AWS securityhub documentation change
Summary
Updated references from 'Security Hub' to 'Security Hub CSPM' throughout documentation, emphasizing Cloud Security Posture Management integration
Security assessment
Changes focus on rebranding/emphasizing CSPM (Cloud Security Posture Management) capabilities but do not address specific vulnerabilities or security incidents. The modifications enhance documentation about existing security features rather than patching issues.
Diff
diff --git a/securityhub/latest/userguide/service-managed-standard-aws-control-tower.md b/securityhub/latest/userguide/service-managed-standard-aws-control-tower.md index d23956a91..cf7a5acdb 100644 --- a//securityhub/latest/userguide/service-managed-standard-aws-control-tower.md +++ b//securityhub/latest/userguide/service-managed-standard-aws-control-tower.md @@ -3 +3 @@ -[Documentation](/index.html)[AWS Security Hub](/securityhub/index.html)[User Guide](what-is-securityhub.html) +[Documentation](/index.html)[AWS Security Hub](/securityhub/index.html)[ User Guide ](what-is-security-hub-adv.html) @@ -13 +13 @@ This section provides information about Service-Managed Standard: AWS Control To -This standard is designed for users of AWS Security Hub and AWS Control Tower. It lets you configure the proactive controls of AWS Control Tower alongside the detective controls of Security Hub in the AWS Control Tower service. +This standard is designed for users of AWS Security Hub Cloud Security Posture Management (CSPM) and AWS Control Tower. It lets you configure the proactive controls of AWS Control Tower alongside the detective controls of Security Hub CSPM in the AWS Control Tower service. @@ -19 +19 @@ Proactive controls help ensure that your AWS accounts maintain compliance becaus -Service-managed standards differ from standards that AWS Security Hub manages. For example, you must create and delete a service-managed standard in the managing service. For more information, see [Service-managed standards in Security Hub](./service-managed-standards.html). +Service-managed standards differ from standards that AWS Security Hub Cloud Security Posture Management (CSPM) manages. For example, you must create and delete a service-managed standard in the managing service. For more information, see [Service-managed standards in Security Hub CSPM](./service-managed-standards.html). @@ -21 +21 @@ Service-managed standards differ from standards that AWS Security Hub manages. F -In the Security Hub console and API, you can view Service-Managed Standard: AWS Control Tower alongside other Security Hub standards. +In the Security Hub CSPM console and API, you can view Service-Managed Standard: AWS Control Tower alongside other Security Hub CSPM standards. @@ -36 +36 @@ This standard is available only if you create the standard in AWS Control Tower. -Security Hub controls are identified in the AWS Control Tower console as **SH.`ControlID`** (for example, **SH.CodeBuild.1**). +Security Hub CSPM controls are identified in the AWS Control Tower console as **SH.`ControlID`** (for example, **SH.CodeBuild.1**). @@ -38 +38 @@ Security Hub controls are identified in the AWS Control Tower console as **SH.`C -When you create the standard, if you haven’t already enabled Security Hub, AWS Control Tower also enables Security Hub for you. +When you create the standard, if you haven’t already enabled Security Hub CSPM, AWS Control Tower also enables Security Hub CSPM for you. @@ -40 +40 @@ When you create the standard, if you haven’t already enabled Security Hub, AWS -If you haven't set up AWS Control Tower, you can't view or access this standard in the Security Hub console, Security Hub API, or AWS CLI. Even if you have set up AWS Control Tower, you can't view or access this standard in Security Hub without first creating the standard in AWS Control Tower using one of the preceding methods. +If you haven't set up AWS Control Tower, you can't view or access this standard in the Security Hub CSPM console, Security Hub CSPM API, or AWS CLI. Even if you have set up AWS Control Tower, you can't view or access this standard in Security Hub CSPM without first creating the standard in AWS Control Tower using one of the preceding methods. @@ -48 +48 @@ After you've created the standard in the AWS Control Tower console, you can view -After you first create the standard, it doesn't have any controls that are automatically enabled. In addition, when Security Hub adds new controls, they aren't automatically enabled for Service-Managed Standard: AWS Control Tower. You should enable and disable controls for the standard in AWS Control Tower by using one of the following methods: +After you first create the standard, it doesn't have any controls that are automatically enabled. In addition, when Security Hub CSPM adds new controls, they aren't automatically enabled for Service-Managed