When it comes to compliance issues, the cloud is no different than an organization’s network. Government regulations like Sarbanes-Oxley, Gramm-Leach-Bliley, Personal Information Protection and Electronic Documents Act, Safe Harbor Frameworks, PCI DSS, and the Health Insurance Portability and Accountability Act need to be followed regardless of where data are stored or shared. Yet, many organizations cite such compliance as a stumbling block when it comes to adopting cloud services, because communication is lacking from providers about security and data-protection methods.
The risks associated with the cloud also present problems to organizations that are considering moving data or applications. Like compliance, some risks are shared between the two, such as data leakage, vulnerable applications, data breaches, and insider threats. In addition, the cloud presents unique risks. Concerns like data loss, shared resources, service traffic or account hijacking, and lack of control present themselves as risks more common to the cloud itself.
The Amazon Web Services Approach to Compliance
To address compliance issues, Amazon Web Services (AWS) has made its IT control environment transparent to its customers for the purpose of making compliance discussions smoother. Through the AWS Compliance Program, customers have access to white papers, reports, certifications, accreditations, and third-party attestations to show that AWS aligns with security best practices that meet both government and industry standards required for certification and compliance.
Addressing the Risks
Many of the security risks that organizations face in the cloud are addressed in the compliance-related literature that AWS publishes. Even so, how Amazon addresses security issues is deserving of its own mention.
Amazon employs standard technical controls like firewalls and other boundary devices to control and monitor incoming and outgoing traffic. To protect the confidentiality and integrity of data and to meet encryption needs, customers have the ability to store data and objects using Advanced Encryption Standard 256. For those companies required to use Hardware Security Modules for key storage, the AWS CloudHSM service provides a way to secure and store cryptographic keys.
Rounding out the AWS technical security controls is its Amazon Virtual Private Cloud (Amazon VPC) service, which allows customers to create private subnets to add a layer of security.
To secure communications between the customer’s network at its Amazon VPC private subnets, IP Security (IPsec) virtual private network tunnels can be created to prevent eavesdropping and data leakage. Other features that help protect the transmission of data between the home network and AWS include HTTP over Secure Socket Layer (HTTPS) to better secure access points. Customers also have the option of the AWS Direct Connect service, which establishes a dedicated connection using 802.1Q virtual LANs. These controls help to uphold the integrity of the customer’s data, which can be compromised by man-in-the middle attacks and other, similar techniques.
Preventing Data Loss
As with any cloud service, AWS performs regular backups. The AWS Management Console makes data restoration much easier, and AWS augments this service through monitoring capabilities. Other steps that AWS takes to make sure that data are available come from its environmental security offerings. Constant monitoring of electrical, mechanical, and life support systems makes it easier to prevent and prepare for outages, while constant climate controls help reduce outages that result from overheating and humidity.
The Human Element
Much of the risk associated with the cloud comes from the customer having no control over whom the provider has on staff and little input as to the provider’s infrastructure. AWS alleviates the latter concern through its Shared Responsibility Environment, where it operates, manages, and controls the technical aspects while the customer takes responsibility for managing the operating system and applications to ensure that they are updated, patched, and hardened according to their specifications.
To ensure that insider threats are not a concern, Amazon conducts criminal background checks on its employees. In addition, cloud services are separate from other Amazon business networks to keep the integrity of this product intact.
For a comprehensive review of AWS security and how it fits into an organization’s security policies, decision makers can compare their needs against the
Auditing Security Checklist for Use of AWS, which was designed to help conduct a meaningful security audit for organizations serious about moving to the cloud.
About the Author
Jeff Orloff works as a content developer for an email security awareness company. He has been involved in technology for years working with networks, web and security. In addition to Jeff’s hands on work in IT, he has also written many articles on the same topics.