Connect with us

Information Technology

AWS Security Audit: Things To Keep In Mind, Checklist, and Tools

Published

on

AWS security audits are important for any organization looking to assess its IT Security. AWS security audits involve both a technical and non-technical review of all major systems, networks, databases and applications. The audit also includes an assessment of the organization’s risk tolerance level in order to prioritize remediation efforts. 

AWS security auditing is also essential when it comes time to ensure compliance with industry standards like HIPAA (Health Insurance Portability & Accountability Act), PCI DSS (Payment Card Industry Data Security Standard) and ISO 27001/27002 (International Organization for Standardization Security Standards, ISO 27001 specifically.

This blog post will provide you with some tips on things to keep in mind, a checklist, and tools and processes that your company can use for performing security audits on your AWS environments.

5 Things to keep in mind during security audit for your AWS

  1. Security assessment of the existing environment.
  2. Security assessment for new/future services and products.
  3. Review AWS managed security service (ex. IAM, encryption) availability, performance & capacity limits.
  4. Security assessments at the application layer include web applications servers like Apache or Nginx running on ECWs and databases like MySQL or Oracle Database running in RDS instances.
  5. Security audits for any other technologies that are used by your organization can be performed as well. 
  6. You should also ensure network segmentation between cloud resources and create a secure baseline configuration with an eye toward best practices around networking, operating systems deployment processes, patching processes, monitoring tools, etc.

A security assessment is not a single snapshot of the environment. It’s an ongoing process that enables continuous monitoring, discovery and improvement by identifying vulnerabilities, threats or exposures to assets before they become issues.

AWS security audit checklist

  • Perform risk assessments in order to understand the business impact/criticality of assets being reviewed.
  • Perform AWS penetration testing to discover potential vulnerabilities and misconfiguration issues in your AWS environment
  • Identify current controls & their effectiveness/scope – e.g., existing access control lists (ACLs) around VPC subnets or network ACL rules controlling traffic between ECWs.
  • Ensure PCI DSS compliance checklist is completed by third-party service providers who manage payment card information data.
  • Determine if AWS managed services meet data protection requirements as outlined in the ISO 27001 and 27002 standards.
  • Identify data flows, compute usage and potential attack vectors.
  • Conduct a network penetration test to identify possible security vulnerabilities that could be exploited by an attacker to gain access into your AWS environment.
  • Review configuration management dashboards for all servers/networks/applications and ensure configurations are set correctly (e.g., SSL certificates with right expiration date) – third-party tools like CloudSploit can help here.
  • Ensure you understand what is happening on the wire where it counts: between ECWs, RDS instances or across VPCs (VPC peering etc.) – NetFlow logs from EBS volumes or Elastic Network Interfaces (ENIs) can be helpful here.
  • Monitor network activity and look for anomalies – e.g., unusual traffic flows coming from an ECW to a known bad actor IP address or application-level data exfiltration attempts.
  • Review AWS CloudTrail logs to see who is trying to access what, when they are doing it, where the requests are originating from/going to etc.
  • Create alerts on security metrics that show abnormal behaviour (e.g., increase in failed login attempts into RDS instances). These patterns should then be cross-referenced with other sources of information like VPC flow logs or network ACLs & firewall rules around subnets.

AWS security audit tools

1) AWS Security Hub

This new service is a centralised location to monitor, track and act on all security-related events for your AWS environment. This includes notifications about third-party configuration issues with services like Elastic Load Balancing or Amazon API Gateway as well as vulnerabilities in other software packages running within ECWs (e.g., Apache Struts). Other data sources include the following: VPC flow logs, CloudTrail event histories, network ACLs/firewall rules around subnets etc. Run automated remediation tasks directly from this console when required too!

2) CloudWatch Events

Get notified via email & Slack of critical changes to your systems that require immediate attention – e.g., an administrator has just deleted an important ECW or security group.

3) CloudFront Access Logs

Get notified via email & Slack of unauthorised access to your SaaS services – e.g., someone has just launched a DDoS attack against one of the databases hosted on an RDS instance!

4) AWS Config Rules

Periodically check that all CloudWatch alarms for metrics like “CPU usage” and “free EBS volume space” are working as expected. Automatically remediate if they’re not (e.g., launch another ECW, increase alarm thresholds etc.)! Or simply use Amazon Inspector which will do this for you automatically (see below).

