AWS snaps up Sqrrl to strengthen threat detection, analytics

A recent Amazon acquisition is likely to lead to another tool to help AWS customers monitor the security of their sensitive data.

Sqrrl, a start-up for security, confirmed this week that it had been taken over by Amazon and would be integrated with AWS. The Cambridge, Massachusetts-based company has its roots in the NSA and focuses on threat detection, hunting and incident response, based on the growing trend of security analysis.

Rumors about the matter are circulating since December when it was reported by Axios. AWS did not publicly confirm the agreement, but this report indicates that the agreement was about $ 40 million. According to Prendergast, co-founder and CEO of Evident.io, a cloud security and compliance company in Pleasanton, the deal works well for Amazon because of the relatively low price and Sqrrl's experience with large sets of data. , California

"Sqrrl is a leading candidate for the integration of GuardDuty, Amazon's internal response and telemetry security team to provide customers with a threat warning," he said. "It seems a natural and logical process to offer and provide better security services over time."

GuardDuty, which became available last November, is the AWS threat detection service that provides alerts based on the intelligent assessment of its own network. Sqrrl can help improve this service with more advanced answers once the threats are detected.

The agreement comes a year after AWS took over a new start-up, Harvest.ai, whose team and alleged technology was used to build Amazon Macie. Macie, which was made available in August 2017, uses machine learning to recognize and keep sensitive data in Simple Storage Service (S3) and warns about abnormal behavior.

AWS touted the shared responsibility model long ago to ensure the safety of the underlying infrastructure, but this model forces its customers to lock everything they build on the AWS cloud. Over time, the company has added important security features, such as key management and identity federation, to make greater use of corporate IT services, not just startups and industries.

Over the past two years, AWS has added many security tools to address security issues and track data: Amazon Cloud Directory, Amazon Inspector, AWS Single Sign-On, AWS Shield, AWS IoT Device Defender, and Amazon GuardDuty. AWS has also updated some of its default settings to prevent embarrassing exposure to sensitive data when customers leave their S3 buckets open to the public.

Despite these efforts, one of the biggest criticisms of AWS cloud security was the incoherent nature of the various tools. Sqrrl can help to meet this short waiting time, which is especially important because Microsoft has made a leap forward in this area in many ways, Prendergast said. For example, Microsoft has integrated detection and threat detection tools into Office 365, Windows Defender Advanced Threat Protection, and as components in Azure Security Center.

"Microsoft has introduced many security chips this year to ensure that customers get defense and depth and make decisions about multiple layers of infrastructure, while Amazon is able to view each layer individually and not bring everything together - a holistic application", he said.

When you get to the cloud [SIM data] come and go so quickly, so if you're a security team you've got to resolve that in a hybrid environment.