PCI Compliance in AWS

intelligent information securityANITIAN

PCI COMPLIANCE

IN AWS


Meet the SpeakersAdam Gaydosh• Anitian’s Director of Professional Services• Qualified Security Assessor• 15+ years experience in IT and Security

Jordan Wiseman• Certified Risk Assessor• Cloud Security Specialist• 15+ years experience in IT and Security


Vision: Security is essential for growth, innovation and prosperity.

Mission: Build great security leaders.

ANIT IAN

Rapid Risk Assessment Compliance

Penetration Testing Managed Threat Intelligence


Intent • Discuss PCI compliance in AWS• Outline AWS services that help meet PCI requirements

Outline1. AWS Services for PCI Compliance2. PCI Reference Architectures3. Third Party Solutions4. AWS PCI Best Practices5. Q&A

Overview


PCI IN AWSOVERVIEW


AWS Compliance Status• AWS is validated annually as a compliant PCI DSS Level 1 Service

Provider• Attestation of Compliance (AOC) & Responsibility Matrix

available to customers pursuing their own compliance• Customer’s compliance is not inherited from AWS


Cloud Compliance is a Shared Responsibility


AWS COMPLIANTPCI SERVICES


Requirement 1: Install and maintain a firewall configuration to protect cardholder data

• AWS Services• Virtual Private Clouds (VPCs)• Security Groups• Network ACLs

• Other Strategies and Considerations• Third-party Amazon Machine Images (AMIs)

– Firewall– NGFW/UTM– IDS/IPS


Requirement 2: Do not use vendor-supplied defaults for system passwords and other security parameters

• AWS Services• Elastic Compute Cloud AMIs

• Other Strategies and Considerations• Amazon-supplied AMIs have no defaults• Third-party AMIs might have defaults• Pre-hardened AMIs available from Anitian in AWS Marketplace


Requirement 3: Protect stored cardholder data• AWS Services

• Elastic Block Store (EBS)• Simple Storage Service (S3)• Key Management Service (KMS)• Relational Database Service (RDS)

• Other Strategies and Considerations• EBS not OS independent• Self-managed DBs and Transparent Data Encryption


Requirement 4: Encrypt transmission of cardholder data across open, public networks

• AWS Services• Elastic load balancers• Network ACLs• Security Groups• Customer Gateways• Virtual Private Gateways• VPN Connections• AWS Direct Connect

• Other Strategies and Considerations• Setup and manage TLS and VPNs• Standard encryption strength and algorithms change


Requirement 5: Protect all systems against malware and regularly update anti-virus software or programs

• AWS Services• AWS does not provide anti-malware for customer AWS instances

• Other Strategies and Considerations• Third-party management AMIs• Manage from within AWS• Use existing on premise solutions


Requirement 6: Develop and maintain secure systems and applications

• AWS Services• None

• Other Strategies and Considerations• Amazon Linux AMI Security Bulletins (ALAS)

– https://alas.aws.amazon.com/• CodeCommit and CodeDeploy• Third-party management AMIs


Requirement 7: Restrict access to cardholder data by business need to know• AWS Services

• Identity and Access Management (IAM)• Directory Service

• Other Strategies and Considerations• IAM controls access AWS itself

– AWS Console– AWS APIs

Requirement 8: Identify and authenticate access to system components• Same as above


Requirement 9: Restrict Physical Access to Cardholder Data

• N/A

Requirement 10: Track and monitor all access to network resources and cardholder data• AWS Services

• CloudTrail• S3

• Other Strategies and Considerations• S3 supports lifecycle management• Leverage CloudTrail APIs to obtain SEIM data• CloudTrail will log AWS Console and API activity• AWS does not include time synchronization


Requirement 11: Regularly test security systems and processes

• AWS Services• Amazon’s Attestation of Compliance (AOC)

– Fully covers physical security of AWS– Fully covers rogue Wireless Access Point detection– Applies to any PCI components hosted in AWS– Does not cover in-scope, but on premise components


Requirement 12: Maintain a policy that addresses information security for all personnel

• AWS Services• None

Requirement A.1: Shared hosting providers must protect the cardholder data environment

• AWS Services• See Requirements 1, 7, and 8


PCI REFERENCE ARCHITECTURES


Architecture 1: Dedicated


Architecture 1: Dedicated• An entire AWS environment dedicated to a web-based e-

commerce application.

• Features• DMZ subnet for webserver and management “Jumpbox”

instances.• Internal subnet for application and AWS RDS instances.

• PCI Scope• Everything

NOTE: While the Jumpbox does not handle cardholder data itself, it does impact the security of the instances and is therefore in-scope.


Architecture 2: Segmented


Architecture 2: Segmented• Adding non-PCI systems to the AWS environment hosting our

existing web-based e-commerce application.

• Features• Separate Virtual Private Clouds for PCI and non-PCI

environments• Network segmentation between VPCs

• PCI Scope• Instances in the PCI VPC only


Architecture 3: Connected


Architecture 3: Connected• Extending an on premise network to the AWS PCI environment

to leverage existing services.

• Features• Connectivity between on premise systems and AWS PCI

environment.• Network segmentation between PCI and non-PCI

environments.• PCI Scope• AWS CDE VPC• AWS In-scope VPC and In-scope On Premise Network


THIRD PARTYSOLUTIONS


Pre-built AMIs• Familiar technologies • Trusted vendors

https://aws.amazon.com/marketplace/


PCI Compliance Related• AWS Service Gaps

• IDS/IDP• SEIM• Patching• Vulnerability Management• FIM

• Enhance AWS Services• Firewalls• VPN• AWS Automation


AWS PCIBEST PRACTICES


Non-technical Actions• Request a copy of the AWS PCI Compliance Package• Requires NDA• AWS AOC• Responsibility Matrix

• Documentation• Config• Trusted Advisor• AMI Identifiers• AWS Console• Resource Groups and Tagging


Technical Considerations• Monitoring• Cloud Watch

• First things first• Naming conventions• KMS encryption keys

• Elastic Load Balancers (ELB)• Availability• Abstract or conceal real endpoints• ELB all the things!


Audit Preparation• Readiness assessment • Documentation • Network diagrams and data flows• Scope and inventory• Penetration tests and vulnerability scans• QSA who knows AWS


QUESTIONS?


EMAIL: [email protected]@anitian.com

WEB: www.anitian.comBLOG: blog.anitian.comSLIDES: http://bit.ly/anitianCALL: 888-ANITIAN

THANK YOU

Date post:	16-Jan-2017
Category:	Technology
Upload:	anitian
View:	149 times
Download:	2 times

PCI Compliance in AWS

Technology