5) Amazon Inspector

This service provides deep insights into what’s running within any given AWS environment – including any vulnerable software packages or misconfigurations that could lead to a security breach.

6) Amazon Macie

This service uses machine learning and big-data techniques to automatically discover, classify & protect sensitive data stored within your AWS environment – e.g., PHI/PII data belonging to customers (e.g., Social Security Numbers). It can help you meet compliance requirements outlined by industry standards like HIPAA, PCI DSS etc..

7) AWS Config Rules

This new feature allows you to validate configuration settings across all ECWs in an AWS account for services like Amazon SNS/Kinesis/DynamoDB and resolve issues before they affect production environments (e.g., workflows executed against the affected resources will fail if rules are violated).

Each of the above services/tools should be used to help you continuously improve your AWS security posture – by allowing you to identify & fix configuration errors before they affect production environments. If one service isn’t sufficient enough, simply use two or more in conjunction with each other!

Summing Up…

If you want to be sure that your organization is safe from hackers, then it’s important to do an AWS security audit. A lot of companies are now realizing the importance of this and have been doing these audits as a precautionary measure. In today’s world where technology has taken over our lives, we need to make sure that we don’t make any mistakes with data security because there will always be someone looking for vulnerabilities in order to exploit them. So, keep your business safe!

Continue Reading

Information Technology

Airtel Plans Relief For Visually Impaired Teacher

Published

on

Airtel Nigeria has announced that in the next episode of “Airtel Touching Lives”, the companys TV series that spotlights its efforts to bring succour to underprivileged Nigerians, the focus will be on Timilehin Segun, a visually impaired teacher.
Segun, who Airtel describes as extraordinary, devotes his life to educating and inspiring the youths in his community, despite his own physical limitations.
The upcoming episode, which is the third in the seventh season, was aired on Sunday, 9th July 2023, and took viewers through Seguns journey from a blind pupil to the neighbourhood mentor who now runs a popular programme, “Reliable Link Tutors”, an after-school centre created to help improve the academic performance of secondary school students.
Commenting on the new episode of Airtel Touching Lives, Director, Corporate Communications and CSR, Airtel Nigeria, Femi Adeniran expressed Airtels delight to be a part of the journey of unyielding determination and passion.
“Seguns determination, resilience, and enthusiasm for education demonstrate the spirit of Airtel Touching Lives, and we hope that his story will inspire our viewers to pursue their dreams, no matter the odds”, he said.
This instalment of the programme will also include a segment on Irede Foundation, an Airtel Touching Lives beneficiary from the previous season.
The non-governmental organisation provides young children with prosthetic limbs and helps to prepare them for a self-reliant living and, this Sunday, the series will review the progress the foundation has made since Airtels intervention in 2022.
Airtel Touching Lives continues to showcase extraordinary individuals like Segun, who have not only overcome personal challenges, but have also dedicated themselves to improving their immediate environment.
With Airtel Nigeria’s commitment to empowering lives and making dreams come true through Airtel Touching Lives, the telecom giant has restored hope for countless vulnerable individuals and families across the country, encouraging other corporations to commit more resources towards making positive social impact.
Airtel Touching Lives Season 7 is broadcast on Sundays on four national and cable TV channels, and one streaming app.
The platforms include African Magic Urban at 5:00 pm, NTA Network at 6:30 pm, and Startimes Channel 108 at 6:00 pm.
Re-runs are broadcast on Tuesdays on African Magic Urban at 3:30 pm, and on Wednesdays on Startimes Channel 108 at 6:30 pm. Current and previous episodes are also available to stream on Airtel TV.

