Blog

Cloud

Cómo la duplicación del tráfico de Amazon VPC ampliada mejora la seguridad de la nube de autoaprendizaje de Darktrace

Cómo la duplicación del tráfico de Amazon VPC ampliada mejora la seguridad de la nube de autoaprendizaje de DarktraceDefault blog imageDefault blog image
10
Mar 2021
10
Mar 2021

With self-learning Cyber AI, the Darktrace Immune System brings real-time visibility and adaptive, autonomous defense to your AWS cloud security strategy.

The platform continuously learns what normal behavior looks like for every user, device, and workload in your AWS environment. With this deep understanding of usual ‘patterns of life,’ the Darktrace Immune System can recognize the subtle deviations that point to a threat, from account takeovers to critical misconfigurations.

This bespoke, real-time knowledge of usual activity allows Darktrace to spot the unknown and unpredictable threats that get through policy-based defenses – all without relying on any rules, signatures, or prior assumptions.

With Amazon Virtual Private Cloud (Amazon VPC) Traffic Mirroring, Darktrace’s self-learning AI can seamlessly access granular packet data in AWS cloud environments, helping the platform build a rich understanding of context. AWS’s recent announcement of the extension of VPC Traffic Mirroring to non-Nitro instance types now allows our customers to gain agentless Cyber AI defense across these instances as well.

Expanding VPC traffic mirroring to non-Nitro instances

Amazon VPC Traffic Mirroring replica el tráfico de red de las instancias EC2 dentro de las VPC y permite a los clientes aprovechar este tráfico para la detección e investigación de amenazas impulsada por la IA de Darktrace. La Cyber AI de Darktrace aprende "sobre la marcha" cómo es la actividad normal en los entornos de AWS de los clientes, en parte utilizando la visibilidad en tiempo real proporcionada por VPC Traffic Mirroring. La plataforma se adapta continuamente a medida que el negocio de cada cliente evoluciona, una característica crítica dada la velocidad y la escala de desarrollo en la nube.

Previously, customers could only enable VPC Traffic Mirroring on their Nitro-based EC2 instances. Now, AWS has announced that this seamless access to hundreds of features from network traffic is extended to select non-Nitro instance types, supporting Darktrace’s ability to easily learn the bespoke behavioral patterns of our customers’ Amazon VPCs.

Customers can now enable VPC Traffic Mirroring on additional instances types such as C4, D2, G3, G3s, H1, I3, M4, P2, P3, R4, X1 and X1e that use the Xen-based hypervisor.* This feature is available in all 20 regions where VPC Traffic Mirroring is currently supported.

VPC Traffic Mirroring supports many of Darktrace’s extensive use cases across AWS, which include:

  • Data exfiltration and destruction: Detects anomalous device connections and user access, as well as unusual resource deletion, modification, and movement;
  • Critical misconfigurations: Catches open S3 buckets, anomalous permission changes, and unusual activity around compliance-related data and devices;
  • Compromised credentials: Spots unusual logins, including brute force attempts and unusual login source/time, as well as unusual user behavior, from rule changes to password resets;
  • Insider threat and admin abuse: Identifies the subtle signs of malicious insiders – including sensitive file access, resource modification, role changes, and adding/deleting users.

Figure 1: The Darktrace Immune System illuminates activity in AWS

Autonomous investigation and response for AWS cloud environments

The Darktrace Security Module for AWS provides additional visibility across AWS environments via interaction with AWS CloudTrail, allowing for AI-powered monitoring of management and administration activity. With this deep knowledge of how your business operates in the cloud, Darktrace delivers total coverage across all your AWS services, including:

  • EC2
  • IAM
  • S3
  • VPC
  • Lambda
  • Athena
  • DynamoDB
  • Route 53
  • ACM
  • RDS

The recently announced Version 5 of the Darktrace Immune System platform, which focuses on protecting the cloud and the remote workforce, further augments Darktrace’s coverage of AWS environments. Among many other exciting new features, Version 5 extends the reach of Cyber AI Analyst and Darktrace Antigena to cloud environments like AWS VPCs.

Cyber AI Analyst augments the work of security teams by autonomously reporting on the full scope of security incidents and reduces triage time by up to 92%. Cyber AI Analyst can now also conduct on-demand investigations into users and devices of interest, ingest third-party alerts to trigger new investigations, and automatically feed AI-generated Incident Reports to any SIEM, SOAR, or downstream ticketing system.

