adelvalle/scrivas
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Compare commits

base: adelvalle/scrivas:3cce1fa61f6f3d1bfcf73755d9c11b883c78d7dd
Branches Tags
adelvalle/scrivas:main adelvalle/scrivas:update-proposal-levers
..
compare: adelvalle/scrivas:9e3d1f58d5a8f29f7aa8b7ca07c8606143e04741
Branches Tags
adelvalle/scrivas:main adelvalle/scrivas:update-proposal-levers
2 Commits
3cce1fa61f .. 9e3d1f58d5
Author SHA1 Message Date
adelvalle 9e3d1f58d5 Merge pull request 'Update proposal levers with Prowler benchmark findings' (#1) from update-proposal-levers into main 
Reviewed-on: #1
 2026-08-19 15:23:08 -06:00
Alvaro Del Valle 7e50d8083b Update proposal levers with Prowler benchmark findings 
Expand the levers table from 5 to 8 workstreams, grounding each driver in
verified counts from the Prowler run:

- Add backup & resilience (0 of 9 EBS volumes have snapshots or a backup plan)
- Add secrets & key management (19 secrets without rotation or resource policy,
  2 KMS keys without auto-rotation, unencrypted log groups)
- Add compliance acceleration (363 failures; SOC 2 at 81% against existing
  Secureframe program)
- Note Config alongside GuardDuty and Security Hub in the delegated-admin gap
- Add the two criticals and hardware-MFA gaps to identity hardening
- Add internet-facing instances with instance profiles and IMDSv2 to exposure
- Order by priority and add a framing note
 2026-08-19 15:04:26 -04:00
1 changed files with 10 additions and 6 deletions
Expand all files Collapse all files
findings/discovery_dashboard.html
+10 -6
View File
@@ -278,19 +278,23 @@
<!-- ROADMAP -->
<section>
<div class="sec-head"><span class="tag">→</span><h2>Proposal levers</h2><span class="note">where we create value</span></div>
<div class="sec-head"><span class="tag">&rarr;</span><h2>Proposal levers</h2><span class="note">where we create value &middot; ordered by priority</span></div>
<div class="tbl-wrap">
<table>
<thead><tr><th>Workstream</th><th>Driver from discovery</th><th>Outcome</th></tr></thead>
<tbody>
<tr><td><b>Landing zone &amp; account separation</b></td><td>Workloads in mgmt acct; flat org; empty Lazka</td><td>Move workloads to a dedicated account; OUs + SCP guardrails</td></tr>
<tr><td><b>Delegated security account</b></td><td>No delegated admin; unaddressed GD findings; Lazka dark</td><td>Central GuardDuty/Security Hub admin; org-wide monitoring</td></tr>
<tr><td><b>Cost optimization</b></td><td>EC2 = 67% of spend; 4× growth; unattached EBS</td><td>Rightsizing + Savings Plans + cleanup → recurring savings</td></tr>
<tr><td><b>Identity hardening</b></td><td>Stale admin keys; 2 users w/o MFA</td><td>Rotate/retire keys, enforce MFA, move to short-lived roles/SSO</td></tr>
<tr><td><b>Exposure reduction</b></td><td>13 internet-open SGs</td><td>Least-privilege ingress; WAF already in place to leverage</td></tr>
<tr><td><b>Landing zone &amp; account separation</b></td><td>Workloads in mgmt acct; flat org, no OUs; empty Lazka; SCP region-deny absent</td><td>Dedicated workload account; OUs + SCP guardrails (region deny, root protection)</td></tr>
<tr><td><b>Delegated security account</b></td><td>Zero delegated admins &mdash; GuardDuty, Security Hub <i>and</i> Config all flagged high; 4 open GD high/critical findings; Lazka dark</td><td>Central security account admins all three org-wide; findings get a named owner and triage SLA</td></tr>
<tr><td><b>Backup &amp; resilience</b></td><td><b>0 of 9 EBS volumes</b> have snapshots or a backup plan (18 high/medium failures)</td><td>AWS Backup plans, tested restores, RPO/RTO defined &mdash; today a volume loss is unrecoverable</td></tr>
<tr><td><b>Identity hardening</b></td><td>Admin keys 322 &amp; 319 days; 5 keys &gt;90d; 6 users on static creds; 9 users + root without hardware MFA; <code>AdministratorAccess</code> attached (<code>*:*</code>)</td><td>IAM Identity Center + short-lived roles; retire static keys, scope admin, hardware MFA on root</td></tr>
<tr><td><b>Exposure reduction</b></td><td>13 internet-open SGs; 3 permissive NACLs; 7 public-IP instances; <b>6 internet-facing instances carrying instance profiles</b>; IMDSv2 not enforced account-wide</td><td>Least-privilege ingress, IMDSv2 enforced, ALB/WAF fronting &mdash; closes the credential-theft path</td></tr>
<tr><td><b>Secrets &amp; key management</b></td><td>19 secrets with no rotation and no restrictive resource policy; 2 KMS keys without auto-rotation; 19 log groups unencrypted; secrets detected in 7 log groups</td><td>Rotation on every secret, KMS/CMK coverage for logs and SNS, resource policies scoped to consumers</td></tr>
<tr><td><b>Cost optimization</b></td><td>$858/mo, +284% Jan&rarr;Jul; EC2 = 67% of spend; 2 unattached EBS + 7 EIPs; orphaned EKS roles from a torn-down cluster</td><td>Rightsizing + Savings Plans + Graviton/spot + cleanup &rarr; recurring savings and a growth-safe baseline</td></tr>
<tr><td><b>Compliance acceleration</b></td><td>Prowler: 363 failures (2 critical, 111 high); SOC 2 81%, ISO 27001 77%, CIS 3.0 74%; Secureframe + Intruder already engaged</td><td>Close the SOC 2 gap on evidence they already collect; Security Hub as the standing control monitor</td></tr>
</tbody>
</table>
</div>
<p class="sub" style="margin:12px 0 0;font-size:12.5px;">The first three are the fastest to land and the hardest to defend leaving open &mdash; no delegated security owner, no backups, and workloads in the management account are each a single-event risk. Cost optimization is the lever that funds the rest.</p>
</section>
<footer>