Cybersecurity/Goverment: Difference between revisions
From Cramsession
Jump to navigationJump to search
✍️ Verified Author: Mflavell • Click to view professional profile & credentials
No edit summary |
|||
| Line 26: | Line 26: | ||
== How SSP relates to AWS Gov Cloud == | == How SSP relates to AWS Gov Cloud == | ||
Multi account governance | === Multi account governance === | ||
* Don't trust other accounts | * Don't trust other accounts | ||
* Use AWS control tower to implement service control policies / lock down account boundaries. | * Use AWS control tower to implement service control policies / lock down account boundaries. | ||
Data protection | |||
=== Data protection === | |||
* Data at rest and in transit | * Data at rest and in transit | ||
| Line 43: | Line 44: | ||
=== Infrastrcutre as code === | |||
* Maintaining baselines by intergrating polcies in to cloud formation and terraform | |||
* Automated pre-comit code analysis. | |||
= DoD IL4/IL5 = | = DoD IL4/IL5 = | ||
Revision as of 16:32, 22 October 2026
This is the one page "cheat sheet" for goverment regulation in the US and how it relates to cybersecurity.
SSP
SSP - System Security plan
Think of this as the master bluprint for the system.
- It's a living document
- Describes autntoszation boundaires / data flows / protocols ect
The SSP requires:
- WHAT: A clear definition of what is protected
- HOW: How it is protected and isolated
Without a What and How it is not protected!!!
How it relates to NIST 800-53:
- Describes how every 800-53 control is technically implemented.
How SSP relates to AWS Gov Cloud
Multi account governance
- Don't trust other accounts
- Use AWS control tower to implement service control policies / lock down account boundaries.
Data protection
- Data at rest and in transit
- S3 Bucket polcies and encryption
- TLS Enforcement
- TLS 1.3 is a mandotary baseline
- TLS 1.2 can be used with approval
- TLS 1.0 and 1.1 Should not be used
Infrastrcutre as code
- Maintaining baselines by intergrating polcies in to cloud formation and terraform
- Automated pre-comit code analysis.
