Game Security

“Everything starts with a threat model”.  

Work through threat modeling - and when you reach item 9 in the article, also consider the balance of risk versus overhead. Risk divides into residual risk (which is accepted as part of “the risk of doing business”) and material risk (which requires the application of compensating controls to turn it into residual risk). As the article describes, construct and categorize your policies, technical and procedural controls to mitigate risk to your satisfaction (incorporating controls from requirements in regulation and legislation, which you may need to have constructed from interpretations by your Legal team), and map these controls to services and features which can help achieve them. 

To help you construct this mapping, use the following: 

• AWS Compliance
  
• Security Pillar - AWS Well-Architected Framework
  
• Management and Governance Lens
  
• Game Industry Lens - AWS Well-Architected

While there are capabilities you will want to provide yourself using your own code, AWS services, and potentially open-source code, use your policies and control framework to identify the partners you intend to engage to deliver the functions you don’t want to have to manage, or which are outside the scope of AWS services. For example, if your game requires users to authenticate to your environment, which federated identity providers do you intend to support? 

If you’re using EC2 such that your control framework requires you to implement on-instance antimalware tools beyond SELinux capability profiles, what tools are available in the AWS Marketplace to meet your requirements, bearing in mind that you may need to autoscale groups of instances both up and down? 

Unless you’re just starting to explore AWS as a hobbyist or in your spare time, you’re going to need a soundly-designed multi-account environment to learn, develop, build, test and deploy in, while keeping the different environments and the data they hold, suitably segregated from each other. 

Work through Organizing Your AWS Environment Using Multiple Accounts, to design your multi-account structure. As some kinds of games can consume a lot of non-client resource, if yours is one of these, consider how your environment may need to scale rapidly when your game becomes popular. How this is done depends on the kinds of AWS services your game is hosted on, but always be mindful of per-account service quotas. Where your control framework requires, deploy DDoS mitigations Organization-wide as outlined in the AWS Best Practices for DDoS Resiliency whitepaper.

You’re now ready to look at defining and enforcing your tagging strategy in Organizations policy (see Tag policies), and configuring your monitoring and incident response framework based on your policies and threat model, including suppressing findings which may be extraneous to your specific needs. 

On incident response framework recommendations, see this AWS Security Incident Response Guide - sample runbooks for specific incident scenarios are available on GitHub. 

Where your chosen response policy includes activities which can be automated based on monitoring events, see the AWS Security Hub Automated Response and Remediation implementation guide for a framework and automation set to help achieve this.