Zero Trust Architecture a priority to President Donald Trump

Nearly six months ago, the Western media began to highlight growing concerns about potential Chinese interference in critical U.S. infrastructure. Among the sectors most affected were the telecom and treasury industries. These reports sent waves of alarm throughout the United States, as it was feared that foreign adversaries were exploiting vulnerabilities in vital systems. 

The concern reached a new height following the conclusion of the U.S. 2024 elections when Microsoft confirmed that Chinese state-sponsored cyber actors had infiltrated 14 telecom companies since 2019. Over these years, these cyber operatives had allegedly been collecting intelligence, quietly monitoring sensitive U.S. communications and financial data.

This development caught the attention of then-President Donald Trump, who had assumed office after the transition from former President Joe Biden. In response to growing cyber threats, Trump made a bold statement regarding U.S. cybersecurity. He promised to fortify the nation’s digital defenses and warned that the U.S. would not hesitate to retaliate with aggressive cyberattacks against adversaries engaged in espionage, particularly those targeting national infrastructure. His rhetoric suggested an era of heightened cyber warfare, with the possibility of swift and powerful counterattacks to deter foreign cyber operations.

Given the increasingly strained relations between the White House and Beijing, the threat of further cyberattacks looms large. With these tensions in mind, it is highly likely that the current U.S. administration will push for the widespread adoption of Zero Trust Architecture (ZTA) across federal agencies. 

ZTA represents a fundamental shift in cybersecurity philosophy: it operates on the principle of never trust, always verify. This model demands rigorous authentication, authorization, and validation of network access, making it more difficult for cyber attackers to exploit vulnerabilities.

The introduction of Zero Trust Architecture could play a crucial role in enhancing the security of the nation’s IT infrastructure, especially in protecting sensitive systems from cyberattacks orchestrated by foreign adversaries. By implementing ZTA, the U.S. government aims to mitigate the risks of malicious intrusions and provide greater assurance to the public, particularly when it comes to the adoption of emerging technologies like cloud computing. This shift would not only bolster the defense mechanisms against cybercriminals but would also serve as a measure to assuage public concerns over the safety of their data in a rapidly evolving digital landscape.

In the midst of these cybersecurity discussions, a new and highly controversial development has surfaced: Donald Trump has reportedly granted extraordinary powers to the DOGE, with the agency now under the direction of Elon Musk. This news has sparked widespread debate and speculation. Musk, known primarily for his role as the CEO of Tesla and SpaceX, is now positioned to oversee a vast network of federal computer systems. Under his leadership, DHS would have access to a wide range of sensitive data, including financial records and personal information tied to U.S. citizens.

The announcement has raised significant concerns among the public, with many questioning the implications of allowing a private businessman turned part-time politician to hold such unprecedented access to government data. The most immediate concern is whether Musk could use this information for personal gain. Given his track record of turning ventures like Twitter into lucrative commercial platforms within just a few years, there are fears that he could monetize sensitive data for profit. In fact, the speed with which he transformed Twitter into a money-making machine has only amplified suspicions about his potential for turning federal data into a valuable business asset.

On the other hand, Musk has also been vocal about his concerns regarding artificial intelligence and the potential dangers it poses if used by malicious actors. His outspoken criticism of the unchecked development of AI technology, particularly in regions of the world where it is being exploited for harmful purposes, offers some reassurance to those who question his handling of sensitive data. Musk’s public stance against AI misuse suggests that he might take a cautious and responsible approach when managing federal information, even though this viewpoint may not be universally shared.

Ultimately, the controversy surrounding Musk’s involvement in cybersecurity, coupled with the broader push for Zero Trust Architecture, underscores the delicate balance between safeguarding national security and protecting individual privacy. As the U.S. continues to navigate this complex digital landscape, the public remains divided on whether figures like Musk can be trusted with such significant powers. As cyber threats grow more sophisticated and pervasive, it remains to be seen how these technological strategies will unfold and what their long-term impact will be on both national security and personal freedoms.

