How to find AWS configuration vulnerabilities? Types of security assessments and how to proceed.

In AWS, granting excessive permissions, unintentionally exposing resources, insufficient log settings, and vulnerabilities in the OS and middleware can lead to unauthorized access and data breaches.

Amazon Inspector and AWS Security Hub CSPM can be used to continuously detect known vulnerabilities and configurations that deviate from security standards. However, some configurations that deviate from standards may be necessary for the system's purpose. The necessity and urgency of action should be determined based on the operational situation.

This article outlines the types of AWS security assessments, their main checkpoints, and how to choose between AWS services and external assessments. It also explains the steps for organizing detected issues, correcting settings, and conducting reassessments.

What is AWS Security Assessment?

AWS security assessments involve examining the configuration and running software of your cloud environment to identify problems that could lead to unauthorized access or data breaches.

The scope of coverage includes accounts, permissions, networks, resource exposure settings, encryption, and logging. There are also diagnostics to check for vulnerabilities in the operating system, middleware, and web applications on Amazon Elastic Compute Cloud (Amazon EC2).

The purpose and target of a diagnostic test vary depending on the type of test. Diagnostic tests that check for AWS configuration errors, tests that detect known vulnerabilities, and penetration tests that simulate actual attacks will all have different scopes of investigation and implementation methods. 

Check for misconfigurations and vulnerabilities in your AWS environment.

In AWS, the environment configuration changes as users and services are added, systems are modified, and personnel changes occur. Settings that were appropriate at the time of construction may become incompatible with current usage as operations continue.

Typical examples include an increasing number of IAM users with administrator privileges, unused access keys remaining, management ports being exposed to a wide range of users, and the failure to collect operation logs.

Even if the cloud is properly configured, known vulnerabilities may remain in the operating systems, middleware, container images, and applications on Amazon Elastic Compute Cloud (Amazon EC2). AWS security assessments examine AWS configurations and running software to identify potential entry points for attacks.

Differences from AWS environment diagnostics

AWS environment assessment is an initiative that comprehensively evaluates system configuration, availability, performance, cost, monitoring, backup, and operational structure.

On the other hand, AWS security assessments thoroughly examine resource exposure, access permissions, encryption, logging, and software vulnerabilities.

If you need to review your entire environment, including cost increases, configurations to prepare for failures, and operational burden, a comprehensive assessment is appropriate. If you want to identify problems that could lead to unauthorized access or data breaches, a security-focused assessment is recommended.

If security issues are found during the AWS environment assessment, we may narrow down the scope and conduct additional, more detailed assessments.

Types of AWS Security Assessments

AWS security assessments are categorized as follows, depending on the target and purpose:

AWS Security Configuration Diagnostics

AWS security configuration diagnostics check whether your AWS account and each resource are configured in accordance with your company's standards and adopted security specifications.

The main items to check are IAM permissions, security group communication control, Amazon Simple Storage Service (Amazon S3) exposure status, encryption, and operation log acquisition status.

In addition to automated assessments using AWS Security Hub CSPM and AWS Config, we also conduct individual checks in light of the system's purpose and internal rules.

OS and middleware vulnerability assessment

In OS and middleware vulnerability assessments, we check software running on Amazon Elastic Compute Cloud (Amazon EC2) and other platforms for known vulnerabilities and unapplied security updates.

The targets include operating systems, web servers, databases, application servers, and packages included in container images.

Amazon Inspector allows you to continuously scan your workloads, automatically re-evaluating them as new vulnerabilities are disclosed or resources are changed.

Vulnerabilities stemming from the application's implementation will be investigated separately through web application diagnostics.

Web Application Diagnostics

Web application diagnostics target websites, business systems, and API implementations running on AWS.

We actually send requests to verify that there are no problems with authentication, authorization, input processing, session management, and API access control. Even if the cloud infrastructure and OS are properly configured, vulnerabilities in the application can lead to unauthorized operations and data breaches.

Before the diagnostic test, you should decide which screens or APIs to target, which accounts to use, which time slots to run the test, and which operations to prohibit.

Penetration Testing

Penetration testing attempts to infiltrate the AWS environment and applications from the perspective of an attacker.

While configuration and vulnerability assessments detect individual problems, penetration testing verifies whether an attack combining multiple vulnerabilities can succeed.

In principle, you can test services designated by AWS as permitted without prior approval. However, prior approval is required for tests including Command and Control and some simulated events.

