Steve Seaney: Leveraging AWS services to streamline compliance

AWS Community Day Midwest 2024
Leveraging AWS services to streamline compliance
Steve Seaney

1. Leveraging AWS services to streamline
compliance
Steve Seaney
Managing Director, AWS Line of Business
Rego Consulting, Inc
Ganesh Prabhu
Solutions Architect
Amazon Web Services

2. Agenda
•Rego Introduction
•Annual Governance Life Cycle
•Integrating WAFR within a compliance cycle
•Building a cost reduction roadmap
•Leverage AWS Services to help survive a SOC / ISO Audit
•Essential elements for building a security roadmap
•Conclusion
•Questions
2

3. Rego Introduction

4. Who is Rego?
Rego Consulting is one of the world’s largest Project
Portfolio Management (PPM), AWS, FinOps, Apptio, TBM
and Agile consulting firms.
We’ve guided 700+ organizations through their AWS,
PPM, FinOps, and Work Management journeys, including
60% of Fortune 100 companies.
We are the only Clarity by Broadcom SaaS provider on
AWS, as well as the #1 global reseller. We implement and
maintain over ~150 AWS Production Environments for our
clients.
With 10+ years of experience, we bring industry leading
best practices to every client.
4

5. AWS Governance Life Cycle

6. Annual Governance Life Cycle
Cost
SOCFocus
WAFR
Leverage WAFR to update AWS
roadmap and stories
Q1
Set annual cost reduction goals and update stories
Q2
Support annual SOC or ISO audit efforts
Q3
Update roadmap and plan for critical focus area (security)
Q4

7. Life Cycle Phase Objectives
WAFR Phase Q1 Cost Reduction PhaseQ2
SOC or ISO Audit PhaseQ3 Focus Area - SecurityQ4
•Objective is to build an annual AWS plan
•Focus on AWS related changes
•Ignore process items redundant with
SOC / ISO Audit
•Real outcome is stories (not a report)
•Objective is to create cost reduction plan
•Include past and upcoming AWS cost reductions
•Minimize process items redundant with SOC / ISO
Audit
•Real outcome is stories with cost goals
•Objective is to satisfy auditors
•Focus on process related items
•Leverage AWS dashboards and reports
•Real outcome is to be efficient
•Objective is to dig into a critical area
•Security can include WAF changes, etc.
•Great time to review guard rails
•Real outcome is stories

8. Integrating WAFR within a
compliance cycle

9. Well Architected Review Phase
ToolsObjectives
•16-month AWS services roadmap
•Roadmap includes creating stories
•Focus on technical aspects of AWS
•Deprioritize process related discussions
•What services changes since the last WAFR
•What services have upcoming changes
•What issues need addressing
•What can we cost effectively automate
•AWS WAFR Tool
•AWS WAFR Lenses
•AWS Security Hub
•AWS Organizations
•Partner Tool Criteria
•Improve Efficiency
•Maintains Data Sovereignty
•Magnifies AWS Tools
•Enables Automated Remediation
•Rego’s preferred tool is 6-Pillars

10. Building a cost reduction roadmap

11. Cost Reduction Roadmap
ToolsObjectives
•16-month AWS net cost reduction roadmap
•Roadmap includes creating stories
•Plan should include high level cost targes
•Update AWS Budget Settings
•Update AWS Cost Categories
•SaaS Customer focus on cost per usage
•Detailed dive into key cost criteria
•Cost for network services
•Cost for storage
•Cost for compute
•Cost for security and support
•AWS Cost Explorer
•AWS Budget Tool with alerting
•AWS Cost Categories
•Partner Tool Criteria
•Forecasting and trending views
•Detail drill down
•Maintains Data Sovereignty
•Magnifies AWS Tools
•Alerts and remediation
•Rego’s preferred tool are Apptio and nOps

12. SOC or ISO Audit Phase

13. Surviving the ISO/SOC phase
ToolsObjectives
•Improve efficiency with each audit
•Create stories for required changes
•Create stories for periodic requirements
•Minimize the impact on the DevOps and
SecOps teams
•Ideally, 80% of the discussion will be on
process topics
•AWS Quicksight for reusable reporting
•Users, Groups, and Permissions
•Patch Compliance over time
•License Compliance over time
•Control tower is amazing!
•Security Hub, ASR, and Config are critical
•AWS License Manager for evidence
•AWS SSM including patch manager
•AWS Audit Manager is not listed
•Partner tools - Drata looks compelling

14. Essential elements for building a
security roadmap

15. Security is Job Zero
ToolsObjectives
•Create and address security related stories
•Adopt latest Security Hub Standards
•Identify ASR opportunities and gaps
•Adopt changes to Organizations
•Audit and adjust Control Tower Guard Rails
•Audit Patch Manager
•Audit Inspector settings and compliance
•Audit Guard Duty settings
•Security Hub, ASR, and Config
•AWS Control Tower and Config
•AWS Organizations
•AWS SSM and Patch Manager
•Partner Tool Criteria
•Maintains Data Sovereignty
•Magnifies AWS Tools
•Alerts and automated remediation
•Rego’s preferred is 6Pillars

16. Conclusions & Questions

17. Annual Governance Life Cycle
Cost
SOCFocus
WAFR
Leverage WAFR to update AWS
roadmap and stories
Q1
Set annual cost reduction goals and update stories
Q2
Support annual SOC or ISO audit efforts
Q3
Update roadmap and plan for critical focus area (security)
Q4

18. Thank you
[email protected]