AWS securityhub: Add business criticality to SageMaker notebook exposure impact traits
Summary
Adds a 'Business criticality' subsection and TOC entry, and updates the impact traits description to include business criticality of downstream resources reachable from a compromised SageMaker notebook instance.
Security assessment
Adds documentation on how exposure findings for SageMaker notebook instances incorporate business criticality of reachable resources, aiding prioritization of privilege-escalation risk. Security-adjacent guidance, no specific vulnerability addressed.
Evidence
+The business criticality of the primary resource, set either by automation rules or by inference from the name and tags.
Diff
diff --git a/securityhub/latest/userguide/exposure-sagemaker-notebook-instance.md b/securityhub/latest/userguide/exposure-sagemaker-notebook-instance.md index 70d423d..acd7609 100644 --- a//securityhub/latest/userguide/exposure-sagemaker-notebook-instance.md +++ b//securityhub/latest/userguide/exposure-sagemaker-notebook-instance.md @@ -68,0 +69,2 @@ The remediation guidance provided in this topic might require additional consult + * [Business criticality](./exposure-sagemaker-notebook-instance.html#business-criticality) + @@ -152 +154 @@ Based on the type of sensitive data discovered, implement the appropriate securi -Impact traits describe the potential blast radius of an exposure. Security Hub analyzes the effective permissions of the AWS Identity and Access Management principal associated with the SageMaker notebook instance to determine the downstream resources an attacker could reach if the notebook instance is compromised. Each impact trait identifies a specific privilege escalation pattern. To reduce your blast radius, review the permission paths described in each trait and remove any unnecessary privileges. +Impact traits describe the potential blast radius of an exposure. Security Hub analyzes the effective permissions of the AWS Identity and Access Management principal associated with the SageMaker notebook instance to determine the downstream resources an attacker could reach if the notebook instance is compromised, as well as the business criticality of those resources. Each impact trait identifies a specific privilege escalation pattern. To reduce your blast radius, review the permission paths described in each trait and remove any unnecessary privileges. @@ -219,0 +222,4 @@ The associated principal has a privilege escalation path that advances its overa +### Business criticality + +The business criticality of the primary resource, set either by automation rules or by inference from the name and tags. +