Search for a command to run...
Passionate engineer with a decade of experience in the cybersecurity industry. Enjoy piecing together solutions involving many moving parts. Big fan of the 'It finally works!' your brain yells when a complex project comes together. Love all things cloud, security, and containerized.
No comments yet. Be the first to comment.
As I type this, I’m scrolling the news and came across yet another vulnerability with an AI tool that removes the tools' safeguards, allowing malicious commands to be run. The rate that these vulnerabilities are occurring is a bit scary but unsurpris...
A simple example of Go modules and binaries
Look directly into ETCD, the backbone of your Kubernetes cluster
AWS KMS is one of those services that works tirelessly in the background but doesn't get a lot of love. It's common to automatically encrypt every service as part of development and infrastructure-creation workflow, and this usually happens through K...
The AWS Documentation is vague on this subject, so this guide will detail the relationship between SecurityHub and Config. It's assumed that knowledge of what SecurityHub and AWS Config are is present. What will follow is based on AWS best practices.
You need to configure a delegated Admin account to control and house all the findings related to these 2 services. This allows all configuration related to these services across your organization to be done in one central place. This should also be in place for other services, such as GuardDuty, Macie, Detective, Inspector, etc.
This step is simple and involves the following steps:
Login to your master billing account
Go to SecurityHub
Go to Settings
Set Delegated Admin
Enter your Delegated Admin account info
Do the same for the Config service
Upon completing these steps, login to your Delegated Admin account.
The documentation can be a bit confusing on this subject. Basically, SecurityHub uses a service-linked Config role to create rules in target accounts. These are Config rules specifically and live in the Config service. However, they are managed by AWS and prefixed with securityhub-*. You cannot change these rules, but you can view their compliance outcomes.
Now Config requires certain resource types to be recorded, but the documentation makes it seem like for SecurityHub to run at all you need to enable these. That is not true. You can have no resources at all recorded and still get SecurityHub findings. How is this possible?
There are two types of triggers in Config: Periodic and Change. Periodically triggered checks run on a schedule and do not require the resource recording to be provisioned. Change triggered checks run upon some change happening to the resource, and do require resource recording to be enabled. The list of required resources to be recorded for all checks covered in the documentation here.
This is important to understand because recording resources costs money. Your bill can blow up unexpectedly if you have a lot of one resource, or many resources being created and destroyed, as is usually the case in large environments controlled with Terraform. Consider the following as ways to mitigate this issue:
Only enable Config-triggered checks in production accounts
Specify only highly critical resources such as IAM users and S3 buckets as being recorded
Do not record resources that are created and destroyed constantly such as ENI
Setup cost alerts for all accounts
Back in SecurityHub, enable all the standards. Picking and choosing is fine, however, it is best practice to get as complete coverage as possible. The pros far outweigh any cons of enabling too many standards. The standards being enabled are what create the Config rules in the target accounts.
Upon enabling the standards, give them 24 hours to completely run. After that, controls will run every 12-24 hours, therefore it is best practice to use EventBridge to capture these events and send them to a SIEM somewhere.
https://docs.aws.amazon.com/securityhub/latest/userguide/controls-config-resources.html
https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-standards-awsconfigrules.html
https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-controls-reference.html
https://docs.aws.amazon.com/securityhub/latest/userguide/standards-reference.html