IDS/IPS and advanced-threat monitoring
This proposal answers two HECVAT questions:
- “Do you use an automated IDS/IPS?”
- “Are you employing next-generation persistent threat (NGPT) monitoring?”
Status: proposal. All prices are rough estimates at our scale; check them before committing. Our AWS SSO session had expired when this was written, so the live GuardDuty, CloudTrail and Security Hub state is unverified.
What the questions mean, in plain language
IDS/IPS (Intrusion Detection / Prevention System): software that automatically inspects traffic or host activity for attack patterns.
- A detection system (IDS) alerts on what it finds.
- A prevention system (IPS) also blocks it inline.
- Classic examples are network sensors (Suricata/Snort) and host agents (Wazuh/OSSEC).
- In a cloud architecture, the accepted equivalents are an edge WAF in blocking mode (network IPS for HTTP) and cloud-native threat detection such as AWS GuardDuty (IDS for the account, network and workloads).
NGPT (next-generation persistent threat monitoring): the HECVAT is asking about monitoring aimed at advanced persistent threats. These are patient, targeted attackers who get past signature checks, then persist and move laterally. “Next-generation” means going beyond known-bad signatures to:
- behavioral detection on endpoints and servers (EDR/XDR: process trees, persistence mechanisms, credential theft);
- threat intelligence (known-malicious IPs, domains and actors);
- anomaly detection (for example “this IAM identity has never called this API from this country”);
- correlation and alerting across those sources.
A signature-only antivirus or a plain firewall does not count as NGPT.
Architecture in scope and what exists today
| Layer | Components | Existing detection (verified in repo) |
|---|---|---|
AWS account 696081601609 | Lambda (API, stream, crons), SQS, S3 (staging, processing), Bedrock, EC2 Spot fleet (backup consumers), DynamoDB, SSM | GuardDuty Malware Protection for S3 on the upload staging bucket (CfnMalwareProtectionPlan, infra/cdk/lib/stacks/api-stack.ts:155, runbook docs/admin/runbooks/malware-scanning-s3.md). This is signature-based file scanning, not account threat detection. Whether a GuardDuty detector is on account-wide: verify (the runbook lists enabling it as a prerequisite). CloudTrail trail / Security Hub: verify. Spend-anomaly alerts exist (budgets-stack.ts, Bedrock divergence cron). |
| Cloudflare edge | Workers, Pages, R2, Tunnel, Access | Free-plan protections today. The Pro WAF is proposed, not deployed (waf-ruleset.md). Access gates the admin UIs (verified). |
| Corporate network | Office network, internal hosts (backups, CI runners, staging) | IPS at the network gateway (in place). Document the device, whether it runs in prevention (blocking) mode, its rule/threat-intel updates, and where alerts go. Internal hosts hold no customer data. |
| Staff laptops (2× Mac) | Admin workstations | macOS built-ins (XProtect, Gatekeeper, FileVault). No EDR. See Are laptops in scope? below. |
Honest answer today: IDS/IPS is Partial: IPS on the corporate network, plus automated malware scanning of every upload, but no IDS/IPS yet in the cloud environment where customer data is processed. NGPT is No.
Options
| Option | What it gives | Counts toward | Rough monthly cost (estimate) |
|---|---|---|---|
| AWS GuardDuty (foundational: CloudTrail management events, VPC flow, DNS logs) | Managed IDS for the AWS account. ML anomaly detection plus AWS/partner threat intel. Covers compromised credentials, crypto-mining, recon, exfiltration patterns. | IDS and NGPT (anomaly + threat intel) | ~$3–10 (low event volume; 30-day free trial shows the real number) |
| + Lambda Protection | Network activity of Lambda functions (C2 callbacks, mining pools) | IDS / NGPT | ~$1–5 |
| + S3 Protection (data events) | Anomalous S3 access (bulk reads, access from Tor or malicious IPs) | IDS / NGPT | ~$1–5 |
| + Malware Protection for S3 | Already deployed (upload scanning) | IDS (file) | Per GB scanned plus per object. Already paid. |
| + Runtime Monitoring (EC2) | Agent on EC2 compute | NGPT (runtime) | ~$1–5. Optional. |
| CloudTrail (org trail, all regions) + EventBridge → SNS alerts | Audit log, plus alerts on root login, IAM/policy changes, GuardDuty findings ≥ Medium, console logins without MFA | Supports both (evidence and response) | ~$0–2 (first management-event trail is free; S3 storage is pennies) |
| AWS Security Hub (CSPM) + AWS Config | Posture checks (CIS/FSBP), aggregates GuardDuty findings | Supports both; not IDS by itself | ~$10–25 (Config recording is the cost driver). Should-have, not required. |
| IAM Access Analyzer (external access) | Flags public or cross-account exposure | Posture | $0 |
| Cloudflare Pro WAF (managed rules in block mode, rate limits, bot mode) | Inline HTTP IPS at the edge for every public hostname, once origin-locked | IPS | ~$20–25 per zone (already proposed in waf-ruleset.md; don’t count twice) |
| Wazuh (free, self-hosted manager + agents) | HIDS: file-integrity monitoring, rootkit checks, log analysis, vulnerability detection, CIS checks. Agents run on Linux and macOS. | IDS (host). Partial NGPT (rules, some threat intel, but not true EDR). | $0 license. The manager needs about 4–8 GB RAM. Maintenance time is the real cost. Not recommended at our size. |
| Microsoft Defender for Business | EDR with behavioral detection, automated investigation and threat intel. Covers macOS. | NGPT (endpoint) | ~$3/user/mo (5 devices per user) → 2 users ≈ $6/mo |
| SentinelOne Singularity Core/Control | EDR (Mac + Linux) | NGPT | ~$6–8/endpoint/mo → 2 laptops ≈ $12–16 (often sold annually, sometimes with minimums) |
| CrowdStrike Falcon Go | EDR (covers Mac) | NGPT | ~$5/device/mo → 2 laptops ≈ $10 |
| Huntress EDR (sold via MSPs) | Managed EDR with a 24/7 human SOC | NGPT plus human monitoring | ~$3–5/endpoint/mo via an MSP, plus MSP overhead |
Recommended minimal stack
Aim: both answers become a defensible Yes at low cost with little upkeep for two people.
