Amazon CloudTrail Monitoring with SecurityCenter Continuous View

Amazon Web Services (AWS) has become a critical Infrastructure as a Service (IaaS) platform for many companies. Just as cloud environments provide advantages of scalability, elasticity, and performance, they present new challenges to those tasked with securing it. How do you monitor for attacks against the infrastructure from outside, while at the same time watching user accounts for impersonation and misuse? Small changes to configurations and policies within AWS can have a devastating impact to the security of an organization, so continuous monitoring is critical.

SecurityCenter Continuous View™ (CV) now connects directly to AWS for CloudTrail event monitoring via RESTful API, collecting EC2 and IAM logs to pull into your security monitoring program.

Monitoring user accounts and account activities in AWS integrates into your larger account monitoring strategy. Password guessing and other account attacks are detected, as well as known­-malicious hosts attempting access. Permission changes are also captured, and monitored along with the rest of your data for unauthorized changes.

“Detected-change” events provide insight into new or unusual connections into AWS, and isolate IPs that have never communicated before for investigation. Activity trending and anomaly tracking provide deeper insight into the behavior of your AWS environment, as well as the users and administrators who interact with it, alerting you to suspicious activities as they occur.

Drilling into these events shows at a glance who is interacting with AWS, and what they’re up to.

With Amazon, SecurityCenter CV also captures events about the status of your AWS EC2 environment. These instance monitoring logs detail health and status of instances, when instances are added or removed, as well as policy and configuration changes. Just as you monitor critical servers within your organization for changes that could indicate malicious activity, it's time to monitor the cloud in kind.

See the Tenable documentation for more information on how to integrate AWS CloudTrail monitoring into your security program.

Amazon CloudTrail is one of the first platforms supported by SecurityCenter CV for API monitoring. Cloud service monitoring for integrated visibility eliminates blind spots, enabling more informed decision making and improved awareness of security in your organization, no matter where it resides.

For more information on securing IaaS platforms with Tenable, see the following blogs:

• Nessus Amazon AWS Auditing Now Available
• Auditing Microsoft Azure with Nessus v6.5
• Auditing Rackspace Accounts with Nessus