1
00:00:06,730 --> 00:00:07,780
- Let's talk a little bit

2
00:00:07,780 --> 00:00:10,540
about the shared responsibility model.

3
00:00:10,540 --> 00:00:12,430
Now, this is nothing new.

4
00:00:12,430 --> 00:00:14,670
This is something that vendors have had

5
00:00:14,670 --> 00:00:17,060
in place for a long time.

6
00:00:17,060 --> 00:00:19,670
And it represents a sort of agreement

7
00:00:19,670 --> 00:00:24,000
between a provider and a customer.

8
00:00:24,000 --> 00:00:26,270
And in the context of AWS,

9
00:00:26,270 --> 00:00:31,050
it's gonna help us understand
who takes responsibility

10
00:00:31,050 --> 00:00:34,680
for the ownership of different parts

11
00:00:34,680 --> 00:00:38,470
of the infrastructure, the
services, the features,

12
00:00:38,470 --> 00:00:42,613
and resources that are launched
into the AWS ecosystem.

13
00:00:43,970 --> 00:00:45,750
And so first let's talk a little bit

14
00:00:45,750 --> 00:00:48,150
about the AWS side of it.

15
00:00:48,150 --> 00:00:52,480
Now, Amazon Web Services
are going to be responsible

16
00:00:52,480 --> 00:00:56,503
for the security of the cloud itself.

17
00:00:57,650 --> 00:00:59,290
So what does this mean?

18
00:00:59,290 --> 00:01:02,960
This is going to be the
underlying infrastructure

19
00:01:02,960 --> 00:01:07,370
from data centers and physical locations

20
00:01:07,370 --> 00:01:10,810
through the individual
bits and pieces of hardware

21
00:01:10,810 --> 00:01:12,990
that make up those data centers.

22
00:01:12,990 --> 00:01:17,990
Servers, storage, network
hardware and so forth.

23
00:01:18,860 --> 00:01:22,910
They're gonna be responsible
for the physical protection

24
00:01:22,910 --> 00:01:25,840
of those data centers and
making sure that access

25
00:01:25,840 --> 00:01:29,363
is only granted when it
is absolutely required.

26
00:01:30,835 --> 00:01:32,500
AWS is going to be responsible

27
00:01:32,500 --> 00:01:36,860
for all of the service API
endpoints and securing those.

28
00:01:36,860 --> 00:01:40,354
And they're responsible for the assurance

29
00:01:40,354 --> 00:01:45,354
that when you issue a
command or request a task

30
00:01:45,360 --> 00:01:49,140
be performed through those
service API endpoints,

31
00:01:49,140 --> 00:01:52,603
that it is executed
faithfully by the service.

32
00:01:54,730 --> 00:01:57,450
The customer is not left out.

33
00:01:57,450 --> 00:02:01,283
The customer also has a
share of this responsibility.

34
00:02:02,240 --> 00:02:07,200
And so from the customer
perspective, you, me, us,

35
00:02:07,200 --> 00:02:11,370
we are responsible for
the security in the cloud

36
00:02:11,370 --> 00:02:13,260
and there's a difference between security

37
00:02:13,260 --> 00:02:15,343
of the cloud and security in the cloud.

38
00:02:16,410 --> 00:02:19,870
The customer is going to be
responsible for the security

39
00:02:19,870 --> 00:02:23,461
of the individual resources
that they provision

40
00:02:23,461 --> 00:02:26,193
within their various AWS accounts.

41
00:02:27,230 --> 00:02:30,750
And this includes a lot
of different layers,

42
00:02:30,750 --> 00:02:34,000
depending on the type of
service that you're using.

43
00:02:34,000 --> 00:02:36,201
If you are using an infrastructure service

44
00:02:36,201 --> 00:02:41,201
like a VPC network or a
virtual machine in EC2,

45
00:02:42,670 --> 00:02:45,880
you as the customer are
going to have a higher degree

46
00:02:45,880 --> 00:02:49,660
of responsibility over
securing that resource

47
00:02:49,660 --> 00:02:51,540
than if you use something that is closer

48
00:02:51,540 --> 00:02:55,110
to a SAS offering, software as a service

49
00:02:55,110 --> 00:02:59,150
like an S3 bucket or a dynamo DB table.

50
00:02:59,150 --> 00:03:00,944
Now, one thing to be clear is

51
00:03:00,944 --> 00:03:04,840
that the customer always owns their data

52
00:03:05,890 --> 00:03:08,900
and that the data is always private,

53
00:03:08,900 --> 00:03:10,530
regardless of the service,

54
00:03:10,530 --> 00:03:14,993
unless the customer
explicitly shares it publicly.

