AWS whitepapers documentation change
Summary
Removed entire content including sections on threat modeling, cyber threat intelligence, and references to AWS security services.
Security assessment
The change deletes security guidance content but shows no evidence of addressing a specific vulnerability or incident. Removal of best practice documentation may indirectly impact security posture, but isn't directly tied to a security issue.
Diff
diff --git a/whitepapers/latest/aws-security-incident-response-guide/understand-threat-landscape.md b/whitepapers/latest/aws-security-incident-response-guide/understand-threat-landscape.md index 981ae548b..8b1378917 100644 --- a//whitepapers/latest/aws-security-incident-response-guide/understand-threat-landscape.md +++ b//whitepapers/latest/aws-security-incident-response-guide/understand-threat-landscape.md @@ -1 +0,0 @@ -[View a markdown version of this page](understand-threat-landscape.md) @@ -3,39 +1,0 @@ -[](/pdfs/security-ir/latest/userguide/sir-ug.pdf#understand-threat-landscape "Open PDF") - -[Documentation](/index.html)[Security Incident Response](/security-ir/index.html)[](what-is.html) - -Develop threat modelsIntegrate and use cyber threat intelligence - -# Understand the threat landscape - -## Develop threat models - -By developing threat models, organizations can identify threats and mitigations before an unauthorized user can. There are a number of strategies and approaches to threat modeling; refer to the [How to approach threat modeling](https://aws.amazon.com/blogs/security/how-to-approach-threat-modeling/) blog post. For incident response, a threat model can help identify the attack vectors a threat actor might have used during an incident. Understanding what you’re defending against will be crucial in order to respond in a timely manner. You can also use an AWS Partner for threat modeling. To search for an AWS partner, use the [AWS Partner Network](https://partners.amazonaws.com/). - -## Integrate and use cyber threat intelligence - -Cyber threat intelligence is the data and analysis of a threat actor’s intent, opportunity, and capability. Obtaining and using threat intelligence is helpful to detect an incident early and to better understand threat actor behavior. Cyber threat intelligence includes static indicators like IP addresses or file hashes of malware. It also includes high-level information, like behavioral patterns and intent. You can collect threat intelligence from a number of cyber security vendors and from open-source repositories. - -To integrate and maximize threat intelligence for your AWS environment, you can use some out-of-the-box capabilities and integrate your own threat intelligence lists. Amazon GuardDuty uses AWS internal and third-party threat intelligence sources. Other AWS services, such as a DNS firewall and AWS WAF rules, also take inputs from AWS' advanced threat intelligence group. Some GuardDuty findings are mapped to the [MITRE ATT&CK Framework](https://attack.mitre.org/), which provides information on real-world observations on adversary tactics and techniques. - - **Javascript is disabled or is unavailable in your browser.** - -To use the Amazon Web Services Documentation, Javascript must be enabled. Please refer to your browser's Help pages for instructions. - -[Document Conventions](/general/latest/gr/docconventions.html) - -Prepare access to AWS accounts - -Select and set up logs for analysis and alerting - -Did this page help you? - Yes - -Thanks for letting us know we're doing a good job! - -If you've got a moment, please tell us what we did right so we can do more of it. - -Did this page help you? - No - -Thanks for letting us know this page needs work. We're sorry we let you down. - -If you've got a moment, please tell us how we can make the documentation better.