Blumetech's Tech Blog

Automatically Encrypt AWS Instances

Encryption is an important part of any data protection strategy. Over the past two years, Amazon AWS has introduced many features that are designed to simplify the task of storing your cloud-based information in encrypted form. Many customers appreciate the fact that AWS makes it very easy for them to encrypt their data. They enable it as needed, and rely on AWS for the heavy lifting. 

Recently AWS announced that they can encrypt data stored on your EBS volumes (the virtual disks attached to your cloud servers). The stored data is encrypted, as is the data transfer path between the EBS volume and the EC2 instance. The data is decrypted on the instance on an as-needed basis, then stored only in memory.

This feature will aid your security, compliance, and auditing efforts by allowing you to verify that all of the data that you store on EBS is encrypted, whether it is stored on a boot volume or on a data volume. Further, because this feature makes use of KMS, you can track and audit all uses of the encryption keys.

Many years ago, I ran a project that required encryption at rest for all of the mission critical data. At the time to meet this business need required $200+K in hardware, software, and professional services. The installation took over 3 months.

With the recent announcements from AWS, encryption at rest is now as easy as checking a checkbox. Because encryption is now so easy to do, executive officers will expect that all business data is encrypted at rest. There is no additional cost or IT burden and hence no excuse not to implement the additional security.

Encrypting new AWS instances is as simple as a checkbox, but how to we encrypt existing instances that already have data? In some cases these instances have multiple terabytes of unencrypted data.

Blumetech asked one of our skilled AWS engineers to time how long it would take to convert an existing instance into an encrypted one.  The test had one big caveat: nothing about the instance could change except for encryption. We wanted the IP, instance ID, security groups, tags, placement, tenancy, etc. to all be exactly the same. We were concerned that if any of these values changed application related problems would result.

On average it took our engineer about an 1 hour to encrypt a machine with two EBS volumes. Since the instance is stopped during most of the work (we can't safely encrypt data that is in use), lots of downtime was required to do the encryption. In addition, the manual process was prone to simple errors.

To resolve all of the problems Blumetech create an application that will automatically encrypt instances. Some of the key features:

• Error free conversion - The process is completely automated 
• High Throughout - Over 50 instances/hr can be processed
• Built-in Multithreading
• Instance Verification Checks - Runs a series of checks to ensure that an instance can be encrypted
• Safe - Allows you to optionally retain your unencrypted data in case a rollback is required
• Detailed Logging 

Use it Now
This functionality was released earlier this month. Please contact us if you are interested in using this new application.

Updated - Reserved Instance Expiration Alerts

As part of AWS Managed Services from Blumetech, we recently announced a new feature that will alert you to any pending Reserved Instance expirations. We monitor your account for any Reserved Instances that will expire in the next 30 days. We then send you six reminder e-mail alerts that are spread-out evenly over the remainder of the Reserved Instance contract.

This new feature is free to you and is included for all AWS Managed Services customers. You can read more at http://blogs.blumetech.com/blumetechs-tech-blog/2015/12/new-reserved-instance-expiration-alerts.html

The response from clients was overwhelming. This simple feature had been missing from their AWS account management. Many customers were thankful that they would no longer be "burned" by AWS when the reserved instance was expiring.

Customers liked the new feature so much that they asked us to include reserved instances for RDS and Elasticache as well. Amazon Relational Database Service (Amazon RDS) makes it easy to set up, operate, and scale a relational database in the cloud. ElastiCache is a web service that makes it easy to deploy, operate, and scale an in-memory cache.

As part of AWS Managed Services from Blumetech, we are now adding a new feature that will alert you to any pending Reserved Instance expirations including RDS and Elasticache reserved instances. As with EC2 reserved instances, we will monitor your account for any Reserved Instances that will expire in the next 30 days. We then send you six reminder e-mail alerts to remind you of the upcoming expiration.

This new feature is free to you and is included for all AWS Managed Services customers.

Use it Now
This functionality was released earlier this month. Please note that this new functionality requires some additional AWS read-only permissions to your AWS account. Specifically we need to be able to list any of your RDS and ElastiCache reserverations. Contact us and we'll be happy to walk you through the process. It's very easy.

New - Reserved Instance Expiration Alerts

Amazon EC2 Reserved Instances allow you to reserve Amazon EC2 computing capacity for 1 or 3 years, in exchange for a significantly discounted hourly rate (up to 75%), compared to On-Demand Instance pricing.

Reserved Instances can significantly lower your computing costs for your workloads and provide a capacity reservation so that you can have confidence in your ability to launch the number of instances you have reserved when you need them.

One of the subtle downsides of Reserved Instances is that you can easily lose track on when an instance contract is going to expire. When that occurs AWS will automatically switch you to the higher On-Demand Instance pricing. At the higher price you can find yourself getting an AWS bill that is surprisingly higher than previous months because of the Reserved Instance expiration.

