Jonathan Lalou's Blog

Posts Tagged ‘DetectionAndResponse’

Lecturer

Himanshu Verma leads the Worldwide Security Identity and Governance Specialist team at AWS, guiding enterprises through detection engineering, incident response, and security orchestration. His organization designs reference architectures that unify AWS security services into cohesive outcomes.

Abstract

The session presents an integrated detection and response framework leveraging AWS native services—GuardDuty, Security Hub, Security Lake, and Detective—to achieve centralized visibility, automated remediation, and AI-augmented analysis. It establishes architectural patterns for scaling threat detection across multi-account environments while reducing operational overhead.

Unified Security Data Plane with Security Lake

Amazon Security Lake normalizes logs into Open Cybersecurity Schema Framework (OCSF), eliminating parsing complexity:

-- Query across CloudTrail, VPC Flow, GuardDuty in single table
SELECT source_ip, finding_type, count(*)
FROM security_lake.occsf_v1
WHERE event_time > current_date - interval '7' day
GROUP BY 1, 2 HAVING count(*) > 100

Supported sources include 50+ AWS services and partner feeds. Storage in customer-controlled S3 buckets with lifecycle policies enables cost-effective retention (hot: 7 days, warm: 90 days, cold: 7 years).

Centralized Findings Management via Security Hub

Security Hub aggregates findings from:

• AWS native detectors (GuardDuty, Macie, Inspector)
• Partner solutions (CrowdStrike, Palo Alto)
• Custom insights via EventBridge

New capabilities include:

• Automated remediation: Lambda functions triggered by ASFF severity
• Cross-account delegation: Central security account manages 1000+ accounts
• Generative AI summaries: Natural language explanations of complex findings

{
  "Findings": [
    {
      "Id": "guardduty/123",
      "Title": "CryptoMining detected on EC2",
      "Remediation": {
        "Recommendation": "Isolate instance and scan for malware",
        "AI_Summary": "Unusual network traffic to known mining pool from i-1234567890"
      }
    }
  ]
}

Threat Detection Evolution

GuardDuty expands coverage:

• EKS Runtime Monitoring: Container process execution, privilege escalation
• RDS Protection: Suspicious login patterns, SQL injection
• Malware Protection: S3 object scanning with 99.9% efficacy

Machine learning models refresh daily using global threat intelligence, detecting zero-day variants without signature updates.

Investigation and Response Acceleration

Amazon Detective constructs entity relationship graphs:

User → API Call → S3 Bucket → Object → Exfiltrated Data
    → EC2 Instance → C2 Domain

Pre-built investigations for common scenarios (credential abuse, crypto mining) reduce MTTD from hours to minutes. Integration with Security Incident Response service provides 24/7 expert augmentation.

Generative AI for Security Operations

Security Hub introduces AI-powered features:

• Finding prioritization: Risk scores combining severity, asset value, exploitability
• Natural language querying: “Show me all admin actions from external IPs last week”
• Playbook generation: Auto-create response runbooks from finding patterns

These capabilities embed expertise into the platform, enabling junior analysts to operate at senior level.

Multi-Account Security Architecture

Reference pattern for 1000+ accounts:

1. Central Security Account: Security Lake, Security Hub, Detective
2. Delegated Administration: Member accounts send findings via EventBridge
3. Automated Guardrail Enforcement: SCPs + Config Rules + Lambda
4. Incident Response Orchestration: Step Functions with human approval gates

This design achieves single-pane-of-glass visibility while maintaining account isolation.

Conclusion: From Silos to Security Fabric

The convergence of Security Lake, Hub, and Detective creates a security data fabric that scales with cloud adoption. Organizations move beyond fragmented tools to an integrated platform where detection, investigation, and response operate as a unified workflow. Generative AI amplifies human expertise, while native integrations eliminate context switching. Security becomes not a separate practice, but the operating system for cloud governance.

Links:

• Lecture Video