Controlling windows server on Amazon Web Services

Question

Our site is ISO-27001 compliant. As part of the compliance we were advised not to use RDP to connect to the server, but rather to choose a cloud server which provides a web-interface.

Our current cloud server uses NoVNC.

What is the ISO-27001 compliant recommended way of connecting to Windows Servers on Amazon?

As Amazon itself is ISO-27001 compliant since 2010, https://aws.amazon.com/about-aws/whats-new/2010/11/18/aws-achieves-iso-27001-certification/ then I imagine that either Amazon provides more secure RDP than regular cloud servers, or it could be that our advisor for ISO-27001 standards is too strict.

However an additional advantage of NoVNC (as opposed to RDP) is that we put Bitlocker on the hard-drives of the server, and so if the server restarts and is waiting for the Bitlocker password, then we can fix it via NoVNC. Furthermore, if remote desktop doesn't work for whatever reason then NoVNC can be useful. (Note, I appreciate that Bitlocker on Amazon Servers might not be so simple and Amazon have their own method of encrypting hard drives. https://serverfault.com/questions/569133/bitlocker-drive-encryption-on-aws-windows-instance?utm_medium=organic&utm_source=google_rich_qa&utm_campaign=google_rich_qa)

Answer 1

First of all: ISO/IEC 27001 is the norm that specifies the requirements for the establishing, implementation, maintenance and continuous improvement of an information security management system. Security controls are specified in the ISO/IEC 27002.

In general the ISO 27000 series (including ISO/IEC 27001 and 27002) does not recommend products or certain technologies to use for implementing a control. A typical control in the norm is described in a rather abstract way. Here's an example (freely translated from the German version):

13.2.1 Guidelines and procedures for the transmission of information

Formal transmission policies, procedures and measures should be in place to protect the transmission of information for all types of communication devices.

Instructions for implementation

In the context of the procedures and measures to be followed when using communication facilities for the transmission of information, the following points should be taken into account:
(a) developing procedures to prevent transmitted information from being intercepted, copied, altered, diverted or destroyed;
(b) methods of detection and protection against malware transmitted through the use of electronic communications equipment (see 12.2.1);
(c) procedures for the protection of transferred sensitive electronic information, which are in the form of an annex; [...]¹

So to answer your question: there is no one true "ISO-27001 compliant recommended way of connecting to Windows Servers on Amazon", because there is no mention of which technology, protocol or product should be used. This is something you should decide, but what is important here is, that in the end, it should fit the descriptions of a control. So for instance RDP can be used securely but you have a lot of setting up to do which can be complicated.

To come back to your example: Using a cloud provider is fairly easy and using one that is ISO 27001 certified is also a plus in your own audit. To get certified yourself, you will have to read the norms, understand them and only then implement a control that fits the requirements within your scope.

^{1: Quote taken from DIN ISO/IEC 27002:2016-11}