1
00:00:00,560 --> 00:00:02,760
thank

2
00:00:03,279 --> 00:00:06,720
you so Y how everyone how is everyone

3
00:00:06,720 --> 00:00:10,080
doing I will is yeah I will do a live

4
00:00:10,080 --> 00:00:12,679
demo so this is the

5
00:00:12,679 --> 00:00:17,160
setup we need so yeah the the title for

6
00:00:17,160 --> 00:00:19,039
this demo is automating ownership

7
00:00:19,039 --> 00:00:20,720
context and impact assessment in

8
00:00:20,720 --> 00:00:22,840
security findings and I think that

9
00:00:22,840 --> 00:00:24,800
ownership context and impact are three

10
00:00:24,800 --> 00:00:26,880
key security Concepts when working with

11
00:00:26,880 --> 00:00:30,679
security findings or vity management um

12
00:00:30,679 --> 00:00:32,479
thank you for the opportunity to show my

13
00:00:32,479 --> 00:00:34,559
project here I have a few slides I will

14
00:00:34,559 --> 00:00:36,719
try to go as fast as possible and then I

15
00:00:36,719 --> 00:00:38,120
will show how it

16
00:00:38,120 --> 00:00:41,039
works so just briefly about me a

17
00:00:41,039 --> 00:00:42,960
security engineer during the last 10 to

18
00:00:42,960 --> 00:00:45,239
15 years working different networking

19
00:00:45,239 --> 00:00:47,480
infrastructure and cloth uh related

20
00:00:47,480 --> 00:00:49,760
roles uh during the last years also

21
00:00:49,760 --> 00:00:52,120
focus on security tooling and Automation

22
00:00:52,120 --> 00:00:54,199
and I've been contributing to some open

23
00:00:54,199 --> 00:00:57,199
source uh projects you can find all that

24
00:00:57,199 --> 00:00:58,920
in GitHub my

25
00:00:58,920 --> 00:01:00,440
GitHub

26
00:01:00,440 --> 00:01:03,640
so um Automation in security and

27
00:01:03,640 --> 00:01:06,600
especially in vulnerability management

28
00:01:06,600 --> 00:01:09,960
is key it help us uh saving time but

29
00:01:09,960 --> 00:01:11,840
also with what is really important that

30
00:01:11,840 --> 00:01:14,799
is um not the amount of findings we have

31
00:01:14,799 --> 00:01:16,640
is the time it takes to detect them and

32
00:01:16,640 --> 00:01:19,400
fix them in Cloud the most common

33
00:01:19,400 --> 00:01:21,200
security scanners that are available are

34
00:01:21,200 --> 00:01:24,240
cpms misconfiguration scanners and softw

35
00:01:24,240 --> 00:01:28,799
with scanners um these tools help us

36
00:01:28,799 --> 00:01:30,400
discovering hundreds of ISS that will

37
00:01:30,400 --> 00:01:33,399
not be possible manually good and in

38
00:01:33,399 --> 00:01:36,759
general they do it fast good but they

39
00:01:36,759 --> 00:01:39,560
base the ru set based on standards so

40
00:01:39,560 --> 00:01:42,399
they provide in general a generic

41
00:01:42,399 --> 00:01:45,040
definition of each finding and their

42
00:01:45,040 --> 00:01:47,880
severities they focus on single findings

43
00:01:47,880 --> 00:01:49,640
not on resources so they don't provide

44
00:01:49,640 --> 00:01:51,520
any type of correlation between the

45
00:01:51,520 --> 00:01:54,399
findings that the that they detect they

46
00:01:54,399 --> 00:01:57,000
don't provide um they don't provide us

47
00:01:57,000 --> 00:01:58,840
enough context about the affective

48
00:01:58,840 --> 00:02:00,479
resources and at the end this could mean

49
00:02:00,479 --> 00:02:03,399
a lot of extra work noise and probably

50
00:02:03,399 --> 00:02:04,600
false

51
00:02:04,600 --> 00:02:06,840
positives so when there's a security

52
00:02:06,840 --> 00:02:09,119
finding we first need to understand like

53
00:02:09,119 --> 00:02:11,640
this one about uh open an open security

54
00:02:11,640 --> 00:02:13,599
group we first need to understand who

55
00:02:13,599 --> 00:02:16,760
owns that that um affective resource so

56
00:02:16,760 --> 00:02:20,000
we know who should I report it to uh who

57
00:02:20,000 --> 00:02:21,879
created then we need to understand the

58
00:02:21,879 --> 00:02:23,879
context of it like what is doing how is

59
00:02:23,879 --> 00:02:26,080
associated with other resources is there

60
00:02:26,080 --> 00:02:27,959
other security findings for the same

61
00:02:27,959 --> 00:02:30,160
resource and finally with all that

62
00:02:30,160 --> 00:02:32,800
information we can Define the real

63
00:02:32,800 --> 00:02:35,360
impact of the finding like for this

64
00:02:35,360 --> 00:02:37,040
security finding about the an open

65
00:02:37,040 --> 00:02:38,720
security group is the security group is

66
00:02:38,720 --> 00:02:42,159
not attached or it's not even in use why

67
00:02:42,159 --> 00:02:45,800
we you need to report it as a critical

68
00:02:45,800 --> 00:02:48,599
finding so what information is available

69
00:02:48,599 --> 00:02:50,599
programmatically that we can use to

70
00:02:50,599 --> 00:02:53,959
automate this process tagging if it's

71
00:02:53,959 --> 00:02:56,440
used consistently it can provide us a

72
00:02:56,440 --> 00:02:58,360
lot of information about affective

73
00:02:58,360 --> 00:03:01,720
resource maybe the service the owner the

74
00:03:01,720 --> 00:03:05,159
environment a description a name logs or

75
00:03:05,159 --> 00:03:08,360
cloud trail in AWS um could help us

76
00:03:08,360 --> 00:03:09,840
understand who created the affected

77
00:03:09,840 --> 00:03:14,280
resource how when from where if we

78
00:03:14,280 --> 00:03:16,599
isolate services or environments using

79
00:03:16,599 --> 00:03:18,360
different AWS accounts having

80
00:03:18,360 --> 00:03:20,280
information about the affected AWS

81
00:03:20,280 --> 00:03:22,519
account will provide us a lot of also

82
00:03:22,519 --> 00:03:25,239
contextual information uh maybe also the

83
00:03:25,239 --> 00:03:27,360
