How to Identify, Prioritize and Remediate Vulnerabilities in the Cloud

In part one of our four-part series on security in the cloud, we discussed the AWS shared responsibility model and what you need to know to minimize vulnerabilities. In part two of this series, we’ll discuss how to detect, prioritize, and remediate vulnerabilities that you find in your cloud environment.

Filling the gaps of the shared responsibility model

If you use a cloud provider like AWS, you know there are some security features you can access for free, such as AWS Security Hub, AWS Identity & Access Management, and AWS Firewall Manager. Unfortunately, as we covered in part one of this series, that’s not enough coverage for what many organizations need in today’s cloud environments, especially considering the fact that cloud providers can only protect the core infrastructure. That means you are responsible for what you put on that infrastructure, such as EC2 instances and virtual machines.

Too often we hear of companies that leave EC2 instances open for months with critical vulnerabilities that put their entire company risk, thinking that AWS would find them. But that’s not their job—it’s actually yours. This is where vulnerability risk management comes in. To be clear, vulnerability risk management is not a security feature offered by cloud providers. It lies solely on users (you). Unfortunately, many companies don’t recognize this and don’t implement a vulnerability management program, only to find out after an attack.

Vulnerability management solutions like InsightVM ensure you are fully protected by scanning every edge of your cloud environment so you have full visibility and can identify issues in near-real-time. It can find things like open EC2 instances that are exposing your company so they can be fixed, rather than the source of a potential breach. Scanning for vulnerabilities and being able to detect them ensures you’re upholding your end of the shared responsibility model and keeps your data and your customers’ data safe.

Handling vulnerabilities in a busy cloud environment

Vulnerability risk management has five core parts:

1. Identification
2. Assessment
3. Prioritization
4. Remediation
5. Measurement of progress

There are a few ways you can leverage InsightVM in your AWS environment to ensure each part of the vulnerability risk management process is covered. To start, let’s look at InsightVM’s dynamic asset discovery. You can automatically detect EC2 instances as soon as they are spun up or taken down. You can also add vulnerability context by importing assets and tags from InsightVM to your AWS environment, and detect any changes to the environment with lightweight agents and pre-authorized scan engines.

Any vulnerabilities detected in your Amazon EC2 instances are automatically sent to AWS Security Hub. Additional context about these vulnerabilities is provided by InsightVM, which allows you to better prioritize and reduce risk in your AWS environment.

With InsightVM’s Cloud Configuration Assessment for AWS, you can assess your AWS environment for misconfigurations, such as Amazon S3 buckets exposing data to the internet, and compare your setup to industry best practices like the CIS Critical Controls.

You can also identify and assess your Docker hosts, images, and containers in your AWS environment with InsightVM. Furthermore, you can connect with registries to automatically analyze and assess container images for vulnerabilities, and integrate security into your CI/CD build pipeline to ensure vulnerable containers stay out of production environments.

It’s not just enough to be able to identify and assess vulnerabilities in your AWS environment, as you’ll be left with a hopelessly long list of things to tend to. InsightVM can take the list of found vulnerabilities and then prioritize them based on our Real Risk Score to help you quickly see which vulnerabilities are urgent and need to be taken care of ASAP and which ones can wait. This helps to ensure your team is always focused on the highest-priority items and isn’t spending time on tasks that won’t make you any more secure.

Once vulnerabilities are prioritized, you’re ready to move on to the next part of the process: remediation. As mentioned, InsightVM integrates directly with Security Hub to automatically share vulnerability findings of AWS assets. This centralized view gives IT and development teams instant visibility into your AWS environment’s risk. To take action on this risk, Security Hub also integrates with InsightConnect, our security orchestration and automation solution, making it possible to kick off automated workflows for remediation.

Measuring progress made toward reducing risk in your environment is the final critical component of a successful vulnerability risk management program. With InsightVM, you can take advantage of Goals and Service-Level Agreements (SLAs), which ensures that you’re tracking progress at an appropriate pace, maintaining compliance, and holding teams accountable for the work that needs to be done to reduce risk. You can also measure progress through InsightVM’s customizable Live Dashboards and reporting capabilities.

An integrated approach to cloud security

The advent of point solutions has come and gone, and companies are now looking for solutions that can cover the gamut. It’s one of the reasons cloud providers like AWS have quickly become popular, because they offer so much and do have a robust security offering on the hardware and firmware side of things. When you can combine the power of AWS with that of InsightVM, which integrates with the rest of your tech stack, your systems can work better together. It ensures you’re upholding your end of the shared responsibility model, that no vulnerability is left unfound, and that your customers feel safe trusting you with their data, which can be a big driver to your bottom line.

Taking your cloud security to the next level

Now that you’re familiar with the shared responsibility model and how vulnerability risk management helps uphold your end, stay tuned for our next two posts in this series, which will cover how to detect, prioritize, and remediate vulnerabilities in the cloud, and how to secure containers and serverless environments.

What other questions do you have about vulnerability risk management? Comment below or tag us on Twitter.