The post Zero Trust Architecture a priority to President Donald Trump appeared first on Cybersecurity Insiders.

from Cybersecurity Insiders https://ift.tt/milIdyv
via IFTTT

Cybersecurity Jobs in Most Demand in 2025

With the rapid expansion of digital transformation and the increasing sophistication of cyber threats, the demand for skilled cybersecurity professionals continues to rise. Organizations across industries are prioritizing security to protect sensitive data, infrastructure, and operations from cyberattacks. As we move into 2025, several cybersecurity roles will be in high demand due to emerging threats, regulatory requirements, and advancements in technology. Below are the most sought-after cybersecurity jobs in 2025:

1. Cybersecurity Analyst

Cybersecurity analysts play a critical role in monitoring security systems, detecting vulnerabilities, and responding to cyber threats. They conduct risk assessments, analyze security breaches, and implement security measures to protect an organization’s IT infrastructure.

Skills Required:

    • Threat intelligence and risk assessment
    • SIEM (Security Information and Event Management) tools
    • Incident response and malware analysis
    • Compliance knowledge (e.g., GDPR, NIST, ISO 27001)

2. Ethical Hacker (Penetration Tester)

Ethical hackers, also known as penetration testers, simulate cyberattacks to identify weaknesses in an organization’s security defenses. Their role is essential in preventing unauthorized access and mitigating potential threats before they can be exploited by malicious hackers.

Skills Required:
    • Proficiency in penetration testing tools (e.g., Metasploit, Burp Suite)
    • Scripting and programming (Python, Bash, PowerShell)
    • Vulnerability assessment methodologies
    • Social engineering tactics

3. Cloud Security Engineer

With businesses migrating to cloud environments, cloud security engineers are responsible for securing cloud infrastructures, applications, and data. They ensure compliance with security policies and industry regulations while mitigating cloud-related threats.

Skills Required:

    • Cloud platforms (AWS, Azure, Google Cloud Security)
    • Identity and access management (IAM)
    • Encryption and key management
    • Security compliance frameworks (e.g., CIS benchmarks, FedRAMP)

4. Security Architect

Security architects design and implement secure IT infrastructures. They establish cybersecurity policies and frameworks, ensuring an organization’s security strategy aligns with business objectives.

Skills Required:
    • Network and application security design
    • Cryptography and secure coding practices
    • Security framework implementation (Zero Trust, Defense-in-Depth)
    • Risk management and compliance

5. Incident Response Analyst

Incident response analysts specialize in handling cybersecurity incidents, minimizing damage, and preventing future breaches. They develop response plans, investigate security breaches, and work closely with law enforcement when necessary.

Skills Required:

    • Digital forensics and incident analysis
    • SIEM and intrusion detection systems
    • Malware analysis and reverse engineering
    • Crisis management and communication

6. Chief Information Security Officer (CISO)

A CISO is responsible for overseeing an organization’s entire cybersecurity strategy, managing security teams, and ensuring compliance with regulatory requirements. This executive role is crucial in aligning cybersecurity initiatives with business goals.

Skills Required:

    • Leadership and strategic planning
    • Risk management and regulatory compliance
    • Security policy development
    • Budgeting and vendor management

7. IoT Security Specialist

With the growing adoption of IoT devices, IoT security specialists ensure that connected devices and networks remain secure from cyber threats. They assess risks, implement security protocols, and develop mitigation strategies for IoT vulnerabilities.

Skills Required:

    • IoT protocols and device security
    • Embedded system security
    • Network segmentation strategies
    • Secure firmware and hardware development

8. Threat Intelligence Analyst

Threat intelligence analysts gather, analyze, and interpret data to predict and prevent cyber threats. Their work helps organizations stay ahead of potential attacks by understanding threat actor behavior and tactics.

