How Secure Is a Cloud WMS on AWS? C.NET's Layered Security and the Value Versus Building It Yourself
The C.NET (Thailand) WMS runs on AWS with layered security: full encryption, a WAF filtering web attacks, an RDS database separated from EC2 and reachable only internally, administration restricted to one location, and automated backups, while users still log in from anywhere, at any time. This guide explains each layer and compares the value with running your own servers.
Short answer: The cloud WMS that C.NET (Thailand) provides runs on Amazon Web Services (AWS), one of the world's leading cloud providers, with defense in depth. Users reach the system over encrypted web connections from anywhere, at any time. Every request passes through a WAF that filters web attacks before they reach the application. The database runs separately from the application server and accepts connections only from that server inside the private network. Server administration is allowed from one authorized location only, and both servers and databases are covered by automated backups. Customers get the kind of protection large enterprises use, without buying and running their own servers, firewalls, backup systems and operations team.
- $4.44M
- Global average cost of a data breach (IBM 2025)
- 241 days
- Average time to identify and contain a breach
- #1
- Broken Access Control in the OWASP Top 10:2025
- 24/7
- Web access for users from anywhere
This article explains principles and approach. It deliberately leaves out configuration details such as IP addresses, ports, software versions and system schedules, because keeping them out of public view is part of good security practice. Customers who need details to assess a provider can request them from the C.NET (Thailand) team individually.
Why does WMS security matter to the business?
A WMS holds data the business cannot work without: stock balances, product costs, movement history, 3PL owners' data, and consignee names and addresses that count as personal data under Thailand's PDPA. If the system stops or data leaks, the warehouse cannot receive or ship, and the damage goes well beyond repair costs.
IBM's Cost of a Data Breach Report 2025 puts the global average cost of a breach at US$4.44 million, with organizations taking an average of 241 days to identify and contain one (CyberScoop summary of the IBM report). The OWASP Top 10:2025 list of web application risks ranks Broken Access Control first and Security Misconfiguration second (OWASP). Those are exactly the risks the architecture in this article is designed to reduce.
Who is responsible for which part of security? (Shared Responsibility)
AWS works on a Shared Responsibility Model. AWS is responsible for "security of the cloud": the hardware, software, networking and facilities that run its services. Whoever builds on AWS is responsible for "security in the cloud": their own configuration, data and access permissions (AWS). For the C.NET WMS, the split looks like this:
| Responsible party | Covers |
|---|---|
| AWS | Data centers, physical security, power, cooling, hardware and the core network |
| C.NET (Thailand) | System network design, WAF, firewall rules, separation of servers and database, restricted administration, backups, monitoring, and the WMS software itself |
| Customer company | Individual user accounts, role-based permissions, passwords, closing leavers' accounts, and the security of devices used to log in |
How many layers protect the C.NET WMS on AWS, and what does each do?
AWS infrastructure
Data centers that are continuously audited against standards including ISO 27001, SOC 1/2/3 and PCI DSS Level 1, so physical and environmental controls meet the bar banks and large enterprises rely on.
Encryption for all traffic
Everything between browsers or scanners and the system travels over SSL/TLS, including file transfers, so nobody in between can read it.
WAF filters malicious requests
Every request from the internet passes a web application firewall before reaching the system. It helps block common web attacks such as SQL injection and cross-site scripting, and limits clients that send abnormally many requests.
Private network and firewall rules
Servers sit in the system's own private network. Only connections the service needs are allowed; everything else is closed by default.
Database separated from the app server
The database runs on Amazon RDS, separate from the application server on Amazon EC2, and accepts connections only from the app server inside the network. It cannot be reached directly from the internet.
Restricted administration
Users only reach the WMS web interface. Server administration is allowed only from one designated administrator location; from anywhere else, even a correct password gets nowhere.
Backups and monitoring
Servers and databases are backed up automatically and stored apart from the live systems, and monitoring alerts the operations team when the service behaves abnormally.
