AWS Security Hub gives you a prioritized view of security alerts and security posture across your
AWS accounts. With Security Hub, you now have a single place that aggregates, organizes, and
prioritizes your security alerts or findings from multiple AWS services, as well as from AWS partner solutions.
AWS Security Hub continuously monitors your environment using automated security checks
based on the AWS best practices and industry standards that your organization follows.
In this demo, we will be looking at the AWS Foundational Security Best Practices standard in Security Hub.
The security controls in this standard detect when AWS accounts and deployed resources do not align with
security best practices that are defined by AWS security experts. This curated set of controls helps improve a
customer's security posture in AWS and covers AWS's most popular and foundational services.
We will show you how to enable AWS Foundational Security Best Practice, an overview of the security controls available,
we'll take a look at the security control details, demonstrate how to locate remediation instructions for failed control,
and finally, show you how you can disable or enable a specific security control.
Let's head over to the AWS console and get started.
So I'm here in the AWS Security Hub console. I'm presented with the landing page here, as it's the
first time I've accessed the service. Before we go to enable Security Hub I want to highlight one key
prerequisite for enabling the service, which is to enable AWS Config in your account.
Security Hub uses AWS Config and Config Rules as its primary mechanism to evaluate the configuration of
AWS resources. Once you've enabled AWS Config, head back over here and select "go to Security Hub".
As I haven't enabled any checks yet, Security Hub will take me through a wizard to enable certain security standards.
You can see there are three standards available. We'll leave the CIS Benchmark checked;
however, for this demo, we're focusing on the Foundational Security Best Practices, so we make sure that that
that one is checked too. As we enable Security Hub, we're taken to the summary page in the console.
We can see that the security standard is currently being enabled, and if we click through to the security standards
page, that should complete in just a few moments. Security Hub will take some time to create those
Config Rules and evaluate the security controls for the first time.
So we're back in the AWS Security Hub console, and you can see that Security Hub and the Foundational
Security Best Practices Standard are enabled, and I have an overall security score of 74%.
Let's click through to the standards to take a look at the controls and security checks.
Security Hub gives me a collection of all the security controls for this standard, and I can filter results here
on those that have passed or those that have failed. For the purpose of this demo, let's take a look at all the controls.
There are controls across a variety of best practices such as non-public EBS snapshots
or encryption of Elastic File System data. Firstly, let's take a look at a successful check that has passed.
We have a check here to see if CloudTrail is enabled and has at least one multi-region trail.
We see the high-level details for the whole control, such as severity, status, and when it was last evaluated.
And then remediation instructions as well. And then for each of the resources associated to this check,
Security Hub has generated findings for us. You can see this finding is resolved because the check has passed.
We can select the finding and get more specific details. We can even click through to see the AWS Config Rule
associated with this check if we wish. Then, we also see information on the last updated time and other attributes,
as well as details on what resources are associated with this finding. (In this instance, just my AWS account).
So, let's go back and take a look at a control that has failed. We passed the CloudTrail enabled check
but we're also checking if CloudTrail trails have encryption at rest enabled. You can see we have two findings here:
one for the account and one for the specific CloudTrail where this isn't enabled.
Beyond seeing the list of findings here, at the top of the page here at the right, we can click through and get
remediation instructions from the documentation. For all of the controls, we provide detailed instructions on how to remediate.
In this instance we have clear steps on how to configure encryption at rest on our CloudTrail trails using KMS.
I want to show you how to disable or enable a specific control in Security Hub.
Take this example here: control "CodeBuild.1". Let's say for some reason this check is not required,
and we want to disable that check so that it doesn't generate findings. We can do that from the page here,
but also by navigating into the control details and selecting this button at the top right.
We simply provide a reason for disabling the control and then we head back to the standard home page.
You can see that this is now disabled. If anything changes and we want to re-enable the check at any point, we can simply
check the enable box here, and that check is now enabled, and Security Hub will go and re-evaluate.
We looked at some of the individual findings for the specific controls we were interested in,
but I wanted to finally highlight that these findings can all be found in one place alongside your other Security Hub
findings, some of which may come from integrations with other AWS services such as GuardDuty for example.
So your security operations team get the findings from the Foundational Security Best Practices standards alongside
all of your wider account findings and can take advantage of Security Hub features such as custom actions and
updating the workflow status. If you're interested in learning more about the features of Security Hub,
such as integrations with other AWS or third-party services, or how you can automate custom actions,
then please visit aws.amazon.com/security-hub for more details.