Podcast
Questions and Answers
In the AWS shared responsibility model, which of the following is primarily the customer's responsibility?
In the AWS shared responsibility model, which of the following is primarily the customer's responsibility?
- Managing and securing the operating system of EC2 instances. (correct)
- Securing the underlying hardware of AWS data centers.
- Ensuring network resilience across availability zones.
- Physical security of AWS facilities.
Which of the following design principles is MOST relevant to ensuring continuous monitoring and alerting of security-related events in a data pipeline?
Which of the following design principles is MOST relevant to ensuring continuous monitoring and alerting of security-related events in a data pipeline?
- Automate security best practices.
- Prepare for security events. (correct)
- Apply security at all layers.
- Implement a strong identity foundation.
Which access management principle focuses on granting only the essential permissions required to perform a specific task?
Which access management principle focuses on granting only the essential permissions required to perform a specific task?
- Authorization
- Authentication
- Principle of least privilege (correct)
- Role-based access control (RBAC)
What is the primary function of AWS Identity and Access Management (IAM)?
What is the primary function of AWS Identity and Access Management (IAM)?
When implementing data security, what is the PRIMARY difference between 'data at rest' and 'data in transit'?
When implementing data security, what is the PRIMARY difference between 'data at rest' and 'data in transit'?
AWS Key Management Service (KMS) uses Hardware Security Modules (HSMs) to protect your keys. What does this protect against?
AWS Key Management Service (KMS) uses Hardware Security Modules (HSMs) to protect your keys. What does this protect against?
Why is logging and monitoring crucial for maintaining data security in AWS?
Why is logging and monitoring crucial for maintaining data security in AWS?
What is the primary purpose of AWS CloudTrail?
What is the primary purpose of AWS CloudTrail?
Which of the following best describes the capabilities of Amazon CloudWatch?
Which of the following best describes the capabilities of Amazon CloudWatch?
What is the main takeaway regarding access management and the 'principle of least privilege'?
What is the main takeaway regarding access management and the 'principle of least privilege'?
What is the recommended first step when classifying and protecting data in analytics workloads?
What is the recommended first step when classifying and protecting data in analytics workloads?
When controlling data access in analytics workloads, what is the PRIMARY responsibility of data owners?
When controlling data access in analytics workloads, what is the PRIMARY responsibility of data owners?
What is crucial to implement regarding security to workload infrastructure?
What is crucial to implement regarding security to workload infrastructure?
In a stream processing pipeline, what should happen to data classifications?
In a stream processing pipeline, what should happen to data classifications?
An organization wants to set up automated notifications whenever there are unusual access patterns to sensitive data stored in Amazon S3. Which AWS service would be MOST suitable for this purpose?
An organization wants to set up automated notifications whenever there are unusual access patterns to sensitive data stored in Amazon S3. Which AWS service would be MOST suitable for this purpose?
A company needs to ensure that all data transferred to and from their Amazon S3 buckets is encrypted. What is the MOST efficient way to achieve this?
A company needs to ensure that all data transferred to and from their Amazon S3 buckets is encrypted. What is the MOST efficient way to achieve this?
A data engineer is tasked with creating an audit trail for all API calls made within their AWS account. Which AWS service should they use?
A data engineer is tasked with creating an audit trail for all API calls made within their AWS account. Which AWS service should they use?
An organization wants to enforce multi-factor authentication (MFA) for all IAM users accessing the AWS Management Console. How can they achieve this?
An organization wants to enforce multi-factor authentication (MFA) for all IAM users accessing the AWS Management Console. How can they achieve this?
A company is designing a data pipeline that involves processing sensitive customer data. Which of the following security measures is MOST important to implement?
A company is designing a data pipeline that involves processing sensitive customer data. Which of the following security measures is MOST important to implement?
A security engineer needs to ensure that only authorized applications can access an Amazon RDS database instance. How can this be achieved?
A security engineer needs to ensure that only authorized applications can access an Amazon RDS database instance. How can this be achieved?
You need to monitor the CPU utilization of an EC2 instance and receive an alert if it exceeds 80%. Which AWS service should you use?
You need to monitor the CPU utilization of an EC2 instance and receive an alert if it exceeds 80%. Which AWS service should you use?
Which of the following is a key aspect of a data security plan?
Which of the following is a key aspect of a data security plan?
What is the primary purpose of AWS KMS?
What is the primary purpose of AWS KMS?
Which of the following is an example of client-side encryption?
Which of the following is an example of client-side encryption?
What is the purpose of federated identity management?
What is the purpose of federated identity management?
What type of action should be taken in response to unauthorized access of your AWS account?
What type of action should be taken in response to unauthorized access of your AWS account?
What is the correct order to undertake operations to protect data?
What is the correct order to undertake operations to protect data?
