1 00:00:06,730 --> 00:00:07,780 - Let's talk a little bit 2 00:00:07,780 --> 00:00:10,540 about the shared responsibility model. 3 00:00:10,540 --> 00:00:12,430 Now, this is nothing new. 4 00:00:12,430 --> 00:00:14,670 This is something that vendors have had 5 00:00:14,670 --> 00:00:17,060 in place for a long time. 6 00:00:17,060 --> 00:00:19,670 And it represents a sort of agreement 7 00:00:19,670 --> 00:00:24,000 between a provider and a customer. 8 00:00:24,000 --> 00:00:26,270 And in the context of AWS, 9 00:00:26,270 --> 00:00:31,050 it's gonna help us understand who takes responsibility 10 00:00:31,050 --> 00:00:34,680 for the ownership of different parts 11 00:00:34,680 --> 00:00:38,470 of the infrastructure, the services, the features, 12 00:00:38,470 --> 00:00:42,613 and resources that are launched into the AWS ecosystem. 13 00:00:43,970 --> 00:00:45,750 And so first let's talk a little bit 14 00:00:45,750 --> 00:00:48,150 about the AWS side of it. 15 00:00:48,150 --> 00:00:52,480 Now, Amazon Web Services are going to be responsible 16 00:00:52,480 --> 00:00:56,503 for the security of the cloud itself. 17 00:00:57,650 --> 00:00:59,290 So what does this mean? 18 00:00:59,290 --> 00:01:02,960 This is going to be the underlying infrastructure 19 00:01:02,960 --> 00:01:07,370 from data centers and physical locations 20 00:01:07,370 --> 00:01:10,810 through the individual bits and pieces of hardware 21 00:01:10,810 --> 00:01:12,990 that make up those data centers. 22 00:01:12,990 --> 00:01:17,990 Servers, storage, network hardware and so forth. 23 00:01:18,860 --> 00:01:22,910 They're gonna be responsible for the physical protection 24 00:01:22,910 --> 00:01:25,840 of those data centers and making sure that access 25 00:01:25,840 --> 00:01:29,363 is only granted when it is absolutely required. 26 00:01:30,835 --> 00:01:32,500 AWS is going to be responsible 27 00:01:32,500 --> 00:01:36,860 for all of the service API endpoints and securing those. 28 00:01:36,860 --> 00:01:40,354 And they're responsible for the assurance 29 00:01:40,354 --> 00:01:45,354 that when you issue a command or request a task 30 00:01:45,360 --> 00:01:49,140 be performed through those service API endpoints, 31 00:01:49,140 --> 00:01:52,603 that it is executed faithfully by the service. 32 00:01:54,730 --> 00:01:57,450 The customer is not left out. 33 00:01:57,450 --> 00:02:01,283 The customer also has a share of this responsibility. 34 00:02:02,240 --> 00:02:07,200 And so from the customer perspective, you, me, us, 35 00:02:07,200 --> 00:02:11,370 we are responsible for the security in the cloud 36 00:02:11,370 --> 00:02:13,260 and there's a difference between security 37 00:02:13,260 --> 00:02:15,343 of the cloud and security in the cloud. 38 00:02:16,410 --> 00:02:19,870 The customer is going to be responsible for the security 39 00:02:19,870 --> 00:02:23,461 of the individual resources that they provision 40 00:02:23,461 --> 00:02:26,193 within their various AWS accounts. 41 00:02:27,230 --> 00:02:30,750 And this includes a lot of different layers, 42 00:02:30,750 --> 00:02:34,000 depending on the type of service that you're using. 43 00:02:34,000 --> 00:02:36,201 If you are using an infrastructure service 44 00:02:36,201 --> 00:02:41,201 like a VPC network or a virtual machine in EC2, 45 00:02:42,670 --> 00:02:45,880 you as the customer are going to have a higher degree 46 00:02:45,880 --> 00:02:49,660 of responsibility over securing that resource 47 00:02:49,660 --> 00:02:51,540 than if you use something that is closer 48 00:02:51,540 --> 00:02:55,110 to a SAS offering, software as a service 49 00:02:55,110 --> 00:02:59,150 like an S3 bucket or a dynamo DB table. 50 00:02:59,150 --> 00:03:00,944 Now, one thing to be clear is 51 00:03:00,944 --> 00:03:04,840 that the customer always owns their data 52 00:03:05,890 --> 00:03:08,900 and that the data is always private, 53 00:03:08,900 --> 00:03:10,530 regardless of the service, 54 00:03:10,530 --> 00:03:14,993 unless the customer explicitly shares it publicly. 