Cobra Kai's Plan to The Cloud

Considerations For Proposal

• Availability: Customers have access to the services
• Resiliency: if one server goes down, the entire website doesn't go down
  • Requires Redundancy
• Secure: no one will successfully DDOS or get access to sensitive information
• Speed: Customers can access information quickly

Proposed Architecture

Proposed Architecture - On AWS

• Front End And Application Server: EC2 Instances
• Load Balancers: Elastic Load Balancers
• Hard Disk Array: S3 Buckets
• Database: RDS or Aurora

Proposed Architecture - Key Features

• Everything is separated by load balancers
  • DDOS Protection/Speed
• Front-end and Application Service have Auto-Scaling Groups
  • DDOS Protection, Speed, and Cost Savings
• Database and hard-disk array have read-only backups
  • Downtime protection

User Accounts/Privileges

• Four different group
  • Administrator - Full Privileges - system admin 
  • Developer - Has administrator access to services he needs (the cloud infrastructure)
  • Technical Executive - Has view access to cloud services
    • Primarily to ensure everything is on track
  • Non-Technical Executive - Limited access, only has access to services to perform their job

Patching and Backup Strategy

• Patch At Least Monthly
  • Most major updates come out monthly (Windows)
  • Balance between being up-to-date and serving customers
  • Patch critical infrastructure more frequently
• Tier-based backup strategy
  • Front-End/Application Service - Backup live service monthly, version control source code (GitHub)
  • Hard Disk Array - backup weekly (updated frequently, but not as often as the database)
  • Database - backup at least daily - Constantly changing with customer data

Additional Architectural Measures

• Encrypt user data at rest - especially sensitive PII
  • Easy Options on most cloud providers
• Add network and host-based firewalls
  • Can help protect against DDOS and application-based attacks like SQL injection
• Add logs to both the application components and cloud dashboard/API
  • Security breaches can occur in both the application in via the cloud platform
  • Know if breached and how it occurred

Example of Architecture with Firewall

Other Policies - DevSecOps

Other Policies - DevSecOps

How is this helpful?

• Adding processes through Development and Operations
• Improves processes for releasing new applications while ensuring the product is operational, and compliant
• Adding DevSecOps will help to ensure PCI Complicance 

Other Policies - DevSecOps

• Necessary Components to Implement 
  • Threat Modeling
  • Code Review/Auditing 
  • Testing
  • Monitoring
  • Recovery
  • Log activity
    • Both on the server and on the cloud
    • Check for suspicious activity in the application and in the infrastructure

Summary

• Cloud infrastructure will help in three major areas
  • Availability of Services
  • Increased Security
  • Cost Savings
• Policy changes will ensure procedures for updating, patching, and code/infrastructure improvements are standardized
• Combination of architectural and policy changes will ensure compliance (e.g. PCI Compliance