As part of AWS Managed Services from Blumetech, we are now adding a new feature that will alert you to any pending Reserved Instance expirations. We will monitor your account for any Reserved Instances that will expire in the next 30 days. We then send you six reminder e-mail alerts that are spread-out evenly over the remainder of the Reserved Instance contract.

This new feature is free to you and is included for all AWS Managed Services customers.

Use it Now
This functionality was released earlier this month and has automatically been applied to your account.

AWS Security and Blumetech Clients

Customers frequently tell us that they want to be fully secure when they migrate to AWS. As anyone with a good security background would tell you, being "fully secure" is a relative thing. For example, the level of security for our publishing clients is probably not the same level of security for our financial clients. Their risk tolerance related to security have two vastly different profiles.

On one end of the spectrum we have customers that are perfectly happy with the bare minimums delivered at the lowest possible cost and the least management and user burden. We have other customers where security is job #1. Cost is no object to protect their assets. Many of these firms have regulatory requirements that force them to implement various security measures.

In this post I wanted to cover this security spectrum at a high level from security basics to what can be done for the most extreme security conscious firm. We work with our customers to find the most appropriate spot for them on this spectrum.

The Basics

Any AWS account that Blumetech sets up and manages for you will include all the following:

1. Strong passwords on all IAM accounts
2. Dedicated IAM accounts for roles, e.g. Billing Admin, Read-Only User, etc. We use IAM profiles to enforce the standard "least-privilege" model
3. A battle-tested VPC design that we have used successfully for years at dozens of customers
4. Secure private dedicated networks for instances that are unreachable from the Internet
5. Enable CloudTrail to monitor and log all AWS API calls
6. Create an S3 Logging Bucket with an appropriate policy for security and retention to hold all incoming logs
7. Use AWS Security Groups to enforce "least-privilege" at the network layer for each instance

Advanced

"The Basics" cover roughly 60% of our customer base.  Some customers want to leverage more advanced features that come natively on the AWS platform. For those customers that want additional security controls, we typically recommend a combination of the following additions to "The Basics"

1. Lock away root account credentials. Store the credentials in a safe place never to be used except in an emergency. Use IAM accounts instead
2. Remove all API access keys to the root account
3. Enable Multi-Factor Authentication on IAM accounts. This can be for all IAM accounts or a privileged subset
4. Enable Multi-Factor Authentication on AWS Workspaces login
5. Enable periodic password rotation on IAM accounts.
6. Use IAM Profiles for all application. If not possible, force periodic API access key rotation.
7. Enable EBS volume encryption at rest using AWS Key Management Service
8. Enable S3 encryption at rest using AWS Key Management Service
9. Run periodic vulnerability scans of Internet facing instances

Expert

Rarely we run into customers who need additional security controls. Typically when we get to this level we will require some kind of custom solution tailored to either the customer's own needs or some regulatory requirement, e.g. HIPPA. At this level there aren't any simple "cookie-cutter" solutions. An in depth analysis is required to understand what security features are necessary.

In some cases the discussion moves into whether or not the customer trusts the AWS platform itself. This lack of trust may become apparent in either a lack of trust in AWS security itself, i.e. AWS's own security and compliance procedures, and/or a lack of trust in the platform, e.g. a customer may be concerned that in a multi-tenant environment other AWS customers may be able to access their data.

In these situations we may recommend any of the following security controls :

1. Implementing a Security and Compliance 3rd Party, e.g. Evident.IO
2. Implement a Bring-Your-Own-Key security model where customers provide their own data encryption keys
3. Implement SafeNet to encrypt data at rest for any instances
4. Use dedicated hosts to avoid any fear of "cross-talk" between instances from other customers.
5. Implement Web Application Firewalls from TrendMicro, AWS, etc.
6. Implement Intrusion Detection and Intrusion Prevention Systems (IDS/IPS)
7. Build a DevSecOps practice to automatically monitor, alert, and respond to security related events

New - Monthly Snapshots

As part of AWS Managed Services from Blumetech, you can easily backup up your EC2 Instances in a completely automated way. Our Managed Service takes care of the management of your AWS backups for you. The service allows you to set-up a schedule to backup your instances hourly, weekly, and daily. You configure your backup schedule the way you want it.

Earlier this month we added a new feature so that you can now add a monthly backup option to your schedule. 

For example in the screenshot below I have instance, "PLUTO", that is running Microsoft Terminal Services. This machine provides remote desktop connectivity for Blumetech employees. The data on this machine rarely changes and therefore I'm happy with a monthly backup. I've configured a BACKUP_PROFILE of "BRONZE" which is configured for a single monthly backup of the machine.

Use it Now
This functionality was released earlier this month. Contact us anytime to change your backup configuration.

New - Custom Backup Profiles per Instance for AWS Managed Service

As part of AWS Managed Services from Blumetech, you can easily backup up your EC2 Instances in a completely automated way. Our Managed Service takes care of the management of your AWS backups for you. The service allows you to set-up a schedule to backup your instances hourly, weekly, and daily. You configure your backup schedule the way you want it.

