AWS on Sunday announced a new service that provides organizations with quick and effective security incident management capabilities.
The new Security Incident Response, AWS says, relies on automation to triage and analyze security signals from Amazon GuardDuty and integrated third-party detection solutions through the AWS Security Hub cloud security posture management service.
With Security Incident Response, customers receive comprehensive support across the incident response lifecycle, benefiting from communication and coordination, and continuous assistance from the AWS Customer Incident Response Team (CIRT).
“The service is purpose-built to help customers prepare for, respond to, and recover from various security events, including account takeovers, data breaches, and ransomware attacks,” AWS explains.
The new service, AWS says, automatically triages security findings and filters them based on customer-specific information to identify incidents that require immediate attention and deliver critical alerts to security teams.
To simplify incident response, it provides preconfigured notification rules and permission settings and offers access to a central console with integrated features accessible through the service APIs or the AWS Management Console.
Capabilities include secure data transfer, messaging, video conference scheduling, and automated case history tracking and reporting.
In addition to 24/7 support from the AWS CIRT, the service provides customers with self-service investigation tools and enables them to handle incidents independently or to collaborate with third-party security vendors, based on their needs and requirements.
Additionally, customers can monitor, measure, and improve their security incident response performance over time through access to a service dashboard with metrics such as mean time to resolution (MTTR), number of cases within a specific period, number of triaged findings, and other indicators.
The service integrates with AWS Organizations and customers can get onboard “by selecting a central account within their organization, where all active and historical security events can be created and managed,” AWS says.
To allow the service to monitor and analyze security findings, customers need to enable the proactive response feature to create service-level permissions. The service will automatically analyze and remediate findings based on customer-specific data, and will create security cases for findings that cannot be automatically resolved.
The service can also be configured to execute containment actions, leading to faster incident response times and potentially reduced impact of security incidents, AWS says.
Related: Internet Archive Hacked Again During Service Restoration Efforts
Related: Red Hat Announces General Availability of Malware Detection Service
Related: GuidePoint Security Launches ICS/OT Security Services
Related: Amazon’s Shuttering of Alexa Ranking Service Hits Cybersecurity Industry
