STATE OF DEVOPS REPORT_ DORA "Low performers take weeks to conduct security reviews and complete the changes identified. In contrast, elite performers build security in and can conduct security reviews and complete changes in just days."
Visible Invisible Value Chain Evolution Genesis Custom Product Commodity Power Customer MySQL Compute Storage Data Centre HA Scripts Monitoring Config Mgmt Networking
YOUR IAM MIGHT NEED WORK IF YOU_ Log in with the root account Have >1 identity for a single person Don't use roles for compute services Don’t enforce MFA Hard-code secrets in app config (or code!) Have IAM policies with *s in (too permissive) Use a lot of AWS managed IAM policies
YOUR CONTROLS MAY NEED WORK IF..._ You're not logging anything / enough You're not alerting on important log conditions Alerts/notifications are noisy or ignored You're only using logs when debugging
AWS INSPECTOR_ Scans for network reachability Checks hosts against known CVEs Checks against CIS benchmarks Checks other security best practice Analyses app runtime behaviour
YOUR PROTECTION MAY NEED WORK IF..._ You have anything other than LB or NAT in public networks Your security groups are too permissive You mainly use CIDR network ranges in your SGs You're not protecting your application with WAF You're not actively scanning for vulnerabilities You're not checking your application dependencies' security
CLASSIFY DATA_ Identify different data classification levels Use tagging of resources Use KMS keys per classification level Control principal access to keys & resources Consider tokenisation Use AWS Macie to look for sensitive data in S3
DATA PROTECTION MAY NEED WORK IF..._ Too many people have access to too much data You haven't thought about data classification You're not encrypting at rest You're not encrypting in transit You store secrets anywhere other than in AWS services You don't have complete backups You haven't tried restoring your backups recently
INCIDENT RESPONSE MAY NEED WORK IF..._ You can't remediate common incidents automatically You can't quarantine bad nodes for later forensics You don't have engineers on-call for security incidents Engineers don't know how to respond to on-call alerts You don't regularly practice incident response
CASE STUDY_ “We’ve been continuously impressed with the expertise at The Scale Factory, their keenness to understand our business needs and pressures, and help us pave the foundations for a step change in our capability to serve our clients” James Ramirez CTO
Leading Well-Architected Partner Worldwide >200 Reviews Completed Since April 2018 Book a Well-Architected review today https:/ /scalefactory.com/services/well-architected/ $5,000 funding available to support improvement work
scalefactory
oracle4engineer
chumajin
peisuke
smasato
ouchi2501
joker1007
nwiizo
coconala_engineer
radkmb
smt7174
kenchan
maggiecrowley
robhawkes
scottboms
sachag
notwaldorf
morganepeng
jonyablonski
wjessup
jakevdp
lauravandoore
carmenintech
destraynor