AWS Security Hub Reviews

I use Security Hub primarily for security purposes. It is meant to secure the infrastructure, check compliance, and ensure there are no security gaps. By enabling Security Hub, the system provides a security score and areas for improvement.

Security Hub provides insightful information about what is running and where there might be weaknesses. It offers best practice recommendations and supports various compliance standards such as ISO and PCI DSS. Enabling these compliance checks helps identify non-compliant services and suggests steps to achieve compliance. The main advantage is providing information and compliance insights rather than prevention.

Security Hub is used to analyze the configuration of our infrastructure. After analyzing, it provides security findings based on best practices and other industry standards. It is used to combine with GuardDuty to notify us of any security issues flagged in our infrastructure configuration. It is convenient for use in a multi-account security management setup by managing security findings and aggregating them from a single management account.

Measurable benefits include a streamlined process without needing to manage multiple solutions. AWS Security Hub provides seamless integration, eliminating the need to configure additional infrastructure. It is proactive in monitoring and provides early notifications for security issues, allowing us to automate responses based on identified findings.

We utilize most of the services from AWS, including our compute storage, as well as mapping and the messaging queue. We use somewhere around 70 to 80 services that AWS offers.

The advantage is that it is cloud-native, and we do not need to install agents or sensors to find findings. We made improvements to the Security Hub scoring, which has helped enhance the security posture of our accounts. 

An additional advantage is that the native AWS scoring is trusted by most auditors to determine the organization's security posture.

We use AWS Security Hub to monitor resources and check compliance scores regarding configuring our solutions on the platform. Security Hub helps us establish a compliance baseline to evaluate if our resources meet AWS standards. It can also integrate with other AWS services, such as AWS Config and AWS Detective, to set up rules and scan our infrastructure to determine if we comply.

AWS Security Hub can check your infrastructure against multiple compliance frameworks. You can turn on or off specific frameworks based on your needs. For example, if you're working in a PCI environment, you can activate the PCI framework, and Security Hub will evaluate your configuration and provide a score based on that framework. You can assess compliance with various standards, such as PCI, AWS CIS, and other frameworks. 

The solution provides first-hand integration into tools like Amazon Inspector and Amazon Detective. The tool can also integrate with Cisco, Splunk and Microsoft AD and allows an organization to have a stronger posture and clarity against account creation, VPCs, and instance development. An organization can also automatically synchronize all logs within the security data lake using AWS Security Hub. Our company works across multiple continents like Asia and Africa with the product. 

People have a perception that synchronizing logs is quite expensive, but it's not if you understand AWS Security Hub and you don't have multiple streams of your cloud trail and guard duty and similar things. You don't need to pay for the transfer of data in your logs, which gives you absolute analytics and this is one of the most vital features of the solution. The AWS Security Hub also allows to have just one dashboard to manage security.  

We use AWS Security Hub for cloud security posture management and automated remediation.

The most valuable features of the solution are the scanning of all the cloud environments and most of the compliances available in the cloud. We can integrate the findings of different services into AWS Security Hub and analyze our cloud infrastructure based on that. We inform the owners if we find anything that is non-compliant or does not adhere to the security best practices.

We use it to get a comprehensive view of all the processes within the company. It provides us with centralized security insight, available on a dashboard for all of the users while running continuous and automated compliance checks.

It's a security posture management tool from AWS. Basically, it identifies misconfigurations, similar to Trusted Advisor but on a larger scale.

There are a lot of good rules, but the problem is it's very cluttered. Honestly, I wouldn't recommend it. It is too expensive for what it offers, too cluttered, and not user-friendly. It is not worth the money. There are much better options out there for the price.