Prowler: What it does, how we use it, and why you need it.
What is it?
Prowler is an open source Amazon Web Services (AWS) “Security Best Practices Assessment, Auditing, Hardening, and Forensics Readiness tool” developed by Toni de la Fuente. Prowler scans your AWS account to check for potential vulnerabilities, overly permissive Identity and Access Management (IAM) permissions, and best practice violations. Prowler runs 49 checks against the Center for Internet Security (CIS) AWS Foundations Benchmark and over 40 more checks related to GDPR and HIPAA compliance.
How InfusionPoints uses Prowler
Here at InfusionPoints, we use Prowler to constantly check our AWS accounts against the CIS benchmarks for the AWS Cloud. These best practices help ensure that InfusionPoints is operating in accordance with guidance developed by industry consultants, software developers, audit and compliance organizations, security research organizations, operations specialists, government agencies, and legal experts.
Why you should use Prowler
Prowler can help your organization implement practices that will ensure you have a secure environment and have proper protections in place. To learn how to use Prowler to test against your environment, you can check out Toni de la Fuente’s repository on GitHub. For example, in the recent Capital One data leak, the hacker was able to gain access to a role that had permissions that were too broad. Using Prowler, you can verify your permissions, ensure your CloudTrail captures and logs all account activity, and set up alarms for various suspicious behavior. This is a very useful tool to help you protect your company from being the latest company to lose valuable customer data.
InfusionPoints and Amazon Web Services
As an AWS Advanced Consulting Partner and Public Sector Partner, InfusionPoints makes use of the highly innovative features of the AWS platform to deliver a highly available and secure customer experience. InfusionPoints provides AWS expertise from highly-trained and certified AWS experts to deploy your cloud solution so you can stay focused on your core mission -- by infusing security in, at every point in the lifecycle of your cloud environment from concept to operations.