Since some actions are prohibited, we will review AWS policies and terms of service in advance. We will also define the target service, test content, impact on the system, and downtime conditions before conducting the test.

Items to check in AWS Security Assessment

AWS security assessments examine both the cloud-side configuration and the software running on it. The scope of the assessment varies depending on the services and system configuration being used.

Accounts and permissions

Under Accounts and Permissions, we examine AWS Identity and Access Management (IAM) users, roles, policies, multi-factor authentication, and access keys.

The main items to check are as follows:

• Are there any unused IAM users or access keys remaining?

• Have you been granted more administrator privileges than necessary?

• Are you using long-term access keys for human operation?

• Is your account set to require multi-factor authentication?

• Is the administrator of the IAM role and policy clearly defined?

If you manage multiple AWS accounts, your management methods, including AWS Organizations, will also be investigated. This involves organizing access paths for each user, system, and support company to ensure you can track who performed which actions.

Network and Public Access Settings

In the network section, we examine subnets, route tables, security groups, network access control lists, and other elements of the Amazon Virtual Private Cloud (Amazon VPC).

The main things to check are whether the management port is exposed to the entire internet, whether unnecessary communication is permitted, and whether resources that do not need to be publicly accessible are located in the public subnet.

For Amazon Simple Storage Service (Amazon S3) and databases, check resource policies to ensure that unintended external access is not permitted. Also, verify that no unnecessary permissions have been granted to other AWS accounts.

For websites and public APIs, check the scope of access, authentication methods, restrictions on connection sources, and the level of protection provided by AWS WAF, etc.

Encryption, logging, and monitoring settings

Encryption examines the protection of data stored in services such as Amazon Simple Storage Service (Amazon S3), Amazon Elastic Block Store (Amazon EBS), and databases, as well as the communication path.

If you are using AWS Key Management Service (AWS KMS), the key administrator and user, key policy, rotation, and deletion settings will also be checked.

Regarding logs, we will check whether AWS CloudTrail, access logs for each service, and VPC flow logs are being collected. We will also check the retention period, permissions for storage locations, encryption, and settings to prevent deletion and tampering.

Monitoring involves organizing the notification recipients, responsibilities for review, and response conditions for detection results. If the responsible parties and contact criteria are not defined, the initial response will be delayed even when an alert occurs.

Software diagnostic scope and management system

Vulnerability assessments must include all running software without fail. If Amazon Elastic Compute Cloud (Amazon EC2) instances not listed in the management ledger, outdated container images, or libraries that the responsible person is unaware of remain, the assessment will inevitably miss some vulnerabilities.

First, organize the operating systems, middleware, container images, and applications currently in use, along with the person responsible for managing each. Record the version, support end date, and update method so that you can address any vulnerabilities that may be found.

When implementing continuous scanning, you must also decide who will review the detection results, who will be responsible for requesting fixes, and how the status of the response will be managed. If the responsible parties and update procedures are unclear, the response will stop even if vulnerabilities are detected.

Web applications may have different departments responsible for the infrastructure and operating system. By separating the scope of work between the development department and the infrastructure operations department, we ensure that implementation issues such as authentication, authorization, and input processing are not overlooked during the diagnostic process.

When to use AWS services and when to use external diagnostics.

AWS security services allow you to continuously detect misconfigurations and known vulnerabilities according to predefined standards and rules.

AWS services are suitable for routine monitoring and standard checks. However, verifying whether granted permissions are business-appropriate and whether there are intrusion routes combining multiple issues requires verification by someone who understands the system's configuration and operation.

Detecting vulnerabilities with Amazon Inspector

Amazon Inspector is a service that continuously scans resources on AWS to detect software vulnerabilities and unintended external exposures.

The main targets are Amazon Elastic Compute Cloud (Amazon EC2), Amazon Elastic Container Registry (Amazon ECR) container images, and AWS Lambda functions.

Because it is automatically re-evaluated in response to new vulnerability disclosures and resource changes, it can identify problems faster than manual diagnostics performed at regular intervals. 

Evaluate your configuration with AWS Security Hub CSPM and AWS Config.

AWS Security Hub CSPM uses controls included in security standards to evaluate whether AWS resources are configured according to those standards.

It checks log acquisition status, storage access scope, encryption, etc., to detect resources that do not meet the criteria. If you are using multiple AWS accounts or regions, you can aggregate and manage the results from each environment.

AWS Config is a service that records the configuration and change history of AWS resources. Using AWS Config rules, you can continuously check whether your resources are maintained in accordance with internal standards and operational rules. It is also useful for investigating when the resources deviated from the standards and the changes that caused them.

