AWS CloudTrail vs. AWS Security Hub

Most probably it would be suitable for Finance industries, where security is at the head of the table. However, in our case for E-commerce, it's also quite suitable, since we have quite a significant amount of data and usage of AWS services. Especially with usage of AWS services, AWS CloudTrail comes into play as a heavy plus. For instance, troubleshooting any issues in AWS services is really nice. Therefore, it would be less appropriate with a small amount of AWS service usage and some basic web hosting.

Incentivized

AWS Security Hub is mainly for protecting your software, video games, web application, etc... from external digital threats. This is a must for all software out there that can afford it. This also require a decent amount of resources to mitigate problems so that the monitoring page isn't overloaded. So overall, a large amount of budget and manpower is required to maintain this product.

Incentivized

• Logs details
• Easy implementation
• Great support

Incentivized

• Brings together the security related AWS tools in one dashboard
• Allows to pick and chose which AWS security tools to use
• Clean UI

Incentivized

• Delay
• User interface, must send logs elsewhere to view them

Incentivized

• Not easy to read past data, especially once it moves into Glacier deep storage
• performance is somewhat sluggish ... other systems are much faster to analyze data
• Doesn't always provide a remediation solution or suggested fix like other 3rd party tools like Qualys.
• It's hard to get the initial configuration and enrollment completed as there's a lot of manual intervention for every configured rule that needs to be enabled
• alerts are often times delayed

Incentivized

AWS always good with usability and same here for AWS Security Hub. A lot of good documentation is available to read and configure your own. We also started with looking at the videos and documentation to configure automation for our compliance checks. And to configure there are very less steps to be followed which is a very good thing for faster configuration.

Incentivized

For this specific functionality, I am not aware of any other product that can do what [AWS] Cloudtrail does. We did not evaluate any other products.

Incentivized

AWS stacks up very similarly to Splunk but being that it's an AWS tool it is better able to natively monitor our AWS footprint, unlike splunk which requires an appliance and / or forwarding agent for it to work properly. The same can be said about some other tools like Dynatrace. Dynatrace has a much more pleasant user interface that the senior management seems to like more, but AWS Security Hub has better options, a more straightforward rules engine and is less expensive than both Splunk and Dynatrace

Incentivized

• Saved us from purchasing and managing 3rd party solutions
• Satisfies Security/Governance requirements
• No upkeep/maintenance

Incentivized

• The automated compliance test helped us a lot to get PCIDSS certified so it was a very good return for our investments.
• Some third party tools we were using were not available for AWS Security Hub automated testing.
• Easy to configure for faster security automations but if we need detailed reports we should add more tools.

Incentivized