This follows the AWS Well-Architected principle "Apply security at all layers", which calls for multiple controls from the network edge through the VPC, every instance, the operating system and the application, and "Keep people away from data", which reduces direct human access to data (AWS Well-Architected). If one layer fails, the next still protects the system.
Users can log in from anywhere. How does the system stay secure?
The key is separating the user path from the administrator path. Warehouse staff, sales teams and cargo owners open the WMS in a browser or on a scanner from any branch, at any time. That path only reaches the application screens, and it always goes through encryption, the WAF and a personal login.
The path that can control servers directly is not exposed to the public internet at all. It is allowed only from one designated administrator location. Attackers scanning the internet for servers find no administration entry point to guess passwords against, unlike the many servers that leave remote administration open to everyone.
Leaving inbound SSH ports and remote PowerShell ports open on your managed nodes greatly increases the risk of entities running unauthorized or malicious commands on the managed nodes.
AWS's own guidance warns that broadly open administration access sharply raises the risk of unauthorized commands (AWS). Restricting it to a single location removes most of that risk.
How does separating EC2 and RDS improve security?
Amazon EC2 is the server that runs the WMS application. Amazon RDS is a database service whose underlying infrastructure AWS manages. The C.NET WMS keeps the two apart and lets the database accept connections only from the application server inside the private network. This matches the pattern AWS describes in the RDS documentation, where the database's security group allows connections only from the application servers' security group (Amazon RDS).
- The database has no direct path from the internet, so an attacker must get through several layers first
- If the application server has a problem, the data is still intact in the separate database and each can be recovered independently
- Application and database capacity scale separately to real workload, so you don't pay for more than you need
- Much of the database upkeep, such as automated backups, is built into the RDS service
What is a WAF, and how does it protect a WMS?
A WAF (Web Application Firewall) inspects each web request. A network firewall looks at who is connecting on which channel; a WAF looks at what the request contains. AWS describes AWS WAF as helping protect against common attack techniques such as SQL injection and cross-site scripting (XSS), offering managed rule sets maintained by specialists, and rate-limiting clients that send too many requests (AWS WAF).
For a WMS that users reach from anywhere, the WAF is the first checkpoint that discards malicious requests before they touch the application, cutting the risk from bots that probe websites across the internet around the clock.
How complete are the backups, and how is data restored?
Complete backups cover two things: the application server (operating system, software and configuration) and the database (all business data). The C.NET WMS backs up both automatically and stores them apart from the live servers. If a server is damaged, the team can rebuild it from backup instead of reinstalling from scratch.
On the database side, Amazon RDS supports automated backups that can restore to any second within the retention period (configurable up to 35 days), and backups can be copied across Regions (AWS Prescriptive Guidance). These capabilities come with the service, with no backup hardware to buy.
What does "Tier 1" mean, and how resilient are AWS data centers?
Calling AWS a Tier 1 cloud provider usually means a leading global cloud provider with very large infrastructure and extensive third-party audits. That is different from Uptime Institute's Tier I–IV ratings, which classify individual data centers.
AWS states that its data centers are designed for concurrent maintainability and that infrastructure within its Availability Zones exceeds that standard, but that it has chosen not to obtain a certified Uptime Institute tier (AWS). AWS is continuously audited for SOC 1, SOC 2, SOC 3, ISO 9001, ISO 27001 and PCI DSS Level 1, among others, so systems running on AWS inherit those physical controls without customers auditing them separately (AWS).
Is it worth the price? Comparing with building it in-house
To run an equally secure WMS on its own servers, a company has to provide almost every layer itself: at least two servers for application and database, a server room, backup power and cooling, a firewall and WAF with rule updates, a backup system with off-site storage, and people to patch, monitor and respond to incidents outside office hours.