Problems that cannot be identified solely by detection using AWS services.

AWS services can efficiently detect configuration values ​​and known vulnerabilities. However, the following issues need to be considered on a case-by-case basis, taking into account the system's purpose and operational status.

• The permissions and scope of access are too broad for business use.

• Intrusion routes combining multiple configuration errors and vulnerabilities

• Application-specific authentication and authorization deficiencies

• Discrepancies between internal rules and actual AWS settings

• Lack of communication, investigation, and recovery procedures after an alert is triggered.

We don't draw conclusions based solely on detection results; we also examine the system's role, the data it handles, its users, and its public access status. This allows us to narrow down the issues that need to be addressed as a priority.

Cases where it's better to hire a specialist company

You should consider hiring a specialized company in the following cases:

• I want to investigate across multiple AWS accounts and systems.

• Handling personal and confidential information

• We operate a system that is made publicly available on the internet.

• Auditors and business partners are requesting third-party evaluations.

• There are many detection results, making it difficult to prioritize actions.

• I would like support with everything from correcting settings to re-diagnosing.

When choosing a service provider, don't just compare them based on the number of diagnostic items; check whether they understand and can evaluate the AWS environment configuration and its impact on business operations. A company that can handle everything from proposing corrective measures and making configuration changes to conducting re-diagnoses will allow you to translate the diagnostic results into actual improvements. 

How to proceed with an AWS security assessment

AWS security assessments define the objectives and scope, evaluate the risks of detected issues, and then perform configuration corrections and reassessments.

Determine the purpose and scope of the diagnosis.

First, let's clarify what we hope to uncover with this diagnosis.

When investigating AWS configuration issues, you should look at IAM, networking, storage, encryption, logs, and other areas. If you're checking for known vulnerabilities, you should also include the OS, middleware, and container images on Amazon Elastic Compute Cloud (Amazon EC2).

When investigating implementation issues or intrusion routes in a web system, web application diagnostics or penetration testing are the appropriate options.

For companies using multiple AWS accounts or regions, create a list of environments to be assessed. Prepare configuration diagrams, account lists, services used, data handled, and external access status to prevent any omissions.

Determine the risk and priority of action based on the detection results.

The detected problems will be evaluated based on the following three points:

• Is it accessible from the outside?

• Will it affect important data or functions?

• Do they have strong privileges or access routes to other resources?

We will also review known attack methods, their history of exploitation, the impact of any fixes on business operations, and whether alternative solutions exist.

The severity level indicated by the automated diagnosis is one factor in determining the order of responses. However, we don't prioritize solely based on the displayed severity level; we also consider the likelihood of an actual attack occurring and the impact on the business if a problem were to occur.

False positives or settings necessary for business operations may be pointed out. When postponing action, record the reason, the approver, and when to re-examine.

Correct the settings and run the diagnostic again.

After prioritizing, we proceed with reducing IAM permissions, limiting the scope of external access, enabling encryption and logging, and updating the OS and middleware.

Before making any changes, we will confirm the impact on the target system and how to recover from those changes. This is because changing permissions or communication settings may affect the operation of applications and their connection to business systems.

After the fix, a re-diagnosis will be performed under the same conditions. This will verify that the identified problems have been resolved and that the system is functioning correctly.

For issues that cannot be fixed immediately, we will assign a person in charge and set a deadline for resolution. We will take measures such as restricting communication sources, strengthening monitoring, and temporarily reducing permissions to mitigate the risks until a permanent solution is found.

The AWS environment is constantly changing due to resource additions and configuration changes. Regular diagnostics and continuous configuration evaluations are incorporated into operations to maintain the corrected state.

Serverworks and IIJ Group support AWS security assessment and improvement.

Serverworks and the IIJ Group provide support for AWS environment design, construction, and operation, as well as security issue identification and improvement. The scope of the assessment includes not only AWS configuration but also branch network and operational structure.

Serverworks will review the AWS environment configuration, permission settings, log collection, and threat detection status, and propose necessary configuration changes and operational improvements. The IIJ Group will handle everything from implementation to operation, taking into account the network and IT environment of the branch offices.

Through collaboration between our two companies, we can provide comprehensive support, from clarifying the scope of the diagnosis and modifying AWS settings to reviewing the network and monitoring and operation. If you have concerns about the settings or vulnerabilities of your AWS environment, please contact us to discuss your current configuration and operational status.