Skills Required:

    • Cyber threat intelligence platforms (TIPs)
    • OSINT (Open Source Intelligence) gathering
    • MITRE ATT&CK framework knowledge
    • Advanced analytics and reporting

9. Blockchain Security Expert

As blockchain technology gains traction in finance, supply chain, and other industries, blockchain security experts ensure the integrity and security of decentralized systems. They focus on securing smart contracts, preventing cryptographic vulnerabilities, and enhancing blockchain privacy.

Skills Required:

    • Smart contract auditing (Solidity, Rust)
    • Cryptography and decentralized identity management
    • Blockchain forensics and threat modeling
    • Security token standards (ERC-20, ERC-721)

10. DevSecOps Engineer

DevSecOps engineers integrate security practices into the DevOps pipeline, ensuring that applications are built and deployed with security in mind. Their work reduces vulnerabilities early in the development lifecycle and strengthens software security.

Skills Required:

    • Secure software development lifecycle (SDLC)
    • Automation and CI/CD security integration
    • Container and Kubernetes security
    • Secure coding practices and vulnerability management

Conclusion

The cybersecurity job market in 2025 will be highly competitive, with organizations actively seeking skilled professionals to combat evolving cyber threats. As technology advances and attack surfaces expand, roles such as cybersecurity analysts, ethical hackers, cloud security engineers, and incident response specialists will be in high demand. To remain competitive in the field, aspiring cybersecurity professionals should focus on gaining relevant certifications, hands-on experience, and staying updated with the latest cybersecurity trends.

Whether you are a beginner or an experienced professional, there has never been a better time to build a career in cybersecurity. The demand for skilled security experts is not just growing—it is essential for the future of digital security.

The post Cybersecurity Jobs in Most Demand in 2025 appeared first on Cybersecurity Insiders.

from Cybersecurity Insiders https://ift.tt/07PTNiW
via IFTTT

AWS Weekly Roundup: AWS Developer Day, Trust Center, Well-Architected for Enterprises, and more (Feb 17, 2025)

Join us for the AWS Developer Day on February 20! This virtual event is designed to help developers and teams incorporate cutting-edge yet responsible generative AI across their development lifecycle to accelerate innovation.

In his keynote, Jeff Barr, Vice President of AWS Evangelism, shares his thoughts on the next generation of software development based on generative AI, the skills needed to thrive in this changing environment, and how he sees it evolving in the future.

Get a first look at exciting technical deep-dive and product updates about Amazon Q Developer, AWS Amplify, and GitLab Duo with Amazon Q. You get the chance to explore real-world use cases, live coding demos, interactive sessions, and community spotlight sessions with Christian Bonzelet (AWS Community Builder), Hazel Saenz (AWS Serverless Hero), Matt Lewis (AWS Data Hero), and Johannes Koch (AWS DevTools Hero). Please sign up for this event now!

Last week’s launches
Here are some launches that got my attention:

Updating AWS SDK defaults for AWS STS – As we shared upcoming changes to the AWS Security Token Service (AWS STS) global endpoint to improve the resiliency and performance of your applications, we’re updating two defaults of AWS Software Development Kits (AWS SDKs) and AWS Command Line Interfaces (AWS CLIs) on July 31st 2025 – the default AWS STS service to regional, and the default retry strategy to standard. We recommend that you test your application before the release to avoid an unexpected experience after updating.

Introducing the AWS Trust CenterChris Betz, CISO at Amazon Web Services (AWS), shared AWS Trust Center, a new online resource communicating how we approach securing your assets in the cloud. This resource is a window into our security practices, compliance programs, and data protection controls that demonstrates how we work to earn your trust every day.

AWS CloudTrail network activity events for VPC endpoint – This feature provides you with a powerful tool to enhance your security posture, detect potential threats, and gain deeper insights into your VPC network traffic. This feature addresses your critical needs for comprehensive visibility and control over your AWS environments.

AWS Verified Access support for non-HTTP resources – AWS Verified Access now extends beyond HTTP apps to provide VPN-less, secure access to non-HTTP resources like Amazon Relational Database Service (Amazon RDS) databases, enabling improved security and enhanced user experience for both web applications and database connections. To learn more, visit the Verified Access endpoints page and a video tutorial.