The C.NET cloud WMS includes all of this in a monthly or annual service fee, and the team that runs it is the same team that knows the WMS software, so problems get fixed at the source. The real value is not just server cost; it is the risk you avoid, set against an average breach cost of several million dollars.
| Topic | Build in-house | C.NET WMS on AWS |
|---|---|---|
| Upfront investment | Buy servers, firewall and backup equipment | No equipment to buy; paid as a service |
| Data center standard | Depends on your own server room | AWS data centers audited for ISO 27001 and SOC |
| Web attack protection | Source and run a WAF yourself | WAF filters requests before they reach the system |
| Database isolation | Design the network yourself | RDS separated from EC2, internal connections only |
| Backups | Someone must check every backup succeeded | Automated backups of servers and database |
| Operations | IT staff who know both servers and the WMS | C.NET team runs the system and the software |
Questions to ask any cloud WMS provider
Use this list to compare providers. A good provider can answer every question, and should share technical details privately rather than publish them on its website.
- Whose cloud or data center does the system run on, and what standards does it meet?
- Is all traffic between users and the system encrypted?
- Is there a WAF or other web attack filtering?
- Is the database separate from the application server, and can it be reached directly from the internet?
- Who can administer the servers, and how is that access restricted?
- What is backed up, how long is it kept, and has a restore been tested?
- Is there monitoring with alerts when the service is abnormal?
- If we leave, in what format can we get our data back?
Limitations to know, and how to handle them
Even a secure cloud system needs an internet connection, so warehouses should have a backup line and an emergency procedure. User-side security, such as shared passwords or leavers' accounts left open, is something no provider can control for you; it is shared work under the Shared Responsibility Model.
FAQ: security of a WMS on AWS
Is a WMS on AWS secure?
Yes, when it is designed properly. AWS secures data centers and infrastructure audited for ISO 27001 and SOC, and the C.NET WMS adds encryption, a WAF, a private network, a separate database, restricted administration and automated backups.
Where can users access the WMS from?
From anywhere, at any time, through a web browser or scanner, over encrypted connections and through the WAF, with each person's own login. Server administration is restricted to one authorized location.
What is a WAF?
A WAF (Web Application Firewall) inspects the content of web requests and helps block common attacks such as SQL injection and cross-site scripting, and rate-limits abnormally busy clients, before requests reach the system.
Why separate the RDS database from the EC2 server?
So the database has no direct route from the internet and only accepts connections from the application server inside the private network. An attacker must pass several layers to reach data, and each part can be scaled or restored independently.
How is data backed up?
Application servers and databases are backed up automatically and stored apart from live systems, so servers can be rebuilt or data restored when needed. Customers can ask the C.NET team for backup frequency and retention details.
Are AWS data centers Tier 4?
AWS has chosen not to obtain an Uptime Institute tier certification. It states that its data centers are designed for concurrent maintainability and that Availability Zone infrastructure exceeds that standard, and it is audited for ISO 27001, SOC and PCI DSS Level 1.
Why doesn't C.NET publish its security configuration?
Details such as IP addresses, ports and software versions help attackers find a way in. Keeping them out of public view is good security practice. Customers assessing providers can request more information individually.
Is a cloud WMS better value than running our own servers?
For most businesses, yes: there is no need to buy servers, firewalls, backup systems and an operations team to reach the same security level, and the risk of a breach, averaging US$4.44 million globally per incident (IBM 2025), is reduced.
Sources
- AWS: Shared Responsibility Model
- AWS: Introduction to AWS Security, Compliance
- AWS: Uptime Institute and AWS data centers
- AWS WAF FAQs
- Amazon RDS: Scenarios for accessing a DB instance in a VPC
- Amazon RDS（日本語）: VPC 内の DB インスタンスにアクセスするシナリオ
- AWS Prescriptive Guidance: Backup and recovery for Amazon RDS
- AWS Well-Architected Framework: Security design principles
- OWASP Top 10:2025
- CyberScoop: IBM Cost of a Data Breach Report 2025
Updated October 2026 by the C.NET (Thailand) team · AWS service facts from official AWS documentation as of October 2026 · Illustrations are conceptual, not an actual configuration diagram.
