0

My application is a SAAS that leverages amazon web services. Currently, the application is ending development and my company received its first client. My application users are required to upload word documents with reasonably confidential data, which are later analyzed, results persisted to the database for later viewing.

Now, I didn't plan big for serving thousands of clients. We wanted to go one client at a time and then go big with it. But, the first client we received is a CMM level 5 company. They sent us a security review questionnaire which queries us about everything from physical security, application security, data security and network security.

My application can run their entire company user load- which means I do NOT need more than one tomcat application server, and a database application server running on a single node at any point in time to serve this client. So, if I ensure the following -

  • EC2 instance with encrypted ephemeral storage, EBS storage.
  • EC2 instance which will be accessible only to IP ranges of this client.
  • Daily encrypted image backups to S3 of the EBS
  • All ports closed except 443 for HTTPS traffic.

Does this sound better than

  • VPC with one or two nodes, with dedicated app server, database on different nodes.
  • VPC with IDS (Intrusion Detection System), hardened for access.
  • Security groups defined with clear demarcation of who can access what.
  • Firewall/DMZ configuration in VPC
  • SSL for web server
  • Two factor authentication for managing VPC.

We are a small business trying to deal with this big billion dollar company. The deal size is small but the potential of future business is great. We have no great experience in configuring amazon VPC and hardening it for potential threats. Also, hiring people with expertise for creating the perfect VPC environment is going to take its own sweet time and money. Also, at this point, probably I am sounding more like an ASP and not SAAS. (I guess, that's what we are going for at this point to start making money to make the company survive first).

I have a few questions-

Does it make sense to start with VPC? If I do not anticipate increased load,in the near future and if just a single machine can do it or even say two machines, isn't VPC an overkill? If I give the customer a dedicated EC2 instance, with access filtered to their corporate IP range, only https port open, and customer data is encrypted all the time, isn't that a far simpler approach than creating a VPC and managing security at so many levels (network, machine level and etc).

Also, if I have to start using VPC, should I just outsource VPC security to a company that can take care of this for me and I should just focus on application development? Are there any good firms who do this?

|improve this question
5

VPC. Always VPC. Even with a single instance, I always deploy in VPC.

There's a reason that AWS now defaults to deploying EC2 instances in a VPC. By doing this, you gain significant benefits in security and flexibility going forward that are not possible in EC2-Classic.

|improve this answer
  • consider that I have no outbound connections from my amazon ec2-classic instance, other than say, Amazon RDS and Amazon SES, how is VPC inherently more secure in this scenario? – Jay Dec 9 '15 at 20:43
  • 2
    1) Network ACLs 2) Security group egress filtering 3) the ability to collect netflow streams if desired, etc. There are dozens of reasons to use a VPC, and not a single one (other than a small amount of increased initial complexity) to not use a VPC. – EEAA Dec 9 '15 at 20:45
  • Do you have to be a network expert to start using and configuring VPC? I am an experienced developer with decent network fundamentals. Would it be difficult for me to create enterprise level security requirements, such as IDS (intrusion detection systems), network acls, security groups and etc in my VPC? In other words, should I outsource this to people who are expert in this area? – Jay Dec 9 '15 at 20:48
  • 1
    I don't have the information needed answer that. The main decision you have to make right now is VPC or not VPC. The answer to that is clear. Use a VPC. In the future, if you want to add some of the additional features, you can do that, either yourself or someone else. If you aren't in a VPC, though, you won't even be able to consider implementing things like an IDS without migrating into a VPC from EC2-Classic. – EEAA Dec 9 '15 at 20:50
  • 1
    You can setup a simple VPC almost as easily as running a single classic EC2 instance. You can choose to add VPC features later. But if you start in EC2-Classic, then you're stuck from the start. EEAA is right: VPC from the start. – Matt Houser Dec 9 '15 at 22:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.