55
00:03:17,010 --> 00:03:18,470
Now, the next thing we need to talk about

56
00:03:18,470 --> 00:03:21,370
within the shared responsibility
model is ownership

57
00:03:21,370 --> 00:03:23,730
of IT controls.

58
00:03:23,730 --> 00:03:26,160
And so these are going
to be tasks that need

59
00:03:26,160 --> 00:03:31,160
to be regularly performed,
audited, and assured

60
00:03:31,330 --> 00:03:33,540
that they are being performed.

61
00:03:33,540 --> 00:03:37,600
And so this is going to
have a bit of a spectrum

62
00:03:37,600 --> 00:03:39,453
as far as responsibility as well.

63
00:03:40,320 --> 00:03:42,570
And so we start off here
on the left with AWS

64
00:03:43,622 --> 00:03:46,780
and AWS is going to be responsible

65
00:03:46,780 --> 00:03:51,100
for certain actions
like physically securing

66
00:03:51,100 --> 00:03:55,970
the facilities that AWS data
centers are operating in.

67
00:03:55,970 --> 00:03:59,510
They're responsible for
everything from air conditioning

68
00:03:59,510 --> 00:04:03,020
to redundant power and so forth.

69
00:04:03,020 --> 00:04:07,513
All of that underlying
infrastructure that makes AWS work.

70
00:04:09,750 --> 00:04:13,429
There's a middle ground where both AWS

71
00:04:13,429 --> 00:04:17,890
and the customer share
some of these controls.

72
00:04:17,890 --> 00:04:20,831
And here's an excellent example.

73
00:04:20,831 --> 00:04:24,853
AWS deploys actual servers
into the data centers.

74
00:04:25,870 --> 00:04:30,870
There is an AWS owned control
to manage that hardware.

75
00:04:32,720 --> 00:04:37,720
There is a shared control
where AWS is responsible

76
00:04:38,160 --> 00:04:41,930
for the patch management of the hypervisor

77
00:04:41,930 --> 00:04:44,140
that runs on that hardware.

78
00:04:44,140 --> 00:04:47,324
And then the customer is
gonna share some of that

79
00:04:47,324 --> 00:04:50,800
by being responsible
for the patch management

80
00:04:50,800 --> 00:04:53,060
of the virtual machines that actually run

81
00:04:53,060 --> 00:04:56,170
on top of that hypervisor.

82
00:04:56,170 --> 00:04:59,871
And so these shared
controls are going to apply

83
00:04:59,871 --> 00:05:03,710
to both the provider and the customer

84
00:05:03,710 --> 00:05:05,533
but in different contexts.

85
00:05:07,680 --> 00:05:10,990
And finally we have the customer controls,

86
00:05:10,990 --> 00:05:12,800
and this is where the customer gets

87
00:05:12,800 --> 00:05:16,133
to make explicit choices about where

88
00:05:16,133 --> 00:05:19,320
and how to deploy their workloads,

89
00:05:19,320 --> 00:05:23,810
where AWS makes these choices available.

90
00:05:23,810 --> 00:05:27,570
But it is up to the customer
to actually choose them based

91
00:05:27,570 --> 00:05:30,549
on their own requirements,
like which regions are going

92
00:05:30,549 --> 00:05:34,049
to be used, or which services or features

93
00:05:34,049 --> 00:05:36,073
are going to be opted into.

94
00:05:37,320 --> 00:05:40,960
Now, this final diagram
shows a little bit more

95
00:05:40,960 --> 00:05:44,426
of the big picture
around the specific tasks

96
00:05:44,426 --> 00:05:49,426
that are split up between
the customer and AWS.

97
00:05:50,340 --> 00:05:53,060
And you can see here,
we have listed customer

98
00:05:53,060 --> 00:05:56,160
at the top where you own your data.

99
00:05:56,160 --> 00:06:00,080
You own the OS network and
firewall configuration.

100
00:06:00,080 --> 00:06:02,487
You're responsible for configuration

101
00:06:02,487 --> 00:06:05,363
of encryption of data and so forth.

102
00:06:06,200 --> 00:06:09,410
And then on the bottom,
we've got AWS responsible

103
00:06:09,410 --> 00:06:11,640
for the security of the cloud itself

104
00:06:11,640 --> 00:06:15,150
and we have the hardware
here, different regions,

105
00:06:15,150 --> 00:06:18,090
availability zones, service API endpoints,

106
00:06:18,090 --> 00:06:21,090
as well as the underlying structure

107
00:06:21,090 --> 00:06:22,860
that makes up the different services

108
00:06:22,860 --> 00:06:27,423
for compute, network,
storage, and database.
