Security operations

This guide is for attendees in a security operations role protecting their organization's AWS environment. Check out these session recommendations if your job involves detecting or responding to threats.

Consultant, PrimeHarbor Technologies

My hat goes off to everyone in the security operations space. You’re looking at endless events, tracing a thread of evidence back to an initial compromise, constantly building detections for the latest threats, and trying to stay ahead of the TTPs of APTs and ransomware syndicates.

Well, security operations professional, this guide is for you. I’m seeking out the sessions that will tell me what threats I need to be looking for, how to find them, and how to navigate the vast amount of information to find that signal, all while trying to address this new world of AI.

We come together at these events to network and collaborate, and my inclination is to maximize the value of interactivity with peers and AWS experts.

Session Type

Breakout sessions

TDR302 | Detecting and responding to threats in generative AI workloads

Level 300 — Advanced

What jumps out at me is "build out threat detection and incident response capabilities for a generative AI workload that uses Amazon Bedrock." Let's face it, AI is new and has many facets. I look forward to a talk that dives into what we need to do to protect these applications from threat actors.

Learn more

TDR305 | Risk intelligence sharing on AWS

Level 300 — Advanced

As someone who's been attending every re:Invent and re:Inforce since 2014, I love the sessions that feature customers. You'll always get some practical advice from a customer. I also love threat intel sharing, so a customer talk on this topic is super interesting.

Learn more

Session Type

Builders' sessions

IAM353 | Machine-to-machine access with IAM Roles Anywhere

Level 300 — Advanced

Long-term access keys are the easiest way to get multi-cloud authentication working and also the easiest way to find yourself in a security event. While they have their place, there are many better options, and this builders' session walks you through the process of doing authentication more effectively.

Learn more

TDR354 | Insights in your inbox: Build email reporting with AWS Security Hub

Level 300 — Advanced

Do all the findings from AWS Security Hub give you imposter syndrome? Do you need a way to prioritize and bring order? Do you need a better way to get issues in front of the builders who ultimately need to resolve them? Then bring your laptop and learn how you can extract value from Security Hub and get a holistic view of your entire organization and all AWS Regions.

Learn more

Session Type

Chalk talks

DAP232 | Innovate responsibly: Deep dive into data protection for generative AI

Level 200 — Intermediate

No matter how debatable the use cases for generative AI are, as security practitioners, we still need to protect our organizations from outside threats and the models themselves. This chalk talk is an excellent chance to dive in with AWS and ask the hard questions on how their underlying services protect customers.

Learn more

IAM431 | The life of an IAM policy

Level 400 — Expert

This was one of the best sessions at previous re:Inforce and re:Invent events. This chalk talk examines how SCPs, policies, session policies, permission boundaries, and conditions are evaluated. It's a must-see for anyone doing highly complex permissioning in AWS.

Learn more

TDR332 | Anatomy of a ransomware event targeting data within AWS

Level 300 — Advanced

Anyone protecting their AWS environment should know where threats are coming from. This is the third time I have seen this or a similar chalk talk being given. It is an excellent deep dive into actual ransomware events that have impacted cloud customers and provides actionable advice on how to prevent or respond to an event.

Learn more

TDR331 | Unlock OCSF: Turn raw logs into insights with generative AI

Level 300 — Advanced

My joke about AWS CloudTrail is, "So I have 3 billion JSON objects in a bucket. Now what?" All customers need something that can take a pile of OCSF findings and do something useful with them, but most can't afford or dedicate the time to figuring it out.

Learn more

TDR432 | New tactics and techniques for proactive threat detection

Level 400 — Expert

The AWS CIRT sees more security events before 9 AM than you'll see in your whole career (hopefully). I'm keenly looking forward to what they can share and how I can leverage that to update my cloud threat models.

Learn more

TDR433 | Incident response for multi-account and federated environments

Level 400 — Expert

Identity federation is the way to manage joiners, movers, and leavers properly in AWS. Many large organizations use something other than AWS IAM Identity Center's identity store to manage their users. I'm glad to see that AWS recognizes that we all use third-party providers and is willing to talk about it.

Learn more

Security operations

This guide is for attendees in a security operations role protecting their organization's AWS environment. Check out these session recommendations if your job involves detecting or responding to threats.

Breakout sessions

TDR302 | Detecting and responding to threats in generative AI workloads

TDR305 | Risk intelligence sharing on AWS

Builders' sessions

IAM353 | Machine-to-machine access with IAM Roles Anywhere

TDR354 | Insights in your inbox: Build email reporting with AWS Security Hub

Chalk talks

DAP232 | Innovate responsibly: Deep dive into data protection for generative AI

IAM431 | The life of an IAM policy

TDR332 | Anatomy of a ransomware event targeting data within AWS

TDR331 | Unlock OCSF: Turn raw logs into insights with generative AI

TDR432 | New tactics and techniques for proactive threat detection

TDR433 | Incident response for multi-account and federated environments

Join the AWS Cloud community