AWS Security Transformation

A leading multi-national energy company is embarking on a major AWS security transformation.

Overcoming Security Challenges in a Multi-Year Cloud Transformation

The company were embarking on a major multi-year cloud transformational journey, moving much of their on-premise estate into AWS and becoming a cloud-first organisation. Part of this transformation involved the creation of new centralised platform teams that managed the core AWS platform and AWS security functionality. From a security perspective, the company wanted to go “cloud native” as much as possible and required specialist cloud security expertise to help them make this happen.

From Strategy to Execution: Embedding AWS Security Capabilities

Hydras, a part of the Acora Group, is a boutique consultancy that specialise in providing cloud security capability and the company engaged Hydras, over and above their existing large corporate suppliers, to firstly provide AWS consultancy and architecture expertise, helping them set a strategic direction in terms of AWS security tooling and building some initial proof of concepts to prove out the theory. Hydras security consultants worked with the companies security leadership to provide a strategic implementation plan, covering the core security domains of Identity and Access Management, Infrastructure and Data Security, Security Detection and Response and Application Security. Additionally, Hydras security engineers built out initial tooling to to prove this capability, giving the company a short feedback loop that provided immediate value.

Once this phase was complete Hydras were further engaged on a multi-year project to provide AWS Engineering, Operations and Assurance activities to help implement the strategic plan.

Hydras engineers built out AWS native security products and integrated them into the companies existing systems in order to expose security issues and vulnerabilities via automation. This included:

• AWS Organisations for account management and governance
• AWS Cloudtrail for logging
• AWS Config for asset capture and change management
• AWS GuardDuty for threat detection,
• AWS Security Hub for compliance monitoring
• AWS Inspector for vulnerability management
• AWS Systems Manager for on-host security management & patching
• AWS access analyzer and advisor for entitlements management

Operations expertise was provisioned to support the engineering team, providing DevOps capability, as well as to act as specialist advisors to internal customers. Consultancy and assurance capability was provided to aid internal customers in the implementation of AWS security. These consultants would work directly as embedded members of internal teams as specialist security advisors, helping customers achieve the required level of AWS security to meet the internal company control set.

Turning Security Ambition into AWS Reality

Hydras was successfully able to provide its unique cloud security expertise to aid a large corporation in its journey to the cloud, firstly by providing a clear strategic plan and then executing it by automating the enablement of security tooling and the implementing of platform security controls and security monitoring across the companies AWS estate. In total security tooling was automated in over 3000 AWS accounts.

Hydras was also able to provide the required security expertise by embedding consultants directly into internal customer teams to evangelise AWS security and educate developer teams in building security into their internal development processes.

The company now has a successfully operating cloud security team that is continually evolving and providing security expertise across the corporation. Hydras maintains an active working relationship with the customer with continued embedded consultants supporting the central and internal customer teams.