Amazon GuardDuty vs. Amazon Virtual Private Cloud (VPC)

In a multi-account/multi-tenant environment, GuardDuty often alerts us to possible malicious traffic before it becomes an issue. The ability to automatically enable GuardDuty creates baseline security which is crucial when an account is first created. It also helps greatly in environments where other users are able to create resources as often GuardDuty alerts us to insecure resources we did not know about. It can however sometimes be a little overzealous with its assessments alerting on benign activity which then requires suppression rules.

Incentivized

If you are going to deploy within AWS, you need to know how to leverage VPCs. VPCs have several items you must configure for them to be usable and to even link one VPC to another. If you are only going to deploy a few resources or use some of the default configurations, you still need to have working knowledge of how a VPC functions. If you are used to working with VLANs and the ideology behind those, that is the best direct reference to how a VPC can be described, but with additional layers on top of that with route tables, internet gateways, etc.

Incentivized

• Monitors outgoing connections from AWS resources to known malicious hosts.
• Monitors incoming connection to AWS resources from known malicious hosts.
• Integrates with other centralized logging solutions.

Incentivized

• Pricing model & On demand service commitment.
• Well, architectural infrastructure development processing before spending the money.
• AWS VPC are providing hassle-free using with all others services from AWS very easily.
• AWS business support is very helpful & [gives] the right direction according to client’s situations.

Incentivized

• Does not have the ability to add any custom monitors.

Incentivized

• The biggest issue with VPC networks is knowing how you can leverage VPC endpoints to ensure your resources within the VPC are not reaching out over the Internet to get to AWS services such as S3 and others.

Incentivized

Incentivized

• GuardDuty has helped us prevent possible security incidents multiple times which could have caused substantial damage.

Incentivized

• AWS VPCs are actively used for following various compliance and regulatory needs such as network separation for PCI DSS. The ability to keep resources and access to those resources controlled through the initial steps of creating VPCs has helped tremendously.

Incentivized