AWS’ cloud security platform is adding features to inventory, protect, and launch investigations into AI workloads. AWS’ Security Hub is also expanding its breadth of secured cloud workloads with support for Microsoft Azure.
Taken together, these enhancements reflect the evolving nature of corporate computing – especially the dramatic rise of AI — as well as the longstanding practice of customers using cloud services from multiple providers. The goal of AWS and other cloud/security providers is to centrally secure these workloads for customers to the maximum extent.
AI Workload Protections
In launching its new AI security features, AWS noted the rapid delivery of AI workloads into production by corporate customers and the resulting challenges that security programs and products face in keeping pace. For instance, existing systems aren’t well equipped to track AI agent inventory, scrutinize use of AI models, or monitor behavior of AI agents.
AWS Security Hub now offers a critical function for bringing AI apps and agents into a secure framework, namely AI inventory capabilities that provide an organization-wide view of AI assets and their security posture.
Security Hub AI Inventory discovers and catalogs AI workloads across the AWS environment two ways. For managed services, it inventories resources across the Bedrock AI app building platform, SageMaker for training and deploying AI, and the AgentCore orchestration paltform.
For self-hosted and external workloads, it finds models running on AWS services through runtime analysis and identifies external model endpoints being called by the customer’s workloads. It maps each asset to the infrastructure beneath it, including compute, networking, identity management, and data stores, and correlates that detail with inbound security signals. Security Hub AI Inventory is available in AWS Security Hub Essentials plans at no additional cost.
The new GuardDuty AI Protection provides threat detection functions for Bedrock and SageMaker. GuardDuty AI Protection detects anomalous instances of models being invoked, “cost harvesting” attacks in which adversaries abuse stolen credentials to run inference at your expense, and prompt injection attempts. GuardDuty AI Protection is now available to all GuardDuty customers with a 30-day free trial.
The final new AI protection is called GuardDuty AI Investigations, which is intended to replace manual investigation work currently required by high quantities of alerts, which invariably slow response. The new features automatically analyze GuardDuty findings and the accounts they monitor to separate legitimate threats from benign activity. It examines related activity from the past 90 days, affected resources and threat indicators, and uses threat intelligence to quickly complete investigations with a disposition assessment, including a confidence score. GuardDuty AI Investigations is available in preview mode in 10 AWS regions.
Azure Support
Multi-cloud infrastructure has been a customer reality for years, and AWS is moving to address this from a security perspective. Earlier this year, AWS introduced Security Hub Extended, bringing partner products in nine security categories into the Security Hub experience. Those partner products protect endpoints, identities, email, browsers, and data across any cloud or on premises.
Now the platform is being extended to protect Microsoft Azure workloads. Security Hub discovers Azure Virtual Machines, container images, function apps, and identities, then evaluates them for misconfigurations, threat exposure, and software vulnerabilities.
Azure security findings are presented alongside AWS findings using the same format, automation, and response workflows, so a security team can work from a common understanding of risk across the data estate. Azure resources are priced at the same rates as equivalent AWS resources with no additional fees, and there’s a 30-day free trial available.
More on AI Security:
- Customers Lack Confidence in AI Agents for Security
- Microsoft Governance Tools Ensure AI Agents Play Within the Rules at Runtime
- Microsoft Outlines Security and Governance Features Coming to Agent 365
Community Summit North America is the largest independent innovation, education, and training event for Microsoft business applications delivered by Expert Users, Microsoft Leaders, MVPs, and Partners. Register now to attend Community Summit in Nashville, TN from October 11-15.
