Threat Hunting in the Cloud

CHAPTER 7AWS Reference Architecture

What's in This Chapter

• Understanding how AWS Security architecture aligns with NIST Cybersecurity Framework (CSF)
• Exploring the Identify, Protect, Detect, Respond, and Recover functions attributed to AWS Security
• Learning about the reference architecture for AWS services aligned with the MITRE ATT&CK Threat Hunting Framework
• Exploring the key elements of the AWS threat-hunting capability (i.e., specific services) across Identify, Protect, Detect, Respond, and Recover

As mentioned in Chapter 5, the NIST Cybersecurity Framework (CSF) was originally published in February 2014 in response to Presidential Executive Order 13636, “Improving Critical Infrastructure Cybersecurity,” which called for the development of a voluntary framework to help organizations improve the cybersecurity, risk management, and resilience of their systems.

NIST conferred with a broad range of partners from government, industry, and academia for over a year to build a consensus-based set of sound guidelines and practices. While intended for adoption by the critical infrastructure sector, the foundational set of cybersecurity disciplines comprising the CSF have been supported by government and industry as a recommended baseline for use by any organization, regardless of its sector or size. Industry is increasingly referencing the CSF as a de facto cybersecurity standard.

AWS Security Framework Overview

The Amazon NIST Cybersecurity Framework report articulates ...