AWS Security Review
Are you concerned that security problems are hiding somewhere in your AWS infrastructure?
A TRANSFORMsysco Security Review offers a comprehensive analysis of your AWS architecture, operating system configuration, and Docker/Kubernetes environment to identify potential security risks. Our team not only identifies these issues but also provides practical recommendations and solutions to address them.
Operate with confidence
One of the great advantages of the cloud is that it drastically reduces time-to-market. Achieving a lot in a short amount of time is indeed valuable, but this gain in speed and agility also comes with risks, especially if cloud security is not taken seriously. You can benefit from the experience our certified consultants have gained through countless enterprise projects. At TRANSFORMsysco, we ensure that your cloud architecture remains both agile and secure. Our consultants are ready to provide recommendations or support you in implementing solutions after the review.
Why is a TRANSFORMsysco Security review important?
As a customer, you use the AWS infrastructure to host your applications, which users can access over the Internet or intranet. For security within the cloud, AWS offers active security systems as standard and can be externally audited on a regular basis. However, as the customer, you are responsible for correctly configuring all other necessary security measures. AWS refers to this as the shared responsibility model.
This is where we come in to support the work you’ve already done with an audit of your architecture. Our audit is not just conducted from a purely technical perspective but is tailored to your specific application, industry requirements, and concrete risks.
In this way, our consultants can identify actual security-related issues and suggest improvements, unlike fully automated reviews, which can do so only to a limited extent, if at all.
On What Basis Are our recommendations based?
TRANSFORMsysco Security Reviews are based on the following recommendations and standards, among others:
- Industry-specific project experience
- US/Canada specific regulatory requirements
- AWS white papers and best practices
- Cloud Security Alliance (CSA) controls
- Security benchmarks from the Center for Internet Security (CIS)
- Cybersecurity and Infrastructure Security Agency (CISA)
- National Institute of Standards and Technology (NIST) SP 800 Series
- Recommendations from the ISO 27000 series
HOW IS AN AUDIT STRUCTURED?
A TRANSFORMsysco Security Audit begins with a kickoff meeting where you provide us with an overview of your architecture, systems, and use cases. We then receive read-only access to your accounts and infrastructure via a time-limited CloudFormation stack that you install, which we provide.
In the following days, we review your account, VPCs, and AWS services for security issues, compile our findings into a document, prioritize issues with risk classifications and fulfillment levels, and ultimately provide recommendations for addressing them.
Depending on your requirements, up to three levels can be assessed: AWS configuration (account, IAM rights, EC2, RDS, VPC, S3, etc.), operating system configuration of the EC2 instances (Windows, Linux), and your Docker/Kubernetes setup.
The findings of our audit are documented in a report of approximately 70 to 140 pages, containing detailed information and transparent recommendations for action. All findings are categorized by risk classification and fulfillment level, allowing you and your team to prioritize and address each point systematically.
To support your workflows, we can provide the findings in JSON format, enabling easy import into tools like Jira. Additionally, you can request the raw data from our scans in JSON format. All scan data is encrypted and securely stored, and by default, it is deleted after three months to prevent leaks of this critical information.
