WEBVTT 00:00:00.640 --> 00:00:02.100 Welcome back to this demonstration, 00:00:02.100 --> 00:00:05.920 how to perform an AWS benchmark assessment using Prowler. 00:00:06.180 --> 00:00:10.150 So far, you've been introduced to Prowler and its key features and benefits. 00:00:10.540 --> 00:00:13.470 You understand the need for decoy systems in the cloud and 00:00:13.470 --> 00:00:16.340 assessing internet export services within a cloud account 00:00:16.430 --> 00:00:18.020 and across multiple regions. 00:00:18.350 --> 00:00:22.160 You are probably asking more questions right now like what else can Prowler do? 00:00:22.160 --> 00:00:25.490 Because cloud security is not just about network security groups, 00:00:25.660 --> 00:00:28.830 open ports, and exposed services, thankfully, 00:00:28.830 --> 00:00:30.160 Prowler can do a lot more. 00:00:30.240 --> 00:00:33.530 In this demonstration, I will cover AWS benchmarks, 00:00:33.650 --> 00:00:37.430 specifically the AWS CIS Foundations benchmark. 00:00:37.690 --> 00:00:40.810 I will explain what a benchmark document is and why they are 00:00:40.810 --> 00:00:43.880 really important to security professionals and go through the 00:00:43.880 --> 00:00:45.660 steps of performing an assessment. 00:00:46.140 --> 00:00:48.660 The CIS, Center for Internet Security, 00:00:48.660 --> 00:00:52.760 is perhaps one of the best cybersecurity resources available on the internet. 00:00:53.140 --> 00:00:55.240 If you've not used this resource before, 00:00:55.250 --> 00:00:57.990 you will be surprised by the amount of content available, 00:00:58.000 --> 00:01:00.190 which is not just limited to benchmarks. 00:01:00.530 --> 00:01:03.690 Many security practitioners use this as a reference and even 00:01:03.690 --> 00:01:06.310 forms part of the framework for many enterprises. 00:01:06.740 --> 00:01:09.720 I would highly encourage you visit the website for more detail and 00:01:09.720 --> 00:01:12.820 to maybe consider contributing to this resource. 00:01:12.820 --> 00:01:17.190 One of the great positives of this resource is that practitioners can get 00:01:17.190 --> 00:01:20.100 involved and volunteer to contribute to the material. 00:01:20.320 --> 00:01:22.810 Much of the material exists because of volunteers, 00:01:22.840 --> 00:01:26.270 so contributing not only gives the satisfaction of participation, 00:01:26.470 --> 00:01:29.120 but it also benefits thousands of people around the world. 00:01:29.290 --> 00:01:32.650 The CIS use a consensus‑based platform where volunteers 00:01:32.650 --> 00:01:34.750 contribute and agree through discussion. 00:01:34.940 --> 00:01:37.840 The volunteers are usually practitioners and specialists 00:01:37.840 --> 00:01:39.750 in the area they are contributing to. 00:01:39.750 --> 00:01:42.270 In this section, we're concerned with benchmarks. 00:01:42.280 --> 00:01:45.770 Benchmarks are released by CIS as PDF documents, 00:01:45.830 --> 00:01:47.900 and each one covers a specific technology. 00:01:47.900 --> 00:01:51.820 So that could be AWS or Windows or Linux and so on. 00:01:52.010 --> 00:01:54.390 Some of these benchmarks can be hundreds of pages in 00:01:54.390 --> 00:01:57.860 length as they are so detailed, and this detail is great. 00:01:57.940 --> 00:02:02.050 Imagine you or your organization creating and maintaining such a document. 00:02:02.060 --> 00:02:03.120 And within each document, 00:02:03.120 --> 00:02:06.310 there are specific configuration settings that are recommended to 00:02:06.310 --> 00:02:09.520 enable or disable to improve the overall security. 00:02:09.780 --> 00:02:12.130 The benchmarks also take into consideration the 00:02:12.130 --> 00:02:14.080 different needs of your organizations, 00:02:14.110 --> 00:02:17.700 so you will find these documents provide levels 1 through to 3. 00:02:17.700 --> 00:02:21.390 Level 1 is the minimum recommended settings that will improve security, 00:02:21.390 --> 00:02:24.330 but it's not detrimental to the technology; whereas, 00:02:24.330 --> 00:02:26.770 level 3 is perhaps for more secure environments. 00:02:26.860 --> 00:02:28.730 And if all the recommendations are followed, 00:02:28.880 --> 00:02:33.130 then the functionality of the technology may be negatively impacted in some way. 00:02:33.200 --> 00:02:35.770 It's up to each organization to choose the settings or 00:02:35.770 --> 00:02:38.450 controls to utilize and the level to adopt. 00:02:38.450 --> 00:02:43.060 And one final important point in CIS, the benchmarks are available to download, 00:02:43.070 --> 00:02:45.480 and sometimes that is misunderstood as free. 00:02:45.530 --> 00:02:49.220 Both who you are and the organization you represent will determine 00:02:49.220 --> 00:02:51.660 if your organization has to pay a license or not. 00:02:52.140 --> 00:02:53.880 This resource is not open source, 00:02:54.020 --> 00:02:56.560 so please confirm which license that you go under. 