CLOUD SERVICE · AWS

AWS Security Hub

AWS Security Hub is a cloud security management service that aggregates, organizes, and prioritizes security alerts or findings from multiple AWS services and AWS Partner Network (APN) security solutions, providing a comprehensive view of security and compliance across an AWS environment.

Cloud Services Hub →

Icon source: AWS

What is AWS Security Hub

Read the extensive description

AWS Security Hub is a comprehensive security and compliance service offered by Amazon Web Services (AWS) designed to give users a detailed and consolidated view of their security posture across their AWS environment. The findings aggregation, security best practice checks, and compliance monitoring previously offered as Security Hub are now available as Security Hub CSPM; the enhanced Security Hub adds automated correlation across security signals, near real-time risk analytics, and automated response.

One of the key features of AWS Security Hub is its ability to collect and consolidate findings from different sources, such as Amazon GuardDuty, Amazon Inspector, Amazon Macie, AWS Identity and Access Management (IAM) Access Analyzer, and other AWS-supported security solutions. Third-party partner-tool findings can be sent, received, and updated through Security Hub CSPM integrations; the enhanced Security Hub does not directly receive those findings. This integration not only reduces the complexity and effort required to monitor security events but also provides a unified view of security and compliance status in a single dashboard.

AWS Security Hub is designed with customizability and automation in mind. Security Hub CSPM provides managed and custom insights, which group related findings and can be tailored using filters. Through the use of automated response and remediation actions, AWS Security Hub can also streamline the process of addressing security issues by executing pre-defined remediation actions in response to specific findings. Furthermore, it supports continuous compliance checks against industry standards and best practices, such as CIS AWS Foundations Benchmark, helping organizations to continuously monitor and report on their compliance status.

Security Hub offers Essentials as its default plan for risk analytics, vulnerability management, security posture management, and security response management. Optional Threat Analytics adds GuardDuty-powered threat monitoring, while Extended provides curated partner security solutions.

The optional Lambda Code Scanning capability uses Amazon Inspector to detect vulnerabilities in Lambda function code on deployment and through periodic rescanning.

Another advantage of AWS Security Hub is its scalability and global availability, which makes it suitable for organizations of all sizes and industries, from startups to large enterprises operating in multiple global regions. Automated security checks can help prepare for an audit, but they do not cover every control in a security standard or imply that an organization will pass an audit.

In summary, AWS Security Hub is a pivotal component in the AWS ecosystem for managing security and compliance posture. Its ability to aggregate and prioritize security findings from various sources, along with the automation of response actions and continuous compliance checks, provides organizations with the tools they need to bolster their security defenses and maintain compliance with industry standards, thereby strengthening their overall security framework in the cloud.

Key AWS Security Hub Features

AWS Security Hub provides centralized security management, automated compliance checks, integration of findings from various sources, customization of insights and actions, continuous security checks, and seamless integration with AWS services for an enhanced security and compliance posture in the AWS cloud.

Centralized Security Management

AWS Security Hub provides a comprehensive view of your security state within AWS and helps you check your environment against security industry standards and best practices.

Automated Compliance Checks

It automates checks against supported security standards, but these checks do not cover every requirement or guarantee that an organization will pass an audit.

Integrated Findings

Security Hub receives findings from Security Hub CSPM, Amazon GuardDuty, Amazon Inspector, and Amazon Macie; third-party partner findings integrations remain available in Security Hub CSPM.

Custom Insights and Actions

Security Hub CSPM supports managed and custom insights for grouping related findings and focusing investigations using filters.

Automated Security Checks

Leverage continuous, automated security and compliance checks to monitor your AWS resources for any vulnerabilities or deviations from best practices.

Seamless Integration

Easily integrates with Amazon CloudWatch and AWS Lambda for custom alerting and remediation strategies, enhancing the overall security response workflow.

AWS Security Hub Use Cases

AWS Security Hub serves as a comprehensive security management tool, centralizing security monitoring, automating compliance checks, integrating security findings, and providing customizable insights for enhanced visibility and control over AWS environments.

Centralized Security Monitoring

AWS Security Hub allows organizations to aggregate, organize, and prioritize security findings across AWS accounts. Security Hub receives findings from Security Hub CSPM, Amazon GuardDuty, Amazon Inspector, and Amazon Macie, while Security Hub CSPM supports third-party partner-tool findings.

Compliance Standards Monitoring

Security Hub automatically checks the resources in your account against a set of compliance standards, such as the CIS AWS Foundations Benchmark or the PCI DSS. It provides a detailed view of your compliance status and identifies specific accounts and resources that are non-compliant, making it easier to manage and remediate compliance issues across an AWS environment.

Automated Security Best Practice Checks

By employing the AWS Security Hub, organizations can automate the process of checking the configuration of their AWS resources against a set of security best practices. This proactive approach helps in identifying potential security issues before they become actual threats, allowing for prompt remediation and strengthening the security posture.

Integrated Security Findings

Security Hub receives findings from Security Hub CSPM, Amazon GuardDuty, Amazon Inspector, and Amazon Macie. AWS Config and third-party security product findings are supported through Security Hub CSPM rather than as direct findings sources in enhanced Security Hub.

Customizable Insights and Dashboards

AWS Security Hub provides customizable dashboards and insights that enable users to tailor their security alerts and reports according to their specific needs. These customizations can help focus efforts on the areas of highest priority and streamline security operations processes, making it easier for teams to stay informed about their security posture in real-time.

AWS Security Hub pricing models

AWS Security Hub pricing is based on a Pay-Per-Result model, complemented by a Free Tier offering for initial, limited usage.

30-Day Free Trial

Each enabled AWS account and Region receives a 30-day trial of Essentials capabilities, including accounts that previously used Security Hub CSPM or Amazon Inspector trials. Threat Analytics, Lambda Code Scanning, and Extended are excluded, although unused individual-service trials may still apply. Azure monitoring has a separate 30-day trial after integration.

Extended Plan

Partner solutions use pay-as-you-go pricing with no upfront commitment, consolidated AWS billing, and eligibility toward PPA or EDP commitments. Essentials must be enabled, and partner charges are additional.

Lambda Code Scanning Add-on

Enabling Lambda Code Scanning adds a per-function charge to the Essentials Lambda base price.

Pay-Per-Result Pricing Model

AWS Security Hub follows a Pay-Per-Result pricing model where you are billed based on the number of security checks performed. You only pay for the security checks that AWS Security Hub performs on your AWS resources, making it a cost-effective solution for monitoring and securing your AWS environment. There are no upfront costs or minimum fees, and pricing varies by region.

Threat Analytics Add-on

Additional usage charges apply for CloudTrail management events, analyzed log and security-data volume, and monitored runtime vCPUs, with volume tiers for data and runtime activity.

Services AWS Security Hub integrates with

AWS Firewall Manager

AWS Firewall Manager simplifies your AWS WAF, AWS Shield Advanced, and Amazon VPC security group administration and maintenance tasks across multiple accounts and resources.

Open AWS Firewall Manager →

Amazon GuardDuty

Amazon GuardDuty is a threat detection service that continuously monitors for malicious activity and unauthorized behavior to protect your AWS accounts and workloads.

Open Amazon GuardDuty →

Amazon Macie

Amazon Macie is a fully managed data security and data privacy service that uses machine learning and pattern matching to discover and protect your sensitive data in AWS.

Open Amazon Macie →