security contact for that for that

84
00:03:27,360 --> 00:03:29,120
account and then we have the

85
00:03:29,120 --> 00:03:30,519
configuration

86
00:03:30,519 --> 00:03:33,879
from from the affected resource itself

87
00:03:33,879 --> 00:03:36,200
that it depends on its type like for an

88
00:03:36,200 --> 00:03:37,959
is2 instance we will have certain type

89
00:03:37,959 --> 00:03:39,519
of configurations for a Lambda function

90
00:03:39,519 --> 00:03:40,920
we will have other type of

91
00:03:40,920 --> 00:03:43,000
configurations and finally we have all

92
00:03:43,000 --> 00:03:47,760
the resources that are somehow connected

93
00:03:47,760 --> 00:03:50,000
or associated with the affected resource

94
00:03:50,000 --> 00:03:51,959
this could be at the network layer like

95
00:03:51,959 --> 00:03:54,200
the VPC where the resource is running

96
00:03:54,200 --> 00:03:56,000
the subnets the roads at the security

97
00:03:56,000 --> 00:03:58,159
layer like maybe a security group

98
00:03:58,159 --> 00:04:01,120
attached to the affected Resort maybe a

99
00:04:01,120 --> 00:04:03,720
network ecl at the access layer like IM

100
00:04:03,720 --> 00:04:06,480
roads policies maybe boundaries this

101
00:04:06,480 --> 00:04:10,040
tool in in metahub um you can get all

102
00:04:10,040 --> 00:04:11,920
this information together from your

103
00:04:11,920 --> 00:04:14,040
affected resources in the form of

104
00:04:14,040 --> 00:04:15,799
they're called meta outputs so we have

105
00:04:15,799 --> 00:04:17,798
meta taxs for tagging we have meta trads

106
00:04:17,798 --> 00:04:19,560
for logs we have meta account for

107
00:04:19,560 --> 00:04:21,000
information about the account and

108
00:04:21,000 --> 00:04:22,880
finally we have meta checks where we

109
00:04:22,880 --> 00:04:24,880
check the configuration itself from the

110
00:04:24,880 --> 00:04:27,880
affected resource and all their

111
00:04:27,880 --> 00:04:30,280
associations then we have some

112
00:04:30,280 --> 00:04:31,680
Properties or questions that we can

113
00:04:31,680 --> 00:04:33,440
answer about the affective resources

114
00:04:33,440 --> 00:04:36,479
that are independently independent from

115
00:04:36,479 --> 00:04:40,440
the affected resource type um like if

116
00:04:40,440 --> 00:04:42,440
it's public if it's unrestricted if it's

117
00:04:42,440 --> 00:04:45,039
encrypted and the challenge with these

118
00:04:45,039 --> 00:04:48,600
questions is how to answer them not only

119
00:04:48,600 --> 00:04:50,680
based on the affected resource itself

120
00:04:50,680 --> 00:04:52,919
but also based on everything that is

121
00:04:52,919 --> 00:04:55,479
connected to these resource so as an

122
00:04:55,479 --> 00:04:57,919
example uh for an easy to instance with

123
00:04:57,919 --> 00:05:01,039
a public IP in a public net this easy2

124
00:05:01,039 --> 00:05:03,520
instance will be only effectively public

125
00:05:03,520 --> 00:05:05,160
if there is a security group attached to

126
00:05:05,160 --> 00:05:07,639
it that allows traffic and another

127
00:05:07,639 --> 00:05:09,360
example for an NRE bucket with an

128
00:05:09,360 --> 00:05:11,199
unrestricted fully unrestricted buet

129
00:05:11,199 --> 00:05:13,400
policy the bucket will only be

130
00:05:13,400 --> 00:05:15,360
effectively unrestricted if for example

131
00:05:15,360 --> 00:05:18,680
there's no public log access enabled for

132
00:05:18,680 --> 00:05:21,600
the for the bucket or for the account

133
00:05:21,600 --> 00:05:24,199
again uh the goal of this tool is to

134
00:05:24,199 --> 00:05:25,560
provide you the answer to these

135
00:05:25,560 --> 00:05:28,479
questions in a standardized way so you

136
00:05:28,479 --> 00:05:32,600
can easily um Define the real impact of

137
00:05:32,600 --> 00:05:35,360
the of the security

138
00:05:35,360 --> 00:05:38,720
findings one more on the demo so metab

139
00:05:38,720 --> 00:05:42,039
is a framework for fetching this data

140
00:05:42,039 --> 00:05:43,600
and answering questions about your

141
00:05:43,600 --> 00:05:46,319
resources that maybe can help you uh

142
00:05:46,319 --> 00:05:49,400
with the the automation of the ownership

143
00:05:49,400 --> 00:05:51,880
assignment the cont context enrichment

144
00:05:51,880 --> 00:05:53,400
and the impact definition for this

145
00:05:53,400 --> 00:05:55,840
security findings while you continue

146
00:05:55,840 --> 00:05:59,319
using the scanners that you are using so

147
00:05:59,319 --> 00:06:02,479
how how this works metahub reads your

148
00:06:02,479 --> 00:06:05,520
security findings from other tools uh

149
00:06:05,520 --> 00:06:07,440
any tool that supports generating

150
00:06:07,440 --> 00:06:10,400
outputs in isff format could be used to

151
00:06:10,400 --> 00:06:12,400
integrate with metahub or you can read

152
00:06:12,400 --> 00:06:15,240
directly from aw AWS security Hub API if

153
00:06:15,240 --> 00:06:18,000
you are using security Hub then it will

154
00:06:18,000 --> 00:06:20,039
connect to every affected resource and

155
00:06:20,039 --> 00:06:22,560
execute in in each affected account and

156
00:06:22,560 --> 00:06:25,199
execute this meta options uh in those

157
00:06:25,199 --> 00:06:27,160
resources every time there's an

158
00:06:27,160 --> 00:06:29,280
association uh another resource that

159
00:06:29,280 --> 00:06:31,039
this associated with the affected

160
00:06:31,039 --> 00:06:33,440
resource it will also execute the meta

161
00:06:33,440 --> 00:06:35,599
options in those resources as well with

162
00:06:35,599 --> 00:06:38,000
all this information together it will

163
00:06:38,000 --> 00:06:40,639
