Data Theft and AWS Deployments

Data theft: no one’s immune

Because, in conformance with their Shared Responsibility Model, AWS does such a good job protecting their physical infrastructure, many of the kinds of data theft that plague locally-hosted operations aren’t likely to threaten your cloud-based servers.

data theftConsider, as an example, the unauthorized individual who just sat down in front of that workstation over there… the one right behind the room divider. See how easily he’s able to bypass network checkpoints by posting his freshly encoded data to social networking accounts or fax-to-email services? I’ll bet you’ll never see anything like that happening inside an Amazon server farm.

But not so fast with the smug grin: this definitely doesn’t mean you’re off the hook. Not even close. After all, the kind of disaster that recently hit Morgan Stanley – and 350,000 of its customers – could just as easily have happened on an AWS-hosted system. Data theft (sometimes called “data exfiltration”) is a serious threat to all networked systems, and you’ve got responsibilities to your customers, investors, and society at large to do your part to prevent it.

Data theft: preventative solutions

Here’s a checklist of steps you can – and should – take to both harden your deployment and, in general, tighten the way you interact with your cloud resources:

  • IAM. The less access to your resources you provide to team members and applications, the lower the chances that your data will go missing. Through their Identity and Access Management (IAM) service, AWS allows you to expose your individual compute and data resources to specific purpose-built users and roles, rather than to all and sundry who might be associated with your account. Use it.
  • Penetration-testing. When asked in advance, AWS will provide permission for you to launch simulated attacks against your cloud infrastructure. Using specialized operating system distributions like Kali Linux, you’ll get a first-hand look at how well your ACLs, security groups, and VPCs are configured, and how easy it will be for the bad guys to blow past them.
  • Anti-phishing training. All the stealth technology in the world won’t do much good if someone on your team clicks on the “fix the problem” link in the fake “your account needs resetting” email he just received.
  • Secure your own local infrastructure. You can’t very well blame Amazon if the gentleman at Data Theft Incorporated got your account authentication data through a keystroke tracker installed on the compromised PC you’re using, can you?
  • Log monitoring. System access and event logs exist for a reason. Hint: it might have something to do with keeping track of system access and events.
  • CloudWatch. Haven’t got the time or patience to properly monitor your logs? Once you set them to trigger alarm notifications upon detection of unusual activity, the friendly electrons at Amazon’s CloudWatch will be only too happy to do it for you.

Data Leak Prevention technology

Besides those more integrated approaches, there’s also Data Leak Prevention (DLP) technology, an entire class of software solutions aimed at data theft protection. DLP systems use machine learning heuristics, user activity monitoring, and sometimes honeypots to monitor a network.

They’ll particularly focus on analyzing data when it’s in motion (network), at rest (archived), and in use (endpoints). Should you feel the need is pressing enough, there’s no reason you can’t install such a package on part of your cloud infrastructure to keep watch over your account resources.

Of course, DLP systems are available from many of the usual suspects like Symantic and McAfee. But it’s the Linux-based open source packages, MyDLP and, perhaps, OpenDLP that should interest us the most because they’re likely to be flexible (and Linux-friendly) enough to fit comfortably into the AWS environment.

The bottom line? The tools we’ll need to defend our cloud deployments against data theft are available. We’ve just got to decide to use them.

Avatar

Written by

David Clinton

A Linux system administrator with twenty years' experience as a high school teacher, David has been around the industry long enough to have witnessed decades of technology trend predictions; most of them turning out to be dead wrong.


Related Posts

Alisha Reyes
Alisha Reyes
— July 2, 2020

New Content: AWS, Azure, Typescript, Java, Docker, 13 New Labs, and Much More

This month, our Content Team released a whopping 13 new labs in real cloud environments! If you haven't tried out our labs, you might not understand why we think that number is so impressive. Our labs are not “simulated” experiences — they are real cloud environments using accounts on A...

Read more
  • AWS
  • Azure
  • DevOps
  • Google Cloud Platform
  • Machine Learning
  • programming
Joe Nemer
Joe Nemer
— June 19, 2020

Kickstart Your Tech Training With a Free Week on Cloud Academy

Are you looking to make a jump in your technical career? Want to get trained or certified on AWS, Azure, Google Cloud Platform, DevOps, Kubernetes, Python, or another in-demand skill?Then you'll want to mark your calendar. Starting Monday, June 22 at 12:00 a.m. PDT (3:00 a.m. EDT), ...

Read more
  • AWS
  • Azure
  • cloud academy content
  • complimentary access
  • GCP
  • on the house
Alisha Reyes
Alisha Reyes
— June 11, 2020

New Content: AZ-500 and AZ-400 Updates, 3 Google Professional Exam Preps, Practical ML Learning Path, C# Programming, and More

This month, our Content Team released tons of new content and labs in real cloud environments. Not only that, but we introduced our very first highly interactive "Office Hours" webinar. This webinar, Acing the AWS Solutions Architect Associate Certification, started with a quick overvie...

