Hello. Welcome to this session of This is My Architecture.
My name is Guillaume, I am with
Jonathan from Thales. Hello Jonathan.
Hello Guillaume.
Could you explain to us what Thales is,
and what your role is at Thales?
Yes, of course! Well, I'm part of the Thales DIS division
which is related to identity and digital security.
My role within this division is to take care of security
which are... in relation to the Thales DIS, solutions that are hosted on AWS.
All right, great.
Could you please explain to us what this architecture is all about,
and what it does?
All right, on this architecture, what we've tried to do
is to centralize all the security events on a single point,
so that we can identify them in a better way
and then be able to process them automatically if possible.
All right, I see several components.
Could you tell us more about these components
and the links between them?
Of course! Well, we have the security hub component.
What we're going to try to do is to provision
the Guard Duty first.
The Guard Duty allows us to analyze AWS logs,
to find suspicious activity.
So, all these events will be provisioned on Security Hub.
The second AWS service we use is AWS Inspector.
It will also push the events related to the SVEs
which are found on the devices,
because thanks to AWS Inspector, we can do vulnerability scans.
Then, we have other services that are not related to AWS.
First of all, we have the antivirus.
We make sure that all events related to the antivirus
are also provisioned on Security Hub.
And the last one is the HIDS,
which allows us to do OS log analysis on the EC2s,
in order to also detect activities that could be unwanted or suspicious.
It also allows us to upload this information to the Security Hub
and have all the events in one place.
All right, so Security Hub allows you to aggregate, and centralize events
whether they come from AWS services or from partner services
that you chose.
Exactly. - Great.
Let’s go further, Security Hub is aggregating everything,
and what happens next?
Well, once we have all the events in one place,
we can see the activity in our infrastructure more clearly.
It's still security-related.
We'll process events from Security Hub.
And events generated on Security Hub will create a Cloud Watch Event.
This Cloud Watch Event will then launch a Step Function.
At the Step Function level, we're going to have Lambdas libraries,
which will perform small, specific actions.
So, thanks to these specific actions, we will be able to build
automatic remediations
for each type of security incident.
Once we've been able to process the incident automatically,
it will create a ticket in the ITSM that will be closed,
or if we need to have a manual action, the ticket will be left open.
So, the incident will be left open for an analyst to review.
We also have integration with Slack.
We'll have a channel with all the security events
that we think are important.
And the last one is that we've done the integration with Pager Duty
which allows you to directly call a security analyst,
in the event of a critical or high incident.
All right, so Cloudwatch serves as a bus, Step Function as a workflow,
and then it tries to remediate, and sends notifications
to an instant messaging, creates a ticket and does an escalation.
Can Step Function achieve the complete remediation?
Or is there another process in the background?
If we have prospectively developed all the necessary Lambdas
to do an automatic remediation and a security event,
we can cover the event in the right way.
For some events, we sometimes haven't done the development yet
and we will need an analyst
to do the manual investigation, to understand the incident, and solve it.
All right, great.
What did you get out of that solution?
Today that solution is in production, what did you get out of it?
It gave us a better visibility on all the events
because we have a main console
where we are able to see all the events in one place,
which is easier than having different consoles
where we have to log in in order to see what's going on,
so, we really have a global view,
and thanks to Security Hub, where we have a unique format
no matter what type of event is at the source,
we are able to process it in an easier way.
Thus, we speed up our development to perform automatic remediations.
All right, great.
Thank you very much for the presentation.
Thank you for watching This is My Architecture. See you soon.