Meanwhile, Darktrace Antigena brings Autonomous Response to the critical infrastructure which AWS VPCs provide. Antigena’s Autonomous Responses are surgically precise and intelligently maintain normal business operations while stopping emerging threats in real time.**

“The innovations in Version 5 are outstanding and have really meshed with our current needs as a security team, from the flexibility of our new cloud-delivered deployment to the extended visibility of the Darktrace Client Sensors.” Peter Murphy, Technology Manager, Linc Cymru Housing Association

We have also launched a dedicated user interface for visualization and intuitive analysis of cloud-based threats identified across AWS via the Darktrace Security Module.

Self-learning AI defense across the enterprise

The Darktrace Immune System offers AI-driven defense of cloud infrastructure in AWS, as well as across SaaS applications, email, corporate networks, industrial systems, and remote endpoints. Taking a fundamentally unique approach, Darktrace provides the industry’s only self-learning platform that gives complete coverage and visibility across the organization.

This is a critical benefit, as businesses and workforces today are increasingly complex and dynamic. With Darktrace’s Immune System platform approach, our Cyber AI can connect the dots between unusual behavior in disparate infrastructure areas and ensure cloud security is not siloed from the monitoring of the rest of the organization.

Darktrace’s adaptive and unified approach allows the solution to detect, investigate, and respond to the full range of threats facing the enterprise – even those unpredictable threats that move across dynamic and diverse environments.

Thanks to Darktrace product marketing executive Meghan Michel for her insights.

Learn more about Darktrace and AWS

* VPC Traffic Mirroring is not supported on the T2, R3 and I2 instance types and previous generation instances.
** This product is only available in AWS for customers who leverage Darktrace osSensors.

More in this series:

No se ha encontrado ningún artículo.

¿Te gusta esto y quieres más?

Reciba el último blog en su bandeja de entrada
Gracias. Hemos recibido su envío.
¡Ups! Algo salió mal al enviar el formulario.
DENTRO DEL SOC
Darktrace son expertos de talla mundial en inteligencia de amenazas, caza de amenazas y respuesta a incidentes, y proporcionan apoyo al SOC las 24 horas del día a miles de clientes de Darktrace en todo el mundo. Inside the SOC está redactado exclusivamente por estos expertos y ofrece un análisis de los ciberincidentes y las tendencias de las amenazas, basado en la experiencia real sobre el terreno.
AUTOR
SOBRE EL AUTOR
Andrew Tsonchev
VP of Technology

Andrew is a technical expert on cyber security and advises Darktrace’s strategic customers on advanced threat defense, AI and autonomous response. He has a background in threat analysis and research, and holds a first-class degree in physics from Oxford University and a first-class degree in philosophy from King’s College London. His comments on cyber security and the threat to critical national infrastructure have been reported in international media, including CNBC and the BBC World.

Cobertura básica
Este artículo
Cómo la duplicación del tráfico de Amazon VPC ampliada mejora la seguridad de la nube de autoaprendizaje de Darktrace
Compartir
Twitter logoLinkedIn logo

Buenas noticias para su negocio.
Malas noticias para los malos.

Inicie su prueba gratuita

Inicie su prueba gratuita

Entrega flexible
Puedes instalarlo virtualmente o con hardware.
Instalación rápida
Sólo 1 hora de instalación - y aún menos para una prueba de seguridad del correo electrónico.
Elige tu viaje
Pruebe IA de autoaprendizaje donde más lo necesite, incluyendo la nube, la red o el correo electrónico.
Sin compromiso
Acceso completo al visualizador de amenazas Darktrace y a tres informes de amenazas a medida, sin obligación de compra.
Gracias. Hemos recibido su envío.
¡Ups! Algo salió mal al enviar el formulario.

Obtenga una demostración

Entrega flexible
Puedes instalarlo virtualmente o con hardware.
Instalación rápida
Sólo 1 hora de instalación - y aún menos para una prueba de seguridad del correo electrónico.
Elige tu viaje
Pruebe IA de autoaprendizaje donde más lo necesite, incluyendo la nube, la red o el correo electrónico.
Sin compromiso
Acceso completo al visualizador de amenazas Darktrace y a tres informes de amenazas a medida, sin obligación de compra.
Gracias. Hemos recibido su envío.
¡Ups! Algo salió mal al enviar el formulario.