Welcome back to this demonstration,
how to perform an AWS benchmark assessment using Prowler.
So far, you've been introduced to Prowler and its key features and benefits.
You understand the need for decoy systems in the cloud and
assessing internet export services within a cloud account
and across multiple regions.
You are probably asking more questions right now like what else can Prowler do?
Because cloud security is not just about network security groups,
open ports, and exposed services, thankfully,
Prowler can do a lot more.
In this demonstration, I will cover AWS benchmarks,
specifically the AWS CIS Foundations benchmark.
I will explain what a benchmark document is and why they are
really important to security professionals and go through the
steps of performing an assessment.
The CIS, Center for Internet Security,
is perhaps one of the best cybersecurity resources available on the internet.
If you've not used this resource before,
you will be surprised by the amount of content available,
which is not just limited to benchmarks.
Many security practitioners use this as a reference and even
forms part of the framework for many enterprises.
I would highly encourage you visit the website for more detail and
to maybe consider contributing to this resource.
One of the great positives of this resource is that practitioners can get
involved and volunteer to contribute to the material.
Much of the material exists because of volunteers,
so contributing not only gives the satisfaction of participation,
but it also benefits thousands of people around the world.
The CIS use a consensus‑based platform where volunteers
contribute and agree through discussion.
The volunteers are usually practitioners and specialists
in the area they are contributing to.
In this section, we're concerned with benchmarks.
Benchmarks are released by CIS as PDF documents,
and each one covers a specific technology.
So that could be AWS or Windows or Linux and so on.
Some of these benchmarks can be hundreds of pages in
length as they are so detailed, and this detail is great.
Imagine you or your organization creating and maintaining such a document.
And within each document,
there are specific configuration settings that are recommended to
enable or disable to improve the overall security.
The benchmarks also take into consideration the
different needs of your organizations,
so you will find these documents provide levels 1 through to 3.
Level 1 is the minimum recommended settings that will improve security,
but it's not detrimental to the technology; whereas,
level 3 is perhaps for more secure environments.
And if all the recommendations are followed,
then the functionality of the technology may be negatively impacted in some way.
It's up to each organization to choose the settings or
controls to utilize and the level to adopt.
And one final important point in CIS, the benchmarks are available to download,
and sometimes that is misunderstood as free.
Both who you are and the organization you represent will determine
if your organization has to pay a license or not.
This resource is not open source,
so please confirm which license that you go under.
Considering the amount and quality of content,
it's really not expensive if your organization is required to pay.
Since we are on the subject of CIS,
now is a good point to mention which cloud service
providers you will find benchmarks for.
There is at least foundational coverage for the four major CSP.
Now Prowler is only geared up to use AWS CIS Foundations benchmark,
and that's fine.
But if you have other CSP within your organization besides AWS,
CIS does support this.
Okay, back to Prowler.
Prowler was written to assess AWS environments,
and the author is well aware of CIS and has taken great steps to
include the option to perform this assessment.
It's worth pointing out that assessing the level of your
cloud security compliance against the CIS benchmark can
generally not be 100% automated.
And the reason for this is because some settings
cannot be checked by automated means,
maybe because there is no API functionality created yet
by the provider to do those checks.
So it's important to compare what the current version of the automated tool can
do against the current version of CIS benchmark document.
Let's walk through performing an AWS benchmark assessment.
Prior to running the tool,
make sure that you've configured Prowler based on usage
instructions available on the Prowl GitHub site.
From the console, type prowler ‑l, that's a lower case l,
and this will display a list of the available checks where
you can see all of the available options.
It's good to do this,
especially if updating the tool as new capabilities may
be included since the prior release.
As you can see, this list is extensive. If you wanted to perform a single check,
an example command would be prowler ‑c check11.
But I'm not going to do that here because I want to do
an assessment involving many checks.
If you want to view all checks by group,
use the command prowler ‑L, which is an uppercase L.
This is a much more condensed list and recommended prior to running.
From this group list, I want to do a level 1 CIS assessment.
This is number 5 from the list. And then run the command prowler
‑g cislevel1 to begin the assessment process.
This process can take some time,
so I'm going to skip ahead in parts to summarize. As it's running, you
will see non‑compliance results displayed on the screen,
and it's up to you and your organization to categorize
and prioritize what's important.
Some organizations may perform an ad hoc assessment and then
review the output over a period of time.
The risk there is new changes in your cloud environment will not be captured.
It's recommended a scheduled process is developed. As it appears
that's suitable for your organization to deal with, scheduled running
will then capture new changes in the cloud.
Okay, now we have all of our results.
We can see there are some issues here with the security groups, most
regions do not have CloudWatch enabled, and many more.
You can see how straightforward it is to operate this tool.
The real challenge is dealing with the data from Prowler and making those
changes to your cloud environment in a timely manner.
That concludes this demonstration. Up next,
I will detail the reporting options in Prowler.
Documentation is really important in cybersecurity, and it's
important to understand these features.