Data protection in AWS Security Hub
The AWS shared responsibility model
applies to data protection in AWS Security Hub. As described in this model, AWS is responsible
for protecting the global infrastructure that runs
...
Data protection in AWS Security Hub
The AWS shared responsibility model
applies to data protection in AWS Security Hub. As described in this model, AWS is responsible
for protecting the global infrastructure that runs all of the AWS Cloud. You are responsible for
maintaining control over your content that is hosted on this infrastructure. This content includes
the security configuration and management tasks for the AWS services that you use. For more
information about data privacy, see the Data Privacy FAQ. For information about data protection
in Europe, see the AWS Shared Responsibility Model and GDPR
blog post on the AWS Security Blog.
For data protection purposes, we recommend that you protect AWS account credentials and set
up individual user accounts with AWS Identity and Access Management (IAM). That way each
user is given only the permissions necessary to fulfill their job duties. We also recommend that
you secure your data in the following ways:
• Use multi-factor authentication (MFA) with each account.
• Use SSL/TLS to communicate with AWS resources. We recommend TLS 1.2 or later.
• Set up API and user activity logging with AWS CloudTrail.
• Use AWS encryption solutions, along with all default security controls within AWS
services.
• Use advanced managed security services such as Amazon Macie, which assists in
discovering and securing personal data that is stored in Amazon S3.
• If you require FIPS 140-2 validated cryptographic modules when accessing AWS through
a command line interface or an API, use a FIPS endpoint. For more information about the
available FIPS endpoints, see Federal Information Processing Standard (FIPS) 140-2
[Show More]