How Citi advanced their containment capabilities through automation
summary
Citi describes an automated containment framework that cuts containment time from about four hours to under 15 minutes and claims >10x faster mean time to respond for 28 AWS services. It uses AWS Step Functions, Lambda, AWS CDK, KMS, SNS and cross account roles to run state machines that detach instances from Auto Scaling groups, replace security groups with deny‑all network policy, revoke keys and attach a deny‑all IAM policy, and copy S3 objects into a forensics bucket for analysis.
AI-written summary · about
chapters (9)
- 0:00Introduction and overview
- 7:32Why automate containment
- 24:34Introducing CCAF
- 31:59Live poll and deep dive
- 32:40IAM user containment demo
- 35:33EC2 instance containment demo
- 37:37S3 forensic collection demo
- 40:33Benefits and future plans
- 42:00Q&A and closing
related talks
50mAutomation in action: Strategies for risk mitigation
49mCloud operations: A catalyst for innovation
33mAutomating Cloud Security and Incident Response (DevSecOps)
48mJourney to protected workloads on AWS
22mAutomating the CIS Foundations Benchmark for AWS with Terraform
32mAdvanced threat detection and response on AWS
44mAchieve your identity, security, and compliance goals on
51mInnovations in AWS detection and response services