Continue Reading

Information Technology

Agency Seeks Collaboration For IoT Unlock

Published

on

The National Information Technology Development Agency (NITDA) has emphasised the need for collaboration to unlock Nigeria’s potential in Internet of Things (IoT) and its revolutionary impact on the countrys digital ecosystem.
Director General of NITDA, Kashifu Inuwa, who disclosed this is in a bid to implement the Digital Transformation pillar of Strategic Road Map and Action Plan (SRAP 2021-2024) of the agency.
Inuwa made this plea while delivering his keynote address at the IoT West Africa Conference and Exhibition 2023 in Lagos State, recently.
The DG noted some challenges that need unlocking in order to access the potentials of IoT, especially infrastructure, cyber security, and data protection, stating  that most IoT use cloud-based solutions  Alexa, Google, and others.
According to him, todays computer systems are outperforming humans in many endeavours, especially the rise of generative Artificial Intelligence (AI), chat GPT, etc.
He said that is the fabric of the shift humanity is witnessing in accelerating the convergence between physical, biological, and digital world.
“Looking at the areas you can apply them, such s in agriculture, we need to increase our agri-products, and IoT can help us to do that with lesser human efforts”, he said.
He explained further that there are wearable plant sensors at the moment, which is one of the top technologies in 2023.
The NITDA boss hinted that farmers can have a sensor attached to their plant to manage its health, watering, fertilizer, pesticides, and this would invariably enhance the increase of food produce.
He asserted that by 2050, Nigeria will be the third largest population in the world, therefore, there is need to explore how we can use IoT to increase the countrys food production.
In addition to agriculture, the NITDA Director General discussed the role of IoT in addressing security challenges, saying that IoT devices can monitor activities.

The DG emphasised that IoT could be utilised to enhance oil theft prevention by monitoring pipelines and sending alerts for quick security response.

He advised that there is also the need to develop the talent within the country.

 

Continue Reading

Information Technology

ALTON Hails NCC Boss Over Quality Regulation

Published

on

The Chairman of the Association of Licensed Telecoms Operators of Nigeria (ALTON), Mr. Gbenga Adebayo, has praised the leadership of the Executive Vice Chairman/Chief Executive Officer of the Nigerian Communications Commission (NCC), Prof. Umar Garba Danbatta.
He also commended the NCC’s commitment to quality regulation, attributing the success of the telecom industry in the country to the regulatory environment it enjoys.
Speaking at a meeting with mobile network operators on the implementation of the Expanded Revenue Assurance Solution (ERAS) in the telecommunications industry, held at the NCC’s office in Lagos recently, Adebayo expressed his pleasure in what he called Danbatta’s remarkable administrative skills, challenging the notion that engineers are not good administrators.
He described Danbatta as an excellent administrator, highlighting his instrumental role in the growth and development of the telecom industry.
Addressing the audience, Danbatta shared details about the implementation of the ERAS project.
He emphasized the collaboration between the NCC and the Infrastructure Concession and Regulatory Commission (ICRC), saying the ERAS project is being carried out through a Public-Private Partnership (PPP) arrangement, following the  Design, Finance, Develop, Deploy, Operate, and Transfer (DFDDOT) model, as recommended by the ICRC.
Danbatta acknowledged the efforts of the NCC in transforming the dream of the ERAS project, conceived in 2007, and nurtured to reality.
He also underscored the project’s alignment with the Federal Government’s directive to enhance revenue collection and prevent leakages within ministries, departments, and agencies (MDAs).
By deploying the Revenue Assurance Solution, Danbatta said the NCC aims to optimize the revenue payable by licensed telecommunications service providers, thereby bolstering revenue generation for the government.
Initially designed to focus on telecom operators, who have not only become major industry players, but have also expanded their services to to the digital services ecosystem, the ERAS project underwent a significant expansion.
In June 2022, following a presidential approval, the NCC was directed to broaden the scope of the project to encompass the activities of Digital Economy stakeholders. Consequently, the project was renamed the Expanded Revenue Assurance Solution (ERAS).
The implementation of the ERAS demonstrates the NCC’s commitment to fostering transparency, accountability, and financial efficiency within the Nigerian telecom and digital services sectors.

Through the utilisation of accurate data and information, the ERAS aims to eradicate wrong computations, faulty data, and information leakages.

With the telecom industry playing a critical role in driving economic growth and enabling digital transformation, the ALTON Chairman’s commendation and the ongoing efforts of the NCC under Danbatta’s leadership highlight the commitment to creating an enabling regulatory environment that fosters innovation and sustainable development.

As the implementation of the Expanded Revenue Assurance Solution progresses, stakeholders within the telecom and digital services sectors eagerly anticipate its positive impact on revenue generation and the overall growth of the Nigerian economy.
###

Continue Reading

Trending