Read more
  • AWS
  • Azure
  • DevOps
  • Google Cloud Platform
  • Machine Learning
  • programming
Rebecca Willis
Rebecca Willis
— June 3, 2020

Azure vs. AWS: Which Certification Provides the Brighter Future?

More and more companies are using cloud services, prompting more and more people to switch their current IT position to something cloud-related. The problem is most people only have that much time after work to learn new technologies, and there are plenty of cloud services that you can ...

Read more
  • AWS
  • Azure
  • certification
Alisha Reyes
Alisha Reyes
— June 2, 2020

Blog Digest: 5 Reasons to Get AWS Certified, OWASP Top 10, Getting Started with VPCs, Top 10 Soft Skills, and More

Thank you for being a valued member of our community! We recently sent out a short survey to understand what type of content you would like us to add to Cloud Academy, and we want to thank everyone who gave us their input. If you would like to complete the survey, it's not too late. It ...

Read more
  • AWS
  • Azure
  • blog digest
  • Certifications
  • Cloud Academy
  • OWASP
  • OWASP Top 10
  • Security
  • VPCs
Alisha Reyes
Alisha Reyes
— May 11, 2020

New Content: Alibaba, Azure Cert Prep: AI-100, AZ-104, AZ-204 & AZ-400, Amazon Athena Playground, Google Cloud Developer Challenge, and much more

This month, our Content Team released 8 new learning paths, 4 courses, 7 labs in real cloud environments, and 4 new knowledge check assessments. Not only that, but we introduced our very first course on Alibaba Cloud, and our expert instructors are working 'round the clock to create 6 n...

Read more
  • alibaba
  • AWS
  • Azure
  • gitops
  • Google Cloud Platform
  • lab playground
  • programming
Avatar
Rhonda Martinez
— May 4, 2020

Top 5 Reasons to Get AWS Certified Right Now

Cloud computing trends are on the rise and have been for some time already. Fortunately, it’s never too late to start learning cloud computing. Skills like AWS and others associated with cloud computing are in high demand because cloud technologies have become crucial for many businesse...

Read more
  • Amazon Elastic Book Store
  • Amazon Elastic Compute Cloud (EC2)
  • AWS
  • AWS Certifications
  • Glacier
Alisha Reyes
Alisha Reyes
— May 1, 2020

Introducing Our Newest Lab Environments: Lab Playgrounds

Want to train in a real cloud environment, but feel slowed down by spinning up your own deployments? When you consider security or pricing costs, it can be costly and challenging to get up to speed quickly for self-training. To solve this problem, Cloud Academy created a new suite of la...

Read more
  • AWS
  • Azure
  • Docker
  • Google Cloud Platform
  • Java
  • lab playgrounds
  • Python
Alisha Reyes
Alisha Reyes
— April 30, 2020

Blog Digest: AWS Breaking News, Azure DevOps, AWS Study Guide, 8 Ways to Prevent a Ransomware Attack, and More

  New articles by topicAWS Azure Data Science Google Cloud  Cloud Adoption Platform Updates & New Content Security Women in TechAWSBreaking News: All AWS Certification Exams Now Available Online As an Advanced AWS Technology Partner, C...

Read more
  • AWS
  • Azure
  • blog digest
  • Certifications
  • Cloud Academy
  • programming
  • Security
Avatar
Stuart Scott
— April 27, 2020

AWS Certified Solutions Architect Associate: A Study Guide

Want to take a really impactful step in your technical career? Explore the AWS Solutions Architect Associate certificate. Its new version (SAA-C02) was released on March 23, 2020, though you can still take SAA-C01 through July 1, 2020. This post will focus on version SAA-C02.The AWS...

Read more
  • AWS
  • AWS Certifications
  • AWS Certified Solutions Architect Associate
Alisha Reyes
Alisha Reyes
— April 9, 2020

New on Cloud Academy: AWS Solutions Architect Exam Prep, Azure Courses, GCP Engineer Exam Prep, Programming, and More

Free content on Cloud Academy More and more customers are relying on our technology and content to keep upskilling their people in these months, and we are doing our best to keep supporting them. While the world fights the COVID-19 pandemic, we wanted to make a small contribution to he...

Read more
  • AWS
  • Azure
  • Google Cloud Platform
  • programming
Joe Nemer
Joe Nemer
— April 3, 2020

Breaking News: All AWS Certification Exams Now Available Online

Remote proctoring for all AWS certifications Cloud Academy is an Advanced AWS Technology Partner, and we are happy to announce all AWS certification exams are available online!  What does this mean for you? You can stay focused on your certification goal. Or you can start a certifica...

Read more
  • AWS
  • AWS certification
  • AWS Certifications