Siemens Boosts Security Visibility Across 800+ AWS Accounts Using Amazon Security Lake

Siemens, a large industrial manufacturing and technology company, centralized its security data to improve visibility across more than 800 Amazon Web Services (AWS) accounts. The company streamlined manual efforts by adopting Amazon Security Lake, which automatically centralizes security data in a few steps.

Siemens creates technologies that empower industry, infrastructure, transport, and healthcare. The company’s Foundational Technology division provides services for its developers to securely build and deploy software.

The Cloud Security Operations team in this division is responsible for more than 800 AWS accounts but lacked the capacity to store high-volume security logs in its centralized storage. Siemens had developed custom automations to send logs from AWS CloudTrail—which tracks user activity and API usage on AWS—and Amazon Virtual Private Cloud (Amazon VPC)—used to define and launch AWS resources in a logically isolated virtual network—to Splunk, an AWS Partner. However, these custom solutions were insufficient. The security team manually migrated other logs to Splunk based on ticketing requests. “It could take several weeks to turn requests around manually,” says Pedro Borges, senior security engineer at Siemens.

Recognizing the potential to transform its security operations, Siemens beta tested and adopted Amazon Security Lake. The company also began using Cribl, an AWS Partner, to extract and aggregate specific data fields for analysis and monitoring in Splunk.

“After we saw how efficiently we could send data from Amazon Security Lake to Splunk using Cribl, the ball started rolling fast,” says Scott Schwartz, software engineering senior manager at Siemens. “This rapid integration of diverse data sources has given us unprecedented visibility into our security landscape.”

This efficiency created a swift transformation of Siemens’ security infrastructure. Now, the company can onboard new security logs in 1–2 days without manually migrating the data. Within 1 year, Siemens had integrated multiple high-value, high-volume data sources, including Amazon VPC Flow Logs; server access logs from Amazon Simple Storage Service (Amazon S3), an object storage service; and logs from AWS WAF, which protects web applications from common exploits.

Siemens’ centralized operational data empowers its security teams to shorten its mean time to resolve. In one investigation, Siemens identified what data in Amazon S3 was impacted in an event within 10 minutes as opposed to several days. “Our team has more confidence now that we’re collecting these logs and monitoring for security use cases,” says Borges.

Siemens ingests 5–7 TB of security data daily into Amazon Security Lake, then uses Cribl to forward only the most relevant 600 GB of data to Splunk for detailed analysis, a 90 percent reduction. Siemens saved 1.3 million dollars annually while aggregating more logs.

“Using Amazon Security Lake, we have dramatically improved visibility across our entire AWS infrastructure. We can ingest multiple data sources into Splunk and run threat detections against our data in AWS, which helps us satisfy our compliance requirements,” says Schwartz. “This service will help us stay ahead of potential threats while managing the complexity of our large-scale AWS environment.”