What is the AWS service that can allow you to monitor changes of infrastructure?
What is the AWS service that can allow you to monitor changes of infrastructure?
What is the first step to building and maintaining a secure and robust data pipeline?
What is the first step to building and maintaining a secure and robust data pipeline?
In AWS, which service helps you to manage encryption keys?
In AWS, which service helps you to manage encryption keys?
Which of the below is the best practice to follow for the access and use of data?
Which of the below is the best practice to follow for the access and use of data?
How can you monitor the logs on AWS?
How can you monitor the logs on AWS?
Which service is the primary AWS soluton for logging activity?
Which service is the primary AWS soluton for logging activity?
Logging and monitoring can help maintain compliance with?
Logging and monitoring can help maintain compliance with?
To ensure compliance and protect sensitive information, what is one thing you should share downstream when accessing data?
To ensure compliance and protect sensitive information, what is one thing you should share downstream when accessing data?
Which AWS service can assist in enabling governance and compliance as well as operational and risk auditing of your AWS account?
Which AWS service can assist in enabling governance and compliance as well as operational and risk auditing of your AWS account?
Which action allows for the most secure environment?
Which action allows for the most secure environment?
Which can AWS CloudTrail record?
Which can AWS CloudTrail record?
In AWS, what is 'data at rest'?
In AWS, what is 'data at rest'?
Flashcards
Module Objective
Module Objective
Highlight cloud security best practices for analytics and ML data pipelines.
Module Objective
Module Objective
List AWS services that secure a data pipeline.
Module Objective
Module Objective
Describe how IaC supports data pipeline security and scalability.
Module Objective
Module Objective
Signup and view all the flashcards
Customer responsibility
Customer responsibility
Signup and view all the flashcards
AWS responsibility
AWS responsibility
Signup and view all the flashcards
Customer Security Examples
Customer Security Examples
Signup and view all the flashcards
AWS Security Examples
AWS Security Examples
Signup and view all the flashcards
Data security principle
Data security principle
Signup and view all the flashcards
Data security principle
Data security principle
Signup and view all the flashcards
Data security principle
Data security principle
Signup and view all the flashcards
Data security principle
Data security principle
Signup and view all the flashcards
Data security principle
Data security principle
Signup and view all the flashcards
Data security principle
Data security principle
Signup and view all the flashcards
Data security principle
Data security principle
Signup and view all the flashcards
Authentication
Authentication
Signup and view all the flashcards
Authorization
Authorization
Signup and view all the flashcards
Principle of Least Privilege
Principle of Least Privilege
Signup and view all the flashcards
AWS IAM
AWS IAM
Signup and view all the flashcards
AWS KMS
AWS KMS
Signup and view all the flashcards
Logging
Logging
Signup and view all the flashcards
Monitoring
Monitoring
Signup and view all the flashcards
AWS CloudTrail
AWS CloudTrail
Signup and view all the flashcards
Amazon CloudWatch
Amazon CloudWatch
Signup and view all the flashcards
Data at Rest
Data at Rest
Signup and view all the flashcards
Data in Transit
Data in Transit
Signup and view all the flashcards
Data at rest protection
Data at rest protection
Signup and view all the flashcards
Data at rest protection
Data at rest protection
Signup and view all the flashcards
Data in transit protection
Data in transit protection
Signup and view all the flashcards
Analytic workloads principle
Analytic workloads principle
Signup and view all the flashcards
Analytic workloads principle
Analytic workloads principle
Signup and view all the flashcards
Study Notes
- Cloud security best practices apply to analytics and machine learning (ML) data pipelines
- AWS services play key roles in securing a data pipeline
- Infrastructure as Code (IaC) supports the security and scalability of a data pipeline infrastructure
- Identify the function of common AWS CloudFormation template sections
AWS Well-Architected Framework: Security
- Security is a component of theAWS Well-Architected Framework
- Operational Excellence is a component of theAWS Well-Architected Framework
- Reliability is a component of theAWS Well-Architected Framework
- Performance Efficiency is a component of theAWS Well-Architected Framework
- Cost Optimization is a component of theAWS Well-Architected Framework
- Sustainabilty is a component of theAWS Well-Architected Framework
Shared Responsibility Model
- Customer responsibilities in the cloud include securing customer data, managing platforms, applications, identity, and access, and configuring the operating system, network, and firewalls
- Customer is responsible for client-side data encryption, data integrity, and authentication
- Customer is responsible for server-side encryption (file system and data)
- Customer is responsible for networking traffic protection (encryption, integrity, and identity)
- AWS responsibilities include providing foundation services like compute, storage, and databases
- AWS is responsible for networking, global infrastructure, including Regions, Availability Zones, and Edge Locations
Design Principles for Data Security
- Implement a strong identity foundation
- Enable traceability
- Apply security at all layers
- Automate security best practices
- Protect data in transit and at rest
- Keep people away from data
- Prepare for security events
