Jonathan Lalou's Blog

Lecturer

Brian Vecci serves as Field CTO at Varonis, bringing over two decades of experience in data security, identity governance, and cloud-native threat detection. His expertise centers on transforming static posture assessments into dynamic, data-centric threat response platforms that operate across hybrid and multi-cloud environments.

Abstract

The presentation establishes that conventional cloud security posture management (CSPM) and data security posture management (DSPM) fail against credential-based attacks, which constitute 86% of breaches. Through integration with AWS telemetry, Varonis demonstrates real-time user entity behavior analytics (UEBA), automated forensics, and contextual remediation that stop exfiltration even when attackers possess valid credentials.

Identity-Centric Attack Surface and Posture Limitations

Attackers no longer exploit vulnerabilities—they authenticate. Compromised credentials, over-privileged service accounts, and dormant identities provide legitimate access that evades signature-based controls. Posture tools identify misconfigurations (public S3 buckets, excessive IAM permissions) but cannot detect anomalous behavior within authorized boundaries.

Traditional CSPM: "Is the door locked?"
Data-Centric Detection: "Who is walking out with the safe?"

The critical gap lies in behavioral context: a finance analyst downloading 10 GB of customer records at 2 AM represents exfiltration regardless of policy compliance.

Data-Centric Telemetry and Behavioral Baselines

Varonis ingests AWS CloudTrail, VPC Flow Logs, S3 access logs, and GuardDuty findings to construct per-identity behavioral profiles. Machine learning establishes baselines across dimensions:

• Access velocity (files/hour)
• Geographic patterns
• Data classification (PCI, PII)
• Peer group norms

Deviations trigger risk scoring. A service account suddenly enumerating 10,000 S3 objects—normal for backup, anomalous for CI/CD—elevates priority. UEBA correlates identity, data sensitivity, and blast radius to prioritize alerts.

Automated Forensics and Investigation Acceleration

Upon detection, the platform generates investigation playbooks with full context:

{
  "identity": "arn:aws:iam::123456789012:user/finance-analyst",
  "trigger": "30GB download in 5 minutes",
  "data_classification": "PCI:PAN",
  "peer_baseline": "2GB/day",
  "geolocation": "Romania (baseline: USA)",
  "recommended_action": "disable + MFA reset"
}

Evidence packages include session replay, file access timelines, and encryption status. Integration with AWS Security Hub enriches findings with data context GuardDuty misses.

Integration Patterns with AWS Native Services

Varonis augments rather than replaces AWS controls:

• GuardDuty: Provides infrastructure threats; Varonis adds data exfiltration context
• Macie: Discovers sensitive data; Varonis tracks who accesses it
• IAM Access Analyzer: Identifies unused permissions; Varonis reveals abused ones

EventBridge rules trigger automated responses—revoking sessions, quarantining S3 buckets, forcing MFA—closing the loop from detection to containment in minutes.

Operational Outcomes and Scalability

Deployment requires no agents: SaaS connectors ingest logs via S3 or direct API polling. Processing occurs in customer VPCs for compliance. Customers report:

• 90% reduction in mean time to detect (MTTD) for exfiltration
• 70% fewer false positives through behavioral context
• Automated evidence for regulatory audits (GDPR, CCPA)

The platform scales to petabyte datasets and millions of identities, maintaining sub-second query performance through columnar storage and metadata indexing.

Conclusion: From Visibility to Prevention

Data-centric security transforms posture management from periodic snapshots into continuous threat hunting. By combining identity context, sensitive data classification, and behavioral analytics, organizations detect breaches that bypass configuration controls. The future lies in platforms that connect identity, data, and behavior—not as siloed tools, but as an integrated nervous system for cloud environments.

Links:

• Lecture Video