Five essential preventative controls for HCLS | Amazon Web Services

Key Takeaways

Hello, I'm Hector Rodriguez, a healthcare and life sciences principal industry specialist and security leader at AWS. With me, I have my colleague and friend Donnie Wilson, a healthcare and life sciences principal solutions architect at AWS. In this video, we discuss five essential preventative controls for AWS healthcare and life sciences organizations that leverage the AWS service control and resource policies. In this video, we discuss why preventative controls for healthcare and life sciences. We provide an overview of service control policies and resource control policies. Donnie will dive deeper into the five essential preventative controls for HCLS workloads on AWS. And lastly, we'll provide some QR codes to resources to get started with SCPs and RCPs. Healthcare and life sciences organizations can benefit from organizational preventative controls to address constantly evolving regulatory requirements. We're also facing a highly dynamic security threat landscape and we must meet stringent reporting and documentation requirements. We also have to face these challenges with limited developer resources and agility. So we want to leverage foundational SCPs and RCPs to help organizations focus on solutions to drive their mission. Service control policies or SCPs are principal ccentric controls used to define the maximum available permissions to the identity and access management principles in your organization. They can be applied at the root organizational unit or member account level. Resource control policies or RCPs are resource centric controls used to define the maximum available permissions for the AWS resources in your organization. They can also be applied at the root organizational unit or member account level. There are many use cases where SCPs and RCPs can be effectively and efficiently used to enforce access controls. For example, SCP use cases include the ability to prevent identities from accessing external resources, limiting AWS regions, and to protect cloud platform resources. And RCP use cases include the ability to prevent access to your resources by external identities and to apply controls on sensitive resources. Next, my colleague Donnie Wilson will walk us through five essential preventative controls for healthcare and life sciences workloads on AWS. Thanks, Hector. Now that we have an understanding of service and resource control policies, let's go through five examples that are essential for healthcare and life science customers. These five essential service and resource control policies focus on protecting the foundational governance layer of your AWS environment. The first SCP will maintain the integrity of your regulated landing zone. The next SCP can be used to enforce HIPPA eligible services for AWS accounts and or organizational units. Third, we'll cover how to specify specific foundation models in Amazon Bedrock. And for our fourth and fifth examples, we'll show how to enforce encryption for data at rest and in transit for your AWS resources. The AWS landing zone is a well architected multi-account AWS environment that is scalable and secure. It is a starting point where your organization can quickly launch and deploy workloads and applications with confidence in your security and infrastructure environment. This SCP is part of the landing zone accelerator or LZA. The LZA deploys your landing zone using the guidelines and recommendations from the AWS security reference architecture. If you want your AWS landing zone to remain secure, it is important that unintended changes are not made to the LZA. This SCP is designed to maintain the integrity of your landing zone accelerator deployment and can be useful for protecting organizational audit and logging data for preventing changes to foundational resources and exceptional conditions for allowed IM roles. HLS customers often work with sensitive data such as protected health information. AWS customers that are subject to HIPPA can restrict which AWS services are used in an AWS member account or organizational unit. A HIPPA eligible service can be used to create, receive, process, maintain, or transmit electronic protected health information. AWS has evaluated these services to demonstrate its compliance with HIPPA requirements subject to the AWS shared responsibility model. While this list is not exhaustive, it demonstrates a SCP allowing only HIPPA eligible services. The net effect of this statement is to only allow HIPPA eligible services included in the not action section of this policy. This can be useful for dying user or RO requests to AWS services that are not on the HIPPA eligible list. SCPs can be applied to a specific account or OU designated for HIPPA workloads. For a complete list of HIPPA eligible services, visit our AWS services in scope page listed at the bottom of this slide. Organizations can allow or deny access to specific foundation models which can be useful for enforcing compliance requirements, controlling cost, or standardizing on specific models across your organization, allowing you to meet data governance requirements. This SCP provides an example of allowing only a specific foundation model while denying all others. HTLS customers must encrypt data at rest. A way to do this is to use resource control policies to enforce encryption like in this example for S3 buckets. This is useful for ensuring data meets regulatory requirements or creating an immutable security foundation. It also helps eliminate manual tasks for security teams, limiting the impact of a breach and allowing developers more time to focus on building applications. For HTLS customers, data must also be encrypted when it's in transit. This RCP enforces workload isolation by requiring HTTPS across all resources. This helps protect against easedropping, credential theft, and man-in-the-middle attacks. This is also helpful for meeting regulatory encryption requirements, blocking unencrypted API calls, and protecting against network-based attacks. In this session, we covered five essential SCP and RCPs for healthcare and life science customers that can be used to protect their resources, identities, and data. Remember, these are examples, and it's important that you review and make these your own as applicable to your organizational needs. To help you get started with SCPs and RCPs, please use these QR codes. Thank you for joining us and please continue to work with your AWS account team to plan your next steps or for more information.