[Music]
hello hello welcome to solving with aws
solutions your deep dive into reference
architecture architectures built by aws
that are ready to deploy instantly in
the cloud i'm rob your host joined today
with roxanna hey roxanna
hey rob today we are going to talk about
aws security hub
automated response and remediation
solution which helps you
improve your security posture in aws and
easily
resolve common security findings from
aws security hub service
the solution deploys a set of predefined
playbooks that help you drive automated
security remediations
yep and what's more you can easily
resolve these security findings
across your cross account setup under
the purview of aws security hub
let's take a deep dive into this
reference architecture here we go
so can you walk us through the aws
security hub automated response and
remediation solution detail page please
oh sure i'm on the solution landing page
so you can view the architecture diagram
over here
you can also go to the deployment guide
to read through the deployment steps and
how to work with the solution
there is also a link to the cloud
formation template which helps you to
easily deploy the solution in your
aws account that's awesome so if we look
at this architecture diagram
it's broken up into four workflows talk
to me about the first workflow
sure so let's start with the detect
workflow so
as you know the aws security hub service
is going to continuously
monitor your accounts your member
accounts as well as your primary account
to make sure that your resources in the
account are compliant with
you know industry standards and best
practices so
anytime a resource is not compliant it's
going to show up on the security hub
servers
as a finding that's the detect part
okay and now after we've detected
something how are we actually ingesting
it into the next phases
so that's going to be through the aws
cloudwatch event role
which is going to pick up these findings
and it's going to kick off the
remediation workflow
now is that automated or is it manual so
good question
uh the cloudwatch event rule is fired
automatically if
you enabled automated remediation when
you configured and deployed the solution
but if you chose to you know do manual
remediation
all you'll have to do is to go to the
aws security of console and then
click on the custom action and select
that playbook that you want to run
and that's going to fire this cloudwatch
event rule
so how are the actual playbooks being
executed is it being done through
a serverless lambda function the
reputation actions are essentially
executed using
aws lambda functions and in some cases
the remediation steps are completed
within the aws lambda function
and in other cases like for other
playbooks it's going to call those
aw systems managers automation documents
to execute the remediation steps for you
so it's cool we have different ways of
actually executing these playbooks
and then the output of these things it
has to feed into something how are we
feeding this back to security hub
right so as part of the remediation
workflow one of the last few steps
is that it's going to send information
back to aws security hub service
to update the workflow status to resolve
and
it's also going to update the notes for
the finding to show
what remediation is going to happen and
also keep in mind that
since we're using crossover control and
aws api calls to do the remediation
we're going to make sure that the
remediation is done even in your member
accounts
and it's going to be updated on the
security hub console
that's pretty cool so where does
cloudwatch come into play for these logs
so cloudwatch basically manages all your
remediation logs for any execution that
has happened
and you can easily view an audit history
of all the logs and also enable sns
notifications to be notified
as per your convenience that's pretty
cool so now i'm actually getting
notified when an event has occurred
so i could actually go and double check
on things if i needed to that's pretty
cool
so talk to me about a demonstration can
you walk us through a demo of what this
actually looks like
so the first step after deploying the
cloud formation template is to go to aws
service catalog
where you can see a portfolio that is
set up for you for security hub
playbooks
and if you click on the portfolio you
can see a product called cis
so cis is essentially center for
internet security which is
one of the security standards and we've
selected a bunch of playbooks from here
10 playbooks to be precise for this
version but we could definitely continue
to add more playbooks and
add more standards in the future so
that's pretty cool as part of the
solution these are automatically
deployed you could select
which products you're actually using as
part of your service catalog
so a product is created into your
portfolio and service catalog
but you would have to go ahead and
launch the product to deploy the
playbooks in your accounts
so for that first you have to set up
your im role
and assign it to a group and then when
you go to products
you should be able to view the product
uh and be able to launch the product
from here
so so let me go ahead and launch this
product and
let's give a name for it say demo
this takes me to the parameter page so
is this where we're actually now
selecting whether it was automated or
manual
part of this exactly so for each of the
playbooks you can
choose to make the selection as
automated or manual
based on how you want to execute it so
um one word of caution here is if you
want to do
an automated remediation just make sure
that you're comfortable with
what resources it changes in your
accounts and make sure you test it in a
test environment
before automatically enabling it so in
this case
let's say i'm i'm going to automatically
enable this playbook
which basically deletes my im keys over
90 days old
and i'm going to make everything else
disabled got it that's pretty cool
so can you walk us through an example of
where this actually may be detected and
remediated
sure so i've launched the product over
here it's
it's going gonna show up in my provision
product all i have to do after
uh deploying the product is to deploy
the cis permissions template
to make sure that findings are picked up
from my member accounts as well
now i'm all set to start uh remediating
the findings whenever it comes upon
security hub service
so for that uh i just picked one
playbook to just make sure that the
finding pops up for it
so one of your playbooks makes sure that
your i am password policy
meets industry standards where it should
be a specific character length
and it should have certain special
characters in it and also you know you
should set an expiry date on it
so i had all of them in place but of
course i deleted it
to make sure that the finding is
identified by security hub
and remediated by our solution so now
we're actually going to see where
security hub has detected one of the
findings
yep right so if you go to security hub
service this is where your findings are
going to
be displayed for all of your security
standards
so if i go over to uh findings here
i should be able to see that uh here the
password policy violation
is showing up so all i have to do is to
select the finding and then have to go
to custom actions
now these actions were the ones we
defined as part of services catalog
yep those are the ones that get
displayed here and
once you click on any action that's
going to fire your
workflow so here this belongs to 1.5
to 1.11 so i've just clicked on that
and that's going to send my findings to
amazon cloudwatch event rule
which is going to trigger the
remediation action but this was a manual
remediation that we performed right so
this is manual remediation but
i can go and update my product anytime
to make this
uh automated remediation and the next
time this finding shows up
it's going to just automatically fire
this cloudwatch event rule and remediate
it where does the remediation actually
occur
so in this case we selected a custom
action
to basically do a remediation for an iem
password policy that was non-compliant
right so now when you go to your im
console
you can see that a clean password policy
has been created
which meets all your industry standards
and this is essentially the remediation
action that has taken place
thanks for walking us through the
demonstration thanks rob
aws security hub automated response and
remediation solution provides a library
of actions based on industry best
practices
to help you resolve your security
findings and you can easily
choose to do the remediations
automatically or manually
based on findings from aws security hub
service
go check out this solution or other
solutions on our aws solutions library
see you there
[Music]