The CIS Benchmark for Amazon Web Services (AWS) includes a set of best practices and recommendations for securing AWS cloud services. These controls are industry-wide accepted best practices that touch beyond the high level of security measures of the cloud environment. CIS Benchmarks are provided by the Center for Internet Security (CIS), a nonprofit organization that works to "identify, develop, validate, promote, and sustain best practice solutions for cyber defense and build and lead communities to enable an environment of trust in cyberspace." Moreover, in 2022 the Center for Internet Security (CIS) released version 8 of their 18 CIS Security Controls, which global organizations commonly follow to harden their systems.

The CIS Benchmark for AWS covers foundational security areas, such as identity and access management, logging, monitoring and encryption. It provides practical and actionable guidance for areas such as network security, system hardening and security incident response. Best practices include securing leaky bucket policies or insecure IAM policies, in addition to enabling robust authentications management controls to the AWS assets and cloud environments, which can uplift the overall cloud security posture.

These no-cost benchmarks are accessible through the CIS website. Optiv automates these checks using commercial tools such as Nessus and manual verification. These benchmark standards are updated regularly to reflect the latest best practices and technologies. Organizations are encouraged to use these benchmarks to evaluate their own environment's security posture and take steps to reduce risk.

Amazon Web Services provides a comprehensive set of security controls, such as AWS GuardDuty, as well as services to help customers protect their cloud data. These services include identity and access management, encryption, logging and monitoring, and security best practices.

The following section lists out a few of the cloud security controls that organizations should focus on when aiming to strengthen the security posture of the environment.

Data Security

One of the biggest security challenges with AWS is the potential for data breaches. To mitigate this risk, organizations should use encryption for data at rest and in transit, as well as implement access control measures such as multifactor authentication and identity and access management.

Network Security

Network security is another major challenge with AWS. Organizations should use security groups and network access control lists to limit access to resources, as well as use virtual private clouds to create isolated networks. Below is an overview of network security controls to prioritize for AWS cloud environments.

Resource Security

Organizations should use Amazon’s IAM service to control access to resources, as well as use security groups to limit access to specific resources. To monitor and audit user activity, Amazon’s CloudTrail service is a recommended resource. Regular audits must be done on access controls to ensure that organizations know how resources are being accessed.

AWS provides users with several security layers to ensure that its customers’ data and resources are secure.

By leveraging these four security layers, AWS users can protect their cloud resources from unauthorized access and malicious activities. However, it is important to note that the security of an organization’s cloud resources depends on the individual user’s security practices. As such, users should ensure they have proper security policies, configurations and procedures in place.

Application Security

Organizations should use Amazon’s CloudWatch service to monitor application performance and security. Amazon’s Elastic Compute Cloud (EC2) also allows organizations to deploy secure applications. Amazon’s Web Application Firewall (WAF) is recommended to protect against malicious attacks. In addition, proper application security testing should be performed to identify specific threats for that application.

Insufficient Access Controls

Many organizations that use AWS fail to properly configure access controls, leaving their data and resources vulnerable to malicious activity. Solutions include creating roles and policies to grant least-privilege access to resources and implementing multifactor authentication to control access to the AWS account.

Data Loss

Without proper configuration and monitoring, data stored in the cloud can be lost. Solutions include using multiple backups and redundancies to protect data, setting up alerts for changes in the AWS environment, and using replication and automated backup processes to ensure data is available. MFA should be enabled on S3 buckets to protect the data.

Security Breaches

While Amazon provides effective physical security for its cloud platforms, there are still opportunities for malicious actors to gain access to sensitive data. We suggest using encryption for data stored in the cloud, implementing a security-minded architecture, and regularly monitoring for suspicious activity.

Malware and Ransomware Attacks

Malware and ransomware attacks can target AWS customers’ systems and data. We recommend creating a list of acceptable use policies and regularly monitoring for malicious activity, implementing firewalls and intrusion detection systems, and using software to scan and patch systems.

Key Takeaways

Overall, it is important for organizations to compare their Amazon Web Services cloud environment with the CIS benchmark to streamline the configurations of each AWS assets and components. This comparison aids in securing the cloud environment.