Human Managed app hm.works 1.14 released with dashboard on detected cloud config violations
Since its first release on 13 March 2023, the Human Managed web app hm.works has been getting fresh updates every single week to report on intel generated from any data source from our customers.
📝Note: Read more about our approach to creating intel on your digital business' assets, postures & behavior, and establishing 🔗relationships🔗 between them to improve your decisions and actions for many use cases.
This week, we are excited to announce the release of a dashboard that reports on the detections of violations on public cloud resources (e.g. AWS, Azure, GCP).
Introducing...
cloud posture violations ☁️❗
A collection of charts, recommendations, and data grid that present your org's cloud security posture *near real-time*, so that you can mitigate misconfigurations, address your compliance risks in the resources you have deployed in the public cloud, and track your progress.
The cloud posture violation dashboard answers the top 3 things you need to know about the enterprise cloud security:
- What important checks have our public cloud resources failed on?
- What mitigations should I configure and tune to protect my assets in line with my cyber posture and compliance goals?
- Where are the biggest gaps between my preferred posture state and current posture state?
* * *
Why you should care about cloud security
If any of your business apps and data are in the public cloud, you should care about your company's cloud posture. It's your responsibility to protect your digital assets, whether they're up in the clouds or in your datacentre.
Major cloud providers have made their respective versions of the responsibility model publicly available (e.g. AWS, Azure, and GCP), but AWS simplified this by saying that:
The customer is responsible for security in the cloud
The provider is responsible for security of the cloud
What this means is that regardless of the service consumed (i.e. either SaaS, PaaS, or Iaas) from the cloud provider, these two facts remain:
(1) the customer is always responsible for its data
(2) the cloud provider is responsible for the availability of workloads
* * *
So, your digital assets on your public cloud = your responsibility to configure their security controls against your target posture state (taking into account your specific business needs, industry standards, benchmarks).
Let's explore each segment of the posture violation dashboard.
I.De.A for cloud posture
- What:
- summarized intel gives you a high level summary of all open violations detected in your cloud resources, customizable to key indicators (in this case, check severity)
- recommended decision gives you a direction to prioritize to improve your cloud posture, based on hm.works's analysis.
- recommended action gives you the steps to execute the recommended decision
- Why: Helps you to understand your company's current state of cloud posture, and take prioritized decisions and actions to improve the posture -- based on data.
- How: Forward or connect data (cloud resources under AWS accounts, Azure subscriptions, and GCP projects) to build, configure, and monitor violation use cases on the hm.works platform.
cloud posture violation data grid
- What: An interactive grid breaks down your organization's posture violations based on:
- check name
- check severity (critical, high, medium, low)
- cloud provider (e.g. AWS, Azure, GCP)
- asset name
- asset variety (e.g. EC2, IAM, CloudTrail, Storage)
- asset criticality (critical, high, medium, low)
- cloud account ID
- cloud region
- environment (e.g. prod, dev)
- action taken to mitigate (yes / no)
- detection date
- Why: Understand and explore your current state of cloud posture and violations in detail, identify blockers, and plan for improvements to achieve desired posture goals.
- How: Forward or connect data (cloud resources under AWS accounts, Azure subscriptions, and GCP projects) to build, configure, and monitor violation use cases on the hm.works platform.
exploration: by check severity
To quickly drill down to assets with Critical / High severity posture violation, apply the following
- group by: check severity > check name
exploration: by cloud resource variety
To quickly see what violations exist per asset variety on the public cloud, apply the following
- group by: variety > check severity
* * *
And that is hm.works 1.13! We will be releasing more features and updates regularly, so stay tuned.
To get the latest news from Human Managed, follow us on LinkedIn and check out our blog.
* * *
Want to discuss how we can help solve your cyber, digital, or risk operations through data?
Want a test run of the hm.works app?
Have any questions or feedback?
Please contact us at hello@humanmanaged.com.