Ho-ho

The challenge

Ho-ho Americas is a digital exchange platform that promotes the circular economy and creative reuse by enabling people to buy, sell, and exchange items in a secure and sustainable way.

Organizations operating on AWS face increasingly complex security incidents that require a fast, structured response aligned with AWS best practices. Key challenges included: lack of standardized processes for incident detection and response, limited operational visibility based on metrics and logs, inconsistent security configurations across accounts and environments, manual responses that increased mitigation time, and risks arising from unmanaged access and weak configurations.

The solution

AWS Security Incident Response provides a standardized operating model to prevent, detect, respond to, and recover from security incidents on AWS, integrating technical controls, operational processes, and account governance.

The solution is built on: full automation of infrastructure and operational changes through Infrastructure as Code, network, encryption, and identity security controls aligned with AWS best practices, continuous workload health monitoring using metrics, logs, and alerts, operational runbooks and incident response playbooks, and resilient, highly available, and scalable architectures.

The architecture includes: Detection Layer with workload health metrics collected in Amazon CloudWatch across Lambda, networking, and managed services; centralized operational and network logs for analysis and troubleshooting; Response Layer with automated alarms and notifications based on defined thresholds activated using Amazon CloudWatch; Governance and Access Layer with federated access using temporary credentials across IAM, elimination of operational use of the root account, mandatory MFA and centralized identity control; Resilience and Availability Layer with Multi-AZ architectures for high availability, automatic scaling using AWS Auto Scaling; Remediation Layer with controlled fixes delivered through CI/CD pipelines and versioned infrastructure validated prior to production; and Cost Optimization Layer with serverless architecture.

Results

• 75% reduction in manual operational effort by eliminating console-based changes and adopting CI/CD pipelines
• 60% reduction in configuration-related incidents through standardized, versioned deployments
• Data encryption in transit and at rest as a standard
• Centralized and secure cryptographic key management
• Incident detection time reduced by more than 90%, from hours to under 5 minutes
• Automated alerts for degradation or anomalies
• Consistent application of the principle of least privilege
• 30% reduction in compute costs by eliminating always-on resources through serverless architecture