Standard: AWS Control Tower. You should enable and disable controls for the standard in AWS Control Tower by using one of the following methods: @@ -59 +59 @@ After you first create the standard, it doesn't have any controls that are autom -When you change the enablement status of a control in AWS Control Tower, the change is also reflected in Security Hub. +When you change the enablement status of a control in AWS Control Tower, the change is also reflected in Security Hub CSPM. @@ -61 +61 @@ When you change the enablement status of a control in AWS Control Tower, the cha -However, disabling a control in Security Hub that's enabled in AWS Control Tower results in control drift. The control status in AWS Control Tower shows as `Drifted`. You can resolve this drift by selecting [Re-register OU](https://docs.aws.amazon.com/controltower/latest/userguide/drift.html#resolving-drift) in the AWS Control Tower console, or by disabling and re-enabling the control in AWS Control Tower using one of the preceding methods. +However, disabling a control in Security Hub CSPM that's enabled in AWS Control Tower results in control drift. The control status in AWS Control Tower shows as `Drifted`. You can resolve this drift by selecting [Re-register OU](https://docs.aws.amazon.com/controltower/latest/userguide/drift.html#resolving-drift) in the AWS Control Tower console, or by disabling and re-enabling the control in AWS Control Tower using one of the preceding methods. @@ -65 +65 @@ Completing enablement and disablement actions in AWS Control Tower helps you avo -When you enable or disable controls in AWS Control Tower, the action applies across accounts and Regions. If you enable and disable controls in Security Hub (not recommended for this standard), the action applies only to the current account and Region. +When you enable or disable controls in AWS Control Tower, the action applies across accounts and Regions. If you enable and disable controls in Security Hub CSPM (not recommended for this standard), the action applies only to the current account and Region. @@ -75 +75 @@ You can view the enablement status of a control by using one of the following me - * Security Hub console, Security Hub API, or AWS CLI + * Security Hub CSPM console, Security Hub CSPM API, or AWS CLI @@ -86 +86 @@ You can view the enablement status of a control by using one of the following me -A control that you disable in AWS Control Tower has an enablement status of `Disabled` in Security Hub unless you explicitly enable that control in Security Hub. +A control that you disable in AWS Control Tower has an enablement status of `Disabled` in Security Hub CSPM unless you explicitly enable that control in Security Hub CSPM. @@ -88 +88 @@ A control that you disable in AWS Control Tower has an enablement status of `Dis -Security Hub calculates control status based on the workflow status and compliance status of the control findings. For more information about enablement status and control status, see [Reviewing the details of controls](./securityhub-standards-control-details.html). +Security Hub CSPM calculates control status based on the workflow status and compliance status of the control findings. For more information about enablement status and control status, see [Reviewing the details of controls in Security Hub CSPM](./securityhub-standards-control-details.html). @@ -90 +90 @@ Security Hub calculates control status based on the workflow status and complian -Based on control statuses, Security Hub calculates a [security score](./standards-security-score.html) for Service-Managed Standard: AWS Control Tower. This score is only available in Security Hub. In addition, you can only view [control findings](./controls-findings-create-update.html) in Security Hub. The standard security score and control findings aren't available in AWS Control Tower. +Based on control statuses, Security Hub CSPM calculates a [security score](./standards-security-score.html) for Service-Managed Standard: AWS Control Tower. This score is only available in Security Hub CSPM. In addition, you can only view [control findings](./controls-findings-create-update.html) in Security Hub CSPM. The standard security score and control findings aren't available in AWS Control Tower. @@ -94 +94 @@ Based on control statuses, Security Hub calculates a [security score](./standard -When you enable controls for Service-Managed Standard: AWS Control Tower, Security Hub may take up to 18 hours to generate findings for controls that use an existing AWS Config service-linked rule. You may have existing service-linked rules if you've enabled other standards and controls in Security Hub. For more information, see [Schedule for running security checks](./securityhub-standards-schedule.html). +When you enable controls for Service-Managed Standard: AWS Control Tower, Security Hub