generate outputs that you can use for

164
00:06:40,639 --> 00:06:42,400
integrating with other tooling for

165
00:06:42,400 --> 00:06:45,280
example with an alerting system um it

166
00:06:45,280 --> 00:06:48,319
will generate some uh reports like HTML

167
00:06:48,319 --> 00:06:50,319
reports that you can customize based on

168
00:06:50,319 --> 00:06:52,759
what you want to see there you can also

169
00:06:52,759 --> 00:06:56,520
apply filters on top of all this data um

170
00:06:56,520 --> 00:06:58,199
using these filters you can identify

171
00:06:58,199 --> 00:07:00,080
issues that only make sense in your

172
00:07:00,080 --> 00:07:02,479
context and if you are using security

173
00:07:02,479 --> 00:07:05,039
Hub you can also execute actions

174
00:07:05,039 --> 00:07:06,520
directly in security Hub like for

175
00:07:06,520 --> 00:07:08,360
example updating the workflow statuses

176
00:07:08,360 --> 00:07:12,400
of all your findings together or en uh

177
00:07:12,400 --> 00:07:14,759
adding the context directly in the

178
00:07:14,759 --> 00:07:16,800
findings in the security

179
00:07:16,800 --> 00:07:20,919
Hub so let's see how it

180
00:07:22,199 --> 00:07:27,039
works so I have um an AWS account with a

181
00:07:27,039 --> 00:07:29,560
few resources and security have enabled

182
00:07:29,560 --> 00:07:31,360
so security Hub will be the source of my

183
00:07:31,360 --> 00:07:32,840
security

184
00:07:32,840 --> 00:07:35,199
findings uh let's first explore the

185
00:07:35,199 --> 00:07:38,280
options that we have in

186
00:07:38,319 --> 00:07:41,639
metahub so first we have options for

187
00:07:41,639 --> 00:07:45,000
defining how to read from security from

188
00:07:45,000 --> 00:07:46,879
The Source if we want to use security

189
00:07:46,879 --> 00:07:48,440
Hub as Source we have option for

190
00:07:48,440 --> 00:07:50,000
defining the role to assume in that

191
00:07:50,000 --> 00:07:52,280
account or maybe the profile we have

192
00:07:52,280 --> 00:07:53,879
options for defining the account ID and

193
00:07:53,879 --> 00:07:56,440
the reion where security H is running

194
00:07:56,440 --> 00:07:58,400
then we can apply filters that will be

195
00:07:58,400 --> 00:08:00,560
will be applied in directly in the API

196
00:08:00,560 --> 00:08:03,759
this is useful if we want to uh get only

197
00:08:03,759 --> 00:08:06,720
one finding or a specific severity or a

198
00:08:06,720 --> 00:08:08,919
specific resource type region AWS

199
00:08:08,919 --> 00:08:11,919
account ID um we can also Define these

200
00:08:11,919 --> 00:08:14,680
filters as yaml files that we can keep

201
00:08:14,680 --> 00:08:17,680
them in our in the repository and reuse

202
00:08:17,680 --> 00:08:20,400
them for following executions and then

203
00:08:20,400 --> 00:08:22,639
we have option for defining uh if we

204
00:08:22,639 --> 00:08:25,840
want to um read read the findings from

205
00:08:25,840 --> 00:08:28,199
other sources we can Define this the

206
00:08:28,199 --> 00:08:30,199
path to those files and we can even

207
00:08:30,199 --> 00:08:32,279
combine more than one source together

208
00:08:32,279 --> 00:08:34,399
for example if we want to read from if

209
00:08:34,399 --> 00:08:37,000
we are using Prowler as the source for

210
00:08:37,000 --> 00:08:39,479
our security findings we can com combine

211
00:08:39,479 --> 00:08:42,640
Prowler plus a security Hub and metahub

212
00:08:42,640 --> 00:08:45,240
will generate a UniFi unified output

213
00:08:45,240 --> 00:08:47,880
from all your sources together then we

214
00:08:47,880 --> 00:08:50,040
have options for defining if we want to

215
00:08:50,040 --> 00:08:52,720
do something directly in security Hub

216
00:08:52,720 --> 00:08:54,519
like updating the workflow statuses of

217
00:08:54,519 --> 00:08:56,839
the findings or uh adding the

218
00:08:56,839 --> 00:09:00,000
information back in security hub we have

219
00:09:00,000 --> 00:09:01,760
the options for enabling or disabling

220
00:09:01,760 --> 00:09:04,440
these meta options like meta checks meta

221
00:09:04,440 --> 00:09:06,920
tax meta Trails we Al also have option

222
00:09:06,920 --> 00:09:10,839
for defining filters on top of these um

223
00:09:10,839 --> 00:09:12,760
of these outputs and we have also an

224
00:09:12,760 --> 00:09:15,279
option for defining a role to assume in

225
00:09:15,279 --> 00:09:16,760
the affected accounts because if we are

226
00:09:16,760 --> 00:09:19,760
aggregating findings in one master

227
00:09:19,760 --> 00:09:22,519
Security account we will need a role to

228
00:09:22,519 --> 00:09:25,680
assume in the accounts where the

229
00:09:25,680 --> 00:09:28,880
resources actually are and then we can

230
00:09:28,880 --> 00:09:31,839
Define find the outputs that we want to

231
00:09:31,839 --> 00:09:33,480
get from the tool by default all outputs

232
00:09:33,480 --> 00:09:35,120
are enabled we have six different

233
00:09:35,120 --> 00:09:37,160
outputs four of them are shason one is

234
00:09:37,160 --> 00:09:39,519
HTML and the other one is

235
00:09:39,519 --> 00:09:42,399
CSV um let's see how it works I will

236
00:09:42,399 --> 00:09:46,279
execute metahub um without any extra

237
00:09:46,279 --> 00:09:48,600
option for now by default it will try to

238
00:09:48,600 --> 00:09:52,079
read from security Hub I have my

239
00:09:52,079 --> 00:09:55,240
credentials in uh my environment so

240
00:09:55,240 --> 00:09:57,800
every time you run metahub uh it will

241
00:09:57,800 --> 00:10:00,160
show you the options that it's using for

242
00:10:00,160 --> 00:10:02,600
that execution in my case by default

243
00:10:02,600 --> 00:10:04,320
