Evaluate using AWS Guardduty/Config for baseline monitoring for all accounts

[JJediny]

Background

These services provide automated monitoring of security settings/incidents/best practices

Implementation

• [x] Write up what AWS Guardduty could offer TTS
• [x] Write up what AWS Config could offer TTS

Acceptance

• [x] Decide to use and document rationale for AWS Guardduty usage across TTS accounts. (*Recommend System Owners to Do - Delegated)
• [x] Decide to use and document rationale for AWS Config usage across TTS accounts. (*Need to)
• [x] Create issues for follow-up implementation.

[JJediny]

In accordance with GSA Security Engineering Requirements for AWS - PL-8: Information Security Architecture:

Required

• Enable CloudTrail in ALL regions
• Enable VPC Flow Logs per subnet
• CloudWatch (enabled for CloudTrail and VPC Flow Logs)
• Shield
• Inspector
• Config
• Trusted Advisor

Optional

• SecurityHub
• GuardDuty
• Macie
• CloudFront w/ WAF
• Shield (Advanced)
• CloudWatch (used for metrics, log data, budget alarms)

Background on these services:

GuardDuty ($$) - is a threat detection service that continuously monitors for malicious activity and unauthorized behavior to protect your AWS accounts and workloads. With the cloud, the collection and aggregation of account and network activities is simplified.

Config ($) - is a service that enables you to assess, audit, and evaluate the configurations of your AWS resources. Config continuously monitors and records your AWS resource configurations and allows you to automate the evaluation of recorded configurations against desired configurations.

Next Steps (TBD):

• [ ] Based on this we need to create an issue to enable AWS config to enforce GSA IAM password requirements and user 90 day login check-ins (this issue would be seperate from our SSO w/ GSA AD implementation plans).
• [ ] Recommend GuardDuty for production and staging environments for TTS System owners (Based on pricing this is worth the investment if tuned well).
• [x] Create a new issue to use Cloud Custodian's guardian as an offer to TTS System to potentially co-develop events to alerts for and automate its deployment - based ongoing lessons learned from the login.gov team (which is actively using it).

[afeld]

That all sounds good! In addition, let's split out issues to:

• [ ] Update documentation / link to the GSA Security Engineering Requirements in one or both of:
  • Before You Ship
  • The ATO Checklist
• [ ] Implement those Required things that can be rolled out identically as part of our baseline AWS account configuration
  • Maybe a separate issue for each?

[JJediny]

Closing in favor of https://github.com/18F/tts-tech-portfolio/issues/1044