Study Guides/AWS Cybersecurity Notes/AWS Security Hub

AWS Security Hub

This consolidates the security findings compliance and alerts.

This includes:

AWS IAM

Macie

Guard Duty

Inspector

Firewall Manager

Third party tools:

AWS Security hub can be intergrated to work with many 3rd party applications.

Think of security hub as a central point for a comprehehsive picture of security

By default security hub is a regional service.

Member and master accounts can be setup.

Securty hub administrator is the core account

Security hub member are the leaf accounts

Compliance use case

Security hub can be used for automated compiance checks.

Out of the box Security Hub performes 43 fully automated checks.

They checks are based on the CIS foundations framework.

Security hub looks at configutation and use at the account level.

AWS config: looks at the resource level.

HUB = High level

Hub depends on config

To enable AWS hub you must first have AWS Config enabled.

Baseloine infomration for hub comes from AWS Config

This data refresheshes security hub in alomost realtime

Standards / Contoles and Checks

When enabling you are asked to select a security standard.

Some of these are:

• AWS securirty bes practices

• CIS AWS Foundations benchmarks

• NIST 800-53

• PCI-DSS

Processing payment infomration

Select PCI-DSS (45 controls)

Concerned about the CIA triad

Select NIST 800-53 (216 controls)

Once a standard is enabled security checks will be run.

AWS Config is used to run the security checks.

Checks can be done on a scedule.

Checks can be done whenver a change is detected.

Security hub uses the findings to generte a score.

Security hub insights

Managed insights:

These only work if the product is integrated.

Custom insights:

Can be created with Security HUB API, AWS CLI or PowerShell

You must select an attribute to group by.