AWS Well-Architected Framework - Security Pillar
This framework focuses on the security pillar. This will help you meet your business and regulatory requirements by following current AWS recommendations. It’s intended for those in technology roles, such as chief technology officers (CTOs), chief information security officers (CSOs/CISOs), architects, developers, and operations team members. The security pillar describes how to take advantage of cloud technologies to protect data, systems, and assets in a way that can improve your security posture.
Read more
Read more
Summary: [Not available:44] | [Compliant:11] | [Need Attention:10]
Breakdown
Framework. AWS Well-Architected Framework - Security Pillar
| Category | Rule ID | Compliance Status | Description | Reference |
|---|---|---|---|---|
| SEC01 | BP01 | Compliant | How do you securely operate your workload? - Separate workloads using accounts
| |
| SEC01 | BP02 | Need Attention | How do you securely operate your workload? - Secure account root user and properties
| AWS MFA IAM Best Practices IAM Password Policy |
| SEC01 | BP03 | Compliant | How do you securely operate your workload? - Identify and validate control objectives
| |
| SEC01 | BP04 | Compliant | How do you securely operate your workload? - Stay up to date with security threats and recommendations
| |
| SEC01 | BP05 | Need Attention | How do you securely operate your workload? - Identify and prioritize risks using a threat model
| |
| SEC01 | BP06 | Not available | How do you securely operate your workload? - Reduce security management scope | |
| SEC01 | BP07 | Not available | How do you securely operate your workload? - Automate deployment of standard security controls | |
| SEC01 | BP08 | Not available | How do you securely operate your workload? - Evaluate and implement new security services and features regularly | |
| SEC02 | BP01 | Compliant | How do you manage identities for people and machines? - Use strong sign-in mechanisms
| |
| SEC02 | BP02 | Compliant | How do you manage identities for people and machines? - Use temporary credentials
| |
| SEC02 | BP03 | Not available | How do you manage identities for people and machines? - Store and use secrets securely | |
| SEC02 | BP04 | Compliant | How do you manage identities for people and machines? - Rely on a centralized identity provider
| |
| SEC02 | BP05 | Need Attention | How do you manage identities for people and machines? - Audit and rotate credentials periodically
| AWS Docs AWS Docs Organization GuardRail Blog Lambda execution role |
| SEC02 | BP06 | Compliant | How do you manage identities for people and machines? - Employ user groups and attributes
| |
| SEC03 | BP01 | Not available | How do you manage permissions for people and machines? - Define access requirements | |
| SEC03 | BP02 | Need Attention | How do you manage permissions for people and machines? - Grant least privilege access
| AWS Docs AWS Docs Organization GuardRail Blog Lambda execution role |
| SEC03 | BP03 | Not available | How do you manage permissions for people and machines? - Define permission guardrails for your organization | |
| SEC03 | BP04 | Compliant | How do you manage permissions for people and machines? - Manage access based on lifecycle
| |
| SEC03 | BP05 | Not available | How do you manage permissions for people and machines? - Establish emergency access process | |
| SEC03 | BP06 | Compliant | How do you manage permissions for people and machines? - Share resources securely within your organization
| |
| SEC03 | BP07 | Compliant | How do you manage permissions for people and machines? - Reduce permissions continuously
| |
| SEC03 | BP08 | Compliant | How do you manage permissions for people and machines? - Share resources securely with a third party
| |
| SEC03 | BP09 | Not available | How do you manage permissions for people and machines? - Analyze public and cross account access | |
| SEC04 | BP01 | Need Attention | How do you detect and investigate security events? - Configure service and application logging
| Configure S3 bucket lifecycle Resilience in CloudTrail Insight events |
| SEC04 | BP02 | Not available | How do you detect and investigate security events? - Capture logs, findings, and metrics in standardized locations | |
| SEC04 | BP03 | Not available | How do you detect and investigate security events? - Initiate remediation for non-compliant resources | |
| SEC04 | BP04 | Not available | How do you detect and investigate security events? - Correlate and enrich security events | |
| SEC05 | BP01 | Need Attention | How do you protect your network resources? - Create network layers
| |
| SEC05 | BP02 | Need Attention | How do you protect your network resources? - Control traffic within your network layers
| Best practices for Amazon EC2 Data protection in Amazon EC2 ALB Configuration Guide |
| SEC05 | BP03 | Not available | How do you protect your network resources? - Implement inspection-based protection | |
| SEC05 | BP04 | Not available | How do you protect your network resources? - Automate network protection | |