it's trying to read from security Hub

244
00:10:04,320 --> 00:10:05,680
the information about the account is in

245
00:10:05,680 --> 00:10:08,120
my environment by default if I don't

246
00:10:08,120 --> 00:10:10,160
specify filters it will use the default

247
00:10:10,160 --> 00:10:12,480
security C filters that are record State

248
00:10:12,480 --> 00:10:15,120
equal active and workflow status equal

249
00:10:15,120 --> 00:10:18,399
new and no meta options are enabled and

250
00:10:18,399 --> 00:10:21,040
all the outputs are enabled by default

251
00:10:21,040 --> 00:10:23,160
so the first step for metahub is reading

252
00:10:23,160 --> 00:10:25,000
from The Source in this case security

253
00:10:25,000 --> 00:10:28,480
Hub so in this case it found 80 findings

254
00:10:28,480 --> 00:10:30,600
in security and then you start analyzing

255
00:10:30,600 --> 00:10:33,959
finding by finding and generating the

256
00:10:33,959 --> 00:10:36,360
the configur outputs so we see that here

257
00:10:36,360 --> 00:10:38,959
in the result section we have again 80

258
00:10:38,959 --> 00:10:40,519
findings this is because I didn't apply

259
00:10:40,519 --> 00:10:44,000
any filter on top of the of this query

260
00:10:44,000 --> 00:10:45,839
and we also see that the total amount of

261
00:10:45,839 --> 00:10:47,600
affected resources for this query is

262
00:10:47,600 --> 00:10:49,959
only 24 this could be already an

263
00:10:49,959 --> 00:10:52,040
interesting metric because for each of

264
00:10:52,040 --> 00:10:54,920
our queries we can easily understand how

265
00:10:54,920 --> 00:10:56,839
many resources are affected by the

266
00:10:56,839 --> 00:10:58,839
findings that we are getting from any

267
00:10:58,839 --> 00:11:00,959
any scanner then we have some simple

268
00:11:00,959 --> 00:11:03,320
statistics like findings by severi by

269
00:11:03,320 --> 00:11:06,120
resource type and finally the outputs

270
00:11:06,120 --> 00:11:08,519
that the tool generated I will start by

271
00:11:08,519 --> 00:11:10,279
opening the first output it's called

272
00:11:10,279 --> 00:11:11,880
shason

273
00:11:11,880 --> 00:11:15,240
short um what we see here is that we

274
00:11:15,240 --> 00:11:19,279
have a list of affected resources that

275
00:11:19,279 --> 00:11:22,560
we are getting from security Hub metahub

276
00:11:22,560 --> 00:11:24,839
will always shows the resources using

277
00:11:24,839 --> 00:11:29,079
their AR um and this apply for the main

278
00:11:29,079 --> 00:11:32,000
resource and for any association so if I

279
00:11:32,000 --> 00:11:34,680
expand any of these uh affected resource

280
00:11:34,680 --> 00:11:37,519
we have a section findings where we will

281
00:11:37,519 --> 00:11:39,959
see all the findings that are affecting

282
00:11:39,959 --> 00:11:43,120
this resource together so we can group

283
00:11:43,120 --> 00:11:45,120
all the findings that are related under

284
00:11:45,120 --> 00:11:46,720
the affected resource and then we have

285
00:11:46,720 --> 00:11:50,360
some uh simple fields that describe the

286
00:11:50,360 --> 00:11:52,440
the affected resource if I want to see

287
00:11:52,440 --> 00:11:54,639
more information about the findings I

288
00:11:54,639 --> 00:11:57,399
can use the full output that again is

289
00:11:57,399 --> 00:11:58,800
the same we have all the findings

290
00:11:58,800 --> 00:12:00,680
together that are affecting the same

291
00:12:00,680 --> 00:12:03,160
resource but this time I can expand any

292
00:12:03,160 --> 00:12:05,160
of the findings and get more information

293
00:12:05,160 --> 00:12:07,000
like the severity where it's coming from

294
00:12:07,000 --> 00:12:08,079
the

295
00:12:08,079 --> 00:12:11,480
standard um we also have a statistic

296
00:12:11,480 --> 00:12:14,120
output where we basically generate

297
00:12:14,120 --> 00:12:16,680
statistics by every available field that

298
00:12:16,680 --> 00:12:18,279
we get from the findings for example we

299
00:12:18,279 --> 00:12:21,480
know how many um findings we have for

300
00:12:21,480 --> 00:12:24,320
each resource ID for each resource type

301
00:12:24,320 --> 00:12:27,320
reion if we are using more than one for

302
00:12:27,320 --> 00:12:30,959
every account and finally the last um um

303
00:12:30,959 --> 00:12:32,880
Shon output is an inventory that's

304
00:12:32,880 --> 00:12:34,519
basically a list of affective resources

305
00:12:34,519 --> 00:12:37,560
using their RM so let's start by

306
00:12:37,560 --> 00:12:40,560
enabling some of the meta options I will

307
00:12:40,560 --> 00:12:43,959
start by enabling meta tags meta trails

308
00:12:43,959 --> 00:12:46,480
and meta account you can

309
00:12:46,480 --> 00:12:49,079
decide the ones you need you can combine

310
00:12:49,079 --> 00:12:51,440
them use them all

311
00:12:51,440 --> 00:12:53,440
together again we see the options that

312
00:12:53,440 --> 00:12:54,880
we are passing to the tool we see now

313
00:12:54,880 --> 00:12:57,360
that we have some meta options enabled

314
00:12:57,360 --> 00:12:59,240
First Step reading from security we have

315
00:12:59,240 --> 00:13:00,800
80 findings again and you start

316
00:13:00,800 --> 00:13:02,279
analyzing this findings this time it

317
00:13:02,279 --> 00:13:04,240
will take a maybe a little bit longer

318
00:13:04,240 --> 00:13:06,519
because it actually doing something on

319
00:13:06,519 --> 00:13:09,639
each affective resource let's see if the

320
00:13:09,639 --> 00:13:12,160
connection helps

321
00:13:12,160 --> 00:13:16,880
me this will be enough I will a here the

322
00:13:16,880 --> 00:13:20,600
hard way I will open the first output

323