New subnet management of Network Load Balancer (NLB) – NLBs were previously restricted to only adding subnets in new Availability Zones, and they now support full subnet management, including removal of subnets, matching the capabilities of Application Load Balancer (ALB). This enhancement offers organizations greater control over their network architecture and brings consistency to AWS load balancing services.

Meta SAM 2.1 and Falcon 3 models in Amazon SageMaker JumpStart – You can use Meta’s Segment Anything Model (SAM) 2.1 with state-of-the-art video and image segmentation capabilities in a single model. You can also use the Falcon 3 family with five models ranging from 1 to 10 billion parameters, with a focus on enhancing science, math, and coding capabilities. To learn more, visit SageMaker JumpStart pretrained models and Getting started with Amazon SageMaker JumpStart.

For a full list of AWS announcements, be sure to keep an eye on the What’s New with AWS? page.

Other AWS news
Here are some additional news items that you might find interesting:

AWS Documentation updateGreg Wilson, a lead of AWS Documentation, SDK, and CLI teams shared an insightful blog post about the progress, challenges, and what’s next for technical documentation for 200+ AWS services. It includes AWS Decision Guides for choosing the right service for specific needs; optimizing documents for readability, such as doubled code samples; and improving usability, such as dark mode and auto-suggest with top global navigation controls. You can also learn about how we use generative AI to help create technical documents.

AWS Well-Architected for Enterprises – This is a new free digital course designed for technical professionals who architect, build, and operate AWS solutions at scale. This intermediate-level course will help you optimize your cloud architecture while aligning to your business goals. The course takes approximately 1 hour to complete and includes a knowledge check at the end to reinforce your learning.

Integrating AWS with .NET Aspire – The .NET team at AWS has been working on integrations for connecting your .NET applications to AWS resources. Learn about how to automatically deploy AWS application resources using Aspire.Hosting.AWS NuGet package for NET Aspire, an open source framework building cloud-ready applications.

Upcoming AWS events
Check your calendars and sign up for these upcoming AWS events:

AWS Innovate: Generative AI + Data – Join a free online conference focusing on generative AI and data innovations. Available in multiple geographic regions: APJC and EMEA (March 6), North America (March 13), Greater China Region (March 14), and Latin America (April 8).

AWS Summits – Join free online and in-person events that bring the cloud computing community together to connect, collaborate, and learn about AWS. Register in your nearest city: Paris (April 9), Amsterdam (April 16), London (April 30), and Poland (May 5).

AWS GenAI Lofts – GenAI Lofts offer collaborative spaces and immersive experiences for startups and developers. You can join in-person GenAI Loft San Francisco events such as Built on Amazon Bedrock demo nights (April 19), SageMaker Unified Studio Demo for Startups (April 21), and Hands-on with Agentic Graph RAG Workshop (April 25). GenAI Loft Berlin has its Opening Day on February 24 and goes to March 7.

AWS Community Days – Join community-led conferences that feature technical discussions, workshops, and hands-on labs led by expert AWS users and industry leaders from around the world: Karachi, Pakistan (February 22), Milan, Italy (April 2), Bay Area – Security Edition (April 4), Timișoara, Romania (April 10), and Prague, Czeh Republic (April 29).

AWS re:Inforce – Mark your calendars for AWS re:Inforce (June 16–18) in Philadelphia, PA. AWS re:Inforce is a learning conference focused on AWS security solutions, cloud security, compliance, and identity. You can subscribe for event updates now!

You can browse all upcoming in-person and virtual events.

That’s all for this week. Check back next Monday for another Weekly Roundup!

