/Threat-Alert

stackArmor's repository of AWS CloudFormation templates

Primary LanguagePLpgSQL

stackArmor Threat Alert

stackArmor ThreatAlert® is an “in-boundary” general support system (GSS) that meets NIST SP 800-53 and NIST SP 800-171 security, continuous monitoring and incident response requirements. This solution is suitable for commercial and public sector organizations using FedRAMP accredited commercial cloud services that must comply with NIST SP 800-53 or NIST SP 800-171 requirements. Based on our user research and requirements collection for ATO projects we have defined a common set of needs that includes 1) Security technologies & tools, 2) Security control descriptions and System Security Plan (SSP) templates based on NIST SP 800-53/FedRAMP and NIST SP 800-171 standards and 3) continuous monitoring services with ISSO/ISSM support. The stackArmor ThreatAlert® solution can help reduce the authorization and assessment phase by 40-50% for most organizations.

Here are some of the tools that StackArmor leverages to meet DevSecOps requirements and how they meet them:

1. Continuous Monitoring - ThreatAlert

  1. Scans your all of your AWS accounts for centralized threat identification.
  2. Monitors the following:
    1. Network security
    2. Personnel activity
    3. Configuration changes
    4. Detects deviations from desired states in security, fault tolerance and performance.
  3. Identity ICAM vulnerabilities
  4. User friendly GUI to easily browse, filter, search across findings.
  5. Categorizes all non-compliant findings into individual POA&Ms with recommendations for remediation.

2. Container Security and Compliance - Anchore

  1. Can run as a container sidecar for seamless integration with your application.
  2. Performs a detailed and thorough scan for any known vulnerabilities in your application and operating system packages
  3. Generates a detailed manifest of your application for easy policy application.
  4. Ensures sensitive data such as passwords and API keys are not present in container images.
  5. Fully analyzes Dockerfile to ensure best practices are followed.
  6. Support for Security Content Automation Protocol (SCAP) and Container configuration policies
  7. Integrates with Container CI/CD.
  8. Compatible with Container Orchestration tools such as Docker Swarm and Kubernetes.

3. Security Incident and Event Management - Splunk

  1. Ingests logging events for all user, network, application and data activities.
  2. Aggregates and filters logs for transformation into standardized format.
  3. Assists with detection of advanced persistent threats and forensics.
  4. Notifies security teams of detected events.
  5. Capable of automatic remediation of high priority events.
  6. Improves visibility of system events to reduce downtime and improve customer experience.

4. Intrusion Detection and Prevention - TrendMicro

  1. Inspect and block inbound, outbound, and lateral network traffic in real-time
  2. Deliver scalable performance up to 100 Gbps inspection throughput with low latency
  3. Drive vulnerability threat prioritization with complete network visibility
  4. Provide immediate and ongoing threat protection with out-of-the-box recommended settings
  5. Defends against the latest threats, including ransomware
  6. Monitors traffic for new vulnerabilities with host-based intrusion prevention filters and zero-day attack monitoring

5. Threat Modeling and Vulnerability Assessment - Tenable Nessus

  1. Identify configuration vulnerabilities across a wide spectrum of operating systems.
  2. Built in support for compliance regulations, such as DISA Security Technical Implementation Guides (STIGs), NIST 800-53.
  3. Provides recommedations for immediate remediation.
  4. Built-in and extensible database assessment capabilities
    1. Find the database common security vulnerabilities such as:
    2. Weak password
    3. Known configuration risks
    4. Missing patches
    5. Structured Query Language (SQL) injection test tool
    6. Data access control test
    7. User access control test
    8. Denial of service test

6. Code Vulnerability Scanning - Sonarqube

  1. Analyze a running application dynamically and can identify runtime vulnerabilities (RASP)and environment related issues.
  2. Integrates with CI/CD tools for seamless code vulnerability assessments.
  3. Interactive, Dynamic, and Static Application Security Test capabilities (IAST DAST & SAST).
  4. Offers recommended remediation for findings.
  5. Identifies static code weaknesses.