00:02:56.940 --> 00:02:59.250 Considering the amount and quality of content, 00:02:59.250 --> 00:03:02.960 it's really not expensive if your organization is required to pay. 00:03:03.440 --> 00:03:05.460 Since we are on the subject of CIS, 00:03:05.480 --> 00:03:07.660 now is a good point to mention which cloud service 00:03:07.660 --> 00:03:09.860 providers you will find benchmarks for. 00:03:10.130 --> 00:03:14.280 There is at least foundational coverage for the four major CSP. 00:03:14.430 --> 00:03:18.960 Now Prowler is only geared up to use AWS CIS Foundations benchmark, 00:03:19.120 --> 00:03:19.940 and that's fine. 00:03:19.950 --> 00:03:23.860 But if you have other CSP within your organization besides AWS, 00:03:24.040 --> 00:03:26.380 CIS does support this. 00:03:26.380 --> 00:03:28.350 Okay, back to Prowler. 00:03:28.350 --> 00:03:31.480 Prowler was written to assess AWS environments, 00:03:31.840 --> 00:03:35.540 and the author is well aware of CIS and has taken great steps to 00:03:35.540 --> 00:03:37.660 include the option to perform this assessment. 00:03:38.320 --> 00:03:40.600 It's worth pointing out that assessing the level of your 00:03:40.600 --> 00:03:44.250 cloud security compliance against the CIS benchmark can 00:03:44.250 --> 00:03:46.630 generally not be 100% automated. 00:03:46.870 --> 00:03:49.260 And the reason for this is because some settings 00:03:49.390 --> 00:03:51.610 cannot be checked by automated means, 00:03:51.610 --> 00:03:55.010 maybe because there is no API functionality created yet 00:03:55.020 --> 00:03:57.110 by the provider to do those checks. 00:03:57.540 --> 00:04:01.190 So it's important to compare what the current version of the automated tool can 00:04:01.190 --> 00:04:05.060 do against the current version of CIS benchmark document. 00:04:05.440 --> 00:04:08.420 Let's walk through performing an AWS benchmark assessment. 00:04:08.420 --> 00:04:09.960 Prior to running the tool, 00:04:09.960 --> 00:04:13.290 make sure that you've configured Prowler based on usage 00:04:13.290 --> 00:04:15.860 instructions available on the Prowl GitHub site. 00:04:15.860 --> 00:04:20.110 From the console, type prowler ‑l, that's a lower case l, 00:04:20.110 --> 00:04:23.330 and this will display a list of the available checks where 00:04:23.330 --> 00:04:25.230 you can see all of the available options. 00:04:25.640 --> 00:04:26.470 It's good to do this, 00:04:26.470 --> 00:04:30.130 especially if updating the tool as new capabilities may 00:04:30.130 --> 00:04:32.390 be included since the prior release. 00:04:32.520 --> 00:04:36.850 As you can see, this list is extensive. If you wanted to perform a single check, 00:04:36.860 --> 00:04:41.260 an example command would be prowler ‑c check11. 00:04:41.740 --> 00:04:43.840 But I'm not going to do that here because I want to do 00:04:43.840 --> 00:04:46.070 an assessment involving many checks. 00:04:46.210 --> 00:04:48.330 If you want to view all checks by group, 00:04:48.450 --> 00:04:52.770 use the command prowler ‑L, which is an uppercase L. 00:04:53.260 --> 00:04:57.130 This is a much more condensed list and recommended prior to running. 00:04:57.130 --> 00:05:00.960 From this group list, I want to do a level 1 CIS assessment. 00:05:01.040 --> 00:05:05.310 This is number 5 from the list. And then run the command prowler 00:05:05.320 --> 00:05:09.650 ‑g cislevel1 to begin the assessment process. 00:05:09.930 --> 00:05:11.660 This process can take some time, 00:05:11.800 --> 00:05:15.310 so I'm going to skip ahead in parts to summarize. As it's running, you 00:05:15.310 --> 00:05:18.010 will see non‑compliance results displayed on the screen, 00:05:18.190 --> 00:05:21.100 and it's up to you and your organization to categorize 00:05:21.290 --> 00:05:23.250 and prioritize what's important. 00:05:23.260 --> 00:05:26.750 Some organizations may perform an ad hoc assessment and then 00:05:26.750 --> 00:05:28.710 review the output over a period of time. 00:05:28.890 --> 00:05:32.700 The risk there is new changes in your cloud environment will not be captured. 00:05:32.840 --> 00:05:36.090 It's recommended a scheduled process is developed. As it appears 00:05:36.090 --> 00:05:39.470 that's suitable for your organization to deal with, scheduled running 00:05:39.470 --> 00:05:41.660 will then capture new changes in the cloud. 00:05:42.140 --> 00:05:44.090 Okay, now we have all of our results. 00:05:44.280 --> 00:05:48.660 We can see there are some issues here with the security groups, most 00:05:48.660 --> 00:05:52.160 regions do not have CloudWatch enabled, and many more. 00:05:54.140 --> 00:05:57.020 You can see how straightforward it is to operate this tool. 00:05:57.240 --> 00:06:00.840 The real challenge is dealing with the data from Prowler and making those 00:06:00.840 --> 00:06:03.700 changes to your cloud environment in a timely manner. 00:06:04.060 --> 00:06:06.860 That concludes this demonstration. Up next, 00:06:06.870 --> 00:06:09.190 I will detail the reporting options in Prowler. 00:06:09.840 --> 00:06:13.600 Documentation is really important in cybersecurity, and it's 00:06:13.600 --> 00:06:15.360 important to understand these features.