AWS Security Hub 是一项安全与合规性服务，于2019年6月25日正式推出通用版本。Security Hub在各个区域的统一仪表板中为用户提供涵盖多个AWS账户的安全性与合规性状态的直观支持。通过此项服务，您可以监控各关键设置，保证AWS账户始终安全可靠，同时确保能够时刻关注环境中出现的各类变化、并有针对性地做出快速反应。
工作原理
优势和功能
全面查看安全问题
AWS Security Hub 会收集和整合您环境中启用的 AWS 安全服务的检测结果，例如来自 Amazon GuardDuty 的入侵检测结果、来自 Amazon Inspector 的漏洞扫描和来自 Amazon Macie 的 S3 存储桶策略检测结果。AWS Security Hub 还会整合来自集成的 AWS 合作伙伴网络 (APN) 安全解决方案的检测结果。所有检测结果都将在 AWS Security Hub 存储至少 90 天。
自动化、持续的安全性检查
使用行业标准和最佳实践，进行自动化、持续的账户和资源级配置与安全性检查。例如，AWS Security Hub 会自动执行互联网安全中心(CIS) AWS Foundations 基准，后者是一组 AWS 的安全配置最佳实践。如果您的任何账户或资源偏离最佳实践，AWS Security Hub 会标记问题并建议补救措施。
自定义响应和补救措施
将 AWS Security Hub 与 Amazon CloudWatch Events 集成后，您将能创建自定义响应和补救工作流程。您可以轻松地将检测结果发送到 SIEM、聊天工具、开单系统、安全业务流程自动化和响应工具及呼叫待命管理平台。您也可以使用 AWS System Manager 自动化文档、AWS Step Functions 和 AWS Lambda 函数构建可从 Security Hub 启动的自动补救工作流程。
多账户支持
在 AWS Security Hub 控制台中单击几次，您即可连接多个 AWS 账户并整合这些账户的检测结果。通过指定主安全账户，您可以让您的安全团队查看所有账户的整合检测结果，不过各账户拥有者仅可查看与其账户相关的检测结果。
使用场景
安全扫描
使用各种安全性标准连续扫描您的 AWS 账户，检查是否存在配置错误，并在账户和多账户级别汇总安全性检查结果，以了解您的整体安全性状态。
分类安全问题并确定优先级
使用 AWS Security Hub 的摘要控制面板以及筛选条件规则来识别 AWS 安全服务和合作伙伴安全集成中的检测结果并确定其优先级，确定哪些最重要，以及哪些需要最直接的关注。
如何收费
安全性检查 定价
每账户每区域每月前 100000 次检查 每次检查 0.0010 USD
每账户每区域每月接下来的 400000 次检查 每次检查 0.0008 USD
每账户每区域每月 500000 次以后的检查 每次检查 0.0005 USD
检查结果提取事件
与 Security Hub 安全性检查关联的检查结果提取事件 免费
每账户每区域每月前 10000 个事件 免费
每账户每区域每月 10000 个以后的事件 每个事件 0.00003 USD
如需进一步协助或服务，请留言，泰岳云业务会提供自动化工具及专业服务。
返回技术博客
AWS Security Hub is a security and compliance service that was officially launched for general availability on June 25, 2019. Security Hub provides users with comprehensive visibility into the security and compliance status across multiple AWS accounts in a unified dashboard across regions. With this service, you can monitor key settings to ensure your AWS accounts remain secure, while staying aware of various changes in your environment and responding quickly and appropriately.
How It Works
Benefits and Features
Comprehensive View of Security Issues
AWS Security Hub collects and consolidates findings from enabled AWS security services in your environment, such as intrusion detection results from Amazon GuardDuty, vulnerability scans from Amazon Inspector, and S3 bucket policy findings from Amazon Macie. AWS Security Hub also consolidates findings from integrated AWS Partner Network (APN) security solutions. All findings are stored in AWS Security Hub for at least 90 days.
Automated, Continuous Security Checks
Automate continuous account and resource-level configuration and security checks using industry standards and best practices. For example, AWS Security Hub automatically runs the Center for Internet Security (CIS) AWS Foundations Benchmark, a set of security configuration best practices for AWS. If any of your accounts or resources deviate from best practices, AWS Security Hub flags the issues and suggests remediation steps.
Custom Response and Remediation
Integrating AWS Security Hub with Amazon CloudWatch Events enables you to create custom response and remediation workflows. You can easily send findings to SIEM, chat tools, ticketing systems, security orchestration automation and response tools, and on-call management platforms. You can also build automated remediation workflows triggered from Security Hub using AWS Systems Manager automation documents, AWS Step Functions, and AWS Lambda functions.
Multi-Account Support
With just a few clicks in the AWS Security Hub console, you can connect multiple AWS accounts and consolidate findings from those accounts. By designating a master security account, you enable your security team to view consolidated findings across all accounts, while individual account owners can only view findings related to their accounts.
Use Cases
Security Scanning
Continuously scan your AWS accounts using various security standards to check for misconfigurations, and aggregate security check results at the account and multi-account levels to understand your overall security posture.
Classify and Prioritize Security Issues
Use AWS Security Hub's summary dashboard and filtering rules to identify and prioritize findings from AWS security services and partner security integrations, determining which are most important and require the most immediate attention.
Pricing
Security Checks Pricing
First 100,000 checks per account per region per month: $0.0010 per check
Next 400,000 checks per account per region per month: $0.0008 per check
Checks over 500,000 per account per region per month: $0.0005 per check
Finding Ingestion Events
Finding ingestion events associated with Security Hub security checks: Free
First 10,000 events per account per region per month: Free
Events over 10,000 per account per region per month: $0.00003 per event
For further assistance or services, please leave a message. UltraPower Cloud Business will provide automation tools and professional services.
Back to Tech Blog