My application is a SAAS that leverages amazon web services. Currently, the application is ending development and my company received its first client. My application users are required to upload word documents with reasonably confidential data, which are later analyzed, results persisted to the database for later viewing.
Now, I didn't plan big for serving thousands of clients. We wanted to go one client at a time and then go big with it. But, the first client we received is a CMM level 5 company. They sent us a security review questionnaire which queries us about everything from physical security, application security, data security and network security.
My application can run their entire company user load- which means I do NOT need more than one tomcat application server, and a database application server running on a single node at any point in time to serve this client. So, if I ensure the following -
- EC2 instance with encrypted ephemeral storage, EBS storage.
- EC2 instance which will be accessible only to IP ranges of this client.
- Daily encrypted image backups to S3 of the EBS
- All ports closed except 443 for HTTPS traffic.
Does this sound better than
- VPC with one or two nodes, with dedicated app server, database on different nodes.
- VPC with IDS (Intrusion Detection System), hardened for access.
- Security groups defined with clear demarcation of who can access what.
- Firewall/DMZ configuration in VPC
- SSL for web server
- Two factor authentication for managing VPC.
We are a small business trying to deal with this big billion dollar company. The deal size is small but the potential of future business is great. We have no great experience in configuring amazon VPC and hardening it for potential threats. Also, hiring people with expertise for creating the perfect VPC environment is going to take its own sweet time and money. Also, at this point, probably I am sounding more like an ASP and not SAAS. (I guess, that's what we are going for at this point to start making money to make the company survive first).
I have a few questions-
Does it make sense to start with VPC? If I do not anticipate increased load,in the near future and if just a single machine can do it or even say two machines, isn't VPC an overkill? If I give the customer a dedicated EC2 instance, with access filtered to their corporate IP range, only https port open, and customer data is encrypted all the time, isn't that a far simpler approach than creating a VPC and managing security at so many levels (network, machine level and etc).
Also, if I have to start using VPC, should I just outsource VPC security to a company that can take care of this for me and I should just focus on application development? Are there any good firms who do this?