The document discusses automated security remediation on AWS. It describes how Australia Post built automation using AWS services like CloudWatch, GuardDuty, and Lambda to detect security events, assess configurations, remediate issues, and notify teams. This improved outcomes by reducing response times and increasing transparency while lowering costs. Challenges include managing stakeholders, scaling developer education, and influencing upstream changes. The presentation encourages using the same serverless patterns for other monitoring and building automated security.

1. S U M M I T
SYDNEY

2. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Automated security remediation
Michael Stringer
Solutions Architect
Amazon Web Services
Steve Stojanovski
Head of Security, Education & Culture
Australia Post
Ahmed Al-Anim
Cloud Security Specialist
Australia Post

3. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
What if I told you…
automatically?

4. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
WHY?
We need to ask some questions about your security

5. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Low degree
of automation
Lack of
visibility
Why is security incident response so hard?

6. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Skills shortageSignal-to-noiseLarge datasets
Why is security incident detection so challenging?

7. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Why do I need guardrails in my AWS accounts?
and scales on AWS
You need your security to keep pace with your agility
As your business builds

8. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Why do I need to build automation?
<

9. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Keep humans away from your security and scaling

10. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
• Automation removes the potential for human error
• It works around the clock, and on weekends and holidays
• Automation enables a self-healing environment
• Multiple incidents can be responded to in parallel
• It allows InfoSec and other teams to better utilise their time for
high-level security tasks
• All easily built and scaled using the power of AWS!
Benefits of automating your security remediation

11. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Other Log Sources
AWS Lambda
Amazon
Simple Notification Service
Build repeatable serverless automation patterns
AWS Services
Amazon
CloudWatch Events
Events RemediationNotifiers

12. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Amazon
CloudWatch
Automate with integrated services
Amazon
CloudWatch Events
AWS LambdaAmazon GuardDuty
CloudWatch
Event
AWS Lambda
Lambda
Function

13. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
But enough of the ’why?’
Now for a real-world
example of how!

14. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T

15. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
• Self-funded government business
• Over 70,000 employees in our extended workforce
• Australia's largest retail network with 4,356 post offices
• We deliver to 11.9 million addresses
• We deliver more than 1.3 million parcels across
Australia every day
About Australia Post

16. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
We AWS

17. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
How we build
• Agile methodology, iterative development practices
• Hundreds of developers
• Continuous integration and delivery with 8 – 12 production
deployments per day
• Co-located teams – developers, business analysts, PMs, business
stakeholders and security
• Literally hundreds of AWS configuration changes, every single day

18. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
So how do we scale security?

19. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Step 1: Detect Step 2: Assess Step 4: Notify
How can we detect
specific events of
interest, such as
key configuration
changes in AWS?
How can we
assess selected
assets against
known security
baseline
policies?
Step 3: Remediate
How can we
treat identified
deviations from
security policy?
How do we
notify the
affected people
and maintain
traceability?
The problem(s)

20. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Detect: Examples
AWS CloudTrail configuration changes
Route Table changes
AWS RDS encryption enabled
Security Group ingress rules

21. S U M M I T © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.

22. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
The solution
Detect
Assess
Remediate
Notify
Ticket Raised & Assigned Message Sent

23. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Outcomes
improved
reduction in time
transparency
low operating costs

24. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Challenges
Stakeholder communication and management
Scalability of developer education program
Ability to influence upstream changes
Established and mature security baselines

25. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Try sending the output of AWS monitoring and security services
into the same serverless pattern you have seen here today
Look for AWS Security Blog posts and Quick Starts for more
information on building automated security remediation
Adopt automated security remediation as part of your workflow
Call to action
Go build and let us know what you come up with!

26. Thank you!
S U M M I T © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Michael Stringer Ahmed Al-AnimSteve Stojanovski