| SEC06 | BP01 | Not available | How do you protect your compute resources? - Perform vulnerability management | |
| SEC06 | BP02 | Not available | How do you protect your compute resources? - Provision compute from hardened images | |
| SEC06 | BP03 | Not available | How do you protect your compute resources? - Validate software integrity | |
| SEC06 | BP04 | Not available | How do you protect your compute resources? - Reduce manual management and interactive access | |
| SEC06 | BP05 | Not available | How do you protect your compute resources? - Automate compute protection | |
| SEC06 | BP06 | Not available | How do you protect your compute resources? - None of these | |
| SEC07 | BP01 | Not available | How do you classify your data? - Understand your data classification scheme | |
| SEC07 | BP02 | Not available | How do you classify your data? - Apply data protection controls based on data sensitivity | |
| SEC07 | BP03 | Not available | How do you classify your data? - Define scalable data lifecycle management | |
| SEC07 | BP04 | Not available | How do you classify your data? - Automate identification and classification | |
| SEC08 | BP01 | Not available | How do you protect your data at rest? - Implement secure key management | |
| SEC08 | BP02 | Need Attention | How do you protect your data at rest? - Enforce encryption at rest
| Encrypt CloudTrail using AWS KMS CloudTrail Security Best Practices Best practices for Amazon EC2 Lambda securing environment variables |
| SEC08 | BP03 | Not available | How do you protect your data at rest? - Automate data at rest protection | |
| SEC08 | BP04 | Need Attention | How do you protect your data at rest? - Enforce access control
| AWS Docs AWS Docs Organization GuardRail Blog Lambda execution role AWS Docs Manage Versioning Example AWS Docs |
| SEC08 | BP05 | Not available | How do you protect your data at rest? - None of these | |
| SEC09 | BP01 | Not available | How do you protect your data in transit? - Implement secure key and certificate management | |
| SEC09 | BP02 | Need Attention | How do you protect your data in transit? - Enforce encryption in transit
| Data protection in Amazon EC2 ALB Configuration Guide |
| SEC09 | BP03 | Not available | How do you protect your data in transit? - Authenticate network communications | |
| SEC09 | BP04 | Not available | How do you protect your data in transit? - None of these | |
| SEC10 | BP01 | Not available | How do you anticipate, respond to, and recover from incidents? - Identify key personnel and external resources | |
| SEC10 | BP02 | Not available | How do you anticipate, respond to, and recover from incidents? - Develop incident management plans | |
| SEC10 | BP03 | Not available | How do you anticipate, respond to, and recover from incidents? - Prepare forensic capabilities | |
| SEC10 | BP04 | Not available | How do you anticipate, respond to, and recover from incidents? - Develop and test security incident response playbooks | |
| SEC10 | BP05 | Not available | How do you anticipate, respond to, and recover from incidents? - Pre-provision access | |
| SEC10 | BP06 | Not available | How do you anticipate, respond to, and recover from incidents? - Run simulations | |
| SEC10 | BP07 | Not available | How do you anticipate, respond to, and recover from incidents? - Establish a framework for learning from incidents | |
| SEC11 | BP01 | Not available | How do you incorporate and validate the security properties of applications throughout the design, development, and deployment lifecycle? - Perform regular penetration testing | |
| SEC11 | BP02 | Not available | How do you incorporate and validate the security properties of applications throughout the design, development, and deployment lifecycle? - Deploy software programmatically | |
| SEC11 | BP03 | Not available | How do you incorporate and validate the security properties of applications throughout the design, development, and deployment lifecycle? - Regularly assess security properties of the pipelines | |
| SEC11 | BP04 | Not available | How do you incorporate and validate the security properties of applications throughout the design, development, and deployment lifecycle? - Train for application security | |
| SEC11 | BP05 | Not available | How do you incorporate and validate the security properties of applications throughout the design, development, and deployment lifecycle? - Automate testing throughout the development and release lifecycle | |
| SEC11 | BP06 | Not available | How do you incorporate and validate the security properties of applications throughout the design, development, and deployment lifecycle? - Manual code reviews | |
| SEC11 | BP07 | Not available | How do you incorporate and validate the security properties of applications throughout the design, development, and deployment lifecycle? - Centralize services for packages and dependencies | |
| SEC11 | BP08 | Not available | How do you incorporate and validate the security properties of applications throughout the design, development, and deployment lifecycle? - Build a program that embeds security ownership in workload teams |