Skip to content

Security

The Security pillar includes the ability to protect information, systems, and assets while delivering business value through risk assessments and mitigation strategies.

Questions

SEC01 8 best practices
How do you securely operate your workload?
BP01 Separate workloads using accounts BP02 Secure account root user and properties BP03 Identify and validate control objectives BP04 Stay up to date with security threats and recommendations BP05 Reduce security management scope BP06 Automate deployment of standard security controls BP07 Identify threats and prioritize mitigations using a threat model BP08 Evaluate and implement new security services and features regularly
SEC02 6 best practices
How do you manage authentication for people and machines?
BP01 Use strong sign-in mechanisms BP02 Use temporary credentials BP03 Store and use secrets securely BP04 Rely on a centralized identity provider BP05 Audit and rotate credentials periodically BP06 Employ user groups and attributes
SEC03 9 best practices
How do you manage permissions for people and machines?
BP01 Define access requirements BP02 Grant least privilege access BP03 Establish emergency access process BP04 Reduce permissions continuously BP05 Define permission guardrails for your organization BP06 Manage access based on lifecycle BP07 Analyze public and cross-account access BP08 Share resources securely within your organization BP09 Share resources securely with a third party
SEC04 4 best practices
How do you detect and investigate security events?
BP01 Configure service and application logging BP02 Capture logs, findings, and metrics in standardized locations BP03 Correlate and enrich security alerts BP04 Initiate remediation for non-compliant resources
SEC05 4 best practices
How do you protect your network resources?
BP01 Create network layers BP02 Control traffic flow within your network layers BP03 Implement inspection-based protection BP04 Automate network protection
SEC06 5 best practices
How do you protect your compute resources?
BP01 Perform vulnerability management BP02 Provision compute from hardened images BP03 Reduce manual management and interactive access BP04 Validate software integrity BP05 Automate compute protection
SEC07 4 best practices
How do you classify your data?
BP01 Understand your data classification scheme BP02 Apply data protection controls based on data sensitivity BP03 Automate identification and classification BP04 Define scalable data lifecycle management
SEC08 4 best practices
How do you protect your data at rest?
BP01 Implement secure key management BP02 Enforce encryption at rest BP03 Automate data at rest protection BP04 Enforce access control
SEC09 3 best practices
How do you protect your data in transit?
BP01 Implement secure key and certificate management BP02 Enforce encryption in transit BP03 Authenticate network communications
SEC10 8 best practices
How do you anticipate, respond to, and recover from incidents?
BP01 Identify key personnel and external resources BP02 Develop incident management plans BP03 Prepare forensic capabilities BP04 Develop and test security incident response playbooks BP05 Pre-provision access BP06 Pre-deploy tools BP07 Run simulations BP08 Establish a framework for learning from incidents
SEC11 8 best practices
How do you incorporate and validate the security properties of applications throughout the design, development, and deployment lifecycle?
BP01 Train for application security BP02 Automate testing throughout the development and release lifecycle BP03 Perform regular penetration testing BP04 Conduct code reviews BP05 Centralize services for packages and dependencies BP06 Deploy software programmatically BP07 Regularly assess security properties of the pipelines BP08 Build a program that embeds security ownership in workload teams

AWS services for Security

AWS Identity and Access Management (IAM)

Enables you to manage access to AWS services and resources securely.

Amazon GuardDuty

Provides intelligent threat detection for your AWS accounts and workloads.

AWS Security Hub

Gives you a comprehensive view of your security alerts and security posture across your AWS accounts.

Amazon Inspector v2

Automated vulnerability management for EC2, container images, and Lambda functions, with SBOM integration.

AWS Security Lake

Centralizes security data from AWS, SaaS, on-premises, and cloud sources into a purpose-built data lake in OCSF format.

AWS Config

Configuration management and compliance monitoring with advanced remediation and multi-account support.

AWS Key Management Service (KMS)

Makes it easy for you to create and manage cryptographic keys and control their use.

AWS Shield

Provides protection against DDoS attacks for applications running on AWS.

Amazon Macie

Uses machine learning to automatically discover, classify, and protect sensitive data in AWS.

AWS CloudTrail

Governance, compliance, operational auditing, and risk auditing of your AWS account.

AWS WAF

Helps protect your web applications or APIs against common web exploits and bots.

Related resources