...
- Acronyms
- Roles and Responsibilities
- User Agreements and Training Requirements
- Shared Security Responsibility Model
- Secure Science Cloud Website Hosting Guidelines
- Continuous Vulnerability Scanning with AWS Inspector
- Vulnerability Remediation
- AWS Inspector Console Features
- Effective Vulnerability Management in Science Cloud
- Automated Patching using AWS Patch Manager
Acronyms
ACG | A Cloud Guru | IAM | Identity and Access Management | |
AMI | Amazon Machine Image | ISSO | Information Systems Security Officer | |
API | Application Programming Interface | ISSE | Information Systems Security Engineer | |
ATC | AWS Training and Certification | ITAR | International Traffic in Arms Regulations | |
AVM | Azure Virtual Machine | MAR | Mitigation Action Requirement | |
AWS | Amazon Web Services | MFA | Multi-Factor Authentication | |
CIS | Center for Internet Security | NIST | National Institutes of Standards and Technology | |
CUI | Controlled Unclassified Information | PI | Principal Investigator | |
CVE | Common Vulnerabilities and Exposures | RHEL | Red Hat Enterprise Linux | |
CSET | Cyber Security Engineering Team | S3 | Simple Storage Service | |
DHS | Daily Health Status | SA | Systems Administrator | |
EC2 | Elastic Compute Cloud | SCRM | Supply Chain Risk Management | |
ECR | Elastic Container Registry | SLES | SUSE Linux Enterprise Server | |
FISMA | Federal Information Management Security Act | SOC | Security Operations Center | |
KEV | Known Exploited Vulnerabilities | SSM | Systems Manager |
User Agreements and Training Requirements
Agreement or Training Module | Who Should Take This | Time Frame |
User Agreement | All console users | Annually |
General Security Training | All console users | Annually |
Elevated Privileges Security Training | PIAdmin, Project SysAdmins, CloudAdmins | Annually |
- Training is designed to help users understand current NASA security requirements and how they impact the operation of the Science Cloud
- All Users will need to work together with the Science Cloud CloudAdmin Team to implement good security practices
- Security is everyone’s responsibility!
...
Shared Security Responsibility Model
Layer | Science Cloud CloudAdmins | Project System Administrators |
Application Layer | •Monitor application authentication for security compliance and provide recommendations for remediation | •Install/configure applications in a secure fashion •Create and update passwords to meet NASA guidelines |
Container Layer | •Implement Container Registry for storage of approved Containers | •Store approved Containers in approved Container registries •Update Containers to resolve identified vulnerabilities |
O/S Layer | •Monitor instances for security compliance and provide notifications for required patches | •Read and understand vulnerabilities from weekly vulnerability reports •Configure secure instances and implement patches as required |
Cloud Layer | •Ensure SSM usage, monitor ports, and ensure Password / API key age compliance | •Coordinate with the ISSO to ensure attestation of User Agreement prior to the creation of AWS/Azure users |
Physical Layer | •AWS and Azure provide secure facilities, hardware, and other capabilities | |
Secure Science Cloud Web Hosting Guidelines
...