Centralizing security at scale w/ Security Hub & Intuit’s experience
summary
Shows how Intuit centralizes AWS findings into Security Hub and streams them via EventBridge into a custom ACP pipeline that uses Lambda, Kinesis, MongoDB and OpenSearch for enrichment and tagging, plus integrations with Amazon GuardDuty, Amazon Inspector, Qualys, Amazon Detective and Audit Manager. Claims ingesting 20 million findings a day, deploying ASR and Security Hub Automation Rules to suppress or escalate findings, and achieving reduced audits from six months to two weeks by automating evidence collection, control mapping and developer-facing remediations with Cloud Custodian, Argo and GitHub workflows.
AI-written summary · about
chapters (12)
- 0:00Introduction and speakers
- 3:12What is Security Hub
- 7:54Deploying Security Hub
- 9:20Intuit’s compliance challenges
- 15:29Operationalizing Security Hub
- 16:10Enriching Security Hub findings
- 20:03Supporting compliance teams
- 26:40Empowering developers
- 32:55Automated remediation with ASR
- 37:00Dashboards for managers
- 39:51Other customers’ use cases
- 43:21Summary and next steps
related talks
34mLayering AWS security services to automate incident response
16mStreamlining security auditing with generative AI
13mHarnessing conversational AI for streamlined security operations
24mAnalytics-based investigation & automated response
51mInnovations in AWS detection and response services
24mAnalytics-based investigation & automated response
27mProactively identifying threats & protecting sensitive data in S3
24mOne EdTech’s journey to transforming its security practices