Flashcards in this deck (77)

• What is AWS responsible for in the AWS Cloud infrastructure?

  Protecting the infrastructure that runs the services
  aws cloud security
• What is the customer responsible for in AWS services?

  Everything they decide to do with the services offered by AWS
  aws customer responsibility
• What should be considered when looking for solutions in AWS?

  Total cost of ownership
  aws solutions cost
• What is the Shared Responsibility Model in AWS?

  Division of responsibilities between AWS and the customer
  aws security model
• What are Security Certifications & Attestations in AWS?

  Independent assessments and attestations to provider's capacity for industry-specific workloads
  aws security certifications
• What is a certification in AWS Security Certifications & Attestations?

  Issued by an accredited specialized company, lasts 1-3 years, snapshot in time
  aws certification security
• What is an attestation in AWS Security Certifications & Attestations?

  Focuses on continuous implementation, attests evidence of appropriateness and effectiveness over time
  aws attestation security
• What is HIPAA/HITECH in AWS Security Certifications & Attestations?

  Certification for handling medical data
  aws hipaa security
• What is ISO/IEC 27001:2022 in AWS Security Certifications & Attestations?

  Security management standard specifying best practices for security controls
  aws iso/iec_27001 security
• What is FIPS 140-2 Level 3 in AWS Security Certifications & Attestations?

  U.S. government security standard for approving cryptographic modules
  aws fips_140-2 security
• What is Cloud Computing Compliance Controls Catalog (C5) in AWS Security Certifications & Attestations?

  German Government Backed attestation scheme by BSI
  aws c5 security
• What is the implication for cloud engineers in AWS regarding different services for the same tasks?

  Ensuring the entire application adheres to the required standard
  aws cloud_engineers services
• What does AWS IAM allow you to define in one central place?

  Who can access what
  aws iam access
• What does AWS IAM provide for defining access control?

  Roles, users, groups, policies (and resource policies)
  aws iam access_control
• What does AWS Identity and Access Management (IAM) focus on?

  Defining access control for AWS services
  aws iam access_control
• What does AWS IAM User EC2 provide access to?

  CLI, Web, SDKs
  aws iam access
• What does AWS IAM allow you to define?

  Who can access what in one central place
  aws iam access_control
• What components does AWS IAM provide for defining access control?

  Roles, users, groups, policies (and resource policies)
  aws iam components
• What can a user do with AWS IAM?

  Assume a role for temporary credentials
  aws iam temporary_credentials
• What is recommended when managing access with AWS IAM?

  Use temporary credentials
  aws iam best_practice
• What is the Principle of Least Privilege?

  Aim for providing minimal required permissions
  security access_control
• What tool can be used to iterate on permissions in AWS?

  AWS Policy Analyzer
  aws permissions tool
• How can user pools be federated with existing AD providers in AWS IAM?

  Through Identity Federation
  aws iam user_pools ad
• What does AWS CloudTrail allow you to monitor?

  Requests for resources in your account
  aws cloudtrail monitoring
• Why is splitting workloads into multiple accounts recommended?

  Provides security, access, and billing boundaries
  aws multi-account_setup security
• What are guardrails in AWS multi-account setups?

  Governance rules to enforce compliance
  aws guardrails compliance
• What are the two types of guardrails for enforcing compliance?

  Preventive and Detective
  compliance security
• What is implemented with Service Control Policies for preventive guardrails?

  Preventive guardrails
  aws security
• What allows consolidation of multiple accounts into organizational units and central management?

  AWS Organizations
  aws management
• What service allows central management of access to AWS accounts with temporary credentials?

  IAM Identity Center
  aws security
• What combines AWS Organizations with other services for multi-account setup management?

  AWS Control Tower
  aws management
• What should be enabled for users to enhance security?

  MFA
  security aws
• What are the requirements for secrets management?

  Centralized storage, fine-grained access control, encryption at rest and in transit, secret rotation, integration with other services
  security management
• What is a widespread authorization standard?

  OAuth 2.0
  security authorization
• Why is the implicit flow no longer considered safe?

  Security risks
  security oauth
• What is the authentication/authorization service that covers OAuth 2.0, OICD, and SAML standards?

  Cognito
  aws authentication
• What are some Authentication Authorization Standards mentioned in the text?

  OAuth 2.0, OICD, SAML
  security authentication authorization
• What is the current version of Apache Webserver Project mentioned in the text?

  v.2.4.59
  security webserver
• What is the purpose of Patch Management in the context of application security?

  To find and install patches to protect against vulnerabilities
  security patch_management
• What is Configuration Management responsible for ensuring?

  That the configuration of managed systems conforms to security requirements
  security configuration_management
• What service provided by AWS helps define configurations for managed nodes and reapply them automatically?

  Systems Manager
  aws configuration_management
• What is the recommended approach for managing configuration and deploying it together with the application or infrastructure?

  Configuration should be managed as code
  security configuration_management
• What is the advice given regarding patching of systems?

