Hi, and welcome to 'This is My Architecture'.
Today I'm here with Malte from HDI.
-Hi Malte. -Thank you for your invitation.
Your welcome. So, Malte, tell us about HDI and what you're doing.
Actually, HDI is a German insurance company.
I'm in charge to build a modern data platform
to maintain and develop secure data enabled end products.
Okay, cool. So I think as an insurance company you fall under regulations.
What does security and compliance mean for you in the platform?
Basically we are heavily regulated
and security and compliance is the basement of all of my work
and for all our customers.
Okay, so then how do you ensure continuous compliance and continuous remediation in your platform?
Basically we use a set of services which are going to continuously monitor our environments.
The second part is that we created remediation functions to resolve certain findings.
Okay, so then let's break it down and focus first on the scanning part
and then we dive deeper into the remediation part, okay?
-Yes. -So how do you do the scanning?
Basically, we use AWS Config which is the configuration service.
Actually we have Amazon GuardDuty for intelligent threat detection.
Lastly we have IAM Access Analyzer to check our permission scopes.
All those three are ingesting possible findings into the Security Hub,
the central data place to be.
Okay, security efforts then giving you a single pane of the glass overview
of the security posture and the findings those services generate, right?
-Exactly. -Okay, but you know, initially we were talking about compliance and regulation.
I know that this architecture, which is pretty much aligned with our best practices wasn't enough.
So, can you tell us about those requirements and how you were able to overcome them?
Yeah, sure.
So basically we have the requirement to do a ISO 27001 scanning.
I searched for a tool which is simply to host
and which can bring up findings into our security app solution.
We found Prowler.
Prowler is actually hosted on Fargate
and runs at a certain schedule and ingests, if available, findings to our security app.
Okay, and it really completes the single pane of the glass overview, doesn't it?
Exactly.
And now, I wonder what happens if there is a finding in your architecture?
Basically we have two different personas.
The first one is our platform engineer.
The platform engineer can just take a look into our Security Hub
and check which finding is there and evaluate the finding.
So he has an overview, he sees what the exposure is, basically?
Yes, exactly.
Okay, now there is the finding. What can he or she do then?
Basically we can create an event
and this event is published to EventBridge.
With an EventBridge we have rules for Lambda functions.
Those Lambda functions are doing the remediation work.
So they resolve the actual finding based on the recommendations of the control and the standard.
Got it. So basically, manually or automatically,
you trigger those remediation functions on Lambda.
-Yeah. -Okay.
Can you tell us a bit about the scale of what you were able to achieve with this type of architecture?
Basically the solution is deployed to 20 accounts at the moment.
We started with 10 Lambda functions,
and then as Security Hub progressed, we also needed to progress
and now we have 50 plus standard remediations
for findings occurred within the Security Hub.
And that actually means that you are protecting yourself from 50 different types of security incidents, right?
-Yeah. -Okay, cool, understood.
Now this part of the architecture pretty much covers what's going on in the cloud, right?
But HDI was already running in an on-premis environment.
Now I wonder how those worlds integrate?
Basically we already have sec ops engineers for our existing IT systems
and we have Service Now.
Service Now is the central place where they can administrate or create incidents.
Service Now can be easily integrated with Security Hub.
Basically we have the way down, Security Hub can export findings to Service Now.
But we can do this vice versa as well.
Understood.
So that means that the sec ops engineers now get visibility to what's going on in the cloud,
across all accounts, and all regions.
Exactly. So this can be a centralized function,
where this is the platform concrete product engineering app.
Cool. And how do you plan to evolve this architecture?
Basically the Security Hub exposes new controls within the standards, so we are doing more Lambda functions.
And based on our evaluations, some of those Lambda functions
are converted into controls for our CI/CD pipelines
to avoid noncompliant resources right away.
Lastly, we think about a holistic view within Service Now
over all our AWS accounts.
So, we would like to control the standards, we would like to control the controls,
and lastly we would like to have a central place where to manage all our findings
to create an up-to-date view on our AWS environment.
I understand that. Thanks for sharing that.
I think this is a great example in that security and compliance can actually be a business enabler, right?
Exactly. We would like to delight our customers
to take away the burden of doing security operations.
Okay, thanks for sharing that.
And thanks for watching 'This Is My Architecture'.