📝 AWS Account Security Hub is not enabled 🟢

• Contextual name: 📝 Security Hub is not enabled 🟢
• ID: /ce/ca/aws/account/security-hub
• Located in: 📁 AWS Account

Flags

• 🟢 Policy with categories
• 🟢 Policy with type
• 🟢 Production policy

Our Metadata

• Policy Type: COMPLIANCE_POLICY
• Policy Category:
  • SECURITY

Similar Policies

• Cloud Conformity
  • Security Hub Enabled
• Internal
  • dec-z-bc139af8

Similar Internal Rules

Rule	Policies	Flags
✉️ dec-z-bc139af8	1

Logic

• 🧠 prod.logic.yaml 🟠🟢
  • 📕 AWS Account
  • 🧪 test-data.json

Description

Open File

Description

Security Hub collects security data from across AWS accounts, services, and supported third-party partner products and helps you analyze your security trends and identify the highest priority security issues. When you enable Security Hub, it begins to consume, aggregate, organize, and prioritize findings from AWS services that you have enabled, such as Amazon GuardDuty, Amazon Inspector, and Amazon Macie. You can also enable integrations with AWS partner security products.

Rationale

AWS Security Hub provides you with a comprehensive view of your security state in AWS and helps you check your environment against security industry standards and best practices - enabling you to quickly assess the security posture across your AWS accounts.

Impact

It is recommended AWS Security Hub be enabled in all regions. AWS Security Hub requires AWS Config to be enabled.

Audit

The process to evaluate AWS Security Hub configuration per region

From Console

1. Sign in to the AWS Management Console and open the AWS Security Hub console at https://console.aws.amazon.com/securityhub/.

... see more

Remediation

Open File

Remediation

To grant the permissions required to enable Security Hub, attach the Security Hub managed policy AWSSecurityHubFullAccess to an IAM user, group, or role. Enabling Security Hub

From Console

1. Use the credentials of the IAM identity to sign in to the Security Hub console.
2. When you open the Security Hub console for the first time, choose Go to Security Hub.
3. The Security standards section on the welcome page lists supported security standards. Check the box for a standard to enable it.
4. Choose Enable Security Hub.

From Command Line

1. Run the enable-security-hub command. To enable the default standards, include --enable-default-standards:

aws securityhub enable-security-hub --enable-default-standards

2. To enable the security hub without the default standards, include --no-enable-default-standards:

aws securityhub enable-security-hub --no-enable-default-standards

policy.yaml

Open File

Linked Framework Sections

Section	Sub Sections	Internal Rules	Policies	Flags
💼 CIS AWS v1.5.0 → 💼 4.16 Ensure AWS Security Hub is enabled - Level 2 (Automated)		1	1
💼 CIS AWS v2.0.0 → 💼 4.16 Ensure AWS Security Hub is enabled - Level 2 (Automated)		1	1
💼 CIS AWS v3.0.0 → 💼 4.16 Ensure AWS Security Hub is enabled - Level 2 (Automated)		1	1
💼 CIS AWS v4.0.0 → 💼 4.16 Ensure AWS Security Hub is enabled (Automated)			1
💼 CIS AWS v4.0.1 → 💼 4.16 Ensure AWS Security Hub is enabled (Automated)			1
💼 CIS AWS v5.0.0 → 💼 4.16 Ensure AWS Security Hub is enabled (Automated)			1
💼 Cloudaware Framework → 💼 Threat Protection			25
💼 FedRAMP High Security Controls → 💼 AU-12 Audit Record Generation (L)(M)(H)	2		47
💼 FedRAMP High Security Controls → 💼 SI-4(20) Privileged Users (H)		46	48
💼 FedRAMP Low Security Controls → 💼 AU-12 Audit Record Generation (L)(M)(H)			47
💼 FedRAMP Moderate Security Controls → 💼 AU-12 Audit Record Generation (L)(M)(H)			47
💼 NIST CSF v2.0 → 💼 DE.CM-01: Networks and network services are monitored to find potentially adverse events			83
💼 NIST CSF v2.0 → 💼 DE.CM-03: Personnel activity and technology usage are monitored to find potentially adverse events			59
💼 NIST CSF v2.0 → 💼 DE.CM-09: Computing hardware and software, runtime environments, and their data are monitored to find potentially adverse events			89
💼 NIST SP 800-53 Revision 5 → 💼 AU-12 Audit Record Generation	4	45	47