AWS securityhub high security documentation change
Summary
Added documentation for detecting/remediating EC2 instances with End-Of-Life OS, malicious software packages, and malicious files. Removed section about public IP addresses and updated links.
Security assessment
Added sections explicitly document security risks like malware (critical active threats) and End-Of-Life OS vulnerabilities (lack of security patches). These changes provide remediation guidance for specific security vulnerabilities. The removed public IP section might reduce security visibility but lacks evidence of being a vulnerability fix.
Diff
diff --git a/securityhub/latest/userguide/exposure-ec2-instance.md b/securityhub/latest/userguide/exposure-ec2-instance.md index 066118ce4..5820376fb 100644 --- a//securityhub/latest/userguide/exposure-ec2-instance.md +++ b//securityhub/latest/userguide/exposure-ec2-instance.md @@ -5 +5 @@ -Misconfiguration traits for EC2 instancesReachability traits for EC2 instancesVulnerability traits for EC2 instances +Misconfiguration traits for EC2 instancesReachability traits for EC2 instancesVulnerability traits for EC2 instancesThe EC2 instance has malicious software packagesThe EC2 instance has malicious files @@ -33,3 +33 @@ The remediation guidance provided in this topic might require additional consult - * [The Amazon EC2 instance has an open security group](./exposure-ec2-instance.html#w2aab7c33c19c15c15c15) - - * [The Amazon EC2 instance has a public IP address](./exposure-ec2-instance.html#w2aab7c33c19c15c15c17) + * [The Amazon EC2 instance has an open security group](./exposure-ec2-instance.html#open-security-group) @@ -48,0 +47,6 @@ The remediation guidance provided in this topic might require additional consult + * [The EC2 instance has an End-Of-Life operating system](./exposure-ec2-instance.html#end-of-life-operating-system) + + * [The EC2 instance has malicious software packages](./exposure-ec2-instance.html#malicious-package) + + * [The EC2 instance has malicious files](./exposure-ec2-instance.html#malicious-file) + @@ -159,25 +162,0 @@ Modify your security group rules to restrict access to specific trusted IP addre -### The Amazon EC2 instance has a public IP address - -Amazon EC2 instances with public IP addresses are publicly accessible from the internet. While public IP addresses are sometimes necessary for instances that provide services to external customers, this can be used as a potential by attack unauthorized principals. Following standard security principles, AWS recommends that you limit public exposure of resources when possible. - -###### Move the instance to a private subnet - -If the instance does not require direct internet access, consider moving it to a private subnet within your VPC. This will remove its public IP address while still allowing it to communicate with other resources within your VPC. For more information, see [How do I move my Amazon EC2 instance to another subnet, Availability Zone, or VPC?](https://repost.aws/knowledge-center/move-ec2-instance) in the AWS Knowledge Center. - -###### Configure instances to launch without public IP addresses - -If the instance was launched in a public subnet that doesn’t require public IP addresses, the launch configuration can be modified to prevent the automatic assignment of public IP addresses. This can be disabled at the subnet level or when launching individual instances. For more information, see [Modify the IP addressing attributes of your subnet](https://docs.aws.amazon.com/vpc/latest/userguide/subnet-public-ip.html) in the _Amazon Virtual Private Cloud User Guide_ and [Amazon Amazon EC2instance IP addressing](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-instance-addressing.html) in the _Amazon Elastic Compute Cloud User Guide_. - -###### Alternative access methods - -Consider the following options for alternative access methods: - - * **Use a NAT Gateway for outbound internet connectivity** – - -For instances in private subnets that require access to the internet (e.g., to download updates), consider using a NAT Gateway instead of assigning a public IP address. A NAT Gateway allows instances in private subnets to initiate outbound connections to the internet while preventing inbound connections from the internet. For more information, see [NAT gateways](https://docs.aws.amazon.com/vpc/latest/userguide/vpc-nat-gateway.html) in the _Amazon Virtual Private Cloud User Guide_. - - * **Use Elastic Load Balancing** – For instances that are running web applications, consider using an Elastic Load Balancer (LB). LBs can be configured to allow your instances to run in private subnets while the LB runs in a public subnet and handles internet traffic. For more information, see What is Elastic Load Balancing? in the AWSELB User Guide. See [Load balancer subnets](https://docs.aws.amazon.com/prescriptive-guidance/latest/load-balancer-stickiness/subnets-routing.html) in _AWS Prescriptive Guidance_ for guidance on how to choose a stickiness strategy for your LB. - - - - @@ -219 +198 @@ Amazon Virtual Private Cloud (Amazon VPC) allows you to launch AWS resources in -In the the exposure finding, identify the security group ID in the ARN. Identify which instances need to communicate with each other and on which ports. You can use Amazon VPC Flow Logs to analyze existing traffic patterns in your Amazon VPC to help identify which