MLSEC-13: Monitor human interactions with data for anomalous activity
Ensure that data access logging is enabled. Audit for anomalous data access events, such as access events from abnormal locations, or activity exceeding the baseline for that entity. Use services and tools that support anomalous activity alerting, and combine their use with data classification to assess risk. Evaluate using services to aid in monitoring data access events.
Implementation plan
-
Enable data access logging - Verify that you have data access logging for all human CRUD (create, read, update, and delete) operations, including the details of who accessed what elements, what action they took, and at what time.
-
Classify your data - Use Amazon Macie
for protecting and classifying training and inference data in Amazon S3 . Amazon Macie is a fully managed security service. It uses ML to automatically discover, classify, and protect sensitive data in AWS. The service recognizes sensitive data, such as personally identifiable information (PII) or intellectual property. -
Monitor and protect - Use Amazon GuardDuty
to monitor for malicious and unauthorized activities. This will enable protecting AWS accounts, workloads, and data stored in Amazon S3 .
Documents
Blogs
Videos
Examples
