AWS Digital Forensics Automation at Goldman Sachs

Level: 300

During a security issue, answers are needed quickly. This often starts with evidence collection and log correlation. Companies generally have runbooks and standard operating procedures to respond to security issues, but this process tends to be manual, time consuming, and prone to human error. Goldman Sachs has automated an event-driven cloud response solution that uses AWS native services to successfully collect disk and memory evidence from Amazon EC2 instances. The solution uses AWS security services Amazon GuardDuty and AWS Security Hub. It also leverages a variety of services such as AWS Lambda, AWS Step Functions, and AWS Systems Manager (SSM). In this tech talk, we will provide an overview of Goldman Sachs' environment and a deep dive on how we built automation for digital forensics using AWS native services.