Feeds

AWS CISO needs permission to visit his data centres

He doesn't mind and you shouldn't either because they're not that interesting

Choosing a cloud hosting partner with confidence

Amazon Web Services' General Manager and Chief Information Security Officer Stephen E. Schmidt is not allowed to make unannounced visits to the company's data centres.

Speaking at the AWS Summit 2012 in Sydney today, Schmidt explained that he has to ask for permission from the relevant Vice-President before visiting a data centre, as part of the company's security regime.

That regime means customers are also verboten from visits, a stance Schmidt says the company prefers because “tours are not instructive.” There are only so many ways to set up and secure a data centre, Schmidt says. Those methods are well-documented, AWS is aware of them, has deployed those it deems sensible and feels customers cannot learn anything useful from a visit.

Schmidt also said most AWS employees are kept ignorant of its data centres' locations. Addresses for the facilities are not listed on the company's intranet, a security-through-obscurity strategy Schmidt said “helps with protection.” Another obscurity strategy sees the company deliberately construct nondescript buildings.

Employees who can visit the facilities have that privilege revoked and formally re-instated every ninety days and must use “two or more levels of two factor authentication” to enter the building.

AWS also, Schmidt said, reviews log files proactively and a little obsessively.

“We review the logs to ensure we see what we expect, and to check for things we do not expect,” he said. The security team also checks to make sure logs are present, as absent logs or missing entries are eloquent descriptors of security incidents.

Schmidt also said the company has developed a special process to help penetration testers take advantage of its cloud. In the past such tests would likely have been flagged as a denial of service attack, but demand for such services means AWS now whitelists designated assets being used during penetration tests. ®

New hybrid storage solutions

Whitepapers

Providing a secure and efficient Helpdesk
A single remote control platform for user support is be key to providing an efficient helpdesk. Retain full control over the way in which screen and keystroke data is transmitted.
WIN a very cool portable ZX Spectrum
Win a one-off portable Spectrum built by legendary hardware hacker Ben Heck
Storage capacity and performance optimization at Mizuno USA
Mizuno USA turn to Tegile storage technology to solve both their SAN and backup issues.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Security and trust: The backbone of doing business over the internet
Explores the current state of website security and the contributions Symantec is making to help organizations protect critical data and build trust with customers.