Summary of AWS Security Hub updates announced at re:Invent 2023
Tags: aws, securityhub, reinvent, awsreinvent2023
Published: 2024-01-27 12:19:54

At AWS re:Invent 2023, there were many updates regarding AWS security services.
In this article, I will introduce updates to AWS Security Hub.

### AWS Security Hub Control Customization

You can now customize the managed controls in the Security Hub.  
For example, the default renewal interval for certificates issued by ACM is 30 days, but you can change to 45 or 60 days according to your organization's policies.  

[You can now customize security controls in AWS Security Hub](https://aws.amazon.com/about-aws/whats-new/2023/11/customize-security-controls-aws-security-hub/)

This can be set from "Customize Control Parameters" under "Custom Policies."

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/k2y5afcfpg3eb9wszhcb.png)

Security Hub controls are not always the best for an organization, so it is a nice update to be able to customize them for our　organization.

### AWS Security Hub Dashboard Enhancements

The summary dashboard widget can now be customized.  
The dashboard can now be filtered by AWS account and resource tags, allowing you to customize the dashboard in a way that is easy for you to use.

[Announcing major dashboard enhancements in AWS Security Hub](https://aws.amazon.com/about-aws/whats-new/2023/11/dashboard-enhancements-aws-security-hub/)

You can view threat and vulnerability rankings.  
You can also drag and drop graphs from the widget on the right.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/laezby42p4xqihw24nw3.png)

For operators, the ability to customize an unified dashboard to suit their purposes is a much appreciated feature.  
This update makes the Security Hub much easier to use.

### New centralized configuration feature in AWS Security Hub

Centralized configuration is now available from a delegated administrator account.  
This allows for flexibility with specific standards and controls across accounts and regions.  
For example, specific controls can be disabled on an organizational basis, or customization of control parameters can be applied only to specific accounts.

[Announcing new central configuration capabilities in AWS Security Hub](https://aws.amazon.com/about-aws/whats-new/2023/11/aws-security-hub-central-configuration/)

To see the settings.  
From the Security Hub, go to "Settings" and press "Start Central Configuration."

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/dphqewnrs7jpii0sjokf.png)

From "Region," select any region to which you want to apply the policy.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/1i62l896daz5e85cleh4.png)

From "Configuration Type," select "Customize Security Hub Settings."

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/fo4l0goj5iuu7rlhjg8s.png)

On the "Custom Policies", select "Disable Specific Controls" and select the controls you wish to disable.  
Again, you can use the update "AWS Security Hub Control Customization" feature.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/vbupbsn2391t6d4pqjtm.png)

You can then specify to which organization or account the configured policy should be applied.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/ul7sz5sqim9t8y285qv6.png)

Finally, enter the name, description, and tags of the policy you have set up so far and you are done.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/nycw263j2o229cdooa2m.png)

Previously, controls were enabled or disabled for individual member accounts, but with this update, they can be centrally managed, which will make operations easier.

### Announcing the addition of new Findings in the AWS Security Hub

New metadata has been added to Findings to help prioritize responses and understand context.  
Specifically, the AWS account name, resource tag, and application tag are assigned.

[Announcing new finding enrichment in AWS Security Hub](https://aws.amazon.com/about-aws/whats-new/2023/11/new-finding-enrichment-aws-security-hub/)

From "Detection Results" in the Security Hub, "Details" shows the AWS account name and resource tag.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/wi2s9h51vm4ly0qkv1zl.png)

The same is shown in the JSON log.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/7vgv2rmcwwgiixtapo96.png)

If users wanted to add information to the detection results, they had to develop it, but with this update, it is no longer necessary to build it in.  
For example, it used to be a time-consuming task to identify account names from account IDs in the logs, but now that the information is in the logs, it is easier to investigate.  
This is a very welcome update for operators.

### Summary

The Security Hub is essential to maintaining the security of an AWS environment, so I look forward to future updates.