You can configure automated flows that use both detective and responsive controls and might also feed into preventative controls to help mitigate risks in the future. AWS services provide the building blocks to create powerful patterns for the automated detection and remediation of threats against your AWS environments.

It helps reduce operational overhead and creates repeatable, predictable approaches to monitoring and responding to events.

Security automation is a key principle outlined in the Response Guide. Responsive controls - Drive remediation of potential deviations from your security baselines.Detective controls - Provide full visibility and transparency over the operation of your deployments in AWS.Preventive controls - Protect your workloads and mitigate threats and vulnerabilities.

Directive controls - Establish the governance, risk, and compliance models the environment will operate within.

In the AWS CAF Security Perspective section of the AWS Security Incident Response Guide, we define these controls across four categories: You should implement security measures across your AWS resources by using a holistic approach that incorporates controls across multiple areas. The automation will rely on Amazon GuardDuty to generate findings about the suspicious hosts, and then you can respond to those findings by programmatically updating AWS WAF to block the host from accessing your workloads. In this post, we’ll share an automation pattern that you can use to automatically detect and block suspicious hosts that are attempting to access your Amazon Web Services (AWS) resources.

Post Syndicated from Eucke Warren original

Awsmanagedrulessqliruleset