00:13:20,600 --> 00:13:23,480
again so now let's see this is a

324
00:13:23,480 --> 00:13:25,600
security group so under the affected

325
00:13:25,600 --> 00:13:27,560
resource we will see that we have this

326
00:13:27,560 --> 00:13:30,240
new sex metata tax all the TXS that are

327
00:13:30,240 --> 00:13:33,199
applied to this uh resource we also have

328
00:13:33,199 --> 00:13:35,040
a section meta Trails where we where

329
00:13:35,040 --> 00:13:37,560
metah Hab is trying to identify critical

330
00:13:37,560 --> 00:13:39,639
events in clout in the affected resource

331
00:13:39,639 --> 00:13:41,000
that correspond to this affected

332
00:13:41,000 --> 00:13:43,440
resource so for this for this one that

333
00:13:43,440 --> 00:13:45,399
is a security group we are looking for

334
00:13:45,399 --> 00:13:47,160
the creation event that is create

335
00:13:47,160 --> 00:13:48,519
Security Group and the authorized

336
00:13:48,519 --> 00:13:50,639
Security Group Ingress rule we get the

337
00:13:50,639 --> 00:13:54,079
username who who execute this action the

338
00:13:54,079 --> 00:13:56,120
the event time and and event ID that we

339
00:13:56,120 --> 00:13:58,240
can use to search directly in CL in

340
00:13:58,240 --> 00:14:00,800
Cloud if that's what we want and then we

341
00:14:00,800 --> 00:14:02,959
have information about the affected

342
00:14:02,959 --> 00:14:04,839
account so like the Alas and the

343
00:14:04,839 --> 00:14:08,199
contacts that are defined there for if I

344
00:14:08,199 --> 00:14:12,320
for another this is for example an IM am

345
00:14:12,320 --> 00:14:14,720
user so for meta trades we are looking

346
00:14:14,720 --> 00:14:17,079
for a different event in this Cas is the

347
00:14:17,079 --> 00:14:20,519
create user so we can easily know who uh

348
00:14:20,519 --> 00:14:22,800
who and when created this affected

349
00:14:22,800 --> 00:14:26,519
resource if I open again the statistic

350
00:14:26,519 --> 00:14:28,920
output we'll see that now also we have

351
00:14:28,920 --> 00:14:31,560
statistics by this meta options so in my

352
00:14:31,560 --> 00:14:33,839
case that I'm using this tag key owner

353
00:14:33,839 --> 00:14:37,560
with different values um we are counting

354
00:14:37,560 --> 00:14:40,000
the findings by each of these values I'm

355
00:14:40,000 --> 00:14:42,199
also using environment so we have

356
00:14:42,199 --> 00:14:45,560
statistics by envir environment um also

357
00:14:45,560 --> 00:14:48,160
by for example the the output of the

358
00:14:48,160 --> 00:14:50,839
meta account uh

359
00:14:50,839 --> 00:14:55,399
option some of these um meta options can

360
00:14:55,399 --> 00:14:58,079
be filter so for example if I want to

361
00:14:58,079 --> 00:15:01,480
filter only uh

362
00:15:01,480 --> 00:15:04,560
resources that are tagged in a certain

363
00:15:04,560 --> 00:15:06,440
way for example they are tagged with

364
00:15:06,440 --> 00:15:09,000
this tag key owner and the value

365
00:15:09,000 --> 00:15:11,639
security I can run that

366
00:15:11,639 --> 00:15:14,920
query we'll see now that we have these

367
00:15:14,920 --> 00:15:20,880
options um in the first section of the

368
00:15:22,000 --> 00:15:25,000
execution again first reading from The

369
00:15:25,000 --> 00:15:27,600
Source we start analyzing the

370
00:15:27,600 --> 00:15:30,600
findings

371
00:15:31,360 --> 00:15:33,920
and what we will see now is that the

372
00:15:33,920 --> 00:15:37,519
results are now uh then the amount of

373
00:15:37,519 --> 00:15:40,079
the findings is different because now we

374
00:15:40,079 --> 00:15:42,319
are applying a filter on top of these uh

375
00:15:42,319 --> 00:15:44,399
findings in this case we ended up with

376
00:15:44,399 --> 00:15:45,360
five

377
00:15:45,360 --> 00:15:48,240
findings uh um that are affecting only

378
00:15:48,240 --> 00:15:51,720
two resources so if I open the first

379
00:15:51,720 --> 00:15:53,600
output again we will see that these are

380
00:15:53,600 --> 00:15:56,360
the resources that are uh tagging this

381
00:15:56,360 --> 00:15:59,440
uh way and we have two findings here

382
00:15:59,440 --> 00:16:03,360
um three findings in the other one so I

383
00:16:03,360 --> 00:16:05,000
can even combine these filters with

384
00:16:05,000 --> 00:16:07,000
filters appli directly in security Hub

385
00:16:07,000 --> 00:16:10,399
API so if I want to get only from

386
00:16:10,399 --> 00:16:15,680
security Hub uh findings that are high

387
00:16:15,680 --> 00:16:20,800
severity I can use the severity label uh

388
00:16:23,839 --> 00:16:26,639
filter again First Step reading from The

389
00:16:26,639 --> 00:16:28,759
Source this time we only found 16 them

390
00:16:28,759 --> 00:16:30,399
findings in security Hub because we are

391
00:16:30,399 --> 00:16:32,839
applying this filter directly in the API

392
00:16:32,839 --> 00:16:35,720
and we ended up with only two findings

393
00:16:35,720 --> 00:16:38,240
affected affecting one resource this

394
00:16:38,240 --> 00:16:40,480
means that this is the only resource in

395
00:16:40,480 --> 00:16:44,120
my environment uh tagged as owner equal

396
00:16:44,120 --> 00:16:46,360
security which is affected by high

397
00:16:46,360 --> 00:16:48,000
severity

398
00:16:48,000 --> 00:16:50,360
findings let's see how

399
00:16:50,360 --> 00:16:54,399
the last meta option work meta

400
00:16:54,399 --> 00:16:57,480
checks I will run once

401
00:16:57,480 --> 00:17:00,480
more

402
00:17:03,040 --> 00:17:06,799
again reading from The Source this could

403
00:17:06,799 --> 00:17:11,520
be uh the output of any other security

404
00:17:17,848 --> 00:17:20,999
[Music]