Channy

This post is part of our Weekly Roundup series. Check back each week for a quick roundup of interesting news and announcements from AWS!

from AWS News Blog https://ift.tt/sUV7k2e
via IFTTT

⚡ THN Weekly Recap: Google Secrets Stolen, Windows Hack, New Crypto Scams and More

Welcome to this week’s Cybersecurity News Recap. Discover how cyber attackers are using clever tricks like fake codes and sneaky emails to gain access to sensitive data. We cover everything from device code phishing to cloud exploits, breaking down the technical details into simple, easy-to-follow insights.
⚡ Threat of the Week
Russian Threat Actors Leverage Device Code Phishing to Hack

from The Hacker News https://ift.tt/x0NKra7
via IFTTT

Samsung brings in Quantum safe security to its Knox Security Ecosystem

Samsung has consistently been at the forefront of technological innovation, and its latest advancement comes in the form of enhanced security through its Knox Security Infrastructure. Traditionally, Samsung Knox has provided robust protection against cyber threats by utilizing both hardware and software authentication to shield devices from malicious attacks. Now, the South Korean tech giant has taken its security capabilities a step further by integrating Post Quantum Cryptography (PQC), a cutting-edge technology designed to safeguard data from the potential risks posed by quantum computing-enabled cyberattacks.

The introduction of PQC to Samsung’s mobile security features represents a significant leap in data protection. Quantum computing has the potential to break existing encryption systems, making it an imminent threat to current cybersecurity measures. By incorporating PQC, Samsung aims to future-proof its security infrastructure, addressing vulnerabilities that could arise as quantum technology advances. The Knox PQC framework will offer an enhanced layer of security, ensuring that sensitive information—such as emails, messages, transactions, and attachments—remains secure. Additionally, the cloud data stored on Samsung devices will be protected from modern-day cyber threats, securing both current and future data in a world that is increasingly susceptible to quantum-enabled attacks.

However, Samsung’s new PQC-powered security feature will not be universally available. Initially, it will be rolled out exclusively to users who purchase the latest Galaxy S25 series and higher-end models. This move aligns with Samsung’s strategy of offering premium features to its most loyal customer base. Furthermore, the feature will be incorporated into the Knox Matrix platform, which will protect users’ data during activities such as backing up, restoring, and syncing with Samsung Cloud, ensuring that their information remains secure across different devices and services.

To take full advantage of this new security capability, users will need to have an operating system that is compatible with the One UI 7 update, which is expected to be available on select devices. This means that only those devices running the latest version of One UI will benefit from the PQC security features.

In addition to this development, there have been reports that Samsung is in talks with Google to secure a unique agreement that will allow Galaxy device users to receive the latest Android updates as soon as they are released for Pixel phones. However, this new upgrade will likely be limited to high-end models in Samsung’s lineup, further reinforcing the company’s focus on providing exclusive features to its premium customer segment.

Overall, these advancements in Samsung’s security technology demonstrate the company’s commitment to staying ahead of emerging threats and offering its customers the best possible protection in an increasingly complex digital landscape.

The post Samsung brings in Quantum safe security to its Knox Security Ecosystem appeared first on Cybersecurity Insiders.

from Cybersecurity Insiders https://ift.tt/qQr7LVt
via IFTTT

QuSecure Secures Additional Series A Funding to Advance Post-Quantum Cryptography Solutions

 QuSecure™, Inc., a leader in post-quantum cryptography (PQC) and cryptographic agility, has secured additional funding, bringing its Series A round to $28 million. Led by Two Bear Capital with participation from Accenture Ventures, the investment will accelerate product development, expand QuSecure’s go-to-market strategy, and support the company’s growing presence in government, financial, and critical infrastructure sectors. With the quantum computing market projected to exceed $125 billion by 2030, QuSecure is at the forefront of delivering quantum-resilient cybersecurity solutions.

The rapid advancement of quantum computing is reshaping the cybersecurity landscape. While quantum technology promises breakthroughs in medicine and materials science, it also threatens traditional encryption standards, potentially rendering them obsolete. Sensitive data, from financial transactions to government communications, could be compromised by quantum computers capable of breaking conventional cryptographic algorithms within seconds.