Access management
- Authentication uses credentials to establish the identity of the requestor
- Authentication grants or denies access to resources based on identity
- Authentication utilities usernames, passwords, and multi-factor authentication (MFA) among other methods
- Authorization takes place only after authentication
- Authorization determines the level of access that an identity has to a resource
- Authorization methods include attribute-based access control (ABAC) and role-based access control (RBAC)
- Principle of least privilege grants only the permissions that are required to perform a task
- Users should start with a minimum set of permissions
- Grant additional permissions as necessary
- Revoke unnecessary permissions
AWS Identity and Access Management (IAM)
- Enables securely sharing and controlling access to AWS resources for individuals and groups
- Integrates with most AWS Services
- Supports federated identity management
- Supports granular permissions
- Supports MFA
- Provides identity information for information assurance and compliance audits
Data Security
- Data at rest persists in nonvolatile storage for any duration
- Enforce access control policies for data at rest
- Audit the use of encryption keys for data at rest
- Implement secure key management for data at rest
- Enforce encryption at rest
- Automate data-at-rest protection
- Audit data access logs
- Apply mechanisms to keep people away from data
- Data in transit is data that is sent from one system to another
- Implement secure key and certificate management for data in transit
- Enforce encryption in transit
- Authenticate network communications for data in transit
- Automate detection of unintended data access for data in transit
- Secure data from between VPC or on-premises locations
AWS Key Management Service (AWS KMS)
- The AWS Key Management Service AWS KMS creates and manages cryptographic keys
- It utilizes hardware security modules (HSMs) to protect keys
- Is integrated with other AWS services
- Allows setting usage policies to determine which users can use which keys
Logging and monitoring
- Logging is the collection and recording of activity and event data
- The information logged varies based on the service
- Common log elements include date and time of event, origin of event, and identity of resources that were accessed
- Monitoring is the continuous verification of the security and performance of resources, applications, and data
- AWS provides several services that give visibility to spot issues before they impact operations
AWS CloudTrail
- CloudTrail is the primary AWS solution for logging
- CloudTrail assists in enabling governance and compliance
- It assists in enabling operational and risk auditing of AWS accounts
- Records actions taken by a user, role, or AWS service as events
- CloudTrail can be used to view, search, download, archive, analyze, and respond to account activity across the AWS infrastructure
Amazon CloudWatch
- CloudWatch is a monitoring and observability service
- CloudWatch provides a unified view of the operational health of AWS resources, applications, and services
- It collects metrics in the AWS Cloud and on-premises
- CloudWatch can be used to monitor and troubleshoot infrastructure
- CloudWatch has ability to customize logs and events
Key Takeaways: Cloud Security Review
- Access management consists of authentication and authorization; adhere to the principle of least privilege with both
- IAM integrates with most AWS services and helps securely share and control individual and group access to AWS resources
- Securing data at rest and data in transit is a key aspect of a data security plan
- Logging and monitoring can assist your organization to maintain compliance with local laws and regulations
Classify and Protect Data
- Data classifications and policies are needed as a requirement
- Identifying the source data owners is needed as a requirement
- Recording data classifications into the Data Catalog is needed as a requirement
- Implementing data encryption policies is needed as a requirement
- Implementing data retention policies is needed as a requirement
- Honoring classifications downstream is recommended
Control the Data Access
- Allowing data owners to determine access is required
- Building user identity solutions is required
- Implementing data access authorization models is recommended
- Establishing an emergency access process is recommended
Control Access to Workload Infrastructure
- Preventing unintended access is required
- Implementing least privilege policies is required
- Monitoring the infrastructure changes and user activities is recommended
- Securing infrastructure audit logs is recommended
Securing the Stream Processing Pipeline
- Data classification is maintained throughout the pipeline
- Stream processing pipeline includes data sources (continuous stream)
- Stream processing pipeline includes ingestion and producers
- Stream processing pipeline includes Stream storage
- Stream processing pipeline includes stream processing and consumers
- Stream processing pipeline includes downstream destinations
- AWS activities that emit CloudWatch include Events, Kinesis Data Streams, Amazon Managed Service for Apache Flink, Amazon S3, and Amazon Redshift
Key Takeaways: Security of Analytics Workloads
- Honor the data classifications and protection policies that the owners of the source data assigned
- Secure access to the data in the analytics workload
- Share data downstream in compliance with the source system's classification policies
- Ensure the environment is accessible with the least permissions necessary
- Automate auditing of environment changes, and alert in case of abnormal environment access
Studying That Suits You
Use AI to generate personalized quizzes and flashcards to suit your learning preferences.