405
00:17:21,160 --> 00:17:23,400
scanner start analyzing finding by

406
00:17:23,400 --> 00:17:26,039
finding this time we will have a this

407
00:17:26,039 --> 00:17:27,919
meta check section under each affected

408
00:17:27,919 --> 00:17:29,160
resource

409
00:17:29,160 --> 00:17:33,039
so I will open the first output again um

410
00:17:33,039 --> 00:17:36,080
this one is the the one I find uh most

411
00:17:36,080 --> 00:17:38,760
interesting so let's I have here for

412
00:17:38,760 --> 00:17:41,559
example a security group affected by

413
00:17:41,559 --> 00:17:43,880
three security findings um we have this

414
00:17:43,880 --> 00:17:46,160
new section meta checks meta checks will

415
00:17:46,160 --> 00:17:48,720
start trying to answer questions about

416
00:17:48,720 --> 00:17:50,520
your affective resources that can help

417
00:17:50,520 --> 00:17:52,440
you define the impact of your security

418
00:17:52,440 --> 00:17:55,120
findings in this case we see that this

419
00:17:55,120 --> 00:17:58,000
um Security Group is not associated with

420
00:17:58,000 --> 00:18:01,440
any network interface near E2 instance

421
00:18:01,440 --> 00:18:05,039
managed services but we see that this um

422
00:18:05,039 --> 00:18:07,799
it has a unrestricted Ingress rule so we

423
00:18:07,799 --> 00:18:08,960
get exactly the rule that is

424
00:18:08,960 --> 00:18:11,760
unrestricted from this resource and then

425
00:18:11,760 --> 00:18:13,520
we start seeing the association so this

426
00:18:13,520 --> 00:18:15,720
Security Group is associated with a bpc

427
00:18:15,720 --> 00:18:18,240
so we drill down into that bpc and we

428
00:18:18,240 --> 00:18:20,240
execute meta options in that Resource as

429
00:18:20,240 --> 00:18:21,960
well so we start getting information

430
00:18:21,960 --> 00:18:23,840
about the associations in this case we

431
00:18:23,840 --> 00:18:26,200
get some uh configurations from this

432
00:18:26,200 --> 00:18:28,159
resource like the cier that is using we

433
00:18:28,159 --> 00:18:30,120
know that is the default one and we

434
00:18:30,120 --> 00:18:31,960
drill down once more to understand the

435
00:18:31,960 --> 00:18:34,679
associations that associated with this

436
00:18:34,679 --> 00:18:37,679
Associated resource um and finally we

437
00:18:37,679 --> 00:18:40,159
try to answer the these impact questions

438
00:18:40,159 --> 00:18:42,159
that will help us defining the real

439
00:18:42,159 --> 00:18:44,159
impact of the security findings in this

440
00:18:44,159 --> 00:18:46,080
case we know that it's not public it's

441
00:18:46,080 --> 00:18:48,240
not default and it's not attached let's

442
00:18:48,240 --> 00:18:52,360
find one uh another example maybe the

443
00:18:52,360 --> 00:18:55,880
same uh resource

444
00:18:55,880 --> 00:18:58,280
type like this one this is another sec

445
00:18:58,280 --> 00:19:01,480
Security Group we have three findings um

446
00:19:01,480 --> 00:19:02,880
this time we see that this Security

447
00:19:02,880 --> 00:19:05,520
Group is associated with network

448
00:19:05,520 --> 00:19:08,039
interface with some E2 instances with

449
00:19:08,039 --> 00:19:10,640
something that has an IP that is public

450
00:19:10,640 --> 00:19:14,480
and again it has unrestricted um rules

451
00:19:14,480 --> 00:19:16,720
we get exactly the rule in this case is

452
00:19:16,720 --> 00:19:20,400
uh Port 22 TCP and again we have the

453
00:19:20,400 --> 00:19:22,559
some associations and then we can answer

454
00:19:22,559 --> 00:19:25,720
the impact question if it's public uh

455
00:19:25,720 --> 00:19:27,600
this time through based on the

456
00:19:27,600 --> 00:19:30,000
information that we are getting from

457
00:19:30,000 --> 00:19:32,320
from the resource but let's find find

458
00:19:32,320 --> 00:19:37,840
one more interesting this is a nitu

459
00:19:39,120 --> 00:19:41,679
instance so I have an easy to instance

460
00:19:41,679 --> 00:19:46,280
here some findings like uh public IP and

461
00:19:46,280 --> 00:19:49,799
not using system manager so again we

462
00:19:49,799 --> 00:19:52,120
first get some configuration from the

463
00:19:52,120 --> 00:19:53,960
affective resource and then we start

464
00:19:53,960 --> 00:19:56,159
analyzing the assoc the associations

465
00:19:56,159 --> 00:19:58,240
again in this case this instance is

466
00:19:58,240 --> 00:20:01,280
associated with an an IM role so again

467
00:20:01,280 --> 00:20:03,120
we drill down into this resource and we

468
00:20:03,120 --> 00:20:05,200
execute meta options there and based on

469
00:20:05,200 --> 00:20:07,640
the options we are executing H we can

470
00:20:07,640 --> 00:20:09,320
start answering other questions we see

