Benchmark: 3.6.2 Track, document, and report incidents to designated officials and/or authorities both internal and external to the organization
Description
Tracking and documenting system security incidents includes maintaining records about each incident, the status of the incident, and other pertinent information necessary for forensics, evaluating incident details, trends, and handling. Incident information can be obtained from a variety of sources including incident reports, incident response teams, audit monitoring, network monitoring, physical access monitoring, and user/administrator reports. Reporting incidents addresses specific incident reporting requirements within an organization and the formal incident reporting requirements for the organization. Suspected security incidents may also be reported and include the receipt of suspicious email communications that can potentially contain malicious code. The types of security incidents reported, the content and timeliness of the reports, and the designated reporting authorities reflect applicable laws, Executive Orders, directives, regulations, and policies.
Usage
Install the mod:
mkdir dashboardscd dashboardspowerpipe mod initpowerpipe mod install github.com/turbot/steampipe-mod-aws-compliance
Start the Powerpipe server:
steampipe service startpowerpipe server
Open http://localhost:9033 in your browser and select 3.6.2 Track, document, and report incidents to designated officials and/or authorities both internal and external to the organization.
Run this benchmark in your terminal:
powerpipe benchmark run aws_compliance.benchmark.nist_800_171_rev_2_3_6_2
Snapshot and share results via Turbot Pipes:
powerpipe benchmark run aws_compliance.benchmark.nist_800_171_rev_2_3_6_2 --share
Controls
- API Gateway stage logging should be enabled
- At least one trail should be enabled with security best practices
- CloudTrail trails should be integrated with CloudWatch logs
- CloudWatch alarm should have an action configured
- Log group retention period should be at least 365 days
- GuardDuty should be enabled
- GuardDuty findings should be archived
- Lambda functions should be configured with a dead-letter queue
- Database logging should be enabled
- S3 bucket logging should be enabled
- AWS Security Hub should be enabled for an AWS Account
- VPC flow logs should be enabled
- WAF web ACL logging should be enabled
- Logging should be enabled on AWS WAFv2 regional and global web access control list (ACLs)