2 Key Services for Securing Your AWS Resources

Understanding AWS Config & AWS Security Hub in 5-Minutes

What is the difference between AWS Config and AWS Security Hub anyway?

AWS Config and AWS Security Hub are two different services offered by Amazon Web Services (AWS) that help users manage and secure their AWS resources. Here’s a brief overview of each service and the key differences between them:

AWS Config: AWS Config is a service that allows users to assess, audit, and evaluate the configurations of their AWS resources. It provides a detailed inventory of the AWS resources, configuration changes, and compliance status of the resources. AWS Config continuously monitors the resources and records configuration changes, which helps users to identify potential security issues, compliance violations, and operational inefficiencies. AWS Config is more focused on configuration management and compliance tracking. Learn more about AWS Config.

AWS Security Hub: AWS Security Hub is a security service that aggregates, organizes, and prioritizes security alerts and findings from multiple AWS services, including AWS Config, other AWS services, and third-party solutions. AWS Security Hub collects and analyzes data from various security sources and generates a unified view of security findings across an organization’s AWS accounts. It also provides automated compliance checks and generates recommendations for remediation. AWS Security Hub is more focused on security and threat detection and provides a comprehensive view of the security posture of an organization’s AWS environment. Learn more about AWS Security Hub.

In summary, AWS Config helps users to track configuration changes and compliance status of their AWS resources, while AWS Security Hub provides a centralized view of security alerts and findings and helps users to identify and prioritize security issues in their AWS environment. Both services complement each other and can be used together to ensure that an organization’s AWS environment is both compliant and secure.

So, Security Hub is a Security Information and Event Management Solution (SIEM) right?

Not exactly. AWS Security Hub is not a pure SIEM solution, but it provides some of the functionalities that are typically associated with SIEM solutions.

SIEM solutions are designed to collect and analyze security events and alerts generated by various sources, such as network devices, servers, applications, and security tools, to detect and respond to security threats. SIEM solutions also provide centralized visibility and reporting of security events and alerts to enable incident response and compliance reporting.

AWS Security Hub, on the other hand, aggregates and prioritizes security findings from various AWS security services, such as AWS Config, Amazon GuardDuty, and Amazon Inspector, as well as from third-party security tools. It also provides automated compliance checks and generates recommendations for remediation. AWS Security Hub does not provide the same level of deep event analysis or correlation as a traditional SIEM solution, but it provides a consolidated view of security alerts and findings in an AWS environment, which can be used to improve an organization’s overall security posture.

So, while AWS Security Hub does not offer the same level of in-depth event analysis as a traditional SIEM solution, it can be considered as part of an overall security strategy and can complement a SIEM solution by providing additional visibility into security threats and vulnerabilities specific to an AWS environment.

In fact, AWS Security Hub integrates with several third-party partner solutions including log management and SIEM products. An integration may perform one or more of the following actions:

• Send findings that it generates to Security Hub.
• Receive findings from Security Hub.
• Update findings in Security Hub.

Reference the AWS documentation page labeled Available Third-Party Partner Product Integrations for a list of third-party solutions that can send to, receive from, or update findings within Security Hub.