Cyber threat intelligence sharing on AWS
summary
Demo of a national CTI platform shows a working build: ACSC CTIS on AWS ingests STIX/TAXII/MISP feeds, enriches indicators, and distributes actionable blocks; one case flags a phishing URL mimicking a social‑services site and triggers PDNS takedown. AWS tooling is concrete: GuardDuty, Network Firewall, Route 53 Resolver DNS Firewall, Security Lake, Athena, Lambda, SageMaker are used to automate prevention and hunting. AWS reports Sonaris blocked 24 billion S3 scans and ~2.6 trillion service discovery attempts, and MadPot honeypots collect >100M attempts/day.
AI-written summary · about
chapters (9)
- 0:00Introduction to talk
- 2:51What is CTI and why it matters
- 10:17Global regulatory context
- 13:27Australian case study
- 16:36AWS threat intelligence
- 20:54Getting started on AWS
- 30:18Logging challenges and solutions
- 42:04Reducing false positives
- 48:34Four key takeaways
related talks
26mScaling cyber threat intelligence sharing with the AUS Cyber Security Center
32mAdvanced threat detection and response on AWS
53mHow AWS threat intelligence becomes managed firewall rules
20mFantastic AWS Attacks and Where to Find Them
27mProactively identifying threats & protecting sensitive data in S3
28mAWS security at scale
13mA guide to strengthening your threat detection and response
56mContinuous innovation in AWS detection and response services