INNOVATE recently completed a collaboration with Amazon Web Services (AWS) to develop open-source solutions that add value to AWS’s native services and are useful for AWS clients and partners.

The project delivered a solution called Virtual Security Operation Center (SOC) with MITRE ATT&CK Framework Integration for AWS Security Hub, which, as the name suggests, maps the MITRE ATT&CK cybersecurity framework onto AWS’s native security findings.

As a provider of security services in fully AWS-native environments, we noticed that the information surfaced in Security Hub dashboards is quite limited when it comes to a threat- and attacker-centric view; instead, Security Hub findings tend to focus on quick reference against security standard compliance. Only a handful of findings carry MITRE ATT&CK context from the originating service, making it harder for a security analyst used to working with MITRE’s tactics and techniques.

That’s why INNOVATE, working directly with AWS, extended this capability to a much larger set of findings, giving security operators a quick understanding of their environment’s exposure and the kinds of attacks they may be exposed to.

The project’s key highlights:

✔ We built a solution based exclusively on native AWS services, including AWS Security Hub, Amazon GuardDuty and AWS Config.

✔ We formalized a best-practice configuration rule set to strengthen AWS environment protection, based on the MITRE ATT&CK framework for cyberattacks.

✔ We reviewed and mapped 60 techniques (TTPs) from the MITRE ATT&CK framework against up to 277 AWS service events.

✔ We also mapped best-practice security controls, including Center for Internet Security (CIS CSC v8), NIST 800-53 rev5, PCI-DSS v3.2.1, the BSI Cloud Computing Compliance Criteria Catalog (C5 2022), and Spain’s National Security Framework (ENS, Royal Decree 311/2022).

This solution is published by AWS under an open-source license aimed at small businesses and partners, showing how to surface valuable alerts from AWS native services and giving a broad view of the attack vectors an environment might be exposed to.

github.com/aws-samples/mitre-attack-with-aws-security-hub-example