Hello. I am Bryan Kang from 'This is My Architecture'.
Today, we are going to speak with Daniel from Kmong.
Hello. I am Daniel, working as a lead senior developer at Kmong.
Nice to meet you, Daniel. Before diving into the architecture
please introduce us to Kmong's services.
Kmong is the number one market platform for freelancers in South Korea.
We provide services to over 300 categories, including design, IT, programming, and marketing
and to a wide range of customers, such as large companies, government offices, and start-ups.
The architecture you will be talking about today is a security architecture.
What issue does it address?
As the number of Kmong users increases rapidly
and our business expands, various security events have occurred.
Previously, we faced many challenges in identifying logs and prioritizing events
because we managed logs from different services.
Particularly, it took us too much time to respond to security events.
To address this issue, we've come to apply this security architecture.
Then, why don't we deep dive into the architecture?
For efficient event management, the process was divided into phases of detection, collection and transmission, and visualization analysis.
By using CloudWatch event rules, only the important patterns of the events
which were detected by WAF and GuardDuty are sent to Kinesis Data Streams.
This data is analyzed, using the services such as Elasticsearch and Athena.
The Security Hub prioritizes events and automates responses to events with higher priority.
The detective quickly identifies the underlying cause of the findings discovered, which makes a simple process.
On what area did you focus your efforts on when configuring this architecture?
The biggest focus was on making dynamic correlations of security events and AWS resource events
and on analyzing them efficiently.
It takes much time to analyze separate events which were detected by WAF and GuardDuty Config
but the Security Hub enables the management of the events in the integrated environment
and the consistent monitoring of the automated processes
based on model cases like AWS Benchmarks.
As you said, it seems critical to understand fully which AWS resource event is mapped
with the security event when it occurred.
You're right. An AWS security event does a simple detection of malicious IP lists, but requires pattern correlation between security events.
For example, when GuardDuty detects a security finding which telecommunicates with the server port of a specific instance,
we need to know various relationships between the user and the resource to discern usual behaviors and anomalies.
Using the CloudTrail log or VPC flow log takes too much time to confirm them.
But by using Detective, we can identify the relationships between the user and the resources
by time in the integrated environment. That is why we chose the Detective in our configuration.
Previously, when we monitored security, we tended to employ static analysis, using given information.
But now you have made part of the processes automated, correct?
That's right. The Security Hub processes events with higher priority automatically.
And it is also configured to emit alerts to users via Lambda or SNS service.
For example, in case of disabled CloudTrail log or compromise of policies of S3 bucket disallowing public access
alerts will be sent to the users, and System Manager
or the automation function of Lambda will be used to take actions.
What benefit did you gain after you introduced this architecture?
First, we were able to save over 80% of our time spent detecting and responding to security events.
Previously, it took us hours to respond to a simple event.
But now, prioritized events are processed automatically and searched by a simple query in the integrated environment.
So, uncomplicated issues can be resolved in minutes.
Please share it if you have a plan to improve this architecture in the future.
Yes. I believe that we built the foundation that enables us to respond efficiently
to security events on both AWS resource and infrastructure levels.
In the future, we plan to expand the configuration so that the images used in ECS/EMR applications
can be distributed safely and appropriate actions can be taken
in case that security threats are detected while an instance is in the running state.
Thank you for your time, Daniel.
Thank you for watching. Goodbye from 'This is My Architecture'.