What is our primary use case?
We use it for anomaly detection and security compliance.
How has it helped my organization?
Lacework has helped us in a couple of areas. The first is that it helps us with compliance and third-party risk assessment. We do a lot of third-party risk assessments for other people that ask us questions about how we monitor our environment and who want to know what our security posture looks like. Lacework gives us the ability to respond favorably to those kinds of questions and we rely on the tool for that a lot. In terms of breach risk assessment, it helps us improve the confidence of third-party risk assessors and stakeholders. When they know that we're using Lacework or some other tool like that to help with anomaly detection and compliance to known standards, that is certainly a big benefit.
With regards to vulnerabilities, we can point to the Lacework reporting for some of that information to demonstrate compliance with NIST 800-53, CIS, and other security standards. It's very helpful from that perspective.
It also helps us from a day-to-day monitoring perspective, to know where we are in time with our security posture and if anything new has come in or something has changed in the environment that warrants some kind of immediate action.
And because it helps us focus on the severity of alerts, it has helped us bring down the number of alerts. If you work on trying to understand the cause of each of the alerts, and you then identify the appropriate actions to clear them, that will help you reduce the number of alerts. We've been able to leverage the tool to help us gain insights into some of the more nuanced challenges and vulnerabilities.
If you take action on the alerts it's telling you about, it will help save time on manual compliance tasks. Like any tool though, if you're not understanding the alerts in the context of your architecture, and then taking the action needed to clear those alerts, it probably isn't saving you much time. But it is saving me time in helping me understand exactly what those alerts are about. It helps us focus on the right things. I would give it credit there, for sure.
It also helps free up staff a little bit because it doesn't take as many people to keep tabs on the environment as it used to. I don't feel we're spending as much time on that.
What is most valuable?
The most valuable features are the anomaly detection and security compliance, both, that the product does pretty well.
For anomaly detection, it parses things using a severity scale of low, moderate, and high, and that helps provide context to the urgency and prioritization of the alerts that you get in the tool. And on the compliance side, it supports several benchmarks, including CIS, NIST 800-53, as well as other security standards. It will give you insights into compliance against those standards so you can see how your product is configured and if it complies with the best security practices of those standards.
Where it really shines is in helping you detect anomalous activities and known threats, assuming that you have it properly configured. Out-of-the-box, it's not difficult to configure. You do need to do some minor configuration work depending on how you deployed your application. But for the most part, out-of-the-box, it tells you right away about the things you need to work on. I like the fact that it prioritizes alerts based on severity, so that you can focus your efforts on anything that would be critical/high first, moderate second, and work your way down, trying to continue to improve your security posture. That part works very well.
Also, to the extent that attackers are trying to take advantage of vulnerabilities that you may have in your system, Lacework is very good at giving you a view of your environment from an attacker's perspective. It provides context to help understand how easy or difficult, and how likely or unlikely, it is for an adversary to exploit the vulnerabilities that you may have.
In addition, it's really good at continuously monitoring, 24/7, 365. It's designed to do that. It's constantly working in the background to protect our AWS workloads, and I feel good about that. It's very important because it's one of the things we rely upon the most to give us insights into our security posture at any given point in time.
I also like a lot of the dashboards and reports. They're fairly user-friendly and easy to understand.
What needs improvement?
The biggest thing I would like to see improved is for them to pursue and obtain a FedRAMP moderate authorization. I think they have an ISO 27001 or SOC 2 or maybe both, but they don't have any kind of FedRAMP security authorization. The challenge that creates for us is that we have products in the FedRAMP environment, and to use Lacework in such an environment, it has to be FedRAMP authorized. I don't believe they have any immediate plans to get FedRAMP moderate authorized, which is a bit of a challenge for us because we can only use Lacework in our commercial environment.
We have one government product, and a second one on the way right behind it, that require a FedRAMP authorization. We're unable to use Lacework for the government work that we have because it doesn't have a FedRAMP moderate authorization. We're at a point where if they don't get FedRAMP authorization, sometime in the future, we may be forced to look in another direction, unless we want to continue using more than one tool for the same thing. Doing so is a little bit frustrating from an administrative perspective.
For how long have I used the solution?
We have been using Lacework for a little over two years.
What do I think about the stability of the solution?
