Information Security with AWS DevOps

In 2013, the blacklist of spammers and hackers, Spamhaus, experienced an ironic twist of fate when it became the target of one of the biggest DDoS-attacks ever. And this is not the only time that security measures turned out to be insufficient. Specialized security companies make grandiose promises, yet the majority fail in the end.

Cloud computing approaches stand apart from other solutions. It’s hard to find anyone out there who would argue their disadvantages. AWS DevOps is a growing household name for distinguishing itself as a foremost solution, especially when it comes to information security.



Let’s look at their services to determine whether your business should try it.

Before we talk about AWS security practices, we should understand what AWS and DevOps are.

“DevOps is the combination of cultural philosophies, practices, and tools that increases an organization’s ability to deliver applications and services at high velocity: evolving and improving products at a faster pace than organizations using traditional software development and infrastructure management processes.” - AWS Website

AWS DevOps is a set of methods and tools targeted towards successful implementation of Amazon services and DevOps practices. Among them, security practices stand out with an extensive range of options.

It would be misleading to suggest AWS DevOps has invented something entirely brand-new in the world of information security. However, it would still be a mistake to underestimate its contributions in this field. The approach they've created and utilize optimizes all the known processes. It is realized through two dimensions of the AWS hybrid cloud:

1.Private cloud is the infrastructure designed for use of one organization. All services are included within the infrastructure and communicate inside of inner net. The client is not able to access this network. That is, no one is able to see the state of your infrastructure. Failing to safeguard your information results in increased vulnerability, making it simple for violators to misuse your data.

2.Public cloud is the infrastructure intended for free use by the general public. When working with a public service, users are provided with API along with authorization for a certain IP. For this, SSL (Secure Sockets Layer) certificates are used. And it doesn’t matter whether it’s a database connection or API access, it must be protected. The main thing is data and backup encryption to safeguard the data.



In this way, the trend of global security is realized.

Let’s imagine that your project is situated in Ohio, and your client is in Ireland. They use different virtual VPCs (Virtual Private Cloud), that is, they work in different regions thus different networks. With the help of AWS, you can create a connection between these two networks. In doing this, you wouldn't have to think about routing, administer VPN, or hire additional specialists, unless you need experts to come to grips with AWS security services.

In just a few minutes, the K&C team can set up a secure channel between two organizations: yours and whichever other you choose. With this connection, both parties would be able to  access each other’s services and management. All data circulates between these organisations’ VPC -- nowhere else. That is why the AWS setup process is flexible and secure.

Setting up an average infrastructure in a data center  would take about 40 minutes to adjust the server, and an additional 2 hours to install software. But with AWS, all this would take no more than 20 minutes.

If your server breaks, your first thought would be to buy a new one and migrate data from a backup. With AWS, you wouldn't even notice that your server or database is out of order. This is due to out-of-box monitoring, self-healing function, and autoscaling. Autoscaling is performed when your processor is overloaded longer than three minutes, in cases of overly high traffic on load balancer, etc.

Accessibility from different regions. AWS believes in the idea of divided areas (somehow similar to the tenets of microservice architecture), where America, Europe, Asia do not depend upon each other. AWS has centers in every region. Thus, if a tsunami were to  happen in America, the Asian region would function unimpeded. Something extraordinary would have to happen to destroy the whole network. Your data will always be safe.

Virtual private cloud (VPC). The infrastructure security is defined by VPC, built-in security groups, plus load balancers. With their help, it is possible to restrict/permit access through IP-addresses. For example, if you noticed someone committed DDoS-attack on your system, you would be able to determine their IP and ban them.

CloudWatch. This service helps monitor all resources and applications that function on AWS, their performance, and health of the system. CloudWatch can check EC2 instances, DynamoDB tables, Custom Metrics, and many more. Also, the service notifies you in case something went out of order and enables you to create graphs of AWS resources.

Amazon Shield. It safeguards a website or an application from the most common DDoS-attacks. The advantage is that Amazon Shield detects and blocks unwanted requests automatically. There are two types of protection depending on the needed level of protection. Both are quite cost efficient.

CloudFront. Being a content delivery network (CDN), this service is designed to deliver content most safely. It’s integrated with Amazon Shield, AWS WAF and executed following  PCI DSS, HIPAA and ISO to guarantee the most secure delivery of proprietary information.

AWS WorkSpaces Application Manager Documentation (WAM). This service offers a secure approach to manage and deploy applications in regard to Amazon WorkSpaces.

AWS Identity and Access Management (IAM). This service acts just like Google Docs, allowing you  to share access to a doc or restrict it to  read-only mode. It does not require you  to give access or supply a password key.

The best way to safeguard your project

We have firsthand experience in the field of information security. The K&C team has created a universal approach to guarantee the safety of your data.

To best serve the client, the first thing we do is listen to their thoughts and ideas, then determine how best they can be implemented.

However, if we know from our experience that there are better options the client hasn't considered, we would propose alternatives based on the project’s needs.

For instance, one of our clients reached out to us with the request to build new infrastructure similar to Heroku (which was implemented at that moment). When we offered them a different approach that we felt would be more appropriate, they agreed to it. The reason: we presented them with a more effective possibility they hadn't even thought of.

Nevertheless, if a client has a vivid understanding of precisely what they want, we would never force our point of view. At K&C, we always strive to be one team with our clients to meet their boldest expectations, whether it’s tough deadlines or niche knowledge.