9.4 Risk & Compliance Whitepaper

Shared Responsibility Model

Moving IT infrastructure to AWS services creates a model of shared responsibility between the customer and AWS. This shared model can help relieve customer's operational burden as AWS operates, manages and controls the components from the host operating system and virtualization layer down to the physical security of the facilities in which the service operates.

The customer assumes responsibility and management of the guest operating system (including updates and security patches), other associated application software as well as the configuration of the AWS provided security group firewall.

That is only apply to IaaS. If you got a Managed Service such RDS, DynamoDB, WorkSpaces, etc then it is Amazon's responsibility to patch up to the operating system level of the actual individual host that are running that application. And then it is your responsibility to just make sure you secure that environment by using passwords etc. So if we look at RDS for example, Amazon will patch the underlying servers that are running that say SQL Server, they will patch the windows environment that is running that underneath, and they will keep that up to date with security patches and antivirus. They will also patch SQL Server application and then it is your responsibility to just make sure that you have secure that database.

Risk

AWS management has developed a strategic business plan which includes risk identification and the implementation of controls to mitigate or manage risks. AWS management re-evaluates the strategic business plan at least biannually (twice a year).

This process requires management to identify risks within its areas of responsibility and to implement appropriate measures designed to address those risks.

AWS Security regularly scans all Internet facing service endpoint IP addresses for vulnerabilities (these scans do not include customer instances). AWS Security notifies the appropriate parties to remedy any identified vulnerabilities. In addition, external vulnerability threat assessments are performed regularly by independent security firms.

Findings and recommendations resulting from these assessments are categorized and delivered to AWS leadership. These scans are done in a manner for the health and viability of the underlying AWS infrastructure and are not meant to replace the customer's own vulnerability scans required to meet their specific compliance requirements.

Customers can request permission to conduct scans of their cloud infrastructure as long as they are limited to the customer's instances and do not violate the AWS Acceptable Use Policy.

Compliance

• SOC 1/SSAE 16/ISAE 3402 (formerly SAS 70 Type II)

• SOC 2

• SOC 3

• FISMA, DIACAP, and FedRAMP

• PCI DSS Level 1 - it is to infrastructure level only, you then need to get a Delta accreditation to get your application certified as PCI DSS. Don't think that you can just deploy an application on AWS and start taking card payment details.

• ISO 27001

• ISO 9001

• ITAR

• FIPS 140-2

• Several industry-specific standards:

  • HIPAA

  • Cloud Security Alliance (CSA)

  • Motion Picture Association of America (MPAA)