From 7e50d8083b1e763bd9ba1a36ee6477f92bcb6355 Mon Sep 17 00:00:00 2001 From: Alvaro Del Valle Date: Wed, 19 Aug 2026 15:04:26 -0400 Subject: [PATCH] Update proposal levers with Prowler benchmark findings Expand the levers table from 5 to 8 workstreams, grounding each driver in verified counts from the Prowler run: - Add backup & resilience (0 of 9 EBS volumes have snapshots or a backup plan) - Add secrets & key management (19 secrets without rotation or resource policy, 2 KMS keys without auto-rotation, unencrypted log groups) - Add compliance acceleration (363 failures; SOC 2 at 81% against existing Secureframe program) - Note Config alongside GuardDuty and Security Hub in the delegated-admin gap - Add the two criticals and hardware-MFA gaps to identity hardening - Add internet-facing instances with instance profiles and IMDSv2 to exposure - Order by priority and add a framing note --- findings/discovery_dashboard.html | 16 ++++++++++------ 1 file changed, 10 insertions(+), 6 deletions(-) diff --git a/findings/discovery_dashboard.html b/findings/discovery_dashboard.html index e3828b5..b08590b 100644 --- a/findings/discovery_dashboard.html +++ b/findings/discovery_dashboard.html @@ -278,19 +278,23 @@
-
→

Proposal levers

where we create value
+
→

Proposal levers

where we create value · ordered by priority
- - - - - + + + + + + + +
WorkstreamDriver from discoveryOutcome
Landing zone & account separationWorkloads in mgmt acct; flat org; empty LazkaMove workloads to a dedicated account; OUs + SCP guardrails
Delegated security accountNo delegated admin; unaddressed GD findings; Lazka darkCentral GuardDuty/Security Hub admin; org-wide monitoring
Cost optimizationEC2 = 67% of spend; 4× growth; unattached EBSRightsizing + Savings Plans + cleanup → recurring savings
Identity hardeningStale admin keys; 2 users w/o MFARotate/retire keys, enforce MFA, move to short-lived roles/SSO
Exposure reduction13 internet-open SGsLeast-privilege ingress; WAF already in place to leverage
Landing zone & account separationWorkloads in mgmt acct; flat org, no OUs; empty Lazka; SCP region-deny absentDedicated workload account; OUs + SCP guardrails (region deny, root protection)
Delegated security accountZero delegated admins — GuardDuty, Security Hub and Config all flagged high; 4 open GD high/critical findings; Lazka darkCentral security account admins all three org-wide; findings get a named owner and triage SLA
Backup & resilience0 of 9 EBS volumes have snapshots or a backup plan (18 high/medium failures)AWS Backup plans, tested restores, RPO/RTO defined — today a volume loss is unrecoverable
Identity hardeningAdmin keys 322 & 319 days; 5 keys >90d; 6 users on static creds; 9 users + root without hardware MFA; AdministratorAccess attached (*:*)IAM Identity Center + short-lived roles; retire static keys, scope admin, hardware MFA on root
Exposure reduction13 internet-open SGs; 3 permissive NACLs; 7 public-IP instances; 6 internet-facing instances carrying instance profiles; IMDSv2 not enforced account-wideLeast-privilege ingress, IMDSv2 enforced, ALB/WAF fronting — closes the credential-theft path
Secrets & key management19 secrets with no rotation and no restrictive resource policy; 2 KMS keys without auto-rotation; 19 log groups unencrypted; secrets detected in 7 log groupsRotation on every secret, KMS/CMK coverage for logs and SNS, resource policies scoped to consumers
Cost optimization$858/mo, +284% Jan→Jul; EC2 = 67% of spend; 2 unattached EBS + 7 EIPs; orphaned EKS roles from a torn-down clusterRightsizing + Savings Plans + Graviton/spot + cleanup → recurring savings and a growth-safe baseline
Compliance accelerationProwler: 363 failures (2 critical, 111 high); SOC 2 81%, ISO 27001 77%, CIS 3.0 74%; Secureframe + Intruder already engagedClose the SOC 2 gap on evidence they already collect; Security Hub as the standing control monitor
+

The first three are the fastest to land and the hardest to defend leaving open — no delegated security owner, no backups, and workloads in the management account are each a single-event risk. Cost optimization is the lever that funds the rest.