Security Considerations for Amazon Web Services (AWS):
It is the duty as an IT chief to perform a comprehensive risk evaluation of AWS. But first, it’s important to understand the difference between AWS cloud protection and security within the AWS Cloud Managed Services.
What is the context for determining how safe AWS is for ecommerce?
“By 2020, 95 percent of cloud protection vulnerabilities will be the responsibility of the customer,” according to Gartner. Cloud protection failures, according to the study, would be triggered by users rather than cloud service providers until 2020. As an AWS customer and an ecommerce company’s IT boss, you should be able to tell the difference between protection “of” the cloud and security “in” the cloud.
And ensuring that your online company complies with industry security requirements such as the Payment Card Industry – Data Security Standard is one of the first steps toward protecting your system (PCI-DSS).
The PCI-DSS Norm and AWS
The good news is that AWS Security assists ecommerce in reaching the PCI DSS Level 1 physical security standard. This means that an accredited independent Qualified Security Assessor has audited and certified the underlying physical infrastructure. It’s worth noting that Amazon Web Services was the first cloud platform to achieve PCI DSS Level 1 compliance. As part of its ecosystem, AWS also includes all other PCI DSS Level 2 building blocks.
PCI-DSS Compliance Level 2 & Other Standards Security Measures
AWS has released a whitepaper on best practises in partnership with Anitian, a leading PCI Compliance Assessor. Ecommerce sites hosted on AWS Managed Services must adhere to these guidelines. The following security measures must be deployed alongside the AWS apps in order to ensure that the PCI-DSS, ISO270001, and other guidelines are effectively enforced.
Implement Web Application Firewalls (AWS WAF or third-party solutions like ModSecurity) and make sure there are enough rules designed to defend against the OWASP top 10 attacks. Encrypt all data during its lifecycle, including “Data in Transit,” “Data in Use,” and “Data at Rest.” AWS ELB (Elastic Load Balancing) should be used to allow SSL/TLS, which encrypts all data in transit, for “Data in Transit.” All AWS tools containing sensitive data should be delegated to appropriate protection groups and NACLs, ensuring that only protected protocols are used for data exchange. AES256 encryption mechanisms can be used for ‘Data at Rest’ in EBS and S3. Key Management Systems (KMS), such as AWS KMS, can be used to store private keys.
Using vulnerability scanners such as OpenVAS, OWASP ZAP, and Nexpose, among others, search for Bots and other malware on a regular basis. This will ensure that no ports are opened as a result of human error. AWS CloudTrail and other logging mechanisms should be allowed. Monitoring and detecting anomalies in device activity and results can be done with tools like AWS Cloud Watch.
Identification and authentication of individuals who have access to network services must be managed properly. Since this prevents hackers from using identity fraud to gain access to the network. To – the risk of identity theft, system management should be restricted to a small group of people. For securing Identity Management, the AWS IAM (Identity and Access Management) tool should be connected to Active Directory services using AWS Directory Services. Constant monitoring of connections to protocols like SSH would also assist in the detection of any malicious network intrusions.
To sum it up
Even if an ecommerce website has achieved PCI DSS Level 2 compliance, it is not immune to cyber-attacks such as DDOS. Protection is not a one-time configuration setup destination. It’s a road that never ends. As a result, it’s important to keep an eye on the security posture at all times. Furthermore, today’s leading organisations support integrating security testing with the DevOps process, such that security checks such as vulnerability scanning are conducted every time a software update is made.
