Automated Security Remediation - AWS Summit Sydney

•

1 like•473 views

The document discusses automated security remediation on AWS. It describes how Australia Post built automation using AWS services like CloudWatch, GuardDuty, and Lambda to detect security events, assess configurations, remediate issues, and notify teams. This improved outcomes by reducing response times and increasing transparency while lowering costs. Challenges include managing stakeholders, scaling developer education, and influencing upstream changes. The presentation encourages using the same serverless patterns for other monitoring and building automated security.

© 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Automated security remediation
Michael Stringer
Solutions Architect
Amazon Web Services
Steve Stojanovski
Head of Security, Education & Culture
Australia Post
Ahmed Al-Anim
Cloud Security Specialist
Australia Post

© 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
What if I told you…
automatically?

© 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
WHY?
We need to ask some questions about your security

© 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Low degree
of automation
Lack of
visibility
Why is security incident response so hard?

© 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Skills shortageSignal-to-noiseLarge datasets
Why is security incident detection so challenging?

© 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Why do I need guardrails in my AWS accounts?
and scales on AWS
You need your security to keep pace with your agility
As your business builds

© 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Why do I need to build automation?
<

© 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Keep humans away from your security and scaling

© 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
• Automation removes the potential for human error
• It works around the clock, and on weekends and holidays
• Automation enables a self-healing environment
• Multiple incidents can be responded to in parallel
• It allows InfoSec and other teams to better utilise their time for
high-level security tasks
• All easily built and scaled using the power of AWS!
Benefits of automating your security remediation

© 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Other Log Sources
AWS Lambda
Amazon
Simple Notification Service
Build repeatable serverless automation patterns
AWS Services
Amazon
CloudWatch Events
Events RemediationNotifiers

© 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Amazon
CloudWatch
Automate with integrated services
Amazon
CloudWatch Events
AWS LambdaAmazon GuardDuty
CloudWatch
Event
AWS Lambda
Lambda
Function

© 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
But enough of the ’why?’
Now for a real-world
example of how!

© 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T

© 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
• Self-funded government business
• Over 70,000 employees in our extended workforce
• Australia's largest retail network with 4,356 post offices
• We deliver to 11.9 million addresses
• We deliver more than 1.3 million parcels across
Australia every day
About Australia Post

© 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
We AWS

© 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
How we build
• Agile methodology, iterative development practices
• Hundreds of developers
• Continuous integration and delivery with 8 – 12 production
deployments per day
• Co-located teams – developers, business analysts, PMs, business
stakeholders and security
• Literally hundreds of AWS configuration changes, every single day

© 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
So how do we scale security?

© 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Step 1: Detect Step 2: Assess Step 4: Notify
How can we detect
specific events of
interest, such as
key configuration
changes in AWS?
How can we
assess selected
assets against
known security
baseline
policies?
Step 3: Remediate
How can we
treat identified
deviations from
security policy?
How do we
notify the
affected people
and maintain
traceability?
The problem(s)

© 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Detect: Examples
AWS CloudTrail configuration changes
Route Table changes
AWS RDS encryption enabled
Security Group ingress rules

S U M M I T © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.

© 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
The solution
Detect
Assess
Remediate
Notify
Ticket Raised & Assigned Message Sent

© 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Outcomes
improved
reduction in time
transparency
low operating costs

© 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Challenges
Stakeholder communication and management
Scalability of developer education program
Ability to influence upstream changes
Established and mature security baselines

© 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Try sending the output of AWS monitoring and security services
into the same serverless pattern you have seen here today
Look for AWS Security Blog posts and Quick Starts for more
information on building automated security remediation
Adopt automated security remediation as part of your workflow
Call to action
Go build and let us know what you come up with!

Thank you!
S U M M I T © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Michael Stringer Ahmed Al-AnimSteve Stojanovski

This describes an approach to embedding security within the technology solution landscape. It describes a security model that encompasses the range of individual solution components up to the entire solution landscape. The solution security model allows the security status of a solution and its constituent delivery and operational components to be tracked wherever those components are located. This provides an integrated approach to solution security across all solution components and across the entire organisation topology of solutions. It allows the solution architect to validate the security of an individual solution. It enables the security status of the entire solution landscape to be assessed and recorded. Solution security is a wicked problem because there is no certainly about when the problem has been resolved and a state of security has been achieved. The security state of a solution can just be expressed along a subjective spectrum of better or worse rather than a binary true or false. Solution security can have negative consequences: prevents types of access, limits availability in different ways, restricts functionality provided, makes solution harder to use, lengthens solution delivery times, increases costs along the entire solution lifecycle, leads to loss of usability, utility and rate of use.

