AWS securityhub: Document business criticality in ECS service exposure impact traits
Summary
Adds a 'Business criticality' subsection and TOC entry, and updates the impact-traits description to state that Security Hub also considers the business criticality of downstream resources when assessing the blast radius of an exposed Amazon ECS service.
Security assessment
Mirrors the EC2 exposure doc change: it explains that business criticality of reachable resources is included in exposure/blast-radius analysis, which aids prioritization of privilege-escalation risk. No specific vulnerability or CVE is referenced, so severity is medium.
Evidence
+The business criticality of the primary resource, set either by automation rules or by inference from the name and tags.
Diff
diff --git a/securityhub/latest/userguide/exposure-ecs-service.md b/securityhub/latest/userguide/exposure-ecs-service.md index 48d1e43..2553fdc 100644 --- a//securityhub/latest/userguide/exposure-ecs-service.md +++ b//securityhub/latest/userguide/exposure-ecs-service.md @@ -86,0 +87,2 @@ The remediation guidance provided in this topic might require additional consult + * [Business criticality](./exposure-ecs-service.html#business-criticality) + @@ -314 +316 @@ After updating your container image, push it to your container registry and upda -Impact traits describe the potential blast radius of an exposure. Security Hub analyzes the effective permissions of the AWS Identity and Access Management principal associated with the Amazon ECS service to determine the downstream resources an attacker could reach if the service is compromised. Each impact trait identifies a specific privilege escalation pattern. To reduce your blast radius, review the permission paths described in each trait and remove any unnecessary privileges. +Impact traits describe the potential blast radius of an exposure. Security Hub analyzes the effective permissions of the AWS Identity and Access Management principal associated with the Amazon ECS service to determine the downstream resources an attacker could reach if the service is compromised, as well as the business criticality of those resources. Each impact trait identifies a specific privilege escalation pattern. To reduce your blast radius, review the permission paths described in each trait and remove any unnecessary privileges. @@ -381,0 +384,4 @@ The associated principal has a privilege escalation path that advances its overa +### Business criticality + +The business criticality of the primary resource, set either by automation rules or by inference from the name and tags. +