CSPM may take up to 18 hours to generate findings for controls that use an existing AWS Config service-linked rule. You may have existing service-linked rules if you've enabled other standards and controls in Security Hub CSPM. For more information, see [Schedule for running security checks](./securityhub-standards-schedule.html). @@ -109 +109 @@ You can delete this standard in AWS Control Tower by disabling all applicable co -Disabling all controls deletes the standard in all managed accounts and governed Regions in AWS Control Tower. Deleting the standard in AWS Control Tower removes it from the **Standards** page of the Security Hub console, and you can no longer access it by using the Security Hub API or AWS CLI. +Disabling all controls deletes the standard in all managed accounts and governed Regions in AWS Control Tower. Deleting the standard in AWS Control Tower removes it from the **Standards** page of the Security Hub CSPM console, and you can no longer access it by using the Security Hub CSPM API or AWS CLI. @@ -113 +113 @@ Disabling all controls deletes the standard in all managed accounts and governed -Disabling all controls from the standard in Security Hub doesn't disable or delete the standard. +Disabling all controls from the standard in Security Hub CSPM doesn't disable or delete the standard. @@ -115 +115 @@ Disabling all controls from the standard in Security Hub doesn't disable or dele -Disabling the Security Hub service removes Service-Managed Standard: AWS Control Tower and any other standards that you’ve enabled. +Disabling the Security Hub CSPM service removes Service-Managed Standard: AWS Control Tower and any other standards that you’ve enabled. @@ -119 +119 @@ Disabling the Security Hub service removes Service-Managed Standard: AWS Control -When you create Service-Managed Standard: AWS Control Tower and enable controls for it, you'll start to receive control findings in Security Hub. Security Hub reports control findings in the [AWS Security Finding Format (ASFF)](./securityhub-findings-format.html). These are the ASFF values for this standard's Amazon Resource Name (ARN) and `GeneratorId`: +When you create Service-Managed Standard: AWS Control Tower and enable controls for it, you'll start to receive control findings in Security Hub CSPM. Security Hub CSPM reports control findings in the [AWS Security Finding Format (ASFF)](./securityhub-findings-format.html). These are the ASFF values for this standard's Amazon Resource Name (ARN) and `GeneratorId`: @@ -128 +128 @@ When you create Service-Managed Standard: AWS Control Tower and enable controls -For a sample finding for Service-Managed Standard: AWS Control Tower, see [Samples of control findings in Security Hub](./sample-control-findings.html). +For a sample finding for Service-Managed Standard: AWS Control Tower, see [Samples of control findings](./sample-control-findings.html). @@ -134 +134 @@ Service-Managed Standard: AWS Control Tower supports a subset of controls that a -The following list shows available controls for Service-Managed Standard: AWS Control Tower. Regional limits on controls match Regional limits on the corollary controls in the FSBP standard. This list shows standard-agnostic security control IDs. In the AWS Control Tower console, control IDs are formatted as **SH.`ControlID`** (for example **SH.CodeBuild.1**). In Security Hub, if [consolidated control findings](./controls-findings-create-update.html#consolidated-control-findings) is turned off in your account, the `ProductFields.ControlId` field uses the standard-based control ID. The standard-based control ID is formatted as **CT.`ControlId`** (for example, **CT.CodeBuild.1**). +The following list shows available controls for Service-Managed Standard: AWS Control Tower. Regional limits on controls match Regional limits on the corollary controls in the FSBP standard. This list shows standard-agnostic security control IDs. In the AWS Control Tower console, control IDs are formatted as **SH.`ControlID`** (for example **SH.CodeBuild.1**). In Security Hub CSPM, if [consolidated control findings](./controls-findings-create-update.html#consolidated-control-findings) is turned off in your account, the `ProductFields.ControlId` field uses the standard-based control ID. The standard-based control ID is formatted as **CT.`ControlId`** (for example, **CT.CodeBuild.1**). @@ -533 +533 @@ The following list shows available controls for Service-Managed Standard: AWS Co -For more information about this standard, see [Security Hub controls](https://docs.aws.amazon.com/controltower/latest/userguide/security-hub-controls.html) in the _AWS Control Tower User Guide_. +For more information about this standard, see [Security Hub CSPM controls](https://docs.aws.amazon.com/controltower/latest/userguide/security-hub-controls.html) in the _AWS Control Tower User Guide_.