Blueprint for Security Architecture & Strategy.pdf

Fetri Miftach

BGA CTF Ethical Hacking Yarışması Çözümleri

BGA Cyber Security

ITIL Business Relationship Management, the "Hidden" Process

Flevy.com Best Practices

Original article from the Flevy business blog can be found here: http://flevy.com/blog/itil-business-relationship-management-the-hidden-process/ The Business Relationship Management (BRM) process was introduced into the Service Strategy element of the ITIL Service Lifecycle in 2011, but you’d be forgiven for not being aware of this. BRM is perhaps a little ambiguous, and the line between it and its better-known cousin, Service Level Management (SLM), is certainly blurred. To better understand the BRM process, it is important to first acknowledge the differences in focus between BRM and SLM: • SLM Focus - Tactical and Operational • BRM Focus – Strategic and Tactical The purpose of the BRM role is to establish and maintain positive relationships with the Business, providing input and guidance into the design and delivery of services that exist solely as a means to provide the desired Business outcomes. A key element of the BRM role is the need to become aware of and understand any factors that may influence a change in the services that are required. A change in the desired Business outcomes, almost certainly means a change to service provision. As such the balancing act of ‘Supply & Demand’ falls squarely at the feet of the BRM. Equally, the pace of technological change must also be considered as an external factor that could influence service utilization.

Neo4j : Graphes de Connaissance, IA et LLMs

Neo4j

Jesús Barrasa, Head of Solutions Architecture for EMEA, Neo4j Les graphes de connaissances et le Machine Learning sont les deux principales méthodes de représentation et d’exploitation des connaissances. Ce qui est intéressant et plutôt méconnu, c’est qu’ils sont hautement complémentaires. Cette présentation vous éclairera sur la manière dont ces deux domaines interagissent, mettant en avant la synergie entre eux et comment les variantes les plus récentes du ML (IA générative et LLMs) s’intègrent avec des graphes de connaissances pour construire des applications sémantiques modernes.

Privacy Engineering

Tomi Mikkonen

Office 365 管理者が押さえておきたい PowerShell コマンド

Mari Miyakawa

An overview of the 2023 National Cybersecurity Strategy, focusing on the innovative solutions that have been introduced to tackle emergent threats in the digital sphere. The strategy emphasizes the importance of public-private partnerships for enhanced security infrastructure and underscores the need for robust education initiatives to ensure comprehensive cybersecurity literacy. As part of the overarching defense plan, a major emphasis is placed on resilience and preparedness to safeguard national interests, individual privacy, and economic stability from cyber threats.

Iso iec 27032 foundation - cybersecurity training course

Mart Rovers

Optimizing Your Supply Chain with Neo4j

Neo4j

Kaynak Kod Analiz Süreci

PRISMA CSI

Establishing enterprise wide data governance - CDAO 2019 Auckland

Ali Khan

Prd004 office 365_における_id_統合と

Tech Summit 2016

Enterprise Architecture for Dummies - TOGAF 9 enterprise architecture overview

Winton Winton

Introduction to COBIT 2019 Certification and Training

Mark Edmead

Windows Sistemlerde Yetkili Hesapları İzleyerek Yanal Hareketleri Yakalama

BGA Cyber Security

A case for Managed Detection and Response

Digital Transformation EXPO Event Series

Established in 1999 Secon Cyber have a long standing experience of providing class leading cyber security solutions to customers ranging from small to large enterprises. We continuously strive to innovate and develop solutions to enable our customers and partners to work, play and live safely in the connected world. As part of this commitment we have developed our own Managed Detection and Response Service. In this session David King will discuss the benefits of an MDR service over a traditional MSSP or SIEM solution.

Cloud and Data Privacy

Maganathin Veeraragaloo

Nist.sp.800 37r2

newbie2019

Microsoft 365 グループ生まれた経緯とそのコントロール MICROSOFT 365 VIRTUAL MARATHON 2022

mokudai masayuki

ISO/IEC 27701, GDPR, and ePrivacy: How Do They Map?

PECB

Due to an increase in the collection of consumer data, high-profile data breaches have become common. Currently, there are 128 countries all over the world that have already put in place regulations to secure the protection of data and privacy. The webinar covers:  Data protection, a global development  Introduction to the GDPR, ePrivacy & ISO/IEC 27701  GDPR & ISO/IEC 27701mapping  ePrivacy & ISO/IEC 27701 mapping Recorded Webinar: https://youtu.be/oVhIoHAGGwk Find out more about ISO training and certification services Training: https://pecb.com/whitepaper/iso-27001-information-technology--security-techniques-information-security--management-systems---requirements https://pecb.com/en/education-and-certification-for-individuals/iso-iec-27701 Webinars: https://pecb.com/webinars Articles: https://pecb.com/article Whitepapers: https://pecb.com/whitepaper ------------------------------------------------------------------------------- For more information about PECB: Website: https://pecb.com/ LinkedIn: https://www.linkedin.com/company/pecb/ Facebook: https://www.facebook.com/PECBInternational/ Slideshare: http://www.slideshare.net/PECBCERTIFICATION

Extend Your Market Reach with IBM Security QRadar for MSPs

IBM Security

View on-demand recording: http://securityintelligence.com/events/ibm-security-qradar-for-msps/ As the number of security events grow in complexity and frequency, your clients are likely looking for ways to deploy leading security capabilities to gain more comprehensive security visibility across their operations. With the next release of IBM Security QRadar, you have an enhanced opportunity to deliver a best-in-class security intelligence solution to your broad base of customers. Join us for a webcast presented by Vijay Dheap, IBM Security Global Solutions Manager, to learn about the new features of IBM Security QRadar designed especially for Managed Service Providers. He will cover: - Centralized views and incident management with extensive APIs - Flexible MSP pricing options - Horizontal, snap-on scalability that is cloud ready

CLASS 2022 - Sergio Sevileanu (Siemens) e Felipe Coelho (Claroty) - Habilitan...

