3 ms·
JEDI is only the start of problems for Amazon in this space. For those that don't follow the government contracting world, for the last year DoD has been in the
by bladegash 6y ago
JEDI is only the start of problems for Amazon in this space. For those that don't follow the government contracting world, for the last year DoD has been in the process of releasing the Cybersecurity Maturity Model Certification (CMMC). In short, any contractor seeking to do business with DoD (including subcontractors) will be required to have varying levels of security controls implemented, mostly derived from NIST 800-171 Rev. 2. Current estimates put the number of effected organizations at 300,000+. We are talking a multi billion dollar industry being created via acquisition regulations.
Most organizations are shooting for a Level 3 certification, which is almost certainly going to require Impact Level 5 authorization. Having done the research on various solutions, Amazon doesn't have anything close to the solutions Microsoft has available via GCC High and M365/Azure/Azure AD/ATP/Intune/Endpoint Configuration Management/etc.
AWS still has a place, but I have a feeling Microsoft is going to increase their market share even further.
- Bedon292 6y agoAmazon already has IL5 certification though [1]. I have loosely been keeping an eye on all the CMMC stuff, but not in detail. What does Microsoft offer that Amazon can't here? I honestly would like to know, as it could be very useful information. [1] https://aws.amazon.com/govcloud-us/dodsrg/ https://aws.amazon.com/govcloud-us/dodsrg/
- tatersolid 6y ago> What does Microsoft offer that Amazon can't here? Anything to do with client device management, security, or attestation. Which matters a lot to the DoD.
- bladegash 6y agoSorry for the delay responding to this. The big ones, at least for small and medium sized businesses, is going to be endpoint configuration management, Windows Defender ATP, MAM/MDM via Intune, data loss prevention, Azure AD, SSO through Azure AD, various identity management tool sets, Bitdefender, patch management, etc. On top of that, each licensed user receives a Windows 10 enterprise license, access to the entire Office desktop suite, OneDrive, SharePoint, Teams, Audio Conferencing #, etc. Microsoft 365 (note: not O365) provides a very solid solution. M365 on GCC makes it much much easier to implement the required security controls for FISMA, DFARs, ISO 27001, etc. and it provides it through one service/SLA. If I wanted to do the same things with Amazon, it would be a much more involved process, more complicated implementation, and almost certainly require multiple vendors.
- Bedon292 6y agoThanks for the reply, great info. We have definitely been looking at more things like Azure AD. (Or Okta maybe?) for the identity management stuff. Even AWS has one I think, but seems worse than other offerings. It is an interesting idea to consider. We already are using Slack, GSuite, Chime, and such. More in one service could have some interesting security improvements. Wow, I just looked into it they can even manage Macs. Very interesting. Most of our devices are Mac.
- bladegash 6y agoNo problem! I think the majority of AWS' capabilities are provided through third-party partners (e.g., Okta, like you mentioned). I don't know for certain, but I'd be surprised if those are available on GovCloud/whatever Amazon's IL5 platform is. Use of additional services also then adds in additional SLAs, potentially additional costs, increased attack surface, etc. Also, I don't believe that Slack, GSuite, Chime, etc. are NIST 800-171/DFARs compliant, let alone authorized at IL5. The Teams in GCC is within the GCC enclave, from what I understand. I feel like I'm starting to sound like a Microsoft salesperson (promise I'm not!), but yeah, it's definitely worth checking out.