Hackers of India

DIAL - Did I Alert Lambda? Centralised Security Misconfiguration Detection Framework

 Saransh Rana   Rashid Feroze   Harsh Varagiya 

2023/08/09

Abstract

Workloads on the cloud provide equal opportunities for hackers as much as they do for internal teams. Cloud-native companies are open to attacks from both outside forces and from within. With the ever-growing risk of a security breach and cloud misconfiguration being one of the most common factors of the same, the mean time to detect is supposed to be reduced to seconds instead of minutes/hours.

DIAL, or “Did I just alert Lambda?”, is a cutting-edge security monitoring and alerting system that provides centralized visibility and analysis of potential internal threats and security misconfigurations across multiple AWS accounts. By leveraging the stateless nature of AWS Lambda, DIAL enables easy modular deployment and makes it highly scalable and cost-efficient, making it an efficient and effective tool for detecting and mitigating security risks.

It’s an event-driven framework, because of which detection time for identifying any security misconfiguration is less than 4 secs whereas traditional SIEM detection time for misconfigurations is more than 5-7 minutes and It can easily be deployed in any organization using its cloud formation stack.

With DIAL, you can deploy a central security monitoring solution on your AWS accounts for pennies compared to deploying a traditional SIEM solution and can gain end-to-end visibility of their AWS infrastructure and receive timely alerts on issues like public database exposure and over-permissive IAM policies, helping them to proactively safeguard their systems and data.