Cybersecurity/Goverment

This is the one page "cheat sheet" for goverment regulation in the US and how it relates to cybersecurity.

SSP

SSP - System Security plan

Think of this as the master bluprint for the system.

• It's a living document
• Describes autntoszation boundaires / data flows / protocols ect

The SSP requires:

• WHAT: A clear definition of what is protected
• HOW: How it is protected and isolated

Without a What and How it is not protected!!!

How it relates to NIST 800-53:

• Describes how every 800-53 control is technically implemented.

How SSP relates to AWS Gov Cloud

Multi account governance

• Don't trust other accounts
• Use AWS control tower to implement service control policies / lock down account boundaries.

Data protection

• Data at rest and in transit
  • S3 Bucket polcies and encryption
  • TLS Enforcement
    • TLS 1.3 is a mandotary baseline
    • TLS 1.2 can be used with approval
    • TLS 1.0 and 1.1 Should not be used

🤔More about TLS

Infrastrcutre as code

• Maintaining baselines by intergrating polcies in to cloud formation and terraform
• Automated pre-comit code analysis

IAC has many major advantages:

• Can be scanned for security issues - just like the scan of application code.

How it works:

• Tools scan the code acting as a security gate
• Violations are caught: Buckets not encrypted / * actions / Open security groups
• The violations causes the comit to fail.

This is a "Shift left" approach, catching issues before they make it to production.

An important caveat: This does not catch CVE's in code!

best approach is Trust but Verify:

• Trust IAC code has been scanned
• Verify the implementation