Security Graphs on AWS

Modern security profiles take a layered security approach. No individual layer stops all threats, but together they mitigate a wide variety of threats and provide redundancy should any layer fail. It is important to realize that these layers are often loosely coupled and individually managed. By storing this information in a graph, the relationships between those layers can be modeled and analyzed to provide a holistic view of the security profile and to find gaps across the layers.

Bad actors plan their schemes in form of a graph. They need to understand what infrastructure they can utilize that will have pathways to the system or data they target, what identities they can compromise that will give them access to that infrastructure, and what telemetry or monitoring they need to circumvent. To protect your organization’s resources, you can model them as a graph representing how they are connected to each other and the users. This makes it easy to discover valuable insights, such as over extended permissions leading to resources vulnerability. If a resource is compromised, you can query your graph to find out the attack surface and where security may be compromised through the installation of backdoors or other malware.

Graph databases help to store and manage your security graph because they are purpose-built to store and navigate the relationships in your data. Their query languages are designed to work with data that is highly connected, making querying the data for patterns and connections simple, fast, and reliable. Graph databases treat relationships as “first-class citizens,” have flexible schema, and provide higher performance for graph query traversals. This makes graph databases capable of sophisticated threat detection and breaches in security by utilizing the relationships between users, roles, and IT resources.

Using a relational database for your security graph is challenging because relational databases are built for storing and analyzing tabular data. They are inefficient at storing and querying the relationships between highly interconnected entities such as network resources and access patterns where you need to explore and visualize connections and groups within the data. Using a relational database and SQL to query relationships can result in multiple complex joins and longer processing times that may lead to missed opportunitites in indentifying security risks.

You can build your security graph solution using Amazon Neptune, a fast, reliable, fully managed graph database service that makes it easy to build and run applications with highly connected data. 

Amazon Neptune is purpose-built for storing billions of relationships and querying the graph with milliseconds latency. Neptune is compatible with open graph APIs, and supports popular graph models Property Graph and W3C's RDF, and their respective query languages Apache TinkerPop Gremlin, openCypher, and SPARQL. While graph databases usually require extensive hardware management, provisioning, and manual scaling, Neptune is a fully managed service, so you no longer have to worry about database management tasks. You can be up and running with Neptune clusters in a matter of minutes, with a few clicks in the AWS Management Console or API calls.

With Neptune, you can query relationships in your data to easily uncover insights in your data such as users with access to resources or how your infrastructure is connected. Neptune provides a fully managed service to execute fast graph queries to be able to detect unwanted access or exposed resources in real time and helps you manage the security of your IT infrastructure. You can also use Neptune’s native integration with Amazon OpenSearch Service or export your graph data to analytics and security tools such as Splunk to search for insights in your data and discover security events.