Welcome to another episode of 'Back to Basics', everyone.
I'm Pratima Singh,
and I am here today to talk to you about vulnerability management
but in an automated way.
Now, why, you might ask?
Well, in recent years, vulnerabilities have taken the IT community by storm.
Every year there's a record-breaking number of vulnerabilities
that are recorded.
And with a number of application development frameworks in play
and operating systems,
it can be a real struggle to patch systems and applications.
But before we dive deeper, let's form a collective understanding
of what vulnerabilities really are.
Vulnerabilities don't just magically appear.
They have existed ever since software has.
As with most things, we humans create them.
They are in the software we write and in the configurations we build.
A large portion of vulnerabilities
is recorded in the software that other humans write,
and such software includes third party libraries
and operating systems that help us run applications on servers.
And a major portion of these vulnerabilities
is recorded in operating systems.
Now, earlier on in my career, when I was a Systems Engineer,
I was responsible for managing 100 plus servers
and deploying applications on those servers.
Now, every so often I would get informed about security updates
that I needed to install on those servers.
It used to take me hours, if not days,
to iterate over the inventory, manually install updates on the servers,
build manual reports and reach out to my leads for approval.
And even then, almost always, I would have missed out a few servers.
Now as much as I could, I automated the whole system
by building scripts that I would manually run on those servers.
But then it took me time to build the reports manually
and also testing because it added members of the other team to test
and the security teams for the final approval.
Now, involving other team members added to the lead time.
As I started using AWS,
I came across the AWS Systems Manager service.
AWS Systems Manager - That was a game changer for me.
I could manage on-premises servers and Amazon Elastic Compute Cloud
or EC2 Instances alike by installing a single agent.
Once the Amazon-SSM-agent was installed
servers and EC2 instances,
essentially the whole inventory that I managed manually
was discovered automatically as managed nodes.
With the inventory sorted,
I moved my attention to the Patch Manager.
I could ditch all my makeshift scripts
and use predefined patch baselines
for a range of Linux-based and Windows operating systems,
including adding approval rules, a task I used to manage manually.
Now, this reduced the time I spent on managing patches on servers
to a matter of hours.
Now, as I explored this service more and more,
I came across the feature to schedule patching runs
using the maintenance Windows feature.
Now, I no longer had to sit
looking at installations being done on server by server manually,
and the Patch Manager dashboard
gave me the compliance report automatically
that I used to spend hours building to get my leads approvals.
As the development teams started to work with containers,
it became an interesting challenge
to manage vulnerabilities with Container Images.
Container Images can be easily overwritten,
which can lead to loss of context
with changes along with a layer development approach,
which can result in vulnerabilities hiding in the layers
and only detectable in the container run-time.
Interestingly, teams could turn on the tag Immutability feature
in Amazon Elastic Container Registry or Amazon ECR
to ensure that a container Image cannot be overwritten by another image
using the same tag but with different contents.
This ensured uniqueness of each image pushed to the repository.
Now the teams could also configure scanning of images
either on push or continually.
But the security team wanted a single pane of glass view
of the security posture of the entire IT environment in their organization.
Now, this is where Amazon Inspector and AWS Security Hub, came in.
Now ECR forwards all findings to Inspector,
which is an automated vulnerability management service.
AWS Security Hub natively integrates with AWS services
like Patch Manager and Amazon Inspector.
It supports cross-account and cross-region aggregation.
Once all the findings are consolidated in Security Hub,
the security team could build insights, alerts,
and even trigger auto-remediation actions
using the custom actions feature of Security Hub.
Now with Security Hub, we have been able to tie
our vulnerability management solution
into a neat bow.
Now, in this episode,
we saw how we could build a vulnerability management solution
in a hybrid environment with servers,
Amazon EC2 instances and Container Images.
We've used services like AWS Systems Manager,
Amazon ECR, Amazon Inspector, and AWS Security Hub.
Check out the links below for more details.
See you next time.