Managing Your Environment with AWS Config

Moving through the incident response domain, you have now come to the next critical service that you need to know about, one that helps to show you what has changed after an incident has occurred—AWS Config.

AWS Config and its configuration recorder can help you take a real-time inventory of most of the resources in a single account running in a single Region or can be configured to collate data across multiple Regions and even multiple accounts.

The service provides an even greater functionality when it comes to security. For organizations that need to maintain a compliance security standard, AWS Config can evaluate your resources instantly or on a fixed schedule and, with the help of Config rules, determine whether they are in or out of compliance. If they are found to be out of compliance, you can use a combination of Lambda and System Manager to automate remediations to either destroy items that do not meet the compliance standards...

Technical Requirements

You will require access to the AWS Management Console with an active account along with AWS CLI access. It is also helpful to have an understanding of coding concepts when you go through the remediation code presented in this chapter.

Event Management with Security Hub and GuardDuty

In the process of creating your infrastructure and granting user access to your account, you need to be on the lookout for the security of your environment. There’s a good possibility that your environment will be changing on a constant basis. This means that the security status of your environment could change as well, potentially leading to new vulnerabilities.

One of the challenges of being a security professional is trying to stay on top of all these different changes. Simply being in charge of one account that is full of users is challenging on its own. In an enterprise type environment in which you are responsible for a whole AWS Organization comprised of numerous accounts under different organizational units, it can be almost impossible to keep track of changes without help.

The AWS Security Hub tool was designed with the above problems in mind. It allows you to track multiple accounts from inside an account in the...

Technical Requirements

You will require access to the AWS Console with an active account and AWS CLI access for this chapter. You will also need minimal Git skills to clone a repository with sample code. Finally, knowing how to find your IP address will help in one of the exercises.

Manage threat detection with AWS GuardDuty

For those unfamiliar with GuardDuty, it is a fully managed, intelligent threat-detection service powered by machine learning that continually provides insights into unusual and/or unexpected behavioral patterns within your account that could be considered malicious. Amazon GuardDuty can process and analyze millions of events captured through your AWS CloudTrail, DNS, and VPC Flow logs from a single account or multiple accounts. These events are then referenced against numerous threat detection feeds, many of which contain known sources of malicious activity, including specific URLs and IP addresses.

Amazon GuardDuty is continually learning, based on the day-to-day operations within your account, to differentiate between normal behavior and what could be considered abnormal behavior so it can effectively indicate a threat within your infrastructure. This behavioral-based analysis allows GuardDuty to detect potential interactions and connectivity...

Security Alerting with AWS Security Hub

With so many security tools available in both AWS and from third-party providers, those that are responsible for managing the alerts need a single pane of glass to centralize all the alerts and all the notifications coming in. AWS Security Hub helps you consolidate many of your security findings, alerts, and compliance reports from AWS services including the following:

• AWS Identity and Access Management (IAM)
• Amazon Macie
• Amazon GuardDuty
• Amazon Inspector
• AWS Firewall Manager

In addition to these native AWS Services, AWS Security Hub can be incorporated into any third-party partner solutions such as Sumo Logic, Splunk, and other vendors you might use in your organization. A complete list of these partners can be found at https://aws.amazon.com/security-hub/partners/.

The Security Hub service allows you to categorize and prioritize all the events coming in from various sources. This single-pane-of-glass view gives...

Summary

This chapter concludes Section 2 on incident response with a review of AWS services of Security Hub and GuardDuty. You explored how the GuardDuty service works and how it presents its findings. You also took a walkthrough of setting up the GuardDuty service from the Amazon Management Console.

You also took a look at the Amazon Security Hub service and examined how it can present security findings from AWS security services such as GuardDuty, Amazon Macie, Amazon Inspector, AWS Firewall Manager, and third-party services in a unified view, thereby making tracking your security posture much easier on yourself as a security professional.

The next chapter will begin the next domain in the AWS Security Specialty exam, Logging and Monitoring. This domain concerns the different types of logs you can capture, how to capture them, and what they tell you.

Further Reading

For additional information on the AWS shared responsibility model and an underlying foundation to AWS security, please look at the following resources:

• Amazon GuardDuty FAQs

  https://aws.amazon.com/guardduty/faqs/

• Remediating security issues discovered by GuardDuty

  https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_remediate.html

• Journey to Adopt Cloud-Native Architecture – Enhancing Threat Detection, Data Protection, and Incident Response

  https://aws.amazon.com/blogs/architecture/journey-to-adopt-cloud-native-architecture-series-5-enhancing-threat-detection-data-protection-and-incident-response/

• Building a Self-Service, Secure, and Continually Compliant Environment on AWS

  https://aws.amazon.com/blogs/architecture/building-a-self-service-secure-continually-compliant-environment-on-aws/

• Amazon Security Hub FAQs

  https://aws.amazon.com/security-hub/faqs/

Exam Readiness Drill – Chapter Review Questions

Apart from a solid understanding of key concepts, being able to think quickly under time pressure is a skill that will help you ace your certification exam. That is why working on these skills early on in your learning journey is key.

Chapter review questions are designed to improve your test-taking skills progressively with each chapter you learn and review your understanding of key concepts in the chapter at the same time. You’ll find these at the end of each chapter.

How To Access These Resources

To learn how to access these resources, head over to the chapter titled Chapter 21, Accessing the Online Practice Resources.

To open the Chapter Review Questions for this chapter, perform the following steps:

1. Click the link – https://packt.link/SCSC02E2_CH05.

   Alternatively, you can scan the following QR code (Figure 5.7):

Figure 5.7: QR code that opens Chapter Review Questions...