ports are being used. +In the exposure finding, identify the security group ID in the ARN. Identify which instances need to communicate with each other and on which ports. You can use Amazon VPC Flow Logs to analyze existing traffic patterns in your Amazon VPC to help identify which ports are being used. @@ -223 +202 @@ In the the exposure finding, identify the security group ID in the ARN. Identify -Modify your security group rules to restrict access to specific trusted IP addresses or ranges. For example, instead of allowing all traffic from the entire VPC CIDR range (e.g., 10.0.0.0/16), restrict access to specific security groups or IP ranges. When updating your security group rules, consider separating access requirements for different network segments by creating rules for each required source IP range or restricting access to specific ports. To modify security group rules, see Configure security group rules in the Amazon EC2User Guide. +Modify your security group rules to restrict access to specific trusted IP addresses or ranges. For example, instead of allowing all traffic from the entire VPC CIDR range (e.g., 10.0.0.0/16), restrict access to specific security groups or IP ranges. When updating your security group rules, consider separating access requirements for different network segments by creating rules for each required source IP range or restricting access to specific ports. To modify security group rules, see [Configure security group rules](https://docs.aws.amazon.com/vpc/latest/userguide/working-with-security-group-rules.html) in the Amazon EC2 User Guide. @@ -283,0 +263,26 @@ To prevent future occurrences, consider implementing a vulnerability management +### The EC2 instance has an End-Of-Life operating system + +The EC2 instance runs an end-of-life operating system that is no longer supported or maintained by the original developer. This exposes the instance to security vulnerabilities and potential attacks. When operating systems reach end-of-life, vendors typically stop releasing new security advisories. Existing security advisories may also be removed from vendor feeds. As a result, Amazon Inspector could potentially stop generating findings for known CVEs, creating further gaps in security coverage. + +See [Discontinued operating systems](https://docs.aws.amazon.com/inspector/latest/user/supported.html#formerly-supported-os) in the _Amazon Inspector User Guide_ for information about operating systems that have reached end of life that can be detected by Amazon Inspector. + +###### Update to a supported operating system version + +We recommend updating to a supported version of the operating system. In the exposure finding, open the resource to access the affected resource. Before updating the operating system version on your instance, review available versions in [Supported Operating Systems](https://docs.aws.amazon.com/inspector/latest/user/supported.html#supported-os) in the _Amazon Inspector User Guide_ for a list of currently supported OS versions. + +## The EC2 instance has malicious software packages + +Malicious packages are software components that contain harmful code designed to compromise the confidentiality, integrity, and availability of your systems and data. Malicious packages pose an active and critical threat to your instance, as attackers can execute malicious code automatically without exploiting a vulnerability. Following security best practices, AWS recommends removing malicious packages to protect your instance from potential attacks. + +###### Remove malicious packages + +Review the malicious package details in the **References** section of the **Vulnerability** tab of the trait to understand the threat. Remove the identified malicious packages using the appropriate package manager. See [Package management tool](https://docs.aws.amazon.com/linux/al2023/ug/package-management.html) in the _Amazon Linux 2023 User Guide_ for an example. After removing the malicious packages, consider performing a scan to ensure that all packages that may have been installed by the malicious code have been removed. For more information, see [Starting On-demand malware scan in GuardDuty](https://docs.aws.amazon.com/guardduty/latest/ug/malware-protection-getting-started-on-demand-scan.html) in the __. + +## The EC2 instance has malicious files + +Malicious files contain harmful code designed to compromise the confidentiality, integrity, and availability of your systems and data. Malicious files pose an active and critical threat to your instance, as attackers can execute malicious code automatically without exploiting a vulnerability. Following security best practices, AWS recommends removing malicious files to protect your instance from potential attacks. + +###### Remove malicious files + +To identify the specific Amazon Elastic Block Store (Amazon EBS) volume that has malicious files, review the **Resources** section of the trait's finding details. Once you have identified the volume with the malicious file, remove the identified malicious files. After removing the malicious files, consider performing a scan to ensure that all files that may have been installed by the malicious file have been removed. For more information, see [Starting On-demand malware scan in GuardDuty](https://docs.aws.amazon.com/guardduty/latest/ug/malware-protection-getting-started-on-demand-scan.html) in the __. +