{"id":2542,"date":"2018-09-26T14:46:09","date_gmt":"2018-09-26T14:46:09","guid":{"rendered":"https:\/\/lcloud.pl\/?p=2542"},"modified":"2024-12-12T11:44:38","modified_gmt":"2024-12-12T10:44:38","slug":"protection-with-one-click","status":"publish","type":"post","link":"https:\/\/lcloud.pl\/en\/protection-with-one-click\/","title":{"rendered":"Amazon GuardDuty – protection with one click"},"content":{"rendered":"
Amazon GuardDuty is a service that aims to constantly monitor and manage cloud threats. It provides protection for AWS accounts and workloads.<\/span> It owes its effectiveness to quick risk analysis and simple operation – just a few clicks to fully configure it.<\/span> In addition, it does not require the implementation and maintenance of specialized software or infrastructure, which, as a result, does not burden existing applications.<\/span><\/span>.<\/span> <\/span><\/h5>\n

Amazon GuardDuty found its application, among others in the financial or telecommunications industries. The service is based on access to embedded detection techniques, optimized and developed specifically for the needs of the cloud. In addition, the automated process allows you to design economic architecture while ensuring security without additional costs for the customer. <\/span><\/em>GuardDuty – is an Intrusion Detection tool, that is, it detects unusual behaviors that may potentially indicate that the site is being attacked, hacked or malicious software got on the server.<\/span><\/p>\n

How does GuardDuty work?<\/span><\/h6>\n

\"\"Source: <\/span>Amazon Web Services<\/span><\/a><\/u><\/em><\/p>\n

The above graphic illustrates the scheme of operation of the entire service.<\/em><\/span><\/p>\n

It owes its effectiveness to intelligent detection of threats, based on data from AWS CloudTrail or logs from DNS and from the AWS VPC Flow Logs service<\/em><\/span> (tracking network communication in VPC). In detecting abnormal activities related to the network or account, it uses machine learning, eg GuardDuty sends a notification if the API is invoked by a malicious IP address.<\/span><\/p>\n

With AWS CloudWatch, event data can be redirected to other target actions. The AWS Web Application Firewall (WAF) and VAC NACL are routed and updated with AWS Lambda’s help.<\/em><\/span> AWS WAF is a web application firewall that helps protect Internet applications from typical network exploits that can affect application availability, compromise security, or consume excessive resources.<\/span><\/p>\n

Detected threats in Amazon GuardDuty are categorized on three risk levels: low, medium and high, which are determined by means of numerical values.<\/em> <\/span>The values \u200b\u200boscillate from 0 to 10 on a ten-point scale and allow for the hierarchization of emerging threats. However, the point scale is not fully used – AWS leaves a range between 9.0 and 10.0 for future use.<\/span><\/p>\n

\n
\n
\n

The threat levels are as follows:<\/span><\/p>\n<\/div>\n<\/div>\n<\/div>\n