55 00:03:17,010 --> 00:03:18,470 Now, the next thing we need to talk about 56 00:03:18,470 --> 00:03:21,370 within the shared responsibility model is ownership 57 00:03:21,370 --> 00:03:23,730 of IT controls. 58 00:03:23,730 --> 00:03:26,160 And so these are going to be tasks that need 59 00:03:26,160 --> 00:03:31,160 to be regularly performed, audited, and assured 60 00:03:31,330 --> 00:03:33,540 that they are being performed. 61 00:03:33,540 --> 00:03:37,600 And so this is going to have a bit of a spectrum 62 00:03:37,600 --> 00:03:39,453 as far as responsibility as well. 63 00:03:40,320 --> 00:03:42,570 And so we start off here on the left with AWS 64 00:03:43,622 --> 00:03:46,780 and AWS is going to be responsible 65 00:03:46,780 --> 00:03:51,100 for certain actions like physically securing 66 00:03:51,100 --> 00:03:55,970 the facilities that AWS data centers are operating in. 67 00:03:55,970 --> 00:03:59,510 They're responsible for everything from air conditioning 68 00:03:59,510 --> 00:04:03,020 to redundant power and so forth. 69 00:04:03,020 --> 00:04:07,513 All of that underlying infrastructure that makes AWS work. 70 00:04:09,750 --> 00:04:13,429 There's a middle ground where both AWS 71 00:04:13,429 --> 00:04:17,890 and the customer share some of these controls. 72 00:04:17,890 --> 00:04:20,831 And here's an excellent example. 73 00:04:20,831 --> 00:04:24,853 AWS deploys actual servers into the data centers. 74 00:04:25,870 --> 00:04:30,870 There is an AWS owned control to manage that hardware. 75 00:04:32,720 --> 00:04:37,720 There is a shared control where AWS is responsible 76 00:04:38,160 --> 00:04:41,930 for the patch management of the hypervisor 77 00:04:41,930 --> 00:04:44,140 that runs on that hardware. 78 00:04:44,140 --> 00:04:47,324 And then the customer is gonna share some of that 79 00:04:47,324 --> 00:04:50,800 by being responsible for the patch management 80 00:04:50,800 --> 00:04:53,060 of the virtual machines that actually run 81 00:04:53,060 --> 00:04:56,170 on top of that hypervisor. 82 00:04:56,170 --> 00:04:59,871 And so these shared controls are going to apply 83 00:04:59,871 --> 00:05:03,710 to both the provider and the customer 84 00:05:03,710 --> 00:05:05,533 but in different contexts. 85 00:05:07,680 --> 00:05:10,990 And finally we have the customer controls, 86 00:05:10,990 --> 00:05:12,800 and this is where the customer gets 87 00:05:12,800 --> 00:05:16,133 to make explicit choices about where 88 00:05:16,133 --> 00:05:19,320 and how to deploy their workloads, 89 00:05:19,320 --> 00:05:23,810 where AWS makes these choices available. 90 00:05:23,810 --> 00:05:27,570 But it is up to the customer to actually choose them based 91 00:05:27,570 --> 00:05:30,549 on their own requirements, like which regions are going 92 00:05:30,549 --> 00:05:34,049 to be used, or which services or features 93 00:05:34,049 --> 00:05:36,073 are going to be opted into. 94 00:05:37,320 --> 00:05:40,960 Now, this final diagram shows a little bit more 95 00:05:40,960 --> 00:05:44,426 of the big picture around the specific tasks 96 00:05:44,426 --> 00:05:49,426 that are split up between the customer and AWS. 97 00:05:50,340 --> 00:05:53,060 And you can see here, we have listed customer 98 00:05:53,060 --> 00:05:56,160 at the top where you own your data. 99 00:05:56,160 --> 00:06:00,080 You own the OS network and firewall configuration. 100 00:06:00,080 --> 00:06:02,487 You're responsible for configuration 101 00:06:02,487 --> 00:06:05,363 of encryption of data and so forth. 102 00:06:06,200 --> 00:06:09,410 And then on the bottom, we've got AWS responsible 103 00:06:09,410 --> 00:06:11,640 for the security of the cloud itself 104 00:06:11,640 --> 00:06:15,150 and we have the hardware here, different regions, 105 00:06:15,150 --> 00:06:18,090 availability zones, service API endpoints, 106 00:06:18,090 --> 00:06:21,090 as well as the underlying structure 107 00:06:21,090 --> 00:06:22,860 that makes up the different services 108 00:06:22,860 --> 00:06:27,423 for compute, network, storage, and database.