back-end or the data and machine learning components of a system, the solution should be securely built.In 2022, we discussed security in our postLet’s Architect!Architecting for Security. Today, we take a closer look at general security practices for your cloud workloads to secure both networks and applications, with a mix of resources to show you how to architect for security using the services offered by Amazon Web Services (AWS).In this edition ofLet’s Architect!, we share some practices for protecting your workloads from the most common attacks, introduce theZero Trustprinciple (you can learn how AWS itself is implementing it!), plus how to move to containers and/or alternative approaches for managing your secrets.A deep dive on the current security threat landscape with AWSThis session from AWS re:Invent, security engineers guide you through the most common threat vectors and vulnerabilities that AWS customers faced in 2022. For each possible threat, you can learn how it’s implemented by attackers, the weaknesses attackers tend to leverage, and the solutions offered by AWS to avert these security issues. We describe this as fundamental architecting for security: this implies adopting suitable services to protect your workloads, as well as follow architectural practices for security.Take me to this re:Invent 2022 session!Statistics about common attacks and how they can be launchedZero Trust: Enough talk, let’s build better securityWhat isZero Trust? It is a security model that produces higher security outcomes compared with the traditional network perimeter model.How does Zero Trust work in practice, and how can you start adopting it? This AWS re:Invent 2022 session defines the Zero Trust models and explains how to implement one. You can learn how it is used within AWS, as well as how any architecture can be built with these pillars in mind. Furthermore, there is a practical use case to show you howDelphixput Zero Trust into production.Take me to this re:Invent 2022 session!AWS implements the Zero Trust principle for managing interactions across different servicesA deep dive into container security on AWSNowadays, it’s vital to have a thorough understanding of a container’s underlying security layers. AWS services, likeAmazon Elastic Kubernetes ServiceandAmazon Elastic Container Service, have harnessed these Linux security-layer protections, keeping a sharp focus onthe principle of least privilege. This approach significantly minimizes the potential attack surface by limiting the permissions and privileges of processes, thus upholding the integrity of the system.This re:Inforce 2023 session discusses best practices for securing containers for your distributed systems.Take me to this re:Inforce 2023 session!Fundamentals and best practices to secure containersMigrating your secrets to AWS Secrets ManagerSecrets play a critical role in providing access to confidential systems and resources. Ensuring the secure and consistent management of these secrets, however, presents a challenge for many organizations.Anti-patterns observed in numerous organizational secrets management systems include sharing plaintext secrets via unsecured means, such as emails or messaging apps, which can allow application developers to view these secrets in plaintext or even neglect to rotate secrets regularly. This detailed guidance walks you through the steps of discovering and classifying secrets, plus explains the implementation and migration processes involved in transferring secrets toAWS Secrets Manager.Take me to this AWS Security Blog post!An organization’s perspectives and responsibilities when building a secrets management solutionConclusionWe’re glad you joined our conversation on building secure architectures! Join us in a couple of weeks when we’ll talk about cost optimization on AWS.To find all the blogs from this series, visit theLet’s Architect!list of content on theAWS Architecture Blog.TAGS:containers,Kubernetes,Let's Architect,Networking,security,well architectedLuca MezzaliraLuca is Principal Solutions Architect based in London. He has authored several books and is an international speaker. He lent his expertise predominantly in the solution architecture field. Luca has gained accolades for revolutionizing the scalability of front-end architectures with micro-frontends, from increasing the efficiency of workflows, to delivering quality in products.Federica CiuffoFederica is a Solutions Architect at Amazon Web Services. She is specialized in container services and is passionate about building infrastructure with code. Outside of the office, she enjoys reading, drawing, and spending time with her friends, preferably in restaurants trying out new dishes from different cuisines.Vittorio DentiVittorio Denti is a Machine Learning Engineer at Amazon based in London. After completing his M.Sc. in Computer Science and Engineering at Politecnico di Milano (Milan) and the KTH Royal Institute of Technology (Stockholm), he joined AWS. Vittorio has a background in distributed systems and machine learning. He's especially passionate about software engineering and the latest innovations in machine learning science.Zamira JaupajZamira is an Enterprise Solutions Architect based in the Netherlands. She is highly passionate IT professional with over 10 years of multi-national experience in designing and implementing critical and complex solutions with containers, serverless, and data analytics for small and enterprise companies.CommentsView Comments
Security is fundamental for each product and service you are building with. Whether you are working on the back-end or the data and machine learning components of a system, the solution should be securely built. In 2022, we discussed security in our post Let’s Architect! Architecting for Security. Today, we take a closer look at […]
Luca Mezzalira
Amazon Elastic Container Service Amazon Elastic Kubernetes Service Architecture AWS Secrets Manager Containers Security, Identity, & Compliance Thought Leadership