hi a very good day to you and welcome to aws 101 my name is kwan and i'm a senior solutions architect from a worldwide public sector team and it is my pleasure to share with you the aws shared responsive model in five minutes we often hear from our customers if i am to have my applications running on the cloud will be automatically secured and complies to all the great security compliance centers in the industry well as perfect as it may sound the reality might not be much of that even in the cloud it is very
important for us to understand the roles and responsibilities between a cloud provider like aws as well as those of the customer only to this collaboration handshake we are able to ensure your applications and data are highly secured when they run on the cloud well okay great one i truly understand and agree with you about that notion where both of us have to have this great handshake right so that we can completely run our applications on your cloud safely but where do i start does aws provide a guidance on how to advise the customers of this
well the good news is we actually do in aws secrets drop zero by which we by which we mean it is even more important that any number one priority in aws security and card compliance is really a shared responsive model between aws and our customers in order for us to provide a prescriptive guidance to our customers on this topic aws has come up with a shared responsive model which provides a clear definition to firstly distinguish the scope and respond between our customers and aws as well as the guidance on how we are able to collaborate
with our customers to resolve those gaps through provided through our security offerings only with a complete coverage of those controls that spans across the scopes of responsibilities of both personas we are able to confidently ensure that your applications are secured and ready to comply to the stringent securities in security standards in the industry now let's dissect deeper into the shared responsibility model shall we now as you can see there's a clear distinction between what we can say as security in the cloud and what is secret of the cloud aws will be responsible for security of
the cloud such as the protecting the infrastructure that runs all the services offered in the aws cloud customers on the other hand will need to be responsible with security in the cloud which revolves around the secret of the applications that runs in the cloud so we've got the definition right let's draw deeper on what are the actual scope for each of these now erabrex is responsible for security of the cloud which means aws is responsible to protect the global infrastructure that runs all the services offered in the cloud this is composed of the hardware software
network as well as the facilities that runs all our services protecting this infrastructure is our number one priority what about customers customers is responsible for security in the cloud which refers to the security measures that customer implements and operates relations to the content of the applications customers retain control of security that they have implemented to protect their platform content applications systems and networks just as they do when you run their applications in your accessing on-prem data center that being said do take note the level of scope is also being determined by the aws service that
you use for example using a serverless or a managed service will have less scope to be defined compared to using a virtual machine such as an easy to instance for example let us take a signature scenario where you have a web applications that runs ec2 over the oracle rds using s3 to store document and files a survey such as the amazon elastic compute cloud or ec2 requests customer to perform all the necessary configurations and management tasks customer that deployed ec2 instances are responsible for management of the guest operating systems which includes patches as well as
any application software or utilities that you installed on the instances itself and of course the configurations of the firewall for each of the instances for abstracted or managed services such as amazon s3 or amazon rds the fact that aws operates the infrastructure layer as well as the os and platform customers access only the endpoints to store and retrieve the data in this case customer is only responsible for managing their data which includes specifying the assets as well as using the int tools to apply the appropriate permissions so we have really gone through the fundamentals of
shared responsive mode we have carved out the scopes and responses of the relevant parties within the cloud now let us spend some time to do a quick knowledge check of our understanding of the shared responsive model shall we so the first one configuring the security groups that determine which ports are to open during uh for each of the ec2 linux instance so for those who have chosen customer responsibility you're right what about preventing packet sniffing at the hypervisor layer so the fact that this is under the hypervisor layer that means that this should be security
of the cloud what about patching the gas operating systems with the latest signature patches well this should be security in the cloud which falls under customers so what about shredding this drive before they leave for data center now this literally revolves around physical hardware right so that should be under the jurisdiction or responsibility of aws the same goes with securing the internal network within aws data center now what about installing cctv to monitor the physical data center again this are relevant to the data center security right so that should be a responsive of aws and
lastly toggling on the server-side encryption features for all the s3 buckets now this is specific to encryption of the workloads that runs within aws so in essence this should be the response rate of the customer because you as a customer will define what is the encryption policy that you want to implement for the funds and documents is being stored in your environment so we literally have gone through a brief overview of the shared responding model so for our dear customers who are keen to get more understanding about this topic kindly do visit the landing page
to the url provided here we hope that we are able to provide some valuable information to you on this topic and we look forward to see you soon thank you very much and that is shared responsive model in five minutes you
