Andy 'Bob' Brockhurst :donor:<p><span class="h-card"><a href="https://mastodon.social/@dob" class="u-url mention" rel="nofollow noopener" target="_blank">@<span>dob</span></a></span> That's a big scope.</p><p>Some things we do to make our lives easier and doesn't cost $$$.</p><p>Enable <a href="https://infosec.exchange/tags/guardduty" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>guardduty</span></a> and pipe all the alerts into a slack channel (+email as well).</p><p>Enable <a href="https://infosec.exchange/tags/cloudtrail" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>cloudtrail</span></a> log everything to an <a href="https://infosec.exchange/tags/S3" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>S3</span></a> bucket in another account. <a href="https://infosec.exchange/tags/cloudwatch" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>cloudwatch</span></a> alerts on auth failures (to slack + email (some go to pagerduty <a href="https://infosec.exchange/tags/infosec" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>infosec</span></a> contact).<br>We also have some alerts on updates when a cidr is added to a <a href="https://infosec.exchange/tags/SecurityGroup" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>SecurityGroup</span></a>.</p><p>Don't use <a href="https://infosec.exchange/tags/ssh" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>ssh</span></a> or <a href="https://infosec.exchange/tags/bastion" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>bastion</span></a>/#JumpHosts use <a href="https://infosec.exchange/tags/ssm" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>ssm</span></a> to run automations on the hosts (package install, service restarts etc) also to get a shell on a box (if needed at all). (you can use <a href="https://infosec.exchange/tags/TransitiveTags" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>TransitiveTags</span></a> with <a href="https://infosec.exchange/tags/RoleAssumption" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>RoleAssumption</span></a> to give granular access).<br>Using <a href="https://infosec.exchange/tags/ssm" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>ssm</span></a> for console access also logs the entire session (including someone doing <code>sudo su - root</code> etc!) into <a href="https://infosec.exchange/tags/S3" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>S3</span></a></p><p>Use <a href="https://infosec.exchange/tags/MicroSegmentation" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>MicroSegmentation</span></a> within our <a href="https://infosec.exchange/tags/vpc" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>vpc</span></a>. Instances behind an <a href="https://infosec.exchange/tags/alb" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>alb</span></a> will <em>only</em> accept traffic from the <a href="https://infosec.exchange/tags/alb" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>alb</span></a> <a href="https://infosec.exchange/tags/SecurityGroup" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>SecurityGroup</span></a> etc.. <a href="https://infosec.exchange/tags/rds" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>rds</span></a>, <a href="https://infosec.exchange/tags/elasticache" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>elasticache</span></a> willl only accept traffic from instances in the appropriate <a href="https://infosec.exchange/tags/SecurityGroup" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>SecurityGroup</span></a>. (Basically we don't use cidr ingress rules, we use security group ids) (this works across accounts in the same region with peering, but not across regions however).</p><p><a href="https://infosec.exchange/tags/aws" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>aws</span></a></p>