Title

AWS re:Invent 2023 - Enhance Workload Security with Agentless Scanning and CI/CD Integration (SEC243)

Summary

• Speakers: Rick Anthony from the Amazon Inspector team, Kashish Swadhwa, and Alistair McLaurin.
• Amazon Inspector: An automated vulnerability management service that scans workloads for software vulnerabilities and network exposure.
• History: Amazon Inspector launched two years ago, with a classic version existing previously. Initially supported EC2 and ECR, later expanded to Lambda functions and integration with CodeGuru for code security violations.
• New Features: Integration of Inspector into CI/CD pipelines for container image scanning, generation of SBOMs (Software Bill of Materials), and agentless scanning for EC2 instances.
• Why Use Inspector: Simplifies vulnerability management, supports compliance requirements, and prioritizes remediation efforts.
• Operation: Inspector is turned on, discovers resources, scans them, and generates findings which are contextualized for the environment. It integrates with AWS organizations for easy setup across accounts.
• CI/CD Integration: Proactive scanning of container images, support for Jenkins and TeamCity, and modular components for custom solutions.
• Agentless Scanning: Complements SSM-based scanning, providing a hybrid mode that maximizes coverage by falling back to agentless scanning when necessary.
• Lambda Code Scanning: Enhancements include GenAI and automated reasoning-assisted code remediations.
• HSBC Use Case: Alistair McLaurin shared how HSBC uses Inspector for compliance and security across their AWS accounts, highlighting the benefits of Inspector's automated and continuous scanning capabilities.
• Demos: Demonstrated CI/CD integration with Jenkins, agentless scanning, and Lambda code scanning features.

Insights

• Agentless Scanning: The new agentless scanning feature addresses the challenge of achieving 100% coverage in vulnerability assessments, particularly for instances where installing an agent is not feasible.
• CI/CD Security: The ability to scan container images before they are pushed to registries and to fail builds based on vulnerability thresholds is a significant step towards "shifting security left" in the development process.
• Automated Remediation: The introduction of GenAI-assisted code patches for Lambda functions allows developers to quickly remediate identified vulnerabilities, streamlining the security process.
• SBOMs: The generation of SBOMs is a critical feature for tracking and managing software components, aiding in compliance and risk management.
• HSBC's Implementation: HSBC's use case demonstrates the scalability of Amazon Inspector and its ability to integrate with complex, multi-account AWS environments, providing real-time insights and compliance reporting.
• Vulnerability Intelligence: Enhanced vulnerability intelligence provides context such as exploitability, malware kits used, and mapping to the MITRE ATT&CK framework, aiding security teams in prioritization and response.
• Inspector's Evolution: The evolution of Amazon Inspector from its initial launch to the current feature set shows AWS's commitment to continuous improvement in security services, responding to customer feedback and industry trends.