Enable GuardDuty Rule for High Severity Compliance
This rule highlights the importance of enabling GuardDuty for better security measures.
| Rule | GuardDuty should be enabled |
| Framework | GxP 21 CFR Part 11 |
| Severity | ✔ High |
Rule/Policy Description:
Enable GuardDuty for GxP 21 CFR Part 11 Compliance
GuardDuty is an Amazon Web Services (AWS) service that helps protect your AWS environment by continuously monitoring for malicious activity and unauthorized behavior. Enabling GuardDuty for GxP 21 CFR Part 11 compliance ensures that your environment meets the requirements for the regulation.
Troubleshooting Steps (if applicable):
If GuardDuty is not enabled or functioning properly, follow these troubleshooting steps:
- 1.
Verify AWS Account: Ensure that you have a valid AWS account with administrative access or appropriate permissions to enable GuardDuty.
- 2.
Check Compliance Requirements: Review the specific compliance requirements of GxP 21 CFR Part 11 to ensure that GuardDuty adequately addresses them.
- 3.
Verify GuardDuty Service: Confirm that the GuardDuty service is available in your AWS region. Some regions might not have this service, so consider moving your resources to a region that supports GuardDuty if necessary.
- 4.
Check IAM Permissions: Ensure that the account or user attempting to enable GuardDuty has the necessary IAM (Identity and Access Management) permissions.
- 5.
Validate Region Configuration: GuardDuty must be enabled separately for each AWS region you are using. Verify that GuardDuty is enabled in the appropriate regions.
- 6.
Review CloudTrail Integration: GuardDuty relies on CloudTrail logs to identify potential threats. Ensure that CloudTrail is properly configured and delivering logs to GuardDuty.
Necessary Codes (if applicable):
No specific codes are required for enabling GuardDuty for GxP 21 CFR Part 11 compliance. However, you might need to use AWS CLI (Command Line Interface) commands to enable GuardDuty in specific regions or perform additional configurations.
Step-by-step Guide for Enabling GuardDuty for GxP 21 CFR Part 11 Compliance:
- 1.
Login to AWS Management Console: Using your AWS account credentials, log in to the AWS Management Console.
- 2.
Navigate to GuardDuty: From the AWS Management Console, search and select "GuardDuty" from the services menu.
- 3.
Enable GuardDuty: In the GuardDuty dashboard, click on the "Get Started" button to set up GuardDuty for your AWS account.
- 4.
Select Regions: If you are using multiple AWS regions, you'll need to enable GuardDuty for each region separately. Click on the "Enable GuardDuty in new regions" button to select the additional regions where you want GuardDuty to be active.
- 5.
Review Settings: GuardDuty provides default settings for its managed detectors. Review these settings to ensure they align with the compliance requirements of GxP 21 CFR Part 11. You can customize these settings if needed.
- 6.
Enable CloudTrail Integration: GuardDuty leverages CloudTrail logs to detect potential threats. Verify that GuardDuty is properly integrated with CloudTrail. If not, follow the CloudTrail documentation to set up the integration.
- 7.
Enable SNS Notifications (optional): To receive notifications for GuardDuty findings, configure the Simple Notification Service (SNS) topic in the GuardDuty settings. This step is optional but recommended for proactive monitoring.
- 8.
Enable ThreatIntel Monitoring (optional): GuardDuty provides an option to enable Threat Intelligence Monitoring. You can choose to enable this feature if it aligns with your GxP 21 CFR Part 11 compliance requirements.
- 9.
Save and Enable: Once all the necessary configurations are reviewed and adjusted, click on the "Save" button to enable GuardDuty for your AWS account and selected regions.
- 10.
Verification: After enabling GuardDuty, regularly review the GuardDuty findings to ensure compliance with GxP 21 CFR Part 11. GuardDuty automatically generates alerts for potential threats, which can be accessed through the console or via notifications if configured.
Follow these steps to enable and configure GuardDuty for GxP 21 CFR Part 11 compliance in your AWS environment. Regularly monitor and address any identified threats for a secure and compliant infrastructure.