Authority to Operate on AWS: Compliance as Code

P U B L I C S E C T O R
S U M M I T
Washington, DC

© 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.P U B L I C S E C TO R
S U M M I T
Authority to Operate on AWS:
Compliance as Code
Tim Sandage
Sr. Security Partner Strategist
ATO on AWS Program
S e s s i o n I D - 2 9 5 4 3 6
Ted Steffan
Sr. Security Partner Strategist
ATO on AWS Program

S U M M I T
What is ATO on AWS?
Security & Compliance Acceleration Program
Helps Customers, Partners, Independent Solution Vendors (ISVs)
Outcomes
Accelerates security and compliance authorization process
Reduces cost and time (Average 18-24 months) – FedRAMP
Provides reusable artifacts including guidance, templates, tools, and
pre-built templates from Amazon Partner Solutions
Builds and Optimizes DevOps, SecOps, Continuous
Integration/Continuous Delivery (CI/CD), Continuous Risk Treatment
(CRT) strategies
Develops proven techniques using AWS Security Automation and
Orchestration (SAO) methodology

S U M M I T
ATO on AWS…
Amazon Partner Driven Process
Includes:
 Training
 Tools
 Pre-built automated deployment capabilities
 Control implementation details
 Pre-built artifacts
 Direct engagement
 Qualified System Integrators
 Visibility and marketing
Breaking It Down

S U M M I T
Why ATO on AWS?
Nearly every solution provider and customer in the public sector
space has some compliance responsibility, and getting through the
certification and accreditation process is expensive and time
consuming – causing extensive delays in service availability for
customers.
Security and Compliance Frameworks:
 Average time to FedRAMP ATO: 18 – 24 Months
 Average time to a DoD PA ATO (IL4/IL5): 24 – 36 Months
 Average time to a IRS-1075 Authorization: 12 – 18 Months
 Average time to a PCI-DSS Certifications: 10 – 12 Months
 Average time to a CJIS Authorization: 6 – 10 Months
 Average time to a HITRUST (HIPAA) Certification: 6 – 12 Months

S U M M I T
The Typical FedRAMP JourneyAgencyProcessJABProcess

S U M M I T
Benefits
Reduce effort to deploy security configurations and collect audit
data to meet compliance requirements for solutions on AWS
Build an end-to-end automation capability to streamline
regulated workload deployments
Collaborate in joint partner programs supported by AWS to
develop and deliver unique capabilities and solutions
Works with qualified system integrators:
 To build and support environments that meet compliance standards and requirements
 To minimize and simplify ISV’s area of responsibility by offloading hosting and
compliance management
ATO on AWS?

S U M M I T
Visibility and Marketing for ISVs
ISV ATO is for solutions published and marketed on the
ATO on AWS landing page with the option of a written or
video case study
ATO on AWS APN designations for the solutions that can
be used by the ISV in their marketing artifacts and materials
ATO on AWS
Designation
 FedRAMP
 DoD SRG
 CJIS
 PCI
 HITRUST
 IRS-1075
For example, Smartsheet, an APN partner, used many of the tools available through the
ATO on AWS program as well as expertise from Anitian, Kratos, GitHub, CIS, Yubico, Trend
Micro, Puppet, Saint, Sherlock, Barracuda, and Coalfire to go from having no presence in
AWS GovCloud (US) to FedRAMP compliant in less than 90 days.

S U M M I T
Automation leverages infrastructure as code concepts
Certification optimizes security processes
Validation enables continual tests and monitoring of security
configurations
Empowerment emboldens informed decision-making and drives
change
Guiding Tenets for
ATO on AWS

S U M M I T
Goal
Verifiable compliance control solution for regulated workloads
Outcomes
Accelerated path-to-production
Improved compliance and security posture
Reduction in non-compliant findings and re-work
Demonstrable controls to support the assessment process
Implement Security
and Compliant
Architectures

S U M M I T
Optimized Cloud
Risk Management

S U M M I T
Resource
Provisioning
Automate and Deploy
AWS CloudFormation provisions your resources in a safe, repeatable manner, allowing you to
build and rebuild your infrastructure and applications, without having to perform manual actions or
write custom scripts.

S U M M I T
Automated
Architecture
Templated Infrastructure
Provisioning

S U M M I T
Configuration
Management

S U M M I T
Monitoring &
Performance

S U M M I T
Governance &
Compliance
AWS CloudHSM is a cloud-based hardware security module (HSM)

S U M M I T
Resource
Optimization

S U M M I T
ATO on AWS Metrics

S U M M I T
ATO Readiness Questions
Pre-Qualification Questions:
1. Do have a CURRENT FedRAMP or FISMA certification?
2. Do you have FedRAMP agency sponsor (currently)?
3. What is your current FedRAMP opportunity pipeline (minimum pipeline should be
3-5 X of $500K estimate to pursue) (e.g. direct federal agency request,
supporting applications for other FedRAMP packages, etc.)?
4. Are you familiar with FedRAMP Connect program for business case
acceleration? If yes, have you created a FedRAMP Connect application
package?
5. Are you working with a FedRAMP 3PAO currently?
6. What is your timeline for your FedRAMP pursuit?
7. Are you only using AWS Services that have a FedRAMP authorization?
8. Are you using any additional external services outside the FedRAMP
authorization boundary?
9. Are you using an operating system that supports FIPS 140-2 Validated
cryptography?
10. Are you using TLS 1.2?
11. Are you using FIPS 140-2 Validated cryptography for all encryption?
12. Are you using FIPS 140-2 Validated Multifactor Authentication?
13. For DoD IL4/5: Have you completed the Cloud Service Offering (CSO) Initial
Contact Form per the DISA Cloud Connection Process Guide?

S U M M I T
Related Breakout Sessions
295436 – Accreditation of Commercial Software, Myths and Methods
Toby Zeller/AWS, Tim Sandage/AWS
299937 – Security & Identify: The Continuous Mitigation & Diagnostic
Journey on AWS
Darren House/AWS, John Nemoto/CGI Federal
316557 – Achieve Compliance with Security by Default and by Design
Andrew Plato, CEO Anitian & Ignacio Martinez, VP of Risk and Compliance, Smartsheet

S U M M I T
Related Breakout Sessions
302830 – Beyond Security Automation: How to Move Past Developing
Ad-hoc Tools and Make Tools that Develop Automatically
Brad Dispensa/AWS
316600 – Container Security and Avoiding the 2am Call
Len Henry/AWS, Ramesh Jetty/AWS

S U M M I T
Thank you!
S U M M I T
Tim Sandage & Ted Steffan
sandaget@amazon.com
steffat@amazon.com
atoonaws@amazon.com

S U M M I T
S U M M I T

Authority to Operate on AWS: Compliance as Code

Recommandé

Recommandé

Contenu connexe

Tendances

Tendances (20)

Similaire à Authority to Operate on AWS: Compliance as Code

Similaire à Authority to Operate on AWS: Compliance as Code (20)

Plus de Amazon Web Services

Plus de Amazon Web Services (20)

Authority to Operate on AWS: Compliance as Code