How Bank Leumi Reduces Time Gaining SaaS Security Insights Using AWS AppFabric

Bank Leumi, Israel’s oldest banking corporation, was established in 1902. It provides high-quality banking services to individuals, small businesses, and large corporations. With over 200 branches and service centers throughout Israel, it is one of the largest corporations in the Middle East. Bank Leumi is dedicated to testing and implementing the latest out-of-the-box solutions to maintain its position as an innovative digital product and service provider.

Over the years, Bank Leumi has undergone a significant digital transformation. For example, in 2023, it migrated its cyber on-premises Datawarehouse to the cloud using Amazon Redshift, which uses SQL to analyze structured and semi structured data across data warehouses, operational databases, and data lakes using AWS-designed hardware and machine learning to deliver the best price performance at any scale. Bank Leumi stores over 150 TB of data using Amazon Redshift and hundreds of gigabytes using Amazon Aurora, a relational database management system built for the cloud.

Bank Leumi has adopted several SaaS applications, such as video conferencing software and customer relationship management software, which empowers its teams to focus on relevant business tasks without developing in-house solutions. However, as one of the largest banks in the country, Bank Leumi needs to constantly monitor its SaaS applications to prevent security issues like data breaches and data loss. It also needs to maintain compliance with various regulations, such as SOC II—a cybersecurity compliance framework for service organizations to store and process client data in a secure manner. “We’re investing a lot in protecting our customers’ assets in Israel and abroad,” says Dudi Levi, head of data in the cyber division at Bank Leumi. “We have many security controls across our data infrastructure to make sure everything is running smoothly.”

Normalizing audit log data from SaaS applications required manual point-to-point integrations across departments within the bank. As a result, it would take more than 3 weeks to get usable insights for the cybersecurity team. Bank Leumi wanted to reduce this manual work for its cybersecurity and IT teams, helping these teams to develop more advanced insights and manage higher-level security matters.

In 2023, Bank Leumi adopted AWS AppFabric to accelerate and simplify ingesting and integrating data in the Open Cybersecurity Schema Framework, which provides a standard schema for common security events, defines versioning criteria to facilitate schema evolution, and includes a self-governance process for security log producers and consumers. “Every SaaS application has a different way of writing and transferring data,” says Sapir Dagan, security data team leader in the cyber division at Bank Leumi. “We knew that using AWS AppFabric would be 10 times less effort than trying to connect to each different SaaS application.”

Setting up AWS AppFabric was a straightforward process for Bank Leumi. “After being introduced to AppFabric, AWS managed to make it beneficial immediately,” says Dagan. “It is a much better solution, and it’s faster to integrate than building our own solutions.”

After beta testing AWS AppFabric, Bank Leumi began using it for its self-service data analytics solution, which uses a three-tier data storage approach to empower different departments to query data in near real time. Using AWS AppFabric, the bank can ingest security logs from SaaS applications seamlessly. “AWS AppFabric works like magic,” says Levi. “We simply connect to the service, put in our credentials, and the data starts flowing.”

Previously, it took Bank Leumi over 3 weeks to integrate and ingest data. Now, its cybersecurity and IT teams have accelerated their time to insights to mere hours. The accelerated time frame also helps Bank Leumi’s various departments to query Bank Leumi’s data and obtain results much faster, receiving insights in only a few days instead of months. “AWS AppFabric is a game-changer for us from a productivity perspective,” says Levi. “It helps us work on what we’re doing with the data, not to the data.”

Using AWS, Bank Leumi collaborates with SaaS providers to more efficiently obtain data logs. For example, AWS AppFabric automatically normalized 50 log event types from one of Bank Leumi’s SaaS applications, which significantly reduced manual work for its teams. “I was overwhelmed by the amount of time we saved,” says Dagan. “The data we are getting now from AWS AppFabric saved us a lot of effort.”

Bank Leumi has seen speed and compliance benefits after integrating only a few SaaS applications using AWS AppFabric. Moving forward, the company plans to bring more SaaS applications into its solution. The company also plans to expand its use of AWS AppFabric to other types of logs in the future. More broadly, Bank Leumi is building a cloud-focused architecture using AWS AppFabric and other AWS solutions to improve customer experience.

“If the bank will use a SaaS application and AWS AppFabric is supporting it, we will use AWS AppFabric as our first choice,” says Levi. “It saves a lot of time and helps us to focus on the tasks that we need to do to fulfill our business metrics.”