AWS Security Hub Exposure Findings | Amazon Web Services

Key Takeaways

Hi everyone. Today we're going to be learning about AWS Security Hub's exposure findings. Security Hub is AWS's unified cloud security solution. Security Hub ingest signals from multiple AWS security services to monitor for threats and suspicious activity, scan for vulnerabilities across workloads, track compliance to security standards, discover exposed network paths, and identify sensitive data exposure. At its core, Security Hub provides four key capabilities in one unified solution. Automated correlation of related findings, intelligent prioritization, actionable insights, and automated response capabilities. This integrated approach benefits security teams that need to investigate critical risks that need immediate attention, monitor security trends across cloud environments, and automate responses to streamline remediation. Exposure findings are a new finding type in security hub today. Exposures represent a shift in how we help customers understand risks. Instead of looking at individual findings in isolation, we automatically correlate signals across multiple AWS security services. This includes findings from AWS security hub CSPM, Amazon Inspector, and Amazon Macy. The correlation helps identify toxic combinations of vulnerabilities and misconfigurations. All of this enabling true riskbased prioritization of security issues. This approach delivers four key benefits for security teams. Firstly, you can rapidly triage your security findings instead of manually connecting the dots between related vulnerabilities. Exposure findings does this for you automatically. Secondly, you gain a deeper understanding of risk. You'll see how different configurations and vulnerabilities work together to create security gaps that might not be obvious when viewed separately. Third, you get clear insights into which resources could be potentially exploited. This helps you focus your attention where it matters most. Finally, this comprehensive view enables more confident decision-m about which issues to address first, helping you make the most effective use of your security resources. Now, let us take a look at exposure findings in detail. The exposure summary dashboard implements a severitybased classification system that quantifies and prioritizes security exposures. Security hub categorizes findings into critical, high, medium, and low severity based on multiple factors and exposure indicators. Looking at the types of findings, you can see examples of exposure finding types such as potential credential stealing, potential unauthorized access, potential remote execution, and potential data destruction. Let's click into one of these findings. A potential credential stealing finding with a critical severity which shows an internet reachable EC2 instance with an administrative instance profile that has a network exploitable software vulnerability with a high likelihood of exploitation. You will see that we have three instances in my account that could be at risk. The finding summary page shows me the resources associated with this finding along with the status, attributes, and traits that are involved in this finding. The finding correlates multiple traits across three key domains. Reachability which indicates potential network exposure, vulnerability which indicates that the resource is exposed to common vulnerabilities and exposure and resource misconfiguration that indicates a misconfigured resource. Each trait contributes distinct indicators that security hub synthesizes into a comprehensive exposure assessment. Clicking onto an example of this finding details multiple layers of technical analysis. I can choose to expand this finding view into full screen mode. Here I can see a detailed exposure summary overview that succinly details why the finding was raised as well as the impact should the finding be exploited. I can also see a potential attack path visualization showing potential exploitable paths, the associated security traits as well as an affected resource inventory with its configurations. You will see that AWS security hub has identified three resources involved in this exposure finding an EC2 instance, the subnet that it belongs to, as well as the IM role that is misconfigured. This view allows you to have a comprehensive understanding of your exposure without having to toggle into separate consoles. Now let's take a closer look at the attack path visualization which can also be expanded into full screen mode. The attack path visualization provides a comprehensive network topology view that maps the affected EC2 instance and its network interfaces associated VPC components including subnets security group and network ACL configurations as well as internet gateway dependencies and exposure paths. I can also see further resource relationships such as the EC2 instance profile attached to my instance and the policy granting administrator access to my IM role. Along this network visualization, AWS security hub also maps the traits involved with these resources. This graph-based representation enables rapid identification of potential attack vectors and easily allows you to drill down further to investigate and take action. From here, I can choose to drill down further into my EC2 resource details to learn more about the contributing traits. Traits here are separated into contributing traits as well as contextual traits. Contributing traits represent security issues that are directly contributed to the scenario that has resulted in this exposure finding. For example, I can see that this EC2 instance is reachable by port 80 and the details of the CBE affecting the EC2 instance that has a high likelihood of exploitation. Contextual traits represent additional security findings and configurations associated with the resources in question but did not directly contribute to this exposure findings. Here I can see that my EC2 instance allows access to IMDS using version one as well as the other software vulnerabilities related to this EC2 instance. I can now investigate and remediate each of these different findings. Returning to the exposure findings window, I can now see what I can do to take action. AWS Security Hub supports the ability for you to update severity levels, update finding status, as well as adding comments directly onto the findings to document and track investigation progress. You can also choose to export these findings. The service implements the open cyber security schema framework for all findings. Here I can see that the exposure summary finding is detailed in this JSON. I can then choose to export this finding to my security analytics tooling. We also have the ability for you to create tickets to ticketing systems such as Jira and Service Now so that you can manage a workflow of remediating findings in your chosen tool. This enhanced correlation and exposure finding capability provides the automation, intelligence, and context needed to stay ahead of potential security issues. Thank you for joining us. To get started, enable AWS Security Hub today.