Hey, everyone, and welcome back.
Now, in today's video, we'll be discussing about the security hub.
Now, the security hub basically gives you a comprehensive view of the high priority security alerts
and compliance status across the agencies account.
So the idea of security hub can be seen in the below diagram where you have multiple services.
So you have guard duty, you have inspector, you have Macy and you have various others.
So generally what happens is when you go ahead and enable these, you'll have to go to the respective
console to look into the finding.
So you go to the guard duty console, look into the finding, then you go to the inspector console,
look into the finding and so on.
So it becomes very tedious.
So the main idea of security hub is to create a centralized place where all of your security related
alerts would be visible.
And the security engineer, as well as the auditor, will only have to look into the centralized place
to look into what is missing or what alerts has been raised.
So if you'll see from the security hub, there are multiple alerts which you can see within the console.
Now, these three services that we have included in the diagram, these are some of the services that
it supports, Security Hub, in fact, supports a lot of other services as well.
Now, apart from security hubs, integration with various security services like guard duty and others,
the security hub also has its ability to generate its own finding by running certain automated and continuous
checks against the rules instead of supported security standards.
So these are the standards that security hub supports.
One is the Systemless Foundation, and second is the PCI DSS.
So what this security hub does, it makes use of address config to verify if the rules which are defined
within the security standards are followed within the address account or not.
And depending on that, the dashboards will be generated.
Green So that's the high level idea about security hub.
Let's look into it in a practical way so that it becomes better understood.
So I'm in the security have concern and currently here you see it is basically giving us insights related
to various rules which are being defined.
Now if you go a bit down, it is also showing you the security score associated with various compliance
standards.
So for the SES, a foundation benchmark, the compliance score is 29%.
For PCI, DSS, the compliance score is 72% and so on.
Now it also shows you the resources which has failed the security check.
So you have a security group ID over here.
So this would basically mean that it has a lot of open rules which are available.
Apart from that, you have these nice little graphs which are being generated by the security hub,
which allows us to quickly identify the things.
Now, as we were discussing over here.
If you go to the security standards, there are two security standards which are supported.
One is CIS as well as the PCI, DSS.
And if you look into the Vue results, it basically gives you the result in an individual rule to rule
way.
So this is the 1.1 rule, 1.2, 1.3, 1.4, and so on.
All right.
So basically, this is achieved with the help of a diverse config.
So there are a lot of rules which are available for each of these standards.
Now going into the finding, you will be able to see the list of all the findings which have the status
of field.
So you can also go ahead and group by various filters so it can happen that within your security hub
you have ten accounts or 20 accounts.
So you can even filter things by the account ID as well as various other aspects which you can see here.
Now, one of the good thing that I liked about security is its integration with the third party providers.
So not only it integrates with various services, but it also integrates with various other third party
providers.
So when you discuss about the services which integrates here, you have various things like firewall
manager, analyzer, guard, duty inspector, you have Macy as well as you have various third party
providers like Aqua.
You have alert logic.
And if you go a bit down, there are a lot of service providers.
So if you look down, you have also one of the very popular ones which is tenable, dot IO, which is
used in a lot of organizations for vulnerability assessments as well as other aspects.
Great.
So I hope at a high level overview you understood why security hub service was introduced.
So the primary aim again was to create a centralized console where you will see all the alerts related
to security and you can quickly go ahead and prioritize those.
So now let's quickly do one thing.
Let's select a new region and we'll look into how exactly security hub can be enabled.
Now do remember that if we are going ahead and enabling the compliance benchmarks over here, then you
will need to enable config prior to that.
So this is the security hub console.
Now before we go ahead and do that, let me also quickly show you about the config enabling process.
So let's go ahead and get started.
So in enabling the address config, you can select record all the resources as well as the global resource.
And depending upon if you have bucket or not, you can either create a new bucket or you can select
an existing bucket from your account.
So in my case, I'll just select an existing bucket because I already have it.
Then within the I am role, you can just use the existing one.
Let's click on next.
We'll skip the rules for the time being and you can go ahead and do a confirm.
So it has also come up with the new console for the config.
So if you see the redesigned console is now available for use, so you can go ahead and also right now.
So in case if you see the newer console, the overall steps which are required remains to be the same.
Great.
So once you have the database config enabled, you can go to the security hub.
So in the first step, it will basically ask you for the compliance standards that you might want to
enable.
You can go ahead and enable that.
And also it requires permission to import the findings from now.
Since Security Hub provides a centralized console, it needs to import findings from all the security
services that it supports.
So these are the list of security specific services from which it would like to import the findings
from.
So that is quite good.
You can go ahead and enable guard duty.
Great.
So that's the oral step.
Now it will go ahead and it will verify each and every thing and the results will be shown to you.
Now, one important part to remember here is that let's say that you already have an existing finding.
So let's say you have a device inspector and inspector already has scanned the service and there are
a lot of high level vulnerabilities.
Now, Security Hub will not show you those vulnerabilities provided if they are in the inspector console
before the security hub was enabled.
So the overall concept is after you enable the security hub and next time when the address inspector
goes ahead and scan your servers and the new vulnerabilities are shown, those vulnerabilities will
be part of your console.
The older ones will not be part.
So this is something that I hope that it would be improved at a later stage.
Now, one last thing before we conclude is that you can also go ahead and enable security hub with multiple
accounts.
This is also something that can be achieved.
Now, one of the limitations that you will typically see with security hub is for the organizations
who are using multi region architectures.
So this security hub findings that we are seeing, this is associated with one region.
It will not show you the findings which are part of other regions.
So you have got to have inspector not ordinary region.
So those findings will not be shown.
So for that you'll have to go to the security hub of the North Virginia region.
So that is one limitation.
But over the period of time, this might be improved primarily because security hub is quite a new service
grid.
So I hope at a high level overview you understood what security hub service provides.
Now if you will see, Security Hub is quickly showing you various findings and a lot of graphs are also
being generated.
So that's the high level overview.
I hope this video has been informative for you and I look forward to see you in the next video.