471
00:20:09,320 --> 00:20:11,799
that this role is also associated with I

472
00:20:11,799 --> 00:20:13,960
am policies so we drill down once more

473
00:20:13,960 --> 00:20:16,200
into these I am policies and we check

474
00:20:16,200 --> 00:20:18,679
each of the policies um these policies

475
00:20:18,679 --> 00:20:21,480
are not unrestricted the other one is

476
00:20:21,480 --> 00:20:23,600
also not unrestricted so then we know

477
00:20:23,600 --> 00:20:25,840
that this role is not unrestricted and

478
00:20:25,840 --> 00:20:28,880
if we go up in the up outut we will see

479
00:20:28,880 --> 00:20:31,240
that this instance is not unrestricted

480
00:20:31,240 --> 00:20:34,280
but for this instance it's also

481
00:20:34,280 --> 00:20:37,039
associated with security groups so we

482
00:20:37,039 --> 00:20:39,400
check those security groups um in this

483
00:20:39,400 --> 00:20:42,080
case we see that this Security Group is

484
00:20:42,080 --> 00:20:44,960
it has an Ingress rule uh unrestricted

485
00:20:44,960 --> 00:20:48,880
that is the 22 TCP uh Port so we know

486
00:20:48,880 --> 00:20:52,159
that this Security Group is public so

487
00:20:52,159 --> 00:20:54,679
then we know that this instance is

488
00:20:54,679 --> 00:20:56,600
effectively public and this is this is

489
00:20:56,600 --> 00:20:59,799
BAS this is basic on the affective

490
00:20:59,799 --> 00:21:02,280
resource configuration itself but also

491
00:21:02,280 --> 00:21:03,960
with this Association the this

492
00:21:03,960 --> 00:21:05,559
information information about the

493
00:21:05,559 --> 00:21:08,080
associated resources we are we also do

494
00:21:08,080 --> 00:21:09,919
this for for example EVS that are

495
00:21:09,919 --> 00:21:11,960
attached with the instance we know that

496
00:21:11,960 --> 00:21:14,000
it's attach is associated with an EVS

497
00:21:14,000 --> 00:21:16,240
that is in this case not encrypted so

498
00:21:16,240 --> 00:21:17,880
then we know that the instance is not

499
00:21:17,880 --> 00:21:21,200
encrypted um we have again the bpcs and

500
00:21:21,200 --> 00:21:23,159
the subnets so we drill down into the

501
00:21:23,159 --> 00:21:25,440
subnet we get the road table of these

502
00:21:25,440 --> 00:21:28,880
subnets and for this road table we see

503
00:21:28,880 --> 00:21:30,880
that it has a road to an internet

504
00:21:30,880 --> 00:21:33,919
gateway gateway so we know that this um

505
00:21:33,919 --> 00:21:36,360
subnet is actually public because the

506
00:21:36,360 --> 00:21:39,480
road is uh in the default

507
00:21:39,480 --> 00:21:43,880
Road So Meta checks can also uh also

508
00:21:43,880 --> 00:21:46,080
support filters uh so you if you want

509
00:21:46,080 --> 00:21:48,159
for example to get all the all your

510
00:21:48,159 --> 00:21:50,240
affective resources uh that are

511
00:21:50,240 --> 00:21:52,279
effectively public you can

512
00:21:52,279 --> 00:21:55,600
run metahub with meta checks enabled and

513
00:21:55,600 --> 00:21:58,880
you can apply a filter here

514
00:21:58,880 --> 00:22:01,880
using any of the available um meta

515
00:22:01,880 --> 00:22:03,440
checks for example I can say okay give

516
00:22:03,440 --> 00:22:06,039
me all the uh affective resources that

517
00:22:06,039 --> 00:22:08,440
are effectively public or the other way

518
00:22:08,440 --> 00:22:11,600
around that are not effectively

519
00:22:11,600 --> 00:22:14,200
public we can use any available meta

520
00:22:14,200 --> 00:22:19,080
check we have an option is list meta

521
00:22:19,400 --> 00:22:22,039
checks so we have different met meta

522
00:22:22,039 --> 00:22:24,039
checks for every for some of the

523
00:22:24,039 --> 00:22:25,640
resource type that are

524
00:22:25,640 --> 00:22:29,600
supported um other ways of analyzing

525
00:22:29,600 --> 00:22:30,440
this

526
00:22:30,440 --> 00:22:34,679
information uh we can also use the HTML

527
00:22:34,679 --> 00:22:37,559
output we'll open

528
00:22:37,559 --> 00:22:41,360
this let me do zoom

529
00:22:41,480 --> 00:22:44,440
out so here what we have is basically

530
00:22:44,440 --> 00:22:46,520
the list of findings that we were seeing

531
00:22:46,520 --> 00:22:49,600
before um we can see this finding by

532
00:22:49,600 --> 00:22:53,000
finding but we can also see this group

533
00:22:53,000 --> 00:22:56,159
so same idea as before all the findings

534
00:22:56,159 --> 00:22:58,080
that affect the same resource under the

535
00:22:58,080 --> 00:23:00,200
under under the affected resource and

536
00:23:00,200 --> 00:23:02,279
what we will see here now is that we are

537
00:23:02,279 --> 00:23:04,760
also adding to this report the output of