This funding milestone follows a recent executive order mandating progress toward quantum-safe encryption across U.S. government agencies. The White House has reinforced this urgency through policies such as the National Security Memorandum “Promoting United States Leadership in Quantum Computing While Mitigating Risks to Vulnerable Cryptographic Systems.” Additionally, the Endless Frontiers Act has allocated $100 billion in federal funding over five years to support emerging technologies, including quantum computing, with a specific focus on post-quantum cryptography.

“The requirement to upgrade enterprise technologies to post-quantum cryptographic standards is one of the most significant undertakings facing enterprises this decade,” said Mike Goguen, founder and managing partner of Two Bear Capital. “QuSecure’s unique ability to facilitate this migration, without disruption to existing technology solutions, positions them as a pivotal player in this endeavor. We’re proud to partner with and support QuSecure during this critical and transformative period of growth and opportunity. This funding round will position QuSecure to transition from an R&D and product development company to a powerhouse focused on large-scale customer acquisition and the broad adoption of the QuProtect platform.”

QuSecure has also announced the appointment of Rebecca Krauthamer as CEO to lead the company’s next phase of growth. Krauthamer, a co-founder of QuSecure, previously served as the company’s first VP of Engineering and Chief Product Officer. A Stanford University graduate specializing in Artificial Intelligence, she was recognized on Forbes’ “30 Under 30” list for her contributions to quantum computing. She has also been named among the “12 Women Shaping Quantum Computing” and serves on the World Economic Forum’s Global Future Council for quantum technologies.

“The quantum threat isn’t a distant possibility – it’s a reality that organizations need to address today,” said Ms. Krauthamer, co-founder and CEO of QuSecure. “In a progressively digital world, as AI and quantum threats to encryption emerge at an ever-faster pace, it is critical that we evolve from encryption management that requires several years to upgrade algorithms to orchestrated crypto agility for the ability to push a button and upgrade an entire system at once. The ability to orchestrate cryptography at enterprise scale is critical to a robust cybersecurity strategy. The support of Two Bear Capital and Accenture demonstrates a shared vision to provide organizations with a long-term solution to upgrade and manage their encryption standards.”

QuSecure’s patented, software-based security architecture seamlessly integrates with existing IT infrastructures, ensuring organizations can transition to quantum-resistant encryption without major system overhauls. The company’s flagship product, QuProtect, provides multi-layered security to defend against both current and emerging threats. As the industry’s first cryptographic agility platform, QuProtect enables enterprises to upgrade encryption protocols efficiently while maintaining full cryptographic visibility and orchestration. The solution is already deployed across various sectors, including the United States Army and Air Force, telecommunications, energy, financial services, and global cloud service providers.

“Organizations need a reliable quantum-resilient cybersecurity solution that not only adheres to the National Institute of Standards and Technology’s (NIST) post-quantum encryption standards, but can be easily integrated across all parts of a communications network,” said Tom Patterson, emerging technology security lead at Accenture. “We’re investing in trusted providers like QuSecure to help our clients future-proof their global networks today to protect high-risk data faster.”

The post QuSecure Secures Additional Series A Funding to Advance Post-Quantum Cryptography Solutions appeared first on Cybersecurity Insiders.

from Cybersecurity Insiders https://ift.tt/1s3wrFB
via IFTTT

AWS CloudTrail network activity events for VPC endpoints now generally available

Today, I’m happy to announce the general availability of network activity events for Amazon Virtual Private Cloud (Amazon VPC) endpoints in AWS CloudTrail. This feature helps you to record and monitor AWS API activity traversing your VPC endpoints, helping you strengthen your data perimeter and implement better detective controls.

Previously, it was hard to detect potential data exfiltration attempts and unauthorized access to the resources within your network through VPC endpoints. While VPC endpoint policies could be configured to prevent access from external accounts, there was no built-in mechanism to log denied actions or detect when external credentials were used at a VPC endpoint. This often required you to build custom solutions to inspect and analyze TLS traffic, which could be operationally costly and negate the benefits of encrypted communications.

