Questions and Answers Regarding Amazon Web Services in
the Cloud for eDiscovery Use
by Jeffrey Parkhurst, Cavo eD

Cavo eD decided to launch our flagship product as an AWS enabled Cloud
Product, using their S3 service offering. This decision was made after careful
consideration of the Cost, Security, Infrastructure Security and Ease of Use for
end-users. We have spent extensive time with AWS staff making sure that their
systems meet the stringent security concerns that are required by our clients in
the eDiscovery market. Nothing is more important to us than the security of
your data.
(Cavo eD can also be deployed on any Public or Private Cloud
location as well as behind your firewall.)
Since a number of parties have requested information regarding AWS security
and operations, we have decided to create this document to cover the most
important questions that we get asked on a daily basis. It is our hope that this
information will provide you with the comfort level that you require to
understand how safe your data is in the AWS Cloud. Please feel free to contact
us with any further questions about AWS and how Cavo eD can be implemented
to meet your needs.
General AWS Security Information
The AWS cloud infrastructure has been architected as one of the most flexible
and secure
cloud computing
environments. It provides an extremely scalable,

highly reliable platform that enables customers to deploy applications and data
quickly and securely. The following information has been taken directly from
http://aws.amazon.com/security/
.
World-Class Protection
Infrastructure headaches and costs are removed when using AWS Cloud, as well
as many of the related security issues that are related to them. AWS data
centers are highly secure and use state-of-the-art electronic surveillance and
multifactor access control systems. Each center is staffed 24 X 7 by security
guards and access is restricted on a least privileged bases. Data centers are
environmentally designed to minimize any potential operation disruptions.
Additionally, multiple geographic regions allow users to maintain complete
copies of data (designated only by the user) to avoid disruption, even natural
disasters or system failures.
The AWS virtual infrastructure has been designed to provide optimum
availability while ensuring complete customer privacy and segregation. A
complete list of all the security measures built into the core AWS cloud
infrastructure, platforms, and services, is available at:
Overview of Security
Processes
.
Built-in Security Features
Applications and data are also protected by extensive network and security
monitoring systems. These systems provide basic but important security
measures such as distributed denial of service (DDoS) protection and password
brute-force detection on AWS Accounts. Additional security measures include:
●
Secure access – Customer access points, also called API endpoints, allow
secure HTTP access (HTTPS) so that you can establish secure communication
sessions with your AWS services using SSL.
●
Built-in firewalls – You can control how accessible your instances are by
configuring built-in firewall rules – from totally public to completely private, or
somewhere in between. And when your instances reside within a Virtual
Private Cloud (VPC) subnet, you can control egress as well as ingress.
●
Unique users – The
AWS Identity and Access Management (IAM)
tool allows
you to control the level of access your own users have to your AWS
infrastructure services. With AWS IAM, each user can have unique security
credentials, eliminating the need for shared passwords or keys and allowing
the security best practices of role separation and least privilege.
●
Multi-factor authentication (MFA) – AWS provides built-in support
for
multi-factor authentication (MFA)
for use with AWS Accounts as well as
individual IAM user accounts.
●
Encrypted data storage – Customers can have the data and objects they store
in Amazon S3, Glacier, Redshift, and Oracle RDS encrypted automatically using
Advanced Encryption Standard (AES) 256, a secure symmetric-key encryption
standard using 256-bit encryption keys.
●
Security logs –
AWS CloudTrail
provides logs of all user activity within your
AWS account. You can see what actions were performed on each of your AWS
resources and by whom.
Q&A
Q.
Does Amazon give itself the right to search a customer’s data if it so

chooses?
A.
No.
“Amazon does not search anyone’s data – ever.” “Amazon will
not otherwise access your data for any purpose outside of the Amazon S3
offering, except when required to do so by law.”
(
http://aws.amazon.com/s3/faqs
)
Q. Where is my data stored?
A. Amazon S3 offers storage in the US East (Northern Virginia) US West
(Oregon), US West (Northern California), EU (Ireland), Asia Pacific
(Singapore), Asia Pacific (Tokyo), Asia Pacific (Sydney), South America (Sao
Paulo), and China (Bejing). You specify a region when you create your
Amazon S3 bucket. Within that region, your objects are redundantly
stored on multiple devices across multiple facilities.
Q. If a customer chooses to use servers and store data in a certain country,
can the customer be absolutely assured that the servers and data will reside in
that country?
A.
YES.
AWS provides you with the flexibility to place instances and store
data within multiple geographic regions as well as across multiple
availability zones within each region……Data is not replicated between
regions unless proactively done so by the customer, thus allowing
customers with these types of data placement and privacy requirements
the ability to establish compliant environments.”
Data centers are built in clusters in various global regions. All data centers
are online and serving customers; no data center is “cold.” In case of
failure, automated processes move customer data traffic away from the
affected area. Core applications are deployed in an N+1 configuration, so
that in the event of a data center failure, there is sufficient capacity to
enable traffic to be load-balanced to the remaining sites.
Q. When data is delivered to an AWS regional center for loading onto the AWS
servers, what is the protocol for determining what the status is of the load
request?
A. The Billing Console that is under the control of Cavo eD has a log that
provides instant access to the status of any load job request. Cavo will
monitor this on behalf of our clients and will know as soon as data is
available for client use.
Q. How does AWS insure that the required “Chain of Custody” is followed
when receiving and processing data?
A. AWS uses Amazon employees and 3rd party contractors to securely
process and transport your package. For example, packages shipped to
our specified AWS addresses are transported to our data centers by 3rd
party contractors. Your device is unpackaged only inside an AWS
datacenter and handled by AWS employees who have gone through
extensive background checks.
Q. Does AWS maintain a chain of custody for my package?
Yes, once a shipment arrives at the specified AWS address, AWS maintains
a chain of custody for your package up until the package is delivered to
your return address.
Q. How secure is my data in AWS S3?
A. Amazon S3 is secure by default. Only the bucket and object owners
originally have access to Amazon S3 resources they create. Amazon S3
supports user authentication to control access to data. You can use access
control mechanisms such as bucket policies and Access Control Lists
(ACLs) to selectively grant permissions to users and groups of users. You
can securely upload/download your data to Amazon S3 via SSL endpoints
using the HTTPS protocol. If you need extra security you can use the
Server Side Encryption (SSE) option or the Server Side Encryption with
Customer-Provide Keys (SSE-C) option to encrypt data stored-at-rest.
Amazon S3 provides the encryption technology for both SSE and SSE-C.
Alternatively you can use your own encryption libraries to encrypt data
before storing it in Amazon S3.
Q.
What is AWS’s data security policy regarding return of devices after

Import/Export jobs? (Material is sent to AWS for loading via hard drives)
A. AWS only ships devices out of AWS facilities if the device is completely
erased or the device only contains data encrypted by AWS. For import
jobs, we erase devices after job completion. For export jobs, we will
always encrypt the data being exported onto the device. We use
TrueCrypt software for encryption.
Q. Will selecting the correct region improve connectivity?
A.
YES
. By selecting the correct Region then then Availability Zones within
that Region, you can both protect your data from the failure of a single
location and design the data to be closer to specific customers and
achieve lower latency and higher throughput.