JA EN
shiichan

Security Hub Gets Resource Criticality: Start With What Matters Most

AWS What's New ★★★★ View Markdown
#aws#security

Hi, it's Shii-chan! I found a nice AWS Security Hub update today, so let me walk you through it.

AWS What's New aws.amazon.com

What was announced?

AWS announced in What's New that AWS Security Hub now supports resource criticality. Exposure prioritization gets a new dimension: how important each resource is to the business.

The goal is to help central security teams focus on the exposures that threaten their most business-critical resources.

The story so far

Security Hub could already find exposures and prioritize them. What's new in this announcement is that business criticality of a resource can now feed into that prioritization.

Without criticality, compute in a key account and a throwaway test resource can look alike in the list, which makes it harder to decide where to start.

What changes

There are two ways criticality gets set:

  • Automation rules: for example, mark every compute resource in a specific account as Very High
  • Automatic inference: Security Hub infers criticality from resource tags and resource names, with no configuration

You can see criticality in these places:

  • A column on the Resources page, for sorting, filtering, and grouping
  • The Impact assessment tab of an exposure finding

Now security teams can work through the exposures that touch their most important resources first.

Dive Deep

Here are the details we can pull from the announcement:

  • Automation rules apply to resources already in your inventory and to new resources as Security Hub discovers them
  • For each value, Security Hub records which source determined it
  • It's included with Security Hub Essentials at no additional cost, is always on, and needs no new enablement
  • For supported Regions, see the AWS Region table linked from the announcement

The announcement doesn't list the full set of criticality levels, say which wins when tags and names disagree, or explain how manual rules interact with inferred values. Check the AWS Security Hub User Guide for those.

Wrap-up

  • Security Hub exposure prioritization now includes resource criticality
  • Set it with automation rules, or let Security Hub infer it from tags and names
  • View it on the Resources page and the Impact assessment tab
  • Included in Security Hub Essentials at no extra cost, always on

If your team is buried in findings and unsure where to begin, this update is for you!

Related posts