Wendy Wong for AWS Community Builders

Posted on Jul 26, 2022 • Edited on Aug 9, 2022

Amazon GuardDuty and AWS Security Hub - Incident response with the help of detective controls

#beginners #tutorial #security #aws

Finding the needle in the haystack

If you have been following this series on security from this first blog you will understand various remediation steps completed to remove unauthorized user access from the 'unprepared' AWS account.

I have been monitoring daily usage to identify any new Amazon Sagemaker Canvas charges from user 'michael-c' from region US-East-(N.Virginia).

From inspecting the daily AWS Cost Explorer dashboard in the section unblended costs, there were no new Amazon Sagemaker charges incurred in region US-East-1 after the implementation of Amazon Guard Duty and Trusted Advisor.

In this blog post you will learn how the combination of Amazon Guard Duty and AWS Security Hub work in harmony to quickly protect your AWS accounts against suspicious activity, with the ability to identify unauthorized user access, monitor any unusual API calls and reduce surprise bills.

Solution overview

After enabling Amazon GuardDuty and AWS Security Hub, the AWS Trusted Advisor high risk recommendations were implemented as remediation actions. As a result, there were no further unauthorized user access or any new Amazon Sagemaker Canvas usage charges in US-East-region after 21 July 2022. This is a quick win as you can see from the diagram below.

I upgraded my AWS Support Plan from Basic to Developer so that I could access 7 core AWS Trusted Advisor recommendations for best practice with a price of $29 per month.

You may also implement the Business or Enterprise AWS Support plan if you would like to subscribe and pay for the full-access to all of the Trusted Advisor best practice recommendations. Here is a link to the different AWS Support Plans that you may select for your test and production workloads.

Amazon GuardDuty

Amazon GuardDuty uses machine learning to provide intelligent threat intelligence by continuously monitoring and providing protection for AWS accounts and workloads:

IAM access to S3 buckets
AWS accounts and Users via CloudTrail
Kubernetes Container protection
VPC Flow logs

There are no charges incurred during your 30 day trial period with the AWS Free Tier.

AWS GuardDuty will analyze any anomalies, identify any threats and generate a report of findings to help you remediate and prioritize any detected threats.

Security Pillar

The Security Pillar is part of the AWS Well-Architected Framework that helps you to build AWS workloads that consider the architectural best practices to meet business and regulatory obligations.

High Level Architecture

The AWS GuardDuty architecture diagram, describes a workflow from the quick start initial set up through to producing report findings.

AWS Trusted Advisor

Is a centralized area to receive best practice recommendations for your account to help you save money and maximize the performance of your resources such as removing underutilized EC2 instances.

Recommendations focus on the areas of:

Cost optimization
Performance
Security
Fault Tolerance
Service Limits

With an AWS Business or Enterprise Support Plan you will receive full checks for Trusted Advisor.

AWS Security Hub

Provides a centralized view of insights for all of your AWS resources across multiple regions and produces findings of security alerts by providing a classification from high, medium and low risk using the services:

Amazon GuardDuty
Amazon Inspector
Amazon Macie
Amazon Trusted Advisor
Other optional integrations

AWS Security Hub will provide a list of security findings that you can investigate and then remediate according to best practice guidelines.

Tutorial 1: Enabling AWS GuardDuty

Step 1: Sign into the AWS Management console with your Admin IAM user account.

Step 2: On the search bar type 'AWS GuardDuty'

Step 3: On the AWS GuardDuty homepage click Get Started

Step 4: Click Enable GuardDuty

Step 5: Enter your 12 digit AWS account number

Step 6: There are no charges to AWS GuardDuty during a 30 day free trial with AWS Free Tier.

Step 7: After AWS GuardDuty is enabled, wait for 10 minutes before you start receiving findings from GuardDuty.

Step 7: AWS GuardDuty provides S3 data protection, enables the listing of trusted IP addresses, includes a new feature for kubernetes protection and also supports AWS Organizations for your accounts.

Tutorial 2: Enabling AWS Trusted Advisor

Step 1: Sign into to your AWS account using use Root account details.

Step 2: Navigate to Amazon Trusted Advisor

Step 3: A warning message to upgrade AWS Support Plan

You will need to upgrade your Amazon Support Plan from Basic to Developer. The Developer Support Plan will allow you to access 7 core AWS Trusted Advisor best practice recommendations on security checks and service limits.

Step 4: Select the Developer option to upgrade the AWS Support Plan and click Next.

Step 5: You will receive a message via a pop-up window to confirm the success of AWS Trusted Advisor which has been enabled on your account.

Step 6: Wait 15 minutes to receive AWS Trusted Advisor recommendations from AWS Security Hub.

Security checks

Service Limit checks

Tutorial 3: Enabling AWS Security Hub

Please complete the steps to enable AWS Security Hub by completing the lab from the AWS Well-Architected Labs

Please refer to the documentation to troubleshoot AWS Config for AWS Security Hub.

Once AWS Security Hub is enabled, you may view insights from the dashboard for your AWS resources.

AWS re:Invent 2019: Prepare for & respond to security incidents in your AWS environment (SEC356) with Nathan Case and Paul Hawkins.

Join us for AWS re:Inforce conference 2022

Next week is AWS re:Inforce conference, 26-27 July 📆

A learning conference on compliance, privacy and identity 🔐🛠️

• Register to watch the keynote & sessions streamed live online 📺 or join the AWS Community in person in Boston.

• Link: https://reinforce.awsevents.com

Hot off the press 🚀: Tutorial 4: Enabling AWS GuardDuty Malware Detection

🔒 NEW - At AWS re:Inforce 2022 the latest announcement was the release of AWS GuardDuty Malware Detection to scan an EC2 instance or container workload.

Step 1: Navigate to your existing AWS GuardDuty dashboard start the 30 day free trial for Malware Detection.