  Automate it
  security patch_management
• What are some tools mentioned for automated patch management in the software development life cycle?

  Dependabot, Renovate
  security patch_management software_development
• What does Data in Transit refer to in the context of encrypted communication?

  Data sent from A to B
  security encryption communication
• What is recommended to be used for encrypted communication to ensure secure data transfer?

  TLS
  security encryption communication
• What AWS service can be used to provision/manage certificates for AWS workloads?

  AWS Certificate Manager
  aws security encryption
• What does Encryption at Rest mean in terms of data protection?

  Storing data encrypted both at rest
  security encryption data_protection
• What is the central key management service used for Encryption at Rest in AWS?

  AWS KMS
  aws security encryption
• What is recommended for auditing key usage and implementing automated anomaly detection for Encryption at Rest?

  CloudTrail
  security encryption auditing
• What should be leveraged for fine-grained permission control to KMS keys in AWS?

  IAM
  aws security encryption
• What is the purpose of CloudTrail?

  Implement automated anomaly detection for auditory, regulatory, and compliance needs
  cloudtrail compliance auditory anomaly_detection
• How can IAM be leveraged for permission control to KMS keys?

  Fine grained permission control
  iam kms_keys permission_control
• What does the EU Datenschutzverordnung require by default?

  Datensparsamkeit
  eu_datenschutzverordnung compliance
• How long should data be archived for compliance reasons?

  10 years
  data_archiving compliance
• What are some AWS solutions for data protection and lifecycle management?

  S3 IA, S3 Glacier, Lifecycle policies, DDB TTL, Amazon Data Lifecycle Manager
  aws_solutions data_protection lifecycle_management
• What are the different types of DDoS attacks based on layers of the OSI model?

  Layer 7 attacks (exhaust target's resources), Layer 3 or 4 attacks (exhaust state of resources or network equipment), Volumetric attacks (consume all available bandwidth)
  ddos osi_model attacks
• What are some mitigation options for DDoS attacks?

  Blackhole routing, rate limiting, overprovisioning, building resilient applications with Firewalls and content delivery networks, AWS WAF, AWS Shield, Shield Advanced
  ddos mitigation security
• What is the concept of Zero Trust in network security?

  Consider each application and component as discrete entities, don't trust anyone on the network
  network_security zero_trust
• How are VPCs used to model networks in AWS?

  Logically separated virtual networks with specific IP address ranges, contain subnets for further isolation
  vpcs network_modeling aws
• Why is it recommended to have one subnet per availability zone?

  For redundancy and fault resilience
  subnet availability_zone redundancy
• What is the purpose of separating applications into separate subnets?

  For more fine-grained segmentation
  subnet segmentation networking
• What is the benefit of having multiple subnets spread throughout Availability Zones (Azs)?

  Better distribution of resources for redundancy and fault tolerance
  networking security
• How does using NAT Gateways enhance security in a network setup?

  Allows subnets to access the internet without exposing them directly via Route Tables
  networking security
• What is the purpose of VPC endpoints in AWS network security?

  Ensures private traffic to AWS resources without going through the internet
  aws networking
• What is the role of Flow logs in network security?

  Capture and monitor IP traffic for analysis and security auditing
  networking security
• What is Network Access Control Lists (NACL) in AWS?

  A control layer on the subnet/VPC level acting as a stateless firewall with inbound and outbound rules
  aws security
• How are rules evaluated in Network Access Control Lists (NACL)?

  In order, starting from the lowest numbered rule, with only the first matching rule being applied
  aws security
• What is the purpose of Security Groups in AWS network security?

  Provide fine-grained access control to AWS resources at the instance level
  aws security
• What is the key difference between NACLs and Security Groups in AWS?

  NACLs are subnet/VPC level controls, while Security Groups are instance level controls
  aws security
• How can you verify the accessibility and security of an application in AWS network setup?

  Use Reachability Analyzer, VPC Network Access Analyzer, and VPC Flow Logs for analysis and monitoring
  aws networking security
• What is the importance of combining network separation with account separation for security?

  Enhances security by adding multiple layers of protection and access control
  security best_practices
• What is the recommended approach for maintaining system security in AWS?

  Constantly monitor, analyze, and adapt security measures at all levels of the infrastructure
  aws security best_practices
• What is the significance of considering the total cost of ownership in system security?

  Maintenance costs can be unexpectedly high, so it's important to factor in all expenses including security measures
  security cost_management
• What is the advice regarding the use of managed services in maintaining system security?

  Prefer managed services to reduce operational overhead and ensure security updates are managed by experts
  security best_practices
• What is the importance of automation in maintaining system security?

  Automate security processes to reduce human errors and ensure consistent application of security policies
  security automation
• What should be ensured regarding compliance requirements in the technology stack?

  Ensure the entire technology stack adheres to compliance regulations and standards to avoid security breaches and penalties
  compliance security