TI Safe

ITIL and ISO 20000: Fundamentals and necessary compliance Synergies

PECB

The world of Information Technology (IT) is voluminous, fast paced, innovative and very exciting! You have to love IT to make it work! To love IT you must live IT, to live IT you must embrace a design for success and understand business impacts from system failures (not just the hardware). To embrace a design for success and mitigate system failures you need a formal structure and independent validation. This webinar will introduce you to the structure and choices within the ITIL fundamentals (Information Technology Infrastructure Library fundamentals) and a mechanism to validate the performance of the implemented ITIL structure compliant with the ISO 20000 standard (Information Technology -- Service management -- Part 1: Service management system requirements). The object of this webinar is to excite you about a formal IT structure and encourage you to be fearless about independently validating your service management arrangements. Main points covered: - Introducing an IT structure for service delivery and a case for IT system validation - ITIL component options for IT service provision structure - ISO 20000 as an IT service provision validation mechanism - Synergy of ISO 20000 requirements and mandatory ITIL components Presenter: Eugene is an accomplished high-calibre sustainability and resilience authority, professional engineer and Fellow of the Business Continuity Institute (BCI). With over 25 years of hands-on experience he has developed and improved corporate resilience for a number of organisations from various sectors. His accomplishments include delivery of legislative & regulatory compliance requirements, implementation of ITIL, service, business continuity, information security, quality & risk management systems. In addition Eugene has many years of experience auditing ISO management systems. Eugene has represented the UK Institute of Directors (IoD) on the British Standards Institute (BSI) technical committees responsible for developing ISO resilience standards. He has published many thought provoking articles and a book chapter endorsing the importance of standards as the foundation for good organisational practice. Eugene is an experienced design engineer, implementer, exercise facilitator, trainer and auditor with internationally gifted credentials. Listen to the recorded webinar here: https://youtu.be/2CmWnNtFrcY

Information Security vs. Data Governance vs. Data Protection: What Is the Rea...

PECB

This webinar will provide more information on the importance of information security and how you can take security well beyond compliance, an approach on building strong information security, privacy and data governance programs, and the importance of strong data governance in relation to privacy and information security requirements. The webinar covers • Information Security • Importance Of Information Security Today • Taking Information Security Beyond A Compliance First • Importance Of Data Governance In Information Security • Privacy • Changing And Evolving Privacy Requirements • Importance Of Data Governance In Privacy • Data Governance And Data Privacy • Data Privacy - Data Processing Principles Presenters: Moji is a Senior Business Process Analyst working with GemaltoThales, a leading firm in the IT industry. Moji has over fifteen years of experience in leading projects to improve processes, create and implement processes leading to increased revenue generation and eliminate redundancies. She has a zeal for adding value and increasing revenue for organizations. Moji is very passionate about Data Privacy and its application in business and consumer rights. Hardeep Mehrotara has 20+ years of senior leadership experience in Information Technology and Cyber Security working for public and private organizations building security programs from the ground up. He has been featured on Canadian television as a cyber expert and provided advice to various communities on implementing cybersecurity strategy, best practices and controls. He has been a co-author on numerous leading industry security control frameworks, technical benchmarks and industry best practice standards. ------------------------------------------------------------------------------- Find out more about ISO training and certification services Training: https://pecb.com/whitepaper/iso-27001-information-technology--security-techniques-information-security--management-systems---requirements https://pecb.com/en/education-and-certification-for-individuals/iso-iec-27701 Webinars: https://pecb.com/webinars Articles: https://pecb.com/article Whitepapers: https://pecb.com/whitepaper ------------------------------------------------------------------------------- For more information about PECB: Website: https://pecb.com/ LinkedIn: https://www.linkedin.com/company/pecb/ Facebook: https://www.facebook.com/PECBInternational/ Slideshare: http://www.slideshare.net/PECBCERTIFICATION YouTube video: https://youtu.be/aQcS5-RFIEY Website link: https://pecb.com/

Governance in Cybercrime and Cybersecurity orgns - final distribution Organiz...

Dinesh O Bareja

Cybersecurity and cybercrime organizations must be created with great planning but that is not happening anywhere. In India we have a plethora of organizations sprouting up in every domain and we all know too many cooks spoil the broth. I make a case for governance at the national and state level and make the case for having a planned structure that will ensure good security, good response and offense too, if needed.

Automated Security Remediation

Automated Security Remediation - AWS Summit Sydney

Recommended

Recommended

More Related Content

What's hot

What's hot (20)

Similar to Automated Security Remediation - AWS Summit Sydney

Similar to Automated Security Remediation - AWS Summit Sydney (20)

More from Amazon Web Services

More from Amazon Web Services (20)

Automated Security Remediation - AWS Summit Sydney