Amazon's New Math Tool Stops Your Data from Leaking
This could save companies from costly data breaches and protect your private info.
AWS is offering an automated-reasoning approach, using its Tiros tool, to validate network segmentation without relying on dynamic packet sampling. Tiros examines a network statically and is designed to validate segmentation across all modeled paths, providing a mathematical demonstration that the topological description aligns with isolation specifications.
The article describes a case where an AWS customer uses Cloud WAN: Tiros collects the customer’s configuration from route tables, attachments, and policy documents; specialized software converts it into logical propositions; and the system checks that no path exists between segments the policy declares should be off limits. If actual reachability matches expected segmentation, validation succeeds; if they differ, the system alerts an operator. This matters because a single misconfiguration of segmentation rules could allow traffic to reach unintended parts of a network or allow data to cross organizational boundaries.
- Amazon's Tiros uses math to check all possible data paths in a network, not just a sample, so it can catch hidden leaks.
- It can validate network separation as often as every hour, giving fast alerts if something is misconfigured.
- Currently, it only works for networks built with AWS's Cloud WAN service, so other networks can't use it yet.
Why It Matters
This helps prevent data breaches that could expose your personal information and cost companies millions.