An effective strategy for securing sensitive data in the cloud requires a good understanding of general data security patterns and a clear mapping of these patterns to cloud security controls. AWS Training. You then can apply these controls to implementation-level details specific to data stores such as Amazon Relational Database Service (Amazon RDS) and Amazon DynamoDB. Database Training.
This blog post focuses on general data security patterns and corresponding AWS security controls that protect your data. AWS Training. Although I mention Amazon RDS and DynamoDB in this post, I plan to cover the implementation-specific details related to Amazon RDS and DynamoDB in two subsequent posts. Database Training.
The AWS Cloud Adoption Framework
The AWS Cloud Adoption Framework (AWS CAF) provides guidance and best practices to help you build a comprehensive approach to cloud computing across your organization. AWS Training. Within this framework, the Security Perspective of the AWS CAF covers five key capabilities:
AWS Identity and Access Management (IAM): Define, enforce, and audit user permissions across AWS services, actions, and resources. Database Training.
Detective control: Improve your security posture, reduce the risk profile of your environment, and gain the visibility you need to spot issues before they impact your business.
Infrastructure security: Reduce the surface area of the infrastructure you manage and increase the privacy and control of your overall infrastructure on AWS. AWS Training.
Data protection: Implement appropriate safeguards that help protect data in transit and at rest by using natively integrated encrypted services. Database Training.
Incident response: Define and execute a response to security incidents. as a guide for security planning.
The first step when implementing security based on the Security Perspective of the AWS CAF is to think about security from a data perspective. AWS Training.
Instead of thinking about on-premises and off-premises data security, think about the data you are protecting, how it is stored, and who has access to it. The following three categories help you think about security from a data perspective:
Data classification and security-zone modeling.Defense in depth.Swim-lane isolation.
In the rest of this post, I look at each of these categories in detail. Database Training.
Data classification and security-zone modeling
Data classification
Not all data is created equal, which means classifying data properly is crucial to its security. As part of this classification process, it can be difficult to accommodate the complex tradeoffs between a strict security posture and a flexible agile environment. AWS Training.
A strict security posture, which requires lengthy access-control procedures, creates stronger guarantees about data security. However, such a security posture can work counter to agile and fast-paced development environments, where developers require self-service access to data stores. Design your approach to data classification to meet a broad range of access requirements. Database Training.
In most cases, how you classify data doesn’t have to be as binary as public or private, so add an appropriate level of fidelity to your data classification model. As you can see in the following diagram, data comes in various degrees of sensitivity and you might have data that falls in all of the different levels of sensitivity and confidentiality. Design your data security controls with an appropriate mix of preventative and detective controls to match data sensitivity appropriately.