How to Cut Time-to-Security-Incident-Detection on AWS

Time-to-detection is everything these days. If you don’t find a breach yourself, chances are someone else will. A recent study points out that up to 27% of breaches are discovered by third parties. This includes vendors or partners you work with, auditors, and probably most damaging of all — your customers.

The problem most companies are grappling with today is how to cut time-to-detection to ensure that they are the first ones to know about an issue, and in a way that won’t put a resource drain on the team. Last Thursday, Chris Gervais, Threat Stack’s VP of engineering, sat down with George Vauter, a senior software security engineer for Genesys, Jarrod Sexton, the lead information security manager for Genesys, and Scott Ward, the solutions architect at Amazon Web Services (AWS), to have a frank discussion about this in a webinar format.

Genesys is a leader in omnichannel customer experience and customer engagement software, with both on-premise and cloud-based offerings. PureCloud, their cloud-native microservice platform, is run on AWS, so the team has extensive experience launching and scaling in the cloud, as well as building a “secure-by-design” platform.

In our conversation, Genesys outlined several important steps that all companies should be implementing to reduce their time-to-detection, which we wanted to further highlight in today’s post. Read more “How to Cut Time-to-Security-Incident-Detection on AWS”

Join Threat Stack at Velocity 2017


According to its organizers, the upcoming O’Reilly Velocity Conference is the “best place on the planet for web ops and systems engineering professionals” to learn from their peers, exchange ideas with experts, and share best practices and lessons learned for handling modern systems and applications.
Read more “Join Threat Stack at Velocity 2017”

10 Best Practices for Securing Your Workloads on AWS

Achieving optimal security in a cloud environment can seem like a moving target. New security threats are constantly popping up along with security implementations meant to fight them off. To help you achieve optimal security in this environment, this post highlights the top 10 best practices for AWS security. Read more “10 Best Practices for Securing Your Workloads on AWS”

How to Leverage Automation to Make Your Organization Secure by Design

Yesterday, we co-hosted a webinar with Amazon’s security strategist, Tim Sandage, and SessionM’s director of technical solutions and operations, Jason LaVoie, to discuss how companies can become secure by design using automation.

With cloud providers like AWS making it easier than ever to get up and running in the cloud, the next item on the agenda for many is how to get security up to speed as well. In yesterday’s webinar, Tim, Jason, and our own senior security engineer, Patrick Cable, offered practical and strategic ways for companies to do just this. Read more “How to Leverage Automation to Make Your Organization Secure by Design”

Assessing the State of the Shared Responsibility Model

We hear (and at Threat Stack, we write) a lot about the shared security responsibility model. This is the idea that, when it comes to the cloud, businesses are responsible for the security of their data and applications in the cloud, while providers are responsible for the security of the cloud infrastructure.

But are companies prepared to take responsibility for their end of the bargain? How far do we still have to go to reach the promised land of a successfully shared responsibility model? Below, we’ll explore where we stand today and what it will take to reach that holy grail. Read more “Assessing the State of the Shared Responsibility Model”

OneLogin Gains Granular Security Control With Threat Stack on AWS

OneLogin’s Journey on AWS

OneLogin, an identity and access management (IAM) company, is dedicated to superior security for their users, which starts with their own stringent security posture. Since OneLogin’s customers typically come from regulated industries such as healthcare and online retail, OneLogin needed the ability to definitively show that their security, and that of their customers, was as secure as possible at any given moment. Read more “OneLogin Gains Granular Security Control With Threat Stack on AWS”

Join Threat Stack’s Automating AWS Security Webinar

Secure by Design: Automating Security for Your Cloud Deployment

Security and DevOps teams are both being asked to make their organizations run faster and more securely while proving it in the form of compliance audits and completed security questionnaires. But no one has the time — and few have the knowledge — to do all this, let alone do it well.

Read more “Join Threat Stack’s Automating AWS Security Webinar”

Join Threat Stack’s Pete Cheslock at Monitorama 2017

On August 10, 1628, the Swedish warship Vasa began its maiden voyage, and after sailing approximately 1,400 feet, promptly heeled over and sank, causing total loss of the ship as well as the deaths of 53 sailors.

What does this have to do with project managing large, complex software systems? Find out by joining Threat Stack’s Pete Cheslock at Monitorama in Portland, Oregon, May 22–24. Read more “Join Threat Stack’s Pete Cheslock at Monitorama 2017”

Meeting Compliance in the Cloud ≠ A Choice

In the past, we’ve talked about various ways that compliance can add value to your business. But what happens when you don’t attain or maintain compliance. (Note: In the following, we focus on PCI, but equally unpleasant consequences can result, of course, if you fail to meet other standards such as HIPAA, SOC 2, etc.). Read more “Meeting Compliance in the Cloud ≠ A Choice”