Decreasing incident response time for OutSystems with AWS serverless technology
AWS Architecture BlogDecreasing incident response time for OutSystems with AWS serverless technologyby Ivo Pinto, Juan Christian, and Diogo Minhava Lopes | on01 FEB 2023| inAmazon Simple Notification Service (SNS),Architecture,AWS Lambda,AWS Secrets Manager,Customer Solutions,Security, Identity, & Compliance,Serverless|Permalink|ShareLeading modern application platform spaceOutSystemsis a low-code platform that provides tools for companies to develop, deploy, and manage omnichannel enterprise applications.Security is a top priority at OutSystems. Their Security Operations Center (SOC) deals with thousands of incidents a year, each with a set of response actions that need to be executed as quickly as possible. Providing security at such large scale is a challenge, even for the most well-prepared organizations. Manual and repetitive tasks account for the majority of the response time involved in this process, and decreasing this key metric requires orchestration and automation.Security orchestration, automation, and response (SOAR) systems are designed to translate security analysts’ manual procedures into automated actions, making them faster and more scalable.In this blog post, we’ll explore how OutSystems lowered their incident response time by 99 percent by designing and deploying a custom SOAR usingServerless services on AWS.Solution architectureSecurity incidents happen with unknown frequency, making serverless services a natural fit to boost security at OutSystems because of their increased agility and capability to scale to zero.There are two ways to trigger SOAR actions in this architecture:Automatically through Security Information and Event Management (SIEM) security incident findingsOn-demand through chat applicationUsing the first method, when a security incident is detected by the SIEM, an event is published toAmazon Simple Notification Service (Amazon SNS). This triggers anAWS Lambdafunction that creates a ticket in an internal ticketing system. Then the Lambda Playbooks function triggers to decide which playbook to run depending on the incident details.Each playbook is a set of actions that are executed in response to a trigger. Playbooks are the key component behind automated tasks. OutSystems usesAWS Step Functionsto orchestrate the actions and Lambda functions to execute them.But this solution does not exist in isolation. Depending on the playbook, Step Functions interacts with other components such asAWS Secrets Manageror external APIs.Using the second method, the on-demand trigger for OutSystems SOAR relies on a chat application. This application calls a Lambda function URL that interacts with the playbooks we just discussed.Figure 1 represents the high-level architecture of OutSystems’ custom SOAR.Figure 1. SOAR architecture for AWSThis architecture was deployed with Infrastructure as Code (IaC) usingAWS CloudFormationandAWS CodePipeline.This same IaC architecture is used when new playbooks or updates to existing ones are made. Code changes that are committed to a source control repository trigger the CodePipeline which usesAWS CodeBuildand CloudFormation change sets to deploy the updates to the affected resources.Use casesThe use cases that OutSystems has deployed playbooks for to date include:SQL injectionUnauthorized access to credentialsIssuance of new certificatesLogin brute forcesImpossible travelLet’s explore the Impossible travel use case. Impossible travel happens when a user logs in from one location, and then later logs in from a different location that would be impossible to travel between within the elapsed time.When the SIEM identifies this behavior, it triggers an alert and the following actions are performed:A ticket is createdAn IP address check is performed in reputation databases, such asAbuseIPDBorVirusTotalAn IP address check is performed in the internal database, and the IP address is added if it is not foundA search is performed for past events with the same IP addressAWHOISis performed on the IP addressRecent logins of the user are identified in the SIEM, along with all related informationAll of this information is automatically added to the ticket. Every step listed here was previously performed manually; a task that took an average of 15 minutes. Now, the process takes just 8 seconds—a 99.1% incident response time improvement.The following remediation actions can also be automated, along with many others:Isolating anAmazon Elastic Compute Cloud (Amazon EC2)instanceCollecting forensics from the Amazon EC2Blocking IPs in theAWS WAFSome of these remediation actions are already in place, while others are in development.ConclusionAt OutSystems, much like at AWS, security is considered “job zero.” It is not only important to be proactive in preventing security incidents, but when they happen, the response must be quick, effective, and as immune to human error as possible.With the implementation of this custom SOAR, OutSystems reduced the average response time to security incidents by 99%. Tasks that previously took 76 hours of analysts’ time are now accomplished automatically within 31 minutes.During the evaluation period, SOAR addressed hundreds of real-world incidents with some threat intel use cases being executed thousands of times.An architecture composed of serverless services ensures OutSystems does not pay for systems that are standing by waiting for work, and at the same time, not compromising on performance.If you are interested in this topic—how to respond to security incidents using AWS serverless services—be sure you also read theOrchestrating a security incident response with AWS Step FunctionsandHow to get started with security response automation on AWSblog posts.Ivo PintoIvo is a Senior Solutions Architect at AWS. Ivo has a background building out global scale infrastructure for both on-premises and cloud with a specialty in networking. He holds 3 CCIEs and has authored the Network Automation Made Easy book from Cisco Press.Juan ChristianJuan is a Lead Security Engineer at OutSystems with a master's degree, published paper, and 6+ years of experience in security engineering and operations for large companies featured on Forbes and Fortune. He believes in hands-on development and implementation of cloud native solutions to improve the security posture of complex environments worth billions of dollars. He holds multiple certifications from AWS, EC-Council, CompTIA, and others.Diogo Minhava LopesDiogo is a Senior Solutions Architect at AWS. He has a background in software development and 8 years of experience working with companies of all sizes in cloud technology, including a startup he co-founded.
Leading modern application platform space OutSystems is a low-code platform that provides tools for companies to develop, deploy, and manage omnichannel enterprise applications. Security is a top priority at OutSystems. Their Security Operations Center (SOC) deals with thousands of incidents a year, each with a set of response actions that need to be executed as […]
Ivo Pinto
Amazon Simple Notification Service (SNS) Architecture AWS Lambda AWS Secrets Manager Customer Solutions Security, Identity, & Compliance Serverless