The overall stability of Lacework is good. They're obviously a growing organization and they continue to expand. I've seen that they've hired some leaders from other organizations, and they have put together plans to continue to scale and grow the company, and that's encouraging.
What do I think about the scalability of the solution?
We haven't had any issues with scaling. The biggest concern you have is the licensing structure, where one Lacework unit is 200 resources and AWS resources. But it's easy to scale and they're pretty flexible in that department.
How are customer service and support?
We have contacted their tech support on multiple occasions. They're very good, very timely in terms of responding. Generally speaking, they give us good feedback and help us work through most of our problems. There have been a couple of stickier and more challenging problems that have taken some more time to work through, but generally speaking, they've been pretty good about working through issues in a timely manner.
They have a method of escalating when an issue doesn't get resolved in a timely manner, which is good. Sometimes, it takes a little bit longer to engage the supplemental support, get them up to speed on a problem, and get them engaged because that may not be their primary responsibility. But they do help get you through an issue if you give them enough time.
How would you rate customer service and support?
How was the initial setup?
We have it rolled out across multiple AWS accounts that are associated with several of our commercial products.
What was our ROI?
We have definitely seen ROI with Lacework. We used to have more people monitoring things in a more manual way. Lacework has reduced the amount of effort and time applied to monitoring.
We've also leveraged some of the integrations, for example with Jira, so that when an anomaly or alert comes in, we automatically generate a Jira record, which somebody then has an assigned action to go look at. Those are examples of where it's really saved some time. Instead of having someone say, "Yep, there's an alert. I need to create a ticket," it automatically creates a ticket, assigns it to someone on our team, and then they look at it, investigate, and disposition it accordingly.
What's my experience with pricing, setup cost, and licensing?
The pricing has gotten better. That scenario was somewhat unstable. They have a rather interesting licensing structure. I believe you get 200 resources per "Lacework unit." It was difficult, in the beginning, to figure out exactly what a "resource" was. That was not well defined. When I first started working with Lacework, that was something that we provided feedback to them about, that it was something they needed to improve. That was a problem until about a year or so ago.
They have improved it and it has stabilized quite a bit. And I will give them credit as well for being somewhat flexible, especially for their early adopters and customers, as they worked through some of their licensing and pricing-related challenges.
If you have a lot of ephemeral resources, that can throw off your numbers a little bit. But again, they average those to try to keep it balanced. That's pretty reasonable.
Which other solutions did I evaluate?
Lacework is pretty good at ingesting data to correlate workloads and account behaviors. As long as you have the tool properly configured, it will give you correlation information. It's not as much information as you might get out of some other products, potentially, but it does give you good correlation information against some of those standards that I mentioned. To the extent that there's overlap in those standards, we do see the same kind of compliance or other issues pop up more than once.
What other advice do I have?
My advice is to understand what it's going to do for you and what it's not going to do for you. It's very good at highlighting vulnerabilities in your architecture or your system, and it's very good at identifying non-compliance and anomalies. It's not going to do anything outside of that. Those are the things it's intended to do and that it focuses on.
In terms of our time and effort spent on security incidents and threat-hunting, the reduced alerting that has resulted from using Lacework is a mixed bag. I look at Lacework as being part of an overall suite of tools that help us look at the environment. I wouldn't rely upon it too much for threat intelligence. That's not its primary wheelhouse. But, as I mentioned, it does offer us a whole lot in terms of looking at our security posture at a point in time.
We need to be more careful when we roll out new services because we often don't have them properly vetted. Sometimes, when we do that, Lacework will tell us there are a lot of issues with them. But if you use the tool for monitoring those things in a development or staging environment, and it tells you that you have those issues, it will be very helpful in identifying the vulnerabilities and bringing focus to clearing them before you roll something out into production.
The only thing that we do from a maintenance perspective is that we periodically review alerts that are suppressed. Sometimes, you'll run across alerts that don't have value or context in your architecture, based on how you're designed. We will look at those and validate that they should continue to be suppressed, based on our architecture or a similar valid reason for suppressing them. That's pretty much the extent of the maintenance.
Which deployment model are you using for this solution?
Public Cloud
If public cloud, private cloud, or hybrid cloud, which cloud provider do you use?
Amazon Web Services (AWS)
