A leading insurance provider in Indonesia, part of a global insurance group, offers a wide range of products and services, including general, health, and life insurance, tailored to both individuals and businesses.
The company has decided to migration to AWS Cloud services due to the limitations of its outdated on-premises infrastructure. They selected AWS because it has data centers in Indonesia and offers potential cost savings, flexibility, and agility. This migration aims to enhance their security and meet compliance requirements.
With AWS, the company can continue its commitment to delivering reliable and innovative solutions, ensuring strong customer protection and comprehensive coverage for various needs in the Indonesian market.
The Challenges
The company operates in a hybrid environment, utilizing both AWS and on-premises infrastructure, which provides greater flexibility. Their applications include internal systems and public-facing B2B solutions. However, they encountered challenges related to operational resources, knowledge, and technical skills, which slowed their progress. They also needed to enhance their security and compliance. CDT assist with their migration with implemented several key measures, including AWS GuardDuty, AWS CloudTrail, AWS Key Management Service (KMS), Virtual Private Network (VPN), AWS Control Tower, and landing zone.
Solution for Security and Compliance Needs
The organization recognized a pressing need for enhanced security and compliance measures. To bolster security, CDT adopted a multi-layered approach, integrating various AWS services and best practices.
Since they operate in hybrid environments, CDT implemented encryption on all servers using custom keys through AWS KMS. They also utilize a VPN and AWS Direct Connect to create secure network connections, allowing private access to the AWS Cloud. Additionally, load balancers are used to enhance traffic management.
Amazon GuardDuty and AWS CloudTrail are implemented across all accounts to detect malicious activity and monitor log activities, enhancing security visibility. They also use a centralized ingress system with an application load balancer and a network load balancer to minimize the risk of security attacks and exposure.
For traffic inspection, they utilize third-party solutions like FortiGate, which is integrated with a gateway load balancer to ensure high availability. Additionally, a multi-AZ NAT Gateway is utilized to centralize egress traffic.
For access management, the company utilizes Identity and Access Management (IAM) with multiple management accounts set up through AWS Organizations. AWS Control Tower enhances governance and privilege management, streamlining organizational operations. They have already implemented landing zone concepts within AWS Control Tower, with main access provided through Single Sign-On (SSO) and a least privilege access model.
And for incident response, the organization used AWS Disaster Recovery (DRS) for its production environments, while AWS Backup is used for non-production environments to ensure data resilience.
The organization has successfully complied with the National Institute of Standards and Technology (NIST) standards and local regulations (OJK). It is now actively pursuing ISO certification to enhance its credibility and establish itself as a responsible player in the insurance sector.
Benefits Gained
Key security improvements include robust IAM Identity Center practices that facilitate easier management and oversight. The use of Control Tower has streamlined and made it easier to manage the account resources and governance of the organization and improved segmentation, making them more aware that their workloads are clearer, and their segmentation is clearer. Their infrastructure is now more isolated, as many components are inaccessible due to the principle of least privilege.
Looking ahead, the company is focused on implementing a more robust network firewall and cyberattack mitigation as part of its ongoing security strategy. While maintaining a hybrid environment, they are working towards migrating core systems to AWS and exploring further enhancements in data protection, particularly regarding database encryption and centralized monitoring through a Security Information and Event Management (SIEM) system.
Through the adoption of AWS Cloud services, the organization has significantly advanced its digital transformation journey, emphasizing security, compliance, and operational efficiency. As they continue to refine their cloud strategy, the focus remains on enhancing their security posture while achieving compliance goals.