With this new capability, you can now opt in to log all AWS API activity passing through your VPC endpoints. CloudTrail records these events as a new event type called network activity events, which capture both control plane and data plane actions passing through a VPC endpoint.

Network activity events in CloudTrail provide several key benefits:

  • Comprehensive visibility – Log all API activity traversing VPC endpoints, regardless of the AWS account initiating the action.
  • External credential detection – Identify when credentials from outside your organization are accessing your VPC endpoint.
  • Data exfiltration prevention – Detect and investigate potential unauthorized data movement attempts.
  • Enhanced security monitoring – Gain insights into all AWS API activity at your VPC endpoints without the need to decrypt TLS traffic.
  • Visibility for regulatory compliance – Improve your ability to meet regulatory requirements by tracking all API activity passing through.

Getting started with network activity events for VPC endpoint logging
To enable network activity events, I go to the AWS CloudTrail console and choose Trails in the navigation pane. I choose Create trail to create a new one. I enter a name in the Trail name field and choose an Amazon Simple Storage Service (Amazon S3) bucket to store the event logs. When I create a trail in CloudTrail, I can specify an existing Amazon S3 bucket or create a new bucket to store my trail’s event logs.

If you set Log file SSE-KMS encryption to Enabled, you have two options: Choose New to create a new AWS Key Management Service (AWS KMS) key or choose Existing to choose an existing KMS key. If you chose New, you need to type an alias in the AWS KMS alias field. CloudTrail encrypts your log files with this KMS key and adds the policy for you. The KMS key and Amazon S3 must be in the same AWS Region. For this example, I use an existing KMS key. I enter the alias in the AWS KMS alias field and leave the rest as default for this demo. I choose Next for the next step.

In the Choose log events step, I choose Network activity events under Events. I choose the event source from the list of AWS services, such as cloudtrail.amazonaws.com, ec2.amazonaws.com, kms.amazonaws.com, s3.amazonaws.com, and secretsmanager.amazonaws.com. I add two network activity event sources for this demo. For the first source, I select ec2.amazonaws.com option. For Log selector template, I can use templates for common use cases or create fine-grained filters for specific scenarios. For example, to log all API activities traversing the VPC endpoint, I can choose the Log all events template. I choose Log network activity access denied events template to log only access denied events. Optionally, I can enter a name in the Selector name field to identify the log selector template, such as Include network activity events for Amazon EC2.

As a second example, I choose Custom to create custom filters on multiple fields, such as eventName and vpcEndpointId. I can specify specific VPC endpoint IDs or filter the results to include only the VPC endpoints that match specific criteria. For Advanced event selectors, I choose vpcEndpointId from the Field dropdown, choose equals as Operator, and enter the VPC endpoint ID. When I expand the JSON view, I can see my event selectors as a JSON block. I choose Next and after reviewing the selections, I choose Create trail.

After it’s configured, CloudTrail will begin logging network activity events for my VPC endpoints, helping me analyze and act on this data. To analyze AWS CloudTrail network activity events, you can use the CloudTrail console, AWS Command Line Interface (AWS CLI), and AWS SDK to retrieve relevant logs. You can also use CloudTrail Lake to capture, store and analyze your network activity events. If you are using Trails, you can use Amazon Athena to query and filter these events based on specific criteria. Regular analysis of these events can help you maintain security, comply with regulations, and optimize your network infrastructure in AWS.

Now available
CloudTrail network activity events for VPC endpoint logging provide you with a powerful tool to enhance your security posture, detect potential threats, and gain deeper insights into your VPC network traffic. This feature addresses your critical needs for comprehensive visibility and control over your AWS environments.

Network activity events for VPC endpoints are available in all commercial AWS Regions.

For pricing information, visit AWS CloudTrail pricing.

To get started with CloudTrail network activity events, visit AWS CloudTrail. For more information on CloudTrail and its features, refer to the AWS CloudTrail documentation.

— Esra

from AWS News Blog https://ift.tt/xPbTGr8
via IFTTT