- [Jonathan] Hi, everybody, my name is Jonathan Nguyen,
and I'm a senior security consultant here at AWS.
Today, I'll be going over AWS Security Hub
and some of its foundational capabilities.
At a high level, Security Hub aggregates
and normalizes security findings
from over 60 different partners in AWS security services
by automatically transforming findings
into the AWS Security Finding Format.
The normalization allows for customers a single pane
of glass for an aggregated view of your security posture.
Security Hub also conducts
continuous automated security checks
across dozens of AWS services and resources
to ensure they are configured according
to security best practices,
which are mapped to different security standards like CIS,
PCI, and Security Hub's own foundational security standards.
Security Hub then provides mechanisms
to help you take action quickly on findings
by natively integrating with automated response
and remediation workflows.
You have the ability to take action using
AWS services like Lambda functions
or systems manager automation.
Additionally, you could integrate with partner ticketing,
chat, or incident management systems.
So zooming back out, we summarize
Security Hub's capabilities are aligned
to three main cybersecurity product categories.
Security Hub functions
as a cloud security posture management tool,
which helps you understand exactly how
and what you need to do to improve your AWS security.
Security Hub has SIEM
and extended detection and response capabilities,
in that security findings are ingested, normalized,
and aggregated across multiple AWS and partner solutions
into the AWS Security Finding Format.
Security Hub also has SOAR-like capabilities,
in terms of enabling semi-
and fully automated response and remediation for findings.
Now that we've gone over Security Hub's capabilities,
I'll walk you through how to enable
a multi-account setup using AWS Organizations.
We'll configure cross-region and account aggregation
and look into Security Hub's automated security checks.
We'll also look at integrations
with AWS services and partner products
and set up an automated response and remediation workflow.
Now let's jump to the console.
If you're following along,
there are some prerequisites for this demo.
You'll need to enable AWS Organizations
and enroll all your AWS accounts as members.
You'll also need to enable AWS Config's resource recording
for all accounts.
Now I've already enabled Security Hub
and Config in this account,
which is also the delegated administrator
for the AWS Organization.
From the delegated administrator account,
I'm going to use this one-click deployment.
This will enable Security Hub for all my existing accounts
within the AWS Organization,
as well as enable Security Hub for new accounts
as they join my AWS Organization.
That's it, now all my existing accounts have
security I've enabled, and any new accounts
that join my organization will have security I've enabled
and send all findings to this account,
which is the delegated administrator account.
Note that Security Hub is a regional service,
so you'll have to take these steps
in each region where you want Security Hub enabled.
Security Hub can aggregate Security Hub findings
across all supported regions.
I'll set up finding aggregation
for Security Hub to us-east-1.
From the delegated administrator account, select Regions
and Configure Finding Aggregation.
Select the us-east-1 region, which should then populate
supported regions for finding aggregation.
I'll go ahead and select all available regions.
I'll also select Link Future Regions,
which enables finding aggregation in new AWS regions
when cross-region aggregation is supported.
Neither option will enable Security Hub,
and you'll still need to enable Security Hub in each region.
To make any changes, you'll need to go
to the delegated administrator account and primary region
where the finding aggregation is configured.
Now that Security Hub is enabled
for all eight of its accounts and aggregated
across all supported regions, I wanted to spend some time
to review the AWS Foundational Security Best Practices.
These sets of controls, managed by Security Hub,
automatically monitor and detect when AWS accounts
and resources deviate from security best practices.
In order to utilize the control standard,
AWS Config resource recorder must be enabled
for all AWS accounts.
Here in the delegated administrator account,
we've got a consolidated list of all the controls
and a consolidated security score for all of our accounts.
Here, we can see 153 controls enabled,
and Security Hub continually releases additional checks,
which will be added to all of the accounts
if the auto-enabled new control feature is on.
For any of our failed checks,
we've got a severity, an ID, and title.
If I click on one of these titles,
we'll see additional details, in terms of the accounts
and the resources that failed that check.
There's also information for each one of these checks,
in terms of how to remediate
and what actions to take, which can be done manually
or you can set up automation for how to respond.
Next, I wanna briefly talk about Security Hub integrations,
which can be found on the landing page under Integrations.
Security Hub provides the ability
to integrate security findings from AWS services
and third-party products.
This is accomplished by automatically transforming findings
into the AWS Security Finding Format.
For AWS-managed services like GuardDuty,
IAM Access Analyzer, or Inspector,
Security Hub will automatically enable those integrations.
For any of the third-party products,
Security Hub has the ability to enable these integrations
and also provides a link, in terms of configuring
that specific third-party product.
Once enabled, you can accept findings,
which will then integrate the third-party services
into Security Hub.
Now that we've set up Security Hub
for all of our AWS accounts within the organization
and aggregated findings for all supported regions,
it's time to start thinking about how we take action
against all of these findings.
You can use Security Hub's custom actions
to help the Security team efficiently manage
all of these findings by setting up
automation workflows directly in Security Hub.
Custom actions could include
operations like sending findings to chat, email,
or automation systems for ticketing,
or even end-to-end remediation.
To create a custom action, go to Security Hub Settings,
then we'll go to the Custom Actions
and create a new custom action.
Here, I wanna notify my SOC.
Let's put that in the action, the description,
and a custom action ID.
Now that I've created the custom action,
I'm gonna have to link this custom action
to an EventBridge rule.
I'll make sure to copy this custom action ARN
for the next step.
From the Amazon EventBridge page,
I'll create a new rule
and name it SecurityHubNotifySOC.
For the rule type, I'll leave it as a rule
with an event pattern.
As the event source, I'll leave it at AWS Events
and then scroll down to Event Pattern.
For the AWS service, I want to set up Security Hub.
Now it's important to note,
if you wanted a fully automated workflow
without any manual intervention,
you could use the Security Hub findings imported value.
By using this value any time a finding is generated
and matches the event pattern,
EventBridge will invoke
any target set up in this rule automatically,
instead of the semi-automated workflow,
which we'll actually be setting up with custom actions.
So for this, I'll select
Security of Findings, Custom Action.
Now I wanna specify the custom action ARN
where I just created.
So here, I'll paste my custom action ARN.
Looks good, and I'll click Next.
For the targets, I wanna select a SNS topic.
Now I've already created an SNS topic for my SOC team,
which I'll specify here,
and click Next.
I'll skip the tags.
I'm gonna review everything.
Here's my custom action ARN.
The detail type is the security of findings custom action.
Here's my SNS topic.
Everything looks good, go ahead and create the rule.
Now that our EventBridge rule is linked
to our custom action, let's test things out in Security Hub.
I'll go ahead and select a couple of findings.
Next, I'll set off that custom action that I just created.
I'll wait for it and it looks like it was successfully sent
to the EventBridge rule and to the SNS Topic team.
In this demo, I showed you how to set up AWS Security Hub
for all your accounts within your AWS Organization
and aggregated findings across your accounts
across the supported regions.
We reviewed Security Hub's
AWS Foundational Security Best Practice controls,
as well as native Security Hub integration
for AWS services and partner products.
We also walked through setting up automation
with Security Hub custom actions and EventBridge.
I hope you enjoyed this quick demo.
In the next demo, we'll dive a bit deeper
into other Security Hub features.