Security & DR¶

Nine services across backup, disaster recovery, immutability, edge protection, posture management, and secrets.

Backup-as-a-Service

Automated agent + agentless backups, in-region or cross-region.
DRaaS on Bare Metal

Hot-/warm-standby DR using bare metal targets across regions.
Object Lock (S3 Immutability)

WORM mode for S3, governance and compliance retention.
DDoS Protection (Basic)

Always-on, network-layer DDoS at no extra charge.
DDoS Protection (Premium)

L7 DDoS with WAF integration and SLA-backed mitigation.
:material-firewall: Web Application Firewall

Managed rule sets + custom rules + bot management.
Cloud Security Posture Mgmt

Continuous misconfiguration detection, drift alerts.
Managed SIEM

Centralized log analytics, threat detections, retention.
Secrets Management (OpenBao)

OpenBao-based secrets store, KMS, and PKI.

Defense-in-depth model¶

graph TB
    subgraph Edge
      DDoS[DDoS Basic / Premium]
      WAF
    end
    subgraph Identity
      IAM
      OpenBao
    end
    subgraph Workload
      VPC
      SG[Security Groups]
    end
    subgraph Visibility
      CSPM
      SIEM
    end
    subgraph Resilience
      BaaS
      DRaaS
      OL[Object Lock]
    end
    Internet --> DDoS --> WAF --> VPC
    IAM --> Workload
    OpenBao --> Workload
    Workload --> SIEM
    Workload --> CSPM
    Workload --> BaaS
    BaaS --> DRaaS
    BaaS --> OL

Choosing where to start¶

Maturity	First three services to add
Just-launched workload	DDoS Basic (default), Backup-as-a-Service, Object Lock for backups
Customer-facing app	+ WAF + Premium DDoS
Regulated FI	+ SIEM + CSPM + DRaaS
Multi-region with strict RTO/RPO	+ DRaaS Bare Metal active replica

Compliance touchpoints¶

Control area	Service mapping
BB ICT 4.0 §10 — Cryptography	Built-in TLS / AES-256 + OpenBao for KMS
BB ICT 4.0 §15 — Incident Mgmt	SIEM + Status page + RCA process
BB ICT 4.0 §16 — Business Continuity	BaaS + DRaaS + multi-region
PCI DSS — Logging	SIEM with PCI-aligned retention
PCI DSS — Vulnerability mgmt	CSPM + WAF