Event Management with Security Hub and GuardDuty

In the process of creating your infrastructure and granting user access to your account, you need to be on the lookout for the security of your environment. There’s a good possibility that your environment will be changing constantly. This means that the security status of your environment could change as well, potentially leading to new vulnerabilities.

One of the challenges of being a security professional is trying to stay on top of all these different changes. Simply being in charge of one account that is full of users is challenging on its own. In an enterprise-type environment in which you are responsible for a whole AWS organization, comprised of numerous accounts under different organizational units, it can be almost impossible to keep track of changes without help.

The AWS Security Hub tool was designed with the aforementioned problems in mind. It allows you to track multiple accounts from inside an account in the...

Technical Requirements

You will require access to the AWS Management Console with an active account and AWS CLI access for this chapter. You will also need minimal Git skills to clone a repository with example code. Finally, knowing how to find your IP address will help in one of the exercises.

Managing Threat Detection with Amazon GuardDuty

For those unfamiliar with Amazon GuardDuty, it is a fully managed, intelligent threat-detection service, powered by machine learning, that continually provides insights into unusual and/or unexpected behavioral patterns within your account that could be considered malicious. Amazon GuardDuty can process and analyze millions of events captured through your AWS CloudTrail, DNS, and VPC Flow Logs from a single account or multiple accounts. These events are then referenced against numerous threat detection feeds, many of which contain known sources of malicious activity, including specific URLs and IP addresses.

Amazon GuardDuty is continually learning, based on the day-to-day operations within your account, to differentiate between normal behavior and what could be considered abnormal behavior, allowing it to effectively indicate a threat within your infrastructure. This behavioral-based analysis allows GuardDuty to detect potential interactions...

Security Alerting with AWS Security Hub

With so many security tools available in both AWS and from third-party providers, those that are responsible for managing the alerts need a single pane of glass to centralize all the alerts and notifications coming in. AWS Security Hub helps you consolidate many of your security findings, alerts, and compliance reports from AWS services, including the following:

• AWS Identity and Access Management (IAM)
• Amazon Macie
• Amazon GuardDuty
• Amazon Inspector
• AWS Firewall Manager

In addition to these native AWS services, AWS Security Hub can be incorporated into any third-party partner solutions, such as Sumo Logic, Splunk, and other vendors you might use in your organization. A complete list of these partners can be found at https://aws.amazon.com/security-hub/partners/.

The Security Hub service allows you to categorize and prioritize all the events coming in from various sources. This single-pane-of-glass view gives you...

Summary

This chapter concludes Section 2 on incident response, with a review of the AWS services Security Hub and GuardDuty. You explored how the GuardDuty service works and how it presents its findings. You also walked through setting up the GuardDuty service from the Amazon Management Console.

You then took a look at the Amazon Security Hub service and examined how it can present security findings from AWS security services, such as GuardDuty, Amazon Macie, Amazon Inspector, AWS Firewall Manager, and third-party services in a unified view, thereby making tracking your security posture much easier on yourself as a security professional.

Chapter 7, Logs Generated by AWS Services, will begin the next domain in the AWS Security Specialty exam, logging and monitoring. This domain concerns the different types of logs you can capture, how to do so, and what they tell you.

Further Reading

For additional information on the AWS shared responsibility model and to gain more comprehensive understanding of AWS security, refer to the following resources:

• Amazon GuardDuty FAQs: https://packt.link/6ZWIM
• Remediating security issues discovered by GuardDuty: https://packt.link/ghtre
• Journey to Adopt Cloud-Native Architecture – Enhancing Threat Detection, Data Protection, and Incident Response: https://packt.link/HU5cX
• Building a Self-Service, Secure, and Continually Compliant Environment on AWS: https://packt.link/hIZCS
• Amazon Security Hub FAQs: https://packt.link/CaHMF

Exam Readiness Drill – Chapter Review Questions

Apart from a solid understanding of key concepts, being able to think quickly under time pressure is a skill that will help you ace your certification exam. That is why working on these skills early on in your learning journey is key.

Chapter review questions are designed to improve your test-taking skills progressively with each chapter you learn and review your understanding of key concepts in the chapter at the same time. You’ll find these at the end of each chapter.

How To Access These Resources

To learn how to access these resources, head over to the chapter titled Chapter 21, Accessing the Online Practice Resources.

To open the Chapter Review Questions for this chapter, perform the following steps:

1. Click the link – https://packt.link/SCSC02E2_CH06.

   Alternatively, you can scan the following QR code (Figure 6.19):

Figure 6.19: QR code that opens Chapter Review...