How can I use Aviatrix to secure remote user access to AWS VPCs?

Securing user access to VPCs is often overlooked by organizations when it comes to securing their AWS environment. In AWS, security is a shared responsibility model – meaning that AWS has some of the security burden and subscribing organizations also share some of the security burden. In fact, AWS highlights this joint responsibility in the diagram below:

While AWS has responsibility for the underlying infrastructure, hardware, virtualization layer, facilities and staff, the subscriber organization is responsible for securing data in motion, dealing with who can access what VPCs, firewall and egress rules, as examples.

The Importance of Securing User Access to VPCs

Allowing uncontrolled access by users can lead to data breaches. Often users with access privileges can easily move laterally to gain access to resources or data that they should not access. This can create business risks or conflict with regulations – many of which require organizations to limit access only to those who need it to perform their job function. Most organizations under various regulations also have to show that they have controls in place to restrict access, and be capable of providing reports to show that they are in compliance.

For remote access, AWS has long recommended a jumphost type of solution. This had its roots when AWS was more of a “developers world.” At that time, enterprise organizations hadn’t really adopted IAAS significantly , but the jumphost solution was sufficient for the developer community. However, it is not considered sufficient today from a security perspective for remote user access. Additionally, this approach involves putting a jumphost in every VPC which can be difficult to maintain. This same drawback exists with do-it-yourself open SSL VPN solutions.

One more thing to consider…with a jumphost every developer is required to have multiple certificates depending on which VPC they are logging into – it becomes challenging for everyone involved. This approach is not something most would ever consider for their on-prem environments and therefore shouldn’t be the expectation for cloud implementations.

What to consider for secure remote access

Below are some key security capabilities to look for in a remote access solution

1. Multi-factor authentication – consider every user as potentially hostile. Enforce two factor authentication based on something the user has (such as a mobile device) and something they know (such as a password)
2. Authorization – Should be user or profile based rather than IP address based. Mobile workers in a coffee shop may be using a different IP address.
3. Auditing – Ensure you can report on which users accessed what resources. This is critically important if your organization falls under specific regulations such as HIPAA or PCI-DSS. Equally important to actually being compliant is the capability to show that you are compliant.
4. No single point of failure – look for a solution that allows high availability and is not limited to a single instance. Look for solutions that can run behind a load balancer and can scale out. Many of your datacenter-based user VPN solutions don’t support this for cloud.

Aviatrix provides a complete secure network solution in the cloud for all your admins, developers and employees. It combines a policy driven, scale out and geo-aware VPN with encrypted peering and central management console.

Much more of your user VPN questions are answered here.