Earlier this month we added a new feature so that you can now add a monthly backup option to your schedule. 

Building on that success we are also adding custom profiles. Previously customers were required to create a single backup profile for all their EC2 Instances. For example, a customer may have a profile that backs up instances

• hourly and keeps 8 hourly snapshots
• daily and keeps 14 daily snapshots
• weekly and keeps 2 weekly snapshots

Customers were limited by having a single backup profile across all their EC2 instances. They wanted the flexibility to set different backup profiles for different instance types. For example, they wanted instances that just run batch processes to not be backed up at all and other instances that run have mission-critical data like, Exchange E-mail systems, to be backed up hourly.

 Today's big news is that you can now create a custom backup profile for any instance. You can:

• Create as many different backup profiles as you like
• Apply those profiles to as many instances you like
• Use instance tags to match instances to a backup profile. You match on any tag. For example you can match on the "NAME" tag or any tag you create, e.g. "BACKUP_PROFILE"
• Create a default backup profile that applies when an instance doesn't have a specific profile assigned. This is a great way to make sure your instances always have at least a default backup.

Here's a screenshot of Blumetech's AWS Demo Account showing the new custom backup profiles.

In this account I've created a BACKUP_PROFILE tag that I'll use to assign backup profiles. The tag name is completely arbitrary. You can create a new tag or using an existing one.

I've then assigned different profiles to some instances:

• I've assigned the GOLD profile to my Exchange server. Gold is my highest level of protection and backs up the instance hourly and saves 8 hourly backups
• I've assigned SILVER and BRONZE to instances that need just daily and weekly backups respectively
• I've assigned IRON to instances that don't have any data and hence have a backup profile that does not take backups
• Finally some instances don't have a BACKUP_PROFILE assigned. Those instances get a default backup profile.

You can use this new functionality to create lots of different backup use cases. Some examples:

• Don't back up instances with "DisasterRecovery" in the name
• Instances with "DEVELOPMENT" in the name should only be backed up weekly
• Instances with an ENVIRONMENT tag set to QA should only be backed up monthly
• Instances with "DB" for database in the name should be backed up hourly

Use it Now
This functionality was released earlier this month. Contact us anytime to change your backup configuration.

SSD Drives really do make a difference!

Some of you already know this but replacing a standard mechanical or even hybrid hard drive with an SSD makes an incredible difference in system performance.  At the urging of one tech savvy client, we have replaced all desktop hard drives and their 5+ year old machines are now blazing fast.  Using the SSD vendor’s provided data migration utility, the ‘ghosting’ process was fast reliable.  While not free, the cost of SSD drives has been reduced significantly and the technology has been improved.  In my opinion, all business computers  should be provisioned SSD drives for the boot drive – and if your machine is sluggish but you’re not ready to buy a new computer, consider replacing the hard drive – simple and effective.

Looking to use Office 365 storage as file server?

Check out this great utility that we found to be useful and reliable. The developer (Myles Jeffery) responds to feedback and has made improvements to the software based on that feedback. It is a subscription service but we've found this invaluable for clients who want to take advantage of the storage associated with their Microsoft Office 365 E3 subscription plan but don't want to lose their familiar drive drive mappings.

http://www.thinkscape.com/Map-Network-Drives-To-Office-365-OneDrive/

Posted with Blogsy

Scripting VPC and VPN configurations on AWS

As part of Blumetech’s managed service, we’ve created applications that provision your AWS infrastructure.  These services follows AWS published best practices and is based on our many years as an AWS Advanced Partner.

Our team has created scripts which will streamline the configuration your AWS infrastructure (VPC, CloudTrail, and S3 logging bucket).  With the VPC script, we create 2 private subnets, the NAT instances, the public subnets, security groups with minimal least privilege security, Internet Gateway, routing tables necessary to link all of these pieces together, VPC endpoint for fast connections to S3, and much much more.  The process also enables CloudTrail and create an S3 bucket and with that S3 bucket, we allow only access from CloudTrail. On the S3 bucket, we turn on versioning and lifecycle management.   Using the VPN script, we provision all of the necessary components to establish a site to site VPN.  This includes the VPN Gateway and the customer gateway – we then link all of the components together and attach them to a VPC.  And finally, we update routing tables to route traffic back to your on premise network.  All that’s left for you is to configure your on premise firewall.  Reach out if you are interesting in learning more or discussing the use of our service.

Office 365 mail attachment limit update

It was just brought to my attention that Microsoft actually increased the message attachment limit for office 365 mailbox accounts. This is big for some users and worth mentioning now even if it is technically old news. Limit is now 150mb for send and receive if using Outlook for Windows - limit is much lower with other mail clients and methods of connecting to send email. Default send/receive limit remains 25mb so if you need the limit raised on your account, please speak up! Read more here on Microsoft's blog https://blogs.office.com/2015/04/15/office-365-now-supports-larger-email-messages-up-to-150-mb/

 

Posted with Blogsy