"Your enterprise cloud requires oversight and continuous management that can be more effectively addressed through security and compliance automation. In this session, learn how to ensure your cloud is compliant with standards critical to your business, and how you can replace outdated processes and tools that slow down delivery of new (and secure) code. We will look closely at issues that can make your environment vulnerable, like dead accounts and other inappropriate access-enabling risks, and misconfigurations that can create unwanted access points. Our session explains how security and compliance automation is used to eradicate these types of issues and many more by leveraging Amazon Simple Notification Service (SNS) and AWS Lambda workflows, integrations with DevOps tools and more. This session is brought to you by AWS Summit New York City sponsor, Evident.io."

1. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
John Martinez, VP Customer Solutions, Evident.io
August 14, 2017
Automating Security and
Compliance Response in the Cloud

2. The
audit’s
done!
Copyright © 2017

3. Who
made
that
change?
Copyright © 2017

4. Stop
the
madness!
Copyright © 2017

5. Let’s Get You Back to Your Happy Place
Start with the Best
Workload is Shared
Managed Continuously
Automatic Fixes
Reporting is Easy
Auditors (& Customers) are Happy
Copyright © 2017

6. Q: DO ANY OF THESE APPLY TO YOU?
Copyright © 2017

7. Start with the best
Compliant Cloud: AWS
AWS Quick Starts:
• NIST
• NIST High-Impact
• PCI DSS
Security by Design
Quick Start architecture for NIST-based frameworks on AWS
Copyright © 2017

8. Q: WHO OWNS SECURITY & COMPLIANCE?
SECOPS DEVOPS RISK &
COMPLIANCE
CISO CIO, CFO,
CEO
Copyright © 2017

9. SHARING THE WORKLOAD
SECOPS DEVOPS RISK &
COMPLIANCE
CISO CIO, CFO,
CEO
Administration, Investigation, Monitoring, Enforcement
Copyright © 2017

10. SHARING THE WORKLOAD
SECOPS DEVOPS RISK &
COMPLIANCE
CISO CIO, CFO,
CEO
Development, Testing, Maintenance, Mitigation
Copyright © 2017

11. SHARING THE WORKLOAD
SECOPS DEVOPS RISK &
COMPLIANCE
CISO CIO, CFO,
CEO
Audit, Governance, Reporting
Copyright © 2017

12. SHARING THE WORKLOAD
SECOPS DEVOPS RISK &
COMPLIANCE
CISO CIO, CFO,
CEO
Policy, Governance, Education
Copyright © 2017

13. SHARING THE WORKLOAD
SECOPS DEVOPS RISK &
COMPLIANCE
CISO CIO, CFO,
CEO
Oversight, Resource Allocation, Voice of Business
Copyright © 2017

14. SHARING THE WORKLOAD
SECOPS DEVOPS RISK &
COMPLIANCE
CISO CIO, CFO,
CEO
We’re All in This Together!
Copyright © 2017

15. “You Build It, You Run It” Drives Team Efficiency
Ellie Mae’s north star is to automate everything that is automatable in the residential
mortgage industry. They have been able to advance their cloud maturity by building
out security as code to enable their DevOps team to move faster, securely.
“I give new people
AWS accounts with
confidence because
they get an ESP
account, too.”
Anthony Johnson
Staff Engineer,
Cloud Platform
Copyright © 2017

16. Q: HOW OFTEN DO YOU REVIEW & REPORT?
YEARLY QUARTERLY MONTHLY WEEKLY DAILY
2017 Q3 JULY JULY
24-30
JULY
26
Copyright © 2017

17. Q: HOW OFTEN DO YOU REVIEW & REPORT?
DO YOU KNOW WHERE YOU STAND TODAY?
YEARLY QUARTERLY MONTHLY WEEKLY DAILY
2017 Q3 JULY JULY
24-30
JULY
26
Copyright © 2017

18. ORGS THAT PRACTICE AGILE DEVELOPMENT
Copyright © 2017

19. ORGS THAT PRACTICE AGILE COMPLIANCE
Copyright © 2017

20. THE CLASSIC WAY TO MANAGE COMPLIANCE
Start Measuring
Spend 2-4
weeks/months
fixing issues
PANIC MODE…
Start Fixing
Issues
REALLY Freak Out…
Pull Everyone to Get
Ready for Audit
Sit with Auditors
(& pray it’s all OK)
Copyright © 2017

21. HOW DO YOU GET CONTROL OF YOUR
COMPLIANCE BACKLOG?

22. BETTER WAY: MANAGE CONTINUOUSLY
DEPLOY
MONITOR
TEST &
ANALYZE
ALERT
DEVOPS
APPLY
FIXES
NEW
RELEASE
NEW
RELEASE
DEPLOY DEPLOY

23. EVEN BETTER WAY: AUTOMATE ENFORCEMENT, TOO
DEPLOY
MONITOR
TEST &
ANALYZE
NEW
RELEASE
NEW
RELEASE
DEPLOY DEPLOY
COMPLIANT
REMEDIATE

24. ESP Dashboard
AWS
Lambda
Alert
Fix Problem ESP Updated
SNS
Integration
Find
Problem/
Open Ticket
Compliant
Problem
resolved
Ticket updated
1 2 3 4
a
b
c
d
Copyright © 2017

25. AGILE COMPLIANCE = CONTINUOUS COMPLIANCE
 Demonstrate compliance in
small increments
 Make improvements over time
(don’t add to your backlog)
 Get to a fully compliant state
 Measure & report at regular
intervals to stay compliant
Copyright © 2017

26. EVIDENT SECURITY PLATFORM (ESP)
DEMO

27. Simplifying NIST 800-53 Compliance in GovCloud
Jive Software selected the Evident Security Platform (ESP) as an automation tool to continuously
monitor vulnerabilities in their AWS infrastructure, saving them time and money. Simple one-click
compliance reports for CIS AWS Foundations Benchmark, PCI and NIST 800-53 provides
on-going measurement and industry frameworks.
“I can’t do my job
without ESP.”
Matt Willman
Principle Architect for
FedRAMP
Copyright © 2017

28. Q: HOW LONG DOES IT TAKE TO MANUALLY
VALIDATE AND RECORD A CONTROL CHECK?

29. LET’S DO SOME COMPLIANCE MATH
PCI DSS:
4 Accounts
12 Testable Controls
2,813 control checks
X 2.5 minutes per
117.2 hours 10 weeks!
NIST 800-53:
1 Account
35 Testable Controls
9,534 control checks
X 2.5 minutes per
397 hours or
Automation is a MUST

30. Isn’t it time to eliminate
the massive spreadsheets?

31. TURN REPORTING SPEED
INTO A COMPETITIVE ASSET
Copyright © 2017

32. Managing Compliance, Continuously
Like most other small credit unions, Vibrant was trying to do more with less and they
implemented Evident.io’s security platform (ESP) to help with the pain of annual audits and
continuous monitoring for vulnerabilities in their Amazon Web Services (AWS) environment.
Evident.io has helped monitor VCU’s environments and helped the organization remain
compliant throughout their year plus partnership.
STEVE MCATEE,
CIO
VIBRANT
CREDIT UNION
Copyright © 2017

33. Let’s Get You Back to Your Happy Place
Start With the Best
Workload is Shared
Managed Continuously
Automatic Fixes
Reporting is Easy
Auditors (& Customers) are Happy
Copyright © 2017

34. QUESTIONS?
TRY OUT ESP FOR FREE:
EVIDENT.IO/SIGN-UP
LET’S TALK: BOOTH 118

35. Thank you!