Automated Security Response

Resolve common security threats and improve your security posture

Our Offerings

This Offering works with AWS Security Hub and provides predefined response and remediation actions based on industry compliance standards and best practices for security threats.

It helps to resolve common security findings and to improve their security posture in AWS.

It creates playbook contains the necessary actions to start the remediation workflow within the admin account or any member account.

Our Approach

Preconfigured templates are available for the solution

Detect

Security Hub provides you with a comprehensive view of their AWS security state. It helps you to measure your environment against security industry standards and best practices. It works by collecting events and data from other AWS services, such as AWS Config, Amazon GuardDuty, and AWS Firewall Manager.

Initiate

You can initiate events against findings using custom actions, which result in Amazon EventBridge Events. AWS Security Hub Custom Actions and Amazon EventBridge rules initiate Automated Security Response on AWS playbooks to address findings. One EventBridge rule is deployed to match the custom action event, and one EventBridge Event Rule is deployed for each supported control (deactivated by default) to match the real-time finding event.

Orchestrate

Using cross-account AWS Identity and Access Management (IAM) roles, AWS Step Functions in the admin account invokes the remediation in the member account containing the resource that produced the security finding.

Remediate

An AWS Systems Manager Automation Document in the member account performs the action required to remediate the finding on the target resource, such as disabling AWS Lambda public access.

Log

The playbook logs the results to an Amazon CloudWatch Logs group, sends a notification to an Amazon Simple Notification Service (Amazon SNS) topic, and updates the Security Hub finding. An audit trail of actions taken is maintained in the finding notes.

Output verification

On the Security Hub dashboard, the finding workflow status is changed from new to either NOTIFIED or RESOLVED. Hub dashboard. The security finding notes are updated to reflect the remediation performed

Monitoring

Query the findings from the centralized findings repository and build dashboards for visualizations.

Target Customer

Healthcare providers looking to safeguard patient information and comply with health data regulations

Educational institutions needing to secure online learning platforms and student data

Financial services companies focused on compliance and protection against security threats

Manufacturing enterprises securing their operational technologies and data

E-commerce platforms requiring robust security measures to protect customer data and transactions

IT and ITES organizations needing automated security responses for their cloud infrastructure

Customer Engagement And Delivery Mechanism

After understanding client requirements in the initial consultation, we draft a customized Statement of Work (SoW) outlining the specific security automation processes, timelines, and deliverables.

This SoW is submitted for client approval and, if applicable, to AWS for funding validation. Throughout the engagement, we conduct regular status meetings and provide detailed progress reports to ensure the project stays on track and meets client expectations.

Use Cases

Common automated security response use cases on AWS

Automated Remediation for Resource Misconfigurations

Automated Compliance Checks and Remediation

Automated Threat Detection and Mitigation for EC2 Instances

Automated Incident Response for Security Group Policy Violations

Our Offerings

Key Benefits ​

Architecture

Our Approach ​

Detect

Initiate

Orchestrate

Remediate

Log

Output verification

Monitoring

Target Customer

Customer Engagement And Delivery Mechanism

Use Cases​

About Redington

Group Websites

Using Redington Search

QUICK LINKS

Enquiry

Key Benefits

Our Approach

Use Cases