AWS securityhub: Security Hub: add Criticality trait and expand Impact trait docs
Summary
Adds a new 'Criticality' trait row (importance of a resource to the business, set via automation rules or inferred from name/tags) to the supported traits table, and expands the 'Impact' trait definition and explanation to include the criticality of downstream and primary resources alongside IAM effective-permissions analysis.
Security assessment
The change documents how Security Hub computes exposure blast radius from IAM effective permissions and privilege-escalation paths, and introduces a Criticality trait used to prioritize resources. It is security guidance about an existing detection feature (no fix for a specific vulnerability, no CVE), so it is security-adjacent documentation rather than a vulnerability remediation.
Evidence
+The **Impact** trait describes the potential blast radius of an exposure — the downstream resources an attacker could reach and compromise if the primary resource in the exposure finding is compromised. To determine impact, Security Hub analyzes the _effective permissions_ of the AWS Identity and Access Management (IAM) principals associated with the resource, as well as the criticality of the resources.
Diff
diff --git a/securityhub/latest/userguide/exposure-findings-supported-traits.md b/securityhub/latest/userguide/exposure-findings-supported-traits.md index 5db29f3..2c61126 100644 --- a//securityhub/latest/userguide/exposure-findings-supported-traits.md +++ b//securityhub/latest/userguide/exposure-findings-supported-traits.md @@ -16 +16,6 @@ Assumability | Indicates a resource with vended AWS Identity and Access Manage -Impact | Indicates the potential blast radius if the resource is compromised, based on the effective permissions of associated AWS Identity and Access Management principals, including the ability to create and modify resources | Effective permissions analysis of associated AWS Identity and Access Management principals | AWS resources with associated AWS Identity and Access Management identities +Impact | Indicates the potential blast radius if the resource is compromised, based on the effective permissions of associated AWS Identity and Access Management principals, including the ability to create and modify resources, the criticality of downstream resources, and the criticality of the primary resource. | + + * Effective permissions analysis of associated AWS Identity and Access Management principals. + * Criticality of resources accessible by a given AWS Identity and Access Management principal. Criticality can be set by automation rules, or it will be inferred based on the name and tags of the resource. + +| AWS resources with associated AWS Identity and Access Management identities @@ -20,0 +26 @@ Vulnerability | Indicates that a resource has a weakness which could be exploit +Criticality | Indicates the importance of a resource to the business | Assigned via automation rules. If criticality isn't set by an automation rule, Security Hub infers it from the resource name and tags. For more information, see [Resources in Security Hub](./resources-adv.html). | All resource types @@ -26 +32 @@ Each trait can be associated with multiple titles that provide details about the -The **Impact** trait describes the potential blast radius of an exposure — the downstream resources an attacker could reach and compromise if the primary resource in the exposure finding is compromised. To determine impact, Security Hub analyzes the _effective permissions_ of the AWS Identity and Access Management (IAM) principals associated with the resource. +The **Impact** trait describes the potential blast radius of an exposure — the downstream resources an attacker could reach and compromise if the primary resource in the exposure finding is compromised. To determine impact, Security Hub analyzes the _effective permissions_ of the AWS Identity and Access Management (IAM) principals associated with the resource, as well as the criticality of the resources. @@ -30 +36 @@ The **Impact** trait describes the potential blast radius of an exposure — the -Using effective permissions, Security Hub traces the privilege escalation paths from the primary resource to other resources in your environment. Each path is a chain of resources connected by the permissions that allow an attacker to move from one resource to the next. When Security Hub identifies a concrete path to an existing resource, it surfaces that path as part of the **Impact** trait. Impact also accounts for permissions beyond these paths, such as the ability to invoke AWS services that can create or modify other resources. You can review these paths in the potential attack path graph and reduce your blast radius by removing unnecessary permissions. For more information, see [Viewing exposures in Security Hub with the potential attack path graph](./potential-attack-path-graph.html). +Using effective permissions, Security Hub traces the privilege escalation paths from the primary resource to other resources in your environment. Each path is a chain of resources connected by the permissions that allow an attacker to move from one resource to the next. When Security Hub identifies a concrete path to an existing resource, it surfaces that path as part of the **Impact** trait. Impact also accounts for permissions beyond these paths, such as the ability to invoke AWS services that can create or modify other resources and the criticality of the primary resource. You can review these paths in the potential attack path graph and reduce your blast radius by removing unnecessary permissions. For more information, see [Viewing exposures in Security Hub with the potential attack path graph](./potential-attack-path-graph.html).