Explore cloud workload protection with GuardDuty, feat. Booking.com
summary
Amazon GuardDuty adds runtime monitoring with a lightweight agent (SSM-managed on EC2, auto-injected sidecar on Fargate, daemonset on EKS) that streams kernel and process telemetry to a backend via a managed VPC endpoint; the service already ships 36 runtime findings and stops charging flow log volume for instrumented hosts. GuardDuty also ships a newly launched S3 malware scanning with automated tagging and quarantine for new uploads. Booking.com runs GuardDuty everywhere—2,500 accounts across 20 regions—and uses the findings to prioritize and automate triage.
AI-written summary · about
chapters (9)
- 0:00Introduction and speakers
- 1:37GuardDuty overview
- 11:08Findings and integrations
- 12:51Runtime monitoring
- 22:20Agent implementation details
- 31:41Malware protection for S3
- 42:21Booking.com case study
- 47:19Operationalizing security
- 52:19Conclusion and resources
related talks
29mAutomating Threat Detection and Remediation
06mDemo - Amazon S3 security posture management and threat detection
56mContinuous innovation in AWS detection and response services
32mAdvanced threat detection and response on AWS
34mLayering AWS security services to automate incident response
49mCloud operations: A catalyst for innovation
54mHow to layer threat detection & monitoring security services
37mOptimizing Cloud Detection & Response With Security Chaos Engineering