AWS securityhub high security documentation change
Summary
Added documentation for three new vulnerability traits: End-Of-Life operating systems, malicious software packages, and malicious files in EKS clusters. Updated section headers and navigation links.
Security assessment
The changes document critical security risks including EOL operating systems (which stop receiving security updates), malicious packages (active attack vectors), and malicious files (direct compromise vectors). The text explicitly states these pose 'active and critical threat' risks and provides remediation guidance.
Diff
diff --git a/securityhub/latest/userguide/exposure-eks-cluster.md b/securityhub/latest/userguide/exposure-eks-cluster.md index 1e21b3ed5..e0b69174c 100644 --- a//securityhub/latest/userguide/exposure-eks-cluster.md +++ b//securityhub/latest/userguide/exposure-eks-cluster.md @@ -5 +5 @@ -Misconfiguration traits for Amazon EKS clustersVulnerabilitiy traits for Amazon EKS clusters +Misconfiguration traits for Amazon EKS clustersVulnerability traits for Amazon EKS clustersThe Amazon EKS cluster has a container with an End-Of-Life operating systemThe Amazon EKS cluster has a container with malicious software packagesThe EKS cluster has malicious files @@ -31 +31 @@ The remediation guidance provided in this topic might require additional consult - * [Vulnerabilitiy traits for Amazon EKS clusters](./exposure-eks-cluster.html#w2aab7c33c19c19c17) + * [Vulnerability traits for Amazon EKS clusters](./exposure-eks-cluster.html#vulnerability) @@ -35 +35,7 @@ The remediation guidance provided in this topic might require additional consult - * [The Amazon EKS cluster has a container with software vulnerabilities](./exposure-eks-cluster.html#w2aab7c33c19c19c17b9) + * [The Amazon EKS cluster has a container with software vulnerabilities](./exposure-eks-cluster.html#low-priority-vulnerability) + + * [The Amazon EKS cluster has a container with an End-Of-Life operating system](./exposure-eks-cluster.html#end-of-life-operating-system) + + * [The Amazon EKS cluster has a container with malicious software packages](./exposure-eks-cluster.html#malicious-package) + + * [The EKS cluster has malicious files](./exposure-eks-cluster.html#malicious-file) @@ -72 +78 @@ Amazon EKS supports the encryption of Kubernetes secrets using KMS keys through -## Vulnerabilitiy traits for Amazon EKS clusters +## Vulnerability traits for Amazon EKS clusters @@ -91,0 +98,26 @@ Update your container images to newer versions that include security fixes for t +## The Amazon EKS cluster has a container with an End-Of-Life operating system + +The Amazon EKS container image relies on an end-of-life operating system that is no longer supported or maintained by the original developer. This exposes the container to security vulnerabilities and potential attacks. When operating systems reach end-of-life, vendors typically stop releasing new security advisories. Existing security advisories may also be removed from vendor feeds. As a result, Amazon Inspector could potentially stop generating findings for known CVEs, creating further gaps in security coverage. + +See [Discontinued operating systems](https://docs.aws.amazon.com/inspector/latest/user/supported.html#formerly-supported-os) in the _Amazon Inspector User Guide_ for information about operating systems that have reached end of life that can be detected by Amazon Inspector. + +###### Update to a supported operating system version + +We recommend updating to a supported version of the operating system. In the exposure finding, open the resource to access the affected resource. Before updating the operating system version in your container image, review available versions in [Supported Operating Systems](https://docs.aws.amazon.com/inspector/latest/user/supported.html#supported-os) in the _Amazon Inspector User Guide_ for a list of currently supported OS versions. After updating your container image, rebuild and redeploy your containers to the Amazon EKS cluster. + +## The Amazon EKS cluster has a container with malicious software packages + +Malicious packages are software components that contain harmful code designed to compromise the confidentiality, integrity, and availability of your systems and data. Malicious packages pose an active and critical threat to your Amazon EKS cluster, as attackers can execute malicious code automatically without exploiting a vulnerability. Following security best practices, AWS recommends removing malicious packages to protect your cluster from potential attacks. + +###### Remove malicious packages + +Review the malicious package details in the **References** section of the **Vulnerability** tab of the trait to understand the threat. Remove the identified malicious packages from your container images. Then, delete the pods with the compromised image. Update your Kubernetes deployments to use the updated container images. Then, deploy your changes and redeploy your pods. + +## The EKS cluster has malicious files + +Malicious files contain harmful code designed to compromise the confidentiality, integrity, and availability of your systems and data. Malicious files pose an active and critical threat to your cluster, as attackers can execute malicious code automatically without exploiting a vulnerability. Following security best practices, AWS recommends removing malicious files to protect your cluster from potential attacks. + +###### Remove malicious files + +To identify the specific Amazon Elastic Block Store (Amazon EBS) volume that has malicious files, review the **Resources** section of the trait's finding details. Once you have identified the volume with the malicious file, remove the identified malicious files. After removing the malicious files, consider performing a scan to ensure that all files that may have been installed by the malicious file have been removed. For more information, see [Starting On-demand malware scan in GuardDuty](https://docs.aws.amazon.com/guardduty/latest/ug/malware-protection-getting-started-on-demand-scan.html) in the __. +