AWS Security Scanning Capabilities

Overview

The Science Cloud provides comprehensive security scanning and monitoring capabilities for all AWS workloads. This article describes the tools available and how to use them.

Available Security Tools

1. AWS Security Hub

What it does: Centralized security and compliance monitoring

How to access:

  1. Log into AWS Console
  2. Navigate to Security Hub service
  3. View the Summary dashboard for your security score

What you can see:

  • Security findings for your resources
  • Compliance status against industry standards
  • Severity ratings and remediation guidance
  • Trends over time

Supported Standards:

  • AWS Foundational Security Best Practices
  • NIST SP 800-53 Rev. 5

2. Amazon Inspector

What it does: Automated vulnerability scanning for EC2 instances, containers, and Lambda functions

How to use:

  • Automatic: Inspector continuously scans supported resources
  • On-demand: Trigger scans via the Inspector console or API
  • Results: Findings appear in Security Hub and Inspector console

What it scans for:

  • Common Vulnerabilities and Exposures (CVEs)
  • Network reachability issues
  • Software vulnerabilities in packages
  • Container image vulnerabilities

3. Amazon GuardDuty

What it does: Intelligent threat detection using machine learning

What it monitors:

  • Unusual API calls or deployments
  • Potentially compromised instances
  • Reconnaissance by attackers
  • Cryptocurrency mining
  • Credential compromise

How findings are delivered:

  • Automatically sent to Security Hub
  • Can configure EventBridge rules for notifications
  • Severity levels: Low, Medium, High

4. AWS Config

What it does: Tracks resource configurations and compliance

Capabilities:

  • Records configuration changes over time
  • Evaluates resources against compliance rules
  • Provides configuration history for troubleshooting
  • Automated compliance reporting

5. AWS CloudTrail

What it does: Logs all API activity in your AWS account

Use cases:

  • Security analysis and incident investigation
  • Compliance auditing
  • Change tracking
  • Troubleshooting operational issues

Retention: 1 year

Project-Level Scanning Capabilities

Projects can also run their own security scans using:

AWS Native Tools

  • Amazon Inspector: Enable for your specific resources
  • AWS Config Rules: Deploy custom compliance rules
  • Security Hub Insights: Create custom views of findings

How to Respond to Security Findings

Step 1: Review the Finding

  • Check severity level (Critical, High, Medium, Low)
  • Identify affected resources
  • Read the description and compliance impact

Step 2: Assess Impact

  • Determine if the finding affects your workload
  • Evaluate the risk to your data and operations
  • Check if it violates NASA security requirements

Step 3: Remediate

  • Follow the remediation guidance provided
  • Test changes in a non-production environment first
  • Document your remediation actions
  • If you think remediation is not applicable or cannot be completed, please email support@sciencecloud.nasa.gov to open a ticket with Service Desk.

Step 4: Update Status

  • Mark findings as "Resolved" once fixed
  • Add notes for audit trail

Compliance and NASA Requirements

All scanning tools are configured to help meet:

  • NPR 2810.1B: NASA Security of Information Technology
  • NIST SP 800-53: Security and Privacy Controls
  • FedRAMP: Federal Risk and Authorization Management Program

Best Practices

  1. Review findings weekly: Don't let security issues accumulate
  2. Prioritize by severity: Address Critical and High findings first
  3. Enable notifications: Get alerted to new critical findings
  4. Tag your resources: Makes filtering and reporting easier
  5. Document exceptions: If you suppress a finding, explain why

Getting Help

Additional Resources

  • No labels