A Security Solutions Leader in its Own Right, Lookout Relies on Uptycs for Workstation and AWS Infrastructure Security

Lookout Gets Significant ROI From Uptycs

Having joined Lookout three-plus years ago, Grant Kahn brings an extensive security background to his role as its security  intelligence engineering director. His team  performs a variety of infrastructure, cloud, and application security functions.

Used mostly for compliance, Uptycs was already operational when Kahn arrived at Lookout. However, it was underutilized. “Since then, we’ve realized significant ROI on our Uptycs investment,” he says. “It’s feeding  us useful intelligence on both our production and user endpoints.”

For production systems, Uptycs is the behavior-based antimalware story. “The same alerts can be categorized as either normal  user endpoint background noise or as extremely concerning if they occur on  production systems—and vice versa,” says Kahn. “We worked to get our asset groupings right, so we’ve got the right information  coming at the right time. And we’ve been able to cut down on noise.”

Deep Asset Inventory and Service Categorization is Essential

How Lookout performs its core functions makes asset categorization quite complicated. Kahn explains, “Our dynamic analysis  infrastructure reaches into suspicious places, downloads things then takes them apart to see what they are. That’s normal and acceptable behavior. But if my Mac is touching a known bad place I want to know about that.”

The company’s application architecture is based on microservices, and the teams responsible for these services are autonomous. Kahn says that when an alert requiring follow-up occurs, his team needs to know precisely which of the services teams to talk to. This is managed internally through AWS metadata tags. Every AWS service has a tag, and every instance has a tag that identifies what service it is. The AWS metadata tags are essentially the source of truth about Lookout’s infrastructure.

“We’re able to create matching asset groups in Uptycs, to which we can apply our backend and all the things we want to do based on our nomenclature,” says Kahn. “We worked closely with Uptycs’ customer support to get this working exactly the way we want.”

Kahn gives an example of the power of using AWS asset tagging in Uptycs and other Lookout systems. “Before Uptycs, if we learned that EC2 instance 29.68.47.82 is doing a potentially bad thing, it would take a long time to figure out what that action is. I had to take that IP over to the AWS console, figure out what it was, who owned it, where it sat, whether I care about it or not, and then figure out if it was doing what it was supposed to be doing.
“With Uptycs, my service tag on the instance informs me right away. I look and see it's just this instance that's part of, say, a policy engine service doing X, Y, and Z. If it shouldn't be doing that, I can jump right on it. This offers a whole new range of capabilities and security operational efficiencies for us."

“The service tags are part of our IRT’s runbook. That team can look up who’s on call for that service and tell them what to look at for an incident. We’ve been able to create runbooks that help the IRT fulfill some of the functions of a SOC. That was the final step in fitting the Uptycs information stream into the broader Lookout security monitoring information stream.”

Uptycs Improves How Lookout’s ELK-based SIEM Functions Meet FedRAMP Requirement

Lookout is under a FedRAMP requirement to have a single pane of glass for security event monitoring. The company uses an ELK-based SIEM for this purpose. But Kahn says it’s difficult to use and expensive when handling large data volumes. “Its query infrastructure and indexing, and even just generally creating an alert, are a hassle with ELK,” he explains. 

“Instead, the security team feeds the data to Uptycs, where it does the analysis, then sends the highly filtered results to ELK. This way, we don’t have to store the enormous volume of data twice, and we get the best analysis from Uptycs.”

Kahn says they’re looking at using Uptycs for AWS CloudTrail logs instead of having ELK do it. This is because Uptycs is more feature-rich and faster in its ability to analyze data and generate alerts. Only the filtered results will then be fed into ELK, thus satisfying FedRAMP’s ‘single pane of glass' requirement.

“When we feed that data through Uptycs, we extract actual intelligence out of it,” says Kahn. “We can offload all of that from the very expensive, per-cluster ELK licenses, shut down all that storage and the processing nodes, and get all the intelligence we need out of Uptycs— with just the cream going over to ELK. Eventually, we’ll be able to decommission some of the ELK resources and save considerable expense by doing even more in Uptycs.”

Because of FedRAMP requirements, Lookout doesn’t use the Uptycs SaaS for data analysis. Instead, it has deployed a unique Uptycs instance directly into their AWS account that Lookout controls, maintains, and monitors. Uptycs engineers simply update this in-account system to keep it aligned with its SaaS version.

Lookout now has a level of visibility across its AWS estate it didn’t previously enjoy. “We had CloudWatch and other information from AWS, but Uptycs gives us a single data model and query ability that’s very powerful,” says Kahn. “The Uptycs analytics backend just takes all that data and makes it accessible and useful.”