What is AWS Amazon GuardDuty? – Understanding Amazon GuardDuty Course

Hello and welcome to this lecture where I want to provide an introduction to the service, explaining what it is, what it does, and the problem that it solves.

AWS still treats security as its number one priority across its public cloud. They know that without adequate security techniques, mechanisms, and measures in place to safeguard and protect their customers and their data, their customers will not have the confidence to use their services. Cloud security can still be seen as one of the main reasons that companies are slow to adopt cloud technology from a public cloud provider such as AWS. Much of this can be attributed to the lack of cybersecurity skills within an organization. Not having the knowledge and ability to confidently implement a high level of security within the cloud can be damaging to an organization.

Security is an ongoing development process. As technology changes, so do threats and risks against that technology. With this comes a need for newer, more advanced and powerful tools to protect against these threats, and AWS is at the forefront of this development.

Prior to Amazon GuardDuty, there were 10 other services that sat within the security, identity, and compliance category of the AWS Management Console, making this service the 11th. Each security service has a very specific function and benefit that it provides to assist and help customers control, manage, and operate a secure and safe environment within the cloud. The services within this category already cover a wide scope of features and security mechanisms, so how does this new service differ from the rest that already exist?

Amazon GuardDuty is a regional-based intelligent threat detection service, the first of its kind offered by AWS, which allows users to monitor their AWS account for unusual and unexpected behavior by analyzing AWS CloudTrail event logs, VPC flow logs, and DNS logs. It then uses the data from logs and assesses them against multiple security and threat detection feeds, looking for anomalies and known malicious sources, such as IP addresses and URLs.

The service itself is powered by machine learning, and this allows the service to continuously evolve by learning and understanding operational behavior within your infrastructure. Amazon GuardDuty then uses this data to look for erroneous patterns within your AWS account that could indicate potential threats to your environment. These threats could be behavioral based, where a resource has been compromised by an account or credential exposure, unexpected API calls that sit outside security best practices, or even communications from suspicious sources.

Using different threat detection feeds, some generated from public sources and some by AWS, Amazon GuardDuty provides automatic and continuous security analysis for safeguarding your entire AWS environment. Any findings generated by the service are presented and issued with a priority level that enables you to investigate the issue further to ensure that your environment is not compromised and exposed unnecessarily. Amazon GuardDuty is very simple to activate within your account, and unlike other more traditional threat detection mechanisms, there is no need to install any agents or software on your resources, meaning that this is a very scalable and flexible security tool to have enabled.

With this in mind, it’s also possible to link your AWS accounts together to perform a threat detection layer across all of your accounts. In addition to this, the service itself operates entirely on AWS infrastructure, providing zero impact of the performance of your own existing resources within your account. Threat detection is key in the defense against a security breach. Having the ability to respond to a potential threat as it is detected significantly reduces the chances of a breach. Cyber criminals are using more advanced techniques to infiltrate networks and hosts using zero-day threats, and Amazon GuardDuty is the latest service to help defend against these attacks.

That now brings me to the end of this lecture. Coming up next, I will be discussing the different components of the service and how it fits together.