TUI Enhances Security Control Management with Automated Security Response on AWS

Initially, TUI Group used a custom compliance framework to monitor and maintain security standards. This solution worked well for early cloud deployments, but as TUI Group grew its AWS footprint, the company needed a more scalable approach. Engineers had to check security findings region by region, making it difficult to maintain a full view of their security posture and taking time away from product development.

TUI Group made a strategic decision to employ more automation, using AWS native solutions to overcome these limitations and the overhead on developers on remediations. The company first selected AWS Security Hub for its ability to provide a unified, comprehensive view of security alerts across all accounts and regions. To streamline remediation processes through automation, the team then implemented Automated Security Response, which is available through the AWS Solutions Library.

Automated Security Response provides predefined response and remediation actions based on industry compliance standards and best practices for security threats. The open-source nature of this solution was particularly appealing for TUI Group; the company could incorporate custom code and create additional features that were tailored to its evolving security needs.

Using AWS Security Hub, TUI Group consolidates security insights from Amazon GuardDuty and other AWS native security services to protect AWS accounts, workloads, and data with intelligent threat detection. With these services in place, TUI Group gained a foundation for a unified interface to monitor security alerts across all AWS accounts and regions where it operates.

Building on this foundation, TUI Group customized the Automated Security Response solution to meet its needs. The company developed custom and prebuilt playbooks to automatically respond to and remediate specific security scenarios automatically, such as unauthorized configuration changes or non-compliant resources. The AWS product team played a key part in the process by introducing several feature improvements based on TUI Group’s requirements. A key area of collaboration between the AWS team and TUI Group was in the development of an integration feature with Automated Security Response and TUI’s security exceptions approval workflow for security policy compliance.

“Our customized compliance framework, based on Automated Security Response, empowers TUI Group to enhance its cloud posture while reducing cognitive load on our engineers,” says Simon Mehigan, Chief Information Security Officer at TUI Group. “This supports our goal of maintaining zero critical and high-priority findings against AWS best practices across our estate.”

Instead of requiring engineers to log on to each region separately to check security findings, the new framework consolidates data across regions to a single source. This consolidation provides a comprehensive view of TUI Group’s security posture across its entire cloud infrastructure, which empowers security teams to quickly identify, prioritize, and respond to potential incidents while keeping consistent security standards across all regions and AWS accounts. With these improvements, TUI Group has boosted its security control management with Automated Security Response.