How to Engineer Scalable Corporate Security

TL;DR

A small corporate security engineering team can protect endpoints, cloud services, and employees by combining automation, open-source tools, and custom internal workflows. Duo uses trusted-device certificates, StreamAlert, endpoint telemetry, cloud logs, canary tokens, and structured runbooks to detect suspicious activity quickly while preserving employee trust and avoiding unnecessary long-term data storage.

Transcript

Hello. So, um, if you're squeamish, don't worry. Despite the title of the talk, there won't be any actual corpses during the presentation. Um, so I am a senior information security engineer at Duo Security. I work on what is known as the corporate security engineering team. Um, so our responsibilities in corporate security engineering at Duo are to... Read More

Key Insights

• Corporate security engineering is most effective when limited staff automate routine work and reserve their attention for difficult, forward-looking initiatives. Duo’s experience suggests that one or two engineers can create meaningful value by connecting open-source tools, commercial products, and custom internal systems.
• Trusted-device access is based on certificates that authenticate managed endpoints before they reach company services. Because Duo controls these devices, its security team can install monitoring and enforcement components that support endpoint visibility, detection workflows, and other internal security initiatives.
• Employee trust is a security capability because workers are more likely to raise questions and report concerns when they expect helpful treatment. Duo deliberately avoids becoming a security department that automatically rejects requests, shames employees, or obstructs legitimate business activity.
• Consistency is created through automation and clear analyst runbooks. Repeatable procedures prevent uncertainty about the next response step, help analysts follow the same process across cases, and leave them more capacity to provide a personal and supportive experience to employees.
• StreamAlert is an open-source, AWS-based system for processing large data streams and generating real-time security alerts. It uses Kinesis to move data and Lambda to process events, while detections are expressed as unit-testable Python code with configurable inputs and outputs.
• Ephemeral detection can reduce storage costs because high-volume records do not always need long-term retention. Duo sends data such as VPC Flow Logs through StreamAlert, generates alerts when suspicious activity appears, and discards uneventful records instead of placing everything in a SIEM.
• Duo’s detection pipeline combines endpoint and cloud telemetry from osquery, CloudTrail, GuardDuty, Trusted Advisor, VPC Flow Logs, and canary tokens. These sources can reveal possible malware, publicly exposed S3 buckets, unexpected production communication, cost-saving opportunities, and attempted use of fake AWS credentials.
• StreamAlert’s limitations include its dependence on AWS expertise, difficult post-deployment debugging, stateless operation, and lack of built-in correlation. Local unit tests can validate individual detections, but the complete AWS workflow must be deployed for end-to-end testing, making a separate QA instance advisable.

Questions & Answers

Q: How can a small team scale corporate security engineering?

A small team can scale corporate security by automating common operational work, documenting repeatable analyst procedures, and combining open-source tools with commercial and custom internal systems. Duo has seven corporate security engineers, but the presenter argues that one or two engineers can still produce substantial value after focusing their effort on integrations and difficult, forward-looking initiatives.

Q: What does Duo’s corporate security engineering team protect?

Duo’s corporate security engineering team protects company endpoints, cloud services, and employees from compromise. Its work includes managing internal security applications, monitoring services such as G Suite, Box, LastPass, Office 365, Salesforce, Slack, Zoom, and Duo, supporting employee security education, and maintaining assurance that company information and accounts are not compromised or leaked.

Q: How does trusted-device access work at Duo?

Every trusted device receives a certificate that authenticates it to Duo, allowing the company to identify which endpoints may access its services. These endpoints are managed, so the security team can install necessary software and support internal monitoring initiatives. The environment includes roughly six hundred Macs, two hundred Chromebooks, and a small number of Windows computers.

Q: What is StreamAlert used for in corporate security?

StreamAlert is used to process large volumes of endpoint and cloud data in real time and create alerts when defined suspicious conditions appear. Duo sends sources such as osquery events, AWS logs, VPC Flow Logs, and canary-token activity through it, then routes relevant alerts to destinations including Command, Slack, S3, a SIEM, or case-management systems.

Q: Why might StreamAlert be preferable to SIEM alerting?

StreamAlert can handle higher data volumes with strong performance while avoiding unnecessary long-term storage costs. High-volume data can pass through the system, trigger an alert when suspicious activity is detected, and otherwise be discarded. Duo uses this model for records such as VPC Flow Logs that remain useful for immediate detection but do not always require retention in a SIEM.

Q: What are the main limitations of StreamAlert?

StreamAlert is rigidly connected to the AWS stack and requires familiarity with AWS to deploy and operate effectively. It is also difficult to test the entire workflow locally, even though individual Python detection rules support unit tests. The described version is stateless, lacks built-in alert correlation, and needs engineering support for deployment and continued development.

Q: What security events can Duo’s detection pipeline identify?

Duo’s pipeline can identify possible malware on endpoints, accidental public exposure of an S3 bucket, suspicious communication involving the production environment, and attempted use of fake AWS IAM credentials planted as canaries. Trusted Advisor events can also generate cost-saving notifications. These detections draw from endpoint telemetry, AWS services, network-flow data, and canary tokens.

Q: How does Duo maintain employee trust while enforcing security?

Duo treats employee trust as part of its security program. The team aims to enable legitimate work instead of becoming a department that automatically says no, blocks requests, or shames people for asking questions. It supports employees through education, approachable guidance, automation, and consistent runbooks, helping workers feel comfortable bringing security questions and concerns to the team.

Summary & Key Takeaways

• Duo’s corporate security engineering team protects managed endpoints, cloud services, and employees while supporting business growth. Its seven engineers emphasize visibility, automation, consistent processes, and approachable employee support. The central argument is that even one or two engineers can deliver substantial value by integrating open-source, commercial, and internally developed security tools.

• Duo uses trusted-device certificates and manages roughly six hundred Macs, two hundred Chromebooks, and a small number of Windows computers. Its responsibilities include endpoint management, employee education, and security assurance for services such as G Suite, Box, LastPass, Office 365, Salesforce, Slack, Zoom, and Duo’s own internal instance.

• StreamAlert processes high-volume endpoint and AWS data in real time using Kinesis and Lambda. Python detection rules can be tested with sample data, while alerts can flow to Command, Slack, S3, a SIEM, or case management. Limitations include AWS dependence, difficult end-to-end debugging, stateless processing, and absent built-in correlation.