AWS Security Hub

AWS Security Hub is a cloud security posture management (CSPM) service that gives you a comprehensive view of your security state across AWS accounts and regions. It aggregates, organizes, and prioritizes security findings from multiple AWS services (like Amazon GuardDuty, Amazon Inspector, Amazon Macie, AWS Firewall Manager, and AWS IAM Access Analyzer) and from third-party partners (like CrowdStrike, Palo Alto Networks, and Trend Micro). It also performs automated compliance checks against industry standards and best practices.

The primary problem Security Hub solves is alert fatigue and siloed security data. Without Security Hub, a security team would need to log into each service's console (GuardDuty, Inspector, etc.) to see findings, making it nearly impossible to correlate threats across services. Security Hub normalizes all findings into a consistent format called the AWS Security Finding Format (ASFF), which includes fields like Id, ProductArn, GeneratorId, Types, Severity, Title, Description, Resources, Compliance, and Workflow. This normalization enables automated response and integration with other tools via Amazon EventBridge.

Security Hub operates as a regional service. When you enable it in a region, it begins aggregating findings from enabled security services in that same region. The core mechanism involves:

- CIS AWS Foundations Benchmark v1.2.0 and v1.4.0 - PCI DSS v3.2.1 - AWS Foundational Security Best Practices (FSBP) - NIST SP 800-53 Rev. 5 (via integration with AWS Audit Manager) - Controls: Each standard has controls. For example, CIS 1.1 is "Maintain current contact details." Each control has a severity (CRITICAL, HIGH, MEDIUM, LOW, INFORMATIONAL). - Severity: Findings have severity labels: CRITICAL, HIGH, MEDIUM, LOW, INFORMATIONAL. The severity can be overridden by the user. - Workflow Status: Findings have a workflow status: NEW, NOTIFIED, RESOLVED, SUPPRESSED. You can update this manually or via automation. - Finding Aggregation: By default, Security Hub operates per region. You can enable cross-region aggregation by designating a single aggregation region. All findings from enabled regions are copied to the aggregation region. This is configured in the Security Hub console under "Settings" -> "Region configuration." - Multi-Account Architecture: Security Hub integrates with AWS Organizations. The management account (delegated administrator) can enable Security Hub for all member accounts automatically. Findings from member accounts are visible in the management account's Security Hub console if cross-account aggregation is enabled. - Integration with AWS Config: Security Hub uses AWS Config rules for some compliance checks. You must enable AWS Config in each account and region where Security Hub runs compliance checks. - Pricing: Security Hub charges per finding ingestion and per compliance check. The first 10,000 findings per month are free. After that, it's $0.00003 per finding. Compliance checks are $0.001 per control per account per region per month. - EventBridge Integration: Security Hub sends all findings to the default EventBridge bus. You can create rules to trigger automated responses (e.g., send to SNS, invoke Lambda, create OpsItem in Systems Manager).

Enable Security Hub via AWS CLI:

aws securityhub enable-security-hub --region us-east-1 --enable-default-standards

This enables Security Hub with default standards (CIS and FSBP). To disable default standards, use --no-enable-default-standards.

Enable a standard:

aws securityhub batch-enable-standards --standards-subscription-requests '{"StandardsArn": "arn:aws:securityhub:us-east-1::standards/cis-aws-foundations-benchmark/v/1.4.0"}'

List findings:

aws securityhub get-findings --filters '{"SeverityLabel": [{"Value": "HIGH", "Comparison": "EQUALS"}]}' --region us-east-1

Update finding workflow status:

aws securityhub batch-update-findings --finding-identifiers '[{"Id": "arn:aws:securityhub:us-east-1:123456789012:subscription/...", "ProductArn": "arn:aws:securityhub:us-east-1::product/aws/guardduty"}]' --workflow '{"Status": "RESOLVED"}'

Verify integration with GuardDuty:

aws guardduty list-detectors --region us-east-1
aws guardduty get-detector --detector-id <detector-id> --region us-east-1
# Check that Security Hub integration is enabled (DataSources: S3Logs, Kubernetes, etc.)

Security Hub is not a threat prevention tool; it is a monitoring and compliance tool. It does not block attacks or enforce policies; it only reports and aggregates findings.

A large enterprise with 200 AWS accounts needs to demonstrate compliance with PCI DSS for their payment processing workloads. They enable Security Hub in the management account and use AWS Organizations to automatically enroll all member accounts. They enable the PCI DSS v3.2.1 standard in Security Hub. Security Hub runs continuous checks across all accounts and regions. The security team creates custom insights to track PCI DSS failures by account. They use EventBridge rules to automatically create Jira tickets for any FAIL finding with HIGH severity. One common misconfiguration: forgetting to enable AWS Config in all accounts and regions. Security Hub compliance checks rely on AWS Config rules; without Config, many controls will show 'NO DATA' or fail. The team must ensure AWS Config is enabled with recording of global resources (for IAM checks) and that the appropriate AWS Config rules are in place.

A SaaS company uses GuardDuty, Inspector, and Macie across their development, staging, and production accounts. They enable Security Hub in the us-east-1 region as the aggregation region. All findings from other regions (eu-west-1, ap-southeast-1) are copied to us-east-1. The security operations center (SOC) monitors the Security Hub console 24/7. They have a custom insight that groups all findings of type 'TTPs' (tactics, techniques, procedures) from GuardDuty. When a high-severity finding appears, an EventBridge rule triggers a Lambda function that sends a Slack notification to the on-call engineer. The Lambda function also updates the finding's workflow status to 'NOTIFIED'. One challenge: cross-region aggregation introduces latency of up to 15 minutes. For real-time response, the SOC must also monitor individual regional Security Hub instances. Additionally, if a member account disables Security Hub, findings from that account stop flowing, which can create blind spots.

A financial services company uses Splunk as their SIEM. They want to send all Security Hub findings to Splunk for correlation with other logs. They enable Security Hub and create an EventBridge rule that sends all findings to a custom Lambda function. The Lambda function formats the findings as JSON and sends them to Splunk's HTTP Event Collector (HEC). They also enable third-party partner integrations (e.g., CrowdStrike) to send findings directly to Security Hub. A common pitfall: the Lambda function must handle throttling and retries for the Splunk endpoint. Also, Security Hub has a default limit of 30 findings per second per account per region for the BatchImportFindings API. If the third-party product sends too many findings, they may be throttled. The team must monitor CloudWatch metrics for ThrottledRequests and set up appropriate backoff.