Next,
we'll take a look at the built‑in capabilities provided by the cloud service
provider that we could use for vulnerability management.
What we're going to do is use the AWS Inspector as a
vulnerability assessment tool, which is embedded in the Management Console.
We'll log in to the AWS Console, connect to an existing instance.
This instance has deliberately not been updated so that you could see
the process flow of what vulnerability management might look like from
a cloud service provider's perspective.
We're going to create a target assessment on that virtual
network and then review the vulnerabilities and run an
update in order to address them.
So here we are back in the console, and what we'll do is type in there Inspector.
And when we go to Inspector,
if we go over to the hamburger on the left‑hand side
and say Switch to Inspector Classic, that's the one we'll use.
We'll select Get started,
and right away we see that it has a capability of running network
assessments for us and also host assessments with installing the
Inspector agent onto the virtual machine.
Notice also that the benchmarks are from CIS.
So what we're going to do is select Run weekly, select OK.
And you can see that it says SUCCESS,
and you could immediately go check and see the assessment
targets that are associated with it, the templates that have been created,
and the runs that have been completed, along with the findings.
Well, obviously, there's no findings yet because it still has to run,
but if you want to make sure that it's in a running state,
if you select Assessment templates and you select an assessment that's there,
we can just verify that it's running by selecting Run,
and we could see the last run state is preparing to start.
So, we'll give it a moment,
and then we'll come back and check where it is
along the line of its assessments.
Okay, now that we've allowed the assessments to run for a bit,
we'll go back over to Findings, and look at here.
We have some really high findings that are associated with
the insecure instance that we have running,
letting you know the severity of what the issue is,
what the common vulnerability is, what might be missing,
or what might be running that shouldn't run.
You could even examine the MITRE recommendations for
fixing it and update packages.
So what we're going to do is going to go over to the VM and
run an update on it and then rerun the assessment to see
what happens with the findings.
So we're going to go back over to EC2 instances and find our
running instance and connect to it through the SSM client and
then just run an update on that instance.
And that's going to take a while,
so we will come back and check out the results that would happen after we
run the Inspector again once the updates have taken place.
All right, so we are back over inside of our Management Console.
We're going to go back to Inspector, our vulnerability management system.
And when we click the hamburger over on the left
and Switch to Inspector Classic,
we now see that two assessment runs have been completed.
So, not shocked to find that there aren't findings for this run.
And when we go and take a look at the assessment runs and click through,
you actually get proof that there are zero findings.
So now that we have a clean image that has all the
vulnerabilities removed or patched,
we're going to go back over and make a snapshot of
this vulnerability mitigated image.
Now that we've completed running the update to rid
ourselves of the vulnerabilities,
it's time for us to take a snapshot of the image that will help us
to understand the ease of capturing a baseline.
First, what we're going to do is we will log into the Management Console,
go back over to EC2, and we will look at the snapshot services that
can be used for both restores and for forensics purposes that we
will talk about later. We'll select the VM with the image we want
and then simply choose snapshot.
So let's head over there to the console. So here we are in the console. We'll
go back to EC2, and we see our instances running there.
And if we scroll down on the left‑hand side, we'll see a snapshot
manager that's there. And we have no snapshots, so we can ask the
system to create a snapshot. And the choice that we have is to
actually capture the whole instance.
So we want to select our running instance here.
If we capture the instance,
it will not only capture the volumes, which would be representative of disk
on a server, but also the system state and the memory.
In this case, we're going to say yes, include the root volume, and we
can make it so that it is encrypted or unencrypted.
What we're going to do is go ahead and select Create snapshot.
Notice its in Pending state. And if I refresh the window, and we
can see the status change to Completed.
So there's our image of an instance.
Images are stored in object storage. Instances consume volume storage.
When you take a snapshot of an instance,
it takes the volume storage information and puts it into object storage.
That's it.