AWS locks down cloud security, hits 100% MFA enforcement for root users – Source: go.theregister.com

Amazon Web Services hit a major multi-factor authentication milestone, achieving 100 percent MFA enforcement for root users across all types of AWS accounts.

AWS Chief Information Security Officer Amy Herzog announced the expanded MFA enforcement during her keynote address at the tech behemoth’s annual re:Inforce cloud security conference today.

It’s a big deal, and AWS deserves to take a victory lap for this one. 

For anyone who still has doubts about MFA: just ask Snowflake CISO Brad Jones, who last year saw more than 160 of his customers’ accounts compromised using stolen credentials. None of these had MFA enabled, and this safeguard likely would have prevented the intruders from accessing the customers’ databases.

At last year’s re:Inforce conference, AWS announced it would soon start requiring MFA for standalone account root users – those outside of AWS organizations – when signing in to the AWS Management Console, with other root user types also facing this security requirement later in the year.

Today, Herzog said AWS checked this milestone off the list.

“We were the first cloud provider to mandate the use of MFA for management and standalone accounts with root access,” Herzog said on stage. “To further support the CISA Secure by Design pledge this March, we expanded our policy to enforce MFA for member account root users, those non-management accounts within an organization. And with this step, I’m so happy to say that we now have 100 percent MFA enforcement for root users.”

We are also happy to see that a major tech company like AWS isn’t abandoning its (voluntary) commitments to the CISA-led program, despite the agency’s brain drain — including at least two key architects of Secure by Design — and pending budget cuts.

Plus … all the new security things

With so many mega business lines, from retail to cloud computing to advertising to devices, Amazon can’t do anything small-scale. So, in typical fashion, it rolled out dozens of new security capabilities during its annual security conference.

Here’s an overview of some of the most important ones:

A new feature in AWS Identity and Access Management Access Analyzer verifies who, within your organization, has access to critical resources and provides visibility to security teams about this internal access via a unified dashboard.

AWS Security Hub received a data boost (in preview) from more security signals that should help customers prioritize issues, identify which ones are most critical to their organization, and then respond faster to reduce risks. 

“For example, Security Hub can combine the multi-stage threats detected by GuardDuty Extended Threat Detection with other signals like vulnerabilities, and prioritize critical security issues and help you simplify your overall cloud security operations across your entire organization,” Herzog said, and then demoed an example.

“In this case, Security Hub found a publicly exposed EC2 instance with a highly exploitable vulnerability and excessive permissions,” she described. Herzog then clicked “exposure” on the dash, which expanded the details and showed all resources from multiple accounts and regions in the example orgs that also had this type of exposure.

• AWS is pushing ahead with MFA for privileged accounts. What that means for you …
• How Amazon red-teamed Alexa+ to keep your kids from ordering 50 pizzas
• Abandoned AWS S3 buckets can be reused in supply-chain attacks that would make SolarWinds look ‘insignificant’
• AWS Cloud Development Kit flaw exposed accounts to full takeover

Speaking of GuardDuty Extended Threat Detection — that’s the AWS threat detection service that uses AI, the cloud giant’s own signals, and third-party threat intel to monitor AWS accounts and workloads — it now supports container-based applications running on Amazon Elastic Kubernetes Service (EKS).

And finally, there’s a new feature in Shield, which AWS customers already use to defend applications against distributed denial of service (DDoS) attacks. The new capability, called network security director, is available in preview and provides full network security posture management. It identifies and prioritizes any network configuration issues and suggests improvements to defend against threats including DDoS attacks and SQL injections.

“So instead of wading through alerts to determine which issues to tackle first, we aggregate the findings by severity with instructions for enabling the recommended services or rule sets,” Herzog said. ®