|
Amazon Web Services wants to cut the pile of scanner alerts down to the ones an attacker could actually use. AWS Continuum for code vulnerabilities, now generally available, takes findings from across a customer's environment, checks which ones are exploitable, ranks them by business impact and opens a pull request with a proposed fix for each.
The service went live Thursday afternoon in the US East (N. Virginia) and US West (Oregon) regions. In the launch post, AWS's Esra Kayabali framed it as a response to speed on the attacker's side: "Using frontier artificial intelligence (AI) models, threat actors can turn a vulnerability disclosure into working exploit code in minutes," she wrote, and the same tools that speed up development also add to the findings security teams have to work through.
Reachability decides the ranking
Continuum builds what AWS calls a context graph from two places, the customer's code repositories and its AWS environment. Code comes in through a GitHub integration or an Amazon S3 bucket. On the AWS side, a collector installed in the account and region where the code runs gathers AWS Config resources and network configuration, so the service can tell whether a vulnerable path is reachable over the network and what an attacker could get to from it.
From that graph it works out which systems are business-critical, such as customer data stores, payment pipelines and authentication services, then ranks each issue by how close its attack path runs to them. AWS's point is that a generic severity score treats a critical bug in a dev-only utility the same as a medium one sitting a step away from a payments database. |
