Skip to content

Commit

Permalink
docs: minor formatting changes (#10)
Browse files Browse the repository at this point in the history
* fix formatting

* formatting fix

* format fix again
  • Loading branch information
xanderhades authored Sep 13, 2023
1 parent 9210b25 commit ba825be
Show file tree
Hide file tree
Showing 2 changed files with 15 additions and 15 deletions.
18 changes: 9 additions & 9 deletions docs/Compromised_IAM_Credentials.md
Original file line number Diff line number Diff line change
Expand Up @@ -161,10 +161,10 @@ Understand, document, and socialize services such as the following that your use
Best practices recommend removing all access keys associated with the root account: `./prowler -c check_112`

### New or unrecognized IAM users
Review the IAM credential report from your [Asset Inventory](./Compromised_IAM_Credentials.md/#asset-inventory)
Check if IAM users have two active access keys: `./prowler -c check_extra712`
Ensure IAM policies that allow full \"*:*\" administrative privileges are not created: `./prowler -c check_122`
Check if IAM Access Analyzer is enabled and its findings: `./prowler -c check_extra769`
Review the IAM credential report from your [Asset Inventory](./Compromised_IAM_Credentials.md/#asset-inventory)
Check if IAM users have two active access keys: `./prowler -c check_extra712`
Ensure IAM policies that allow full \"*:*\" administrative privileges are not created: `./prowler -c check_122`
Check if IAM Access Analyzer is enabled and its findings: `./prowler -c check_extra769`

### Unrecognized or unauthorized resources (e.g., EC2, Lambda)
```bash
Expand All @@ -173,10 +173,10 @@ aws lambda list-functions
```

### Looking for Secrets
Potential secret found in EC2 instance User Data: `./prowler -c check_extra741`
Potential secret found in Lambda function variables: `./prowler -c check_extra759`
Potential secret found in ECS task definition variables: `./prowler -c check_extra768`
Potential secret found in Autoscaling Configuration: `./prowler -c check_extra775`
Potential secret found in EC2 instance User Data: `./prowler -c check_extra741`
Potential secret found in Lambda function variables: `./prowler -c check_extra759`
Potential secret found in ECS task definition variables: `./prowler -c check_extra768`
Potential secret found in Autoscaling Configuration: `./prowler -c check_extra775`

### Unusual billing increases
To view your AWS bill, open the [Bills](https://console.aws.amazon.com/billing/home#) pane of the Billing and Cost Management console, and then choose the month you want to view from the dropdown menu.
Expand Down Expand Up @@ -266,7 +266,7 @@ For further information and steps, including querying with Athena, please refer

## Eradication
### Review the findings from [Review CloudTrail event history for activity by the compromised access key](./#cloudtrail)
Remove any resources created by the compromised key(s). Check all AWS regions, even regions where you never launched AWS resources.
Remove any resources created by the compromised key(s). Check all AWS regions, even regions where you never launched AWS resources.
* **Important**: If you need to keep any resources for investigation, consider backing them up. For example, if you have a regulatory, compliance, or legal need to retain an EC2 instance, take an EBS snapshot before terminating the instance.

### Review the [Avoiding unexpected charges](https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/checklistforunwantedcharges.html)
Expand Down
12 changes: 6 additions & 6 deletions docs/rationalization_of_security_incident_handling.md
Original file line number Diff line number Diff line change
Expand Up @@ -47,15 +47,15 @@ Alerts are determined by the threat modeling of a workload during the developmen

### Workload relevance:

**High**: major monetary loss and image perception damage, long term business impact, low recovery success
**Medium**: sustainable monetary loss and image perception damage, short term business impact, high recovery success
**Low**: no measurable monetary loss and image perception damage, no business impact, recovery is not applicable
**High**: major monetary loss and image perception damage, long term business impact, low recovery success
**Medium**: sustainable monetary loss and image perception damage, short term business impact, high recovery success
**Low**: no measurable monetary loss and image perception damage, no business impact, recovery is not applicable

### Data classification:

**Secret**: major monetary loss and image perception damage, long term business impact, low recovery success
**Confidential**: sustainable monetary loss and image perception damage, short term business impact, high recovery success
**Unclassified**: no measurable monetary loss and image perception damage, no business impact, recovery is not applicable
**Secret**: major monetary loss and image perception damage, long term business impact, low recovery success
**Confidential**: sustainable monetary loss and image perception damage, short term business impact, high recovery success
**Unclassified**: no measurable monetary loss and image perception damage, no business impact, recovery is not applicable


## The goal of alert prioritization is to send them to the appropriate queue:
Expand Down

0 comments on commit ba825be

Please sign in to comment.