Designing and Deploying an Effective Security Stack for AWS. Lacework at AWS Security Week in San Francisco, July 2018.

1. ©2017 Lacework, Inc. Confidential and Proprietary.
1
Automating Cloud Security at Scale

2. ©2018 Lacework, Inc. Confidential and Proprietary. 2
Lacework Polygraph
Threat Intelligence
and Reputation
Alerting
SIEM
SOC
InvestigationCompliance DetectionVisibility
Enforcement via APIs
Cloud
Infrastructure
Workloads Accounts
VMs ContainersFilesApps Insiders Config Logs
Use cases
Security Platform for the Cloud

3. ©2018 Lacework, Inc. Confidential and Proprietary.
Get started by simply configuring your AWS
CloudTrail and AWS Config Accounts. Then
deploy our agent. We support all modern
deployment methods: Kubernetes, Docker,
Puppet/Chef, etc…
Capture Relevant Activity
Ingested data is used to build relationships
between key activities: CloudTrail data,
API user and account behavior, machines,
containers, applications, processes and
network behaviors.
Build Relationships
Security for your Public Cloud
Data Analysis at Scale

4. ©2018 Lacework, Inc. Confidential and Proprietary.
Ingested data (not samples) runs through
detection algorithms to detect known
threats. Are you failing compliance? Do you
have high risk configuration changes? Have
you been breached? Is data being actively ex-
filtrated to known bad sites, are brute-force
password attacks occurring?
Identify Known Threats
Once a baseline of known behaviors for your
cloud is established, we detect outliers and
potential security threats automatically. Our
”Polygraph” then provides real-time insights
into unknown attacks.
Identify Unknown Risks & Threats

5. ©2018 Lacework, Inc. Confidential and Proprietary.
Upon discovering known or unknown
attacks, alerts are created with context
and supporting evidence combined with
severity levels.
Deliver Alerts / Insights
Upon discovering known or unknown
attacks alerts are created with context
and supporting evidence combined with
severity levels.
Integrated Workflow

6. ©2018 Lacework, Inc. Confidential and Proprietary.
Our core value proposition: auditing of your
public cloud configuration for compliance, threat
prevention, log correlation, and storage in a sub-
second query interface to all the data.
Compliance, Intrusion Prevention,
Container Security, & Analytics

7. ©2018 Lacework, Inc. Confidential and Proprietary.
Example Customer Value (1 month)

8. ©2018 Lacework, Inc. Confidential and Proprietary. 10
46B Events a Month Visualized

9. ©2018 Lacework, Inc. Confidential and Proprietary. 11
Customer – Bitcoin Mining Attack

10. ©2018 Lacework, Inc. Confidential and Proprietary. 12
Customer – Bitcoin Mining Attack

11. ©2018 Lacework, Inc. Confidential and Proprietary.
www.lacework.com/free-trial