538
00:23:04,760 --> 00:23:07,400
every meta check in this case we R we we

539
00:23:07,400 --> 00:23:10,200
run um metahub only with meta checks

540
00:23:10,200 --> 00:23:12,400
enabled but if we do it with also meta

541
00:23:12,400 --> 00:23:14,559
tax we will have also here the tax so we

542
00:23:14,559 --> 00:23:17,559
can start playing here with h filters so

543
00:23:17,559 --> 00:23:19,320
if you want to see only resources that

544
00:23:19,320 --> 00:23:22,640
are not uh encrypted but and they are

545
00:23:22,640 --> 00:23:24,799
attached we can we can combine filters

546
00:23:24,799 --> 00:23:27,320
here and get better Insight on what we

547
00:23:27,320 --> 00:23:29,720
have we can Define which uh columns to

548
00:23:29,720 --> 00:23:32,320
enable or disable we can sort by this uh

549
00:23:32,320 --> 00:23:34,760
information and then we can export this

550
00:23:34,760 --> 00:23:36,799
information again to different formats

551
00:23:36,799 --> 00:23:40,799
that we can use to um create yeah to to

552
00:23:40,799 --> 00:23:45,039
report exactly what what we need um one

553
00:23:45,039 --> 00:23:47,400
more way of using this tool metahub can

554
00:23:47,400 --> 00:23:50,159
runs in a Lambda the code uh for

555
00:23:50,159 --> 00:23:51,799
deploying that Lambda is provided as

556
00:23:51,799 --> 00:23:53,720
part of the tool you see in terraform so

557
00:23:53,720 --> 00:23:57,640
if you deploy um if you deploy meta a

558
00:23:57,640 --> 00:23:59,480
Lambda then you can connect the Lambda

559
00:23:59,480 --> 00:24:02,760
with any supported service one option is

560
00:24:02,760 --> 00:24:05,360
connect if you are using security Hub

561
00:24:05,360 --> 00:24:07,279
relying on the custom actions of

562
00:24:07,279 --> 00:24:11,000
security Hub I have an example

563
00:24:13,520 --> 00:24:16,480
here this is my test

564
00:24:16,480 --> 00:24:21,039
account so if I filter here so I see

565
00:24:21,039 --> 00:24:23,480
less

566
00:24:23,480 --> 00:24:25,880
findings so what I have in this account

567
00:24:25,880 --> 00:24:28,320
is the Lambda already

568
00:24:28,320 --> 00:24:31,679
and I configur a custom a security Hub

569
00:24:31,679 --> 00:24:35,360
custom actions and when you do this you

570
00:24:35,360 --> 00:24:37,880
can select one or more findings go to

571
00:24:37,880 --> 00:24:41,159
actions and execute metahub from

572
00:24:41,159 --> 00:24:44,559
here this will trigger the Lambda with

573
00:24:44,559 --> 00:24:46,440
the information of the findings that you

574
00:24:46,440 --> 00:24:49,919
are selecting and the Lambda will then

575
00:24:49,919 --> 00:24:52,799
update these

576
00:24:54,159 --> 00:24:56,760
findings I think this is

577
00:24:56,760 --> 00:24:59,760
from

578
00:25:00,880 --> 00:25:02,240
yeah

579
00:25:02,240 --> 00:25:05,320
so this will update these findings and

580
00:25:05,320 --> 00:25:09,440
it will add to the finding um all the

581
00:25:09,440 --> 00:25:11,279
information that we have from this uh

582
00:25:11,279 --> 00:25:13,240
meta option in this case I'm running the

583
00:25:13,240 --> 00:25:14,960
Lambda only with meta checks and meta

584
00:25:14,960 --> 00:25:16,960
taxs enabled so I have now all the

585
00:25:16,960 --> 00:25:19,520
information here and there the affected

586
00:25:19,520 --> 00:25:22,039
resource directly in security Hub this

587
00:25:22,039 --> 00:25:23,960
is useful if you want if you want to

588
00:25:23,960 --> 00:25:25,320
stay in the console you can apply

589
00:25:25,320 --> 00:25:28,320
filters here so for example if I want to

590
00:25:28,320 --> 00:25:29,799
see only the

591
00:25:29,799 --> 00:25:34,279
findings that are not

592
00:25:34,279 --> 00:25:36,799
attached we can apply a filter directly

593
00:25:36,799 --> 00:25:39,360
here in security Hub or we can use this

594
00:25:39,360 --> 00:25:42,840
information as well for generating

595
00:25:42,840 --> 00:25:44,760
custom insights for example I have an

596
00:25:44,760 --> 00:25:47,279
Insight here for showing all my

597
00:25:47,279 --> 00:25:50,559
resources that are effectively public

598
00:25:50,559 --> 00:25:51,880
and this is based on the information

599
00:25:51,880 --> 00:25:55,600
that we are um using to enrich those

600
00:25:55,600 --> 00:25:56,679
findings

601
00:25:56,679 --> 00:25:59,679
back

602
00:26:01,240 --> 00:26:03,840
so yeah this is everything I wanted to

603
00:26:03,840 --> 00:26:06,520
show the code is available in

604
00:26:06,520 --> 00:26:09,720
GitHub um I will be around if you have

605
00:26:09,720 --> 00:26:13,159
any questions or you want to

606
00:26:16,530 --> 00:26:19,720
[Applause]

607
00:26:19,720 --> 00:26:22,720
connect