- GuardDuty, account-wide (foundational + Lambda Protection + S3 Protection) in us-east-1, plus any region with resources. Note: GuardDuty findings are regional, so turning it on in all regions stops idle-region abuse from going unseen. Manage it in CDK (new
security-stack.ts) so it’s code-reviewed. - CloudTrail organization trail (all regions, log-file validation on, S3 with lifecycle rules) plus EventBridge rules → SNS → email/Telegram (the existing alert channel) for:
- GuardDuty findings, severity ≥ 4;
- root sign-in;
- IAM, SSO or policy changes;
- CloudTrail stopped;
- GuardDuty disabled.
- Cloudflare Pro WAF in block mode, with origin lock, per
waf-ruleset.md. This is the inline IPS. Origin lock is what makes the claim true: an IPS that attackers can bypass throughexecute-apiorlambda-urlisn’t inline. - Document the corporate-network IPS: device, prevention mode, update cadence, alert destination and log retention. It already exists; the evidence is what’s missing.
- Optional: EDR on the two staff laptops (Microsoft Defender for Business, about $6/mo). Not needed for the IDS/IPS answer. It strengthens the NGPT answer, and the admin laptops are the most likely way an attacker would reach production. See Are laptops in scope?
- IAM Access Analyzer (free). Security Hub is optional; add it when a customer asks for CIS/FSBP posture evidence.
- Runbook: a one-page triage procedure for GuardDuty/EDR alerts, added to the IR plan the HECVAT draft already flags as a gap. Plus a monthly 15-minute review of findings, logged as evidence.
Estimated incremental monthly cost (beyond Cloudflare Pro, which the WAF proposal already covers): GuardDuty ~$5–20 + CloudTrail/EventBridge/SNS ~$1 + Access Analyzer $0 ≈ $6–21/mo, plus ~$6 if you add laptop EDR. With Cloudflare Pro: ≈ $26–50/mo. Add ~$10–25 if you turn on Security Hub + Config.
Answer wording once implemented
(Use only after items 1–4 are live and one alert has been test-fired, e.g. GuardDuty sample findings reaching the alert channel.)
Do you use an automated IDS/IPS? Yes.
“Yes. Inline intrusion prevention runs at the network edge. All public application and API hostnames are proxied through Cloudflare’s WAF, which uses the Cloudflare Managed and OWASP Core rulesets in blocking mode, rate limiting and bot mitigation. Our origins accept only Cloudflare-authenticated connections (mTLS / signed edge headers), so the WAF cannot be bypassed. In AWS, Amazon GuardDuty provides continuous automated intrusion detection across account activity (CloudTrail), network and DNS telemetry, Lambda network activity and S3 data access. Every uploaded file is malware-scanned by GuardDuty before it is admitted to storage. Our corporate network is protected by an intrusion prevention system at its gateway. Findings alert staff in real time.”
Are you employing next-generation persistent threat (NGPT) monitoring? Yes.
“Yes. We combine behavioral and anomaly-based detection with threat intelligence rather than relying only on signatures. Amazon GuardDuty applies machine-learning anomaly detection and AWS/partner threat intelligence to account, identity, network, Lambda and S3 activity. It detects credential compromise, unusual API use, reconnaissance and exfiltration patterns. [If laptop EDR is adopted: Staff workstations run an endpoint detection and response (EDR) agent with behavioral detection and automated investigation.] CloudTrail provides a tamper-evident audit trail, and alerts for high-severity findings, root or privileged-access events and changes to security tooling go to staff immediately. Findings are reviewed under a documented incident-response procedure.”
Until then, the honest answers are: IDS/IPS: “Partial: an intrusion prevention system protects our corporate network, and every upload is automatically malware-scanned (AWS GuardDuty Malware Protection); edge WAF and account-level threat detection for the cloud environment are being deployed (target date).” NGPT: “No: planned (target date).” Don’t answer Yes early. These answers get checked against evidence requests (screenshots of GuardDuty and EDR consoles, alert samples).
Are laptops in scope?
For the IDS/IPS question (Q79): no. It asks about intrusion detection and prevention for the environment that stores and processes institutional data, and the network it is reached from. That is the AWS/Cloudflare production environment and the corporate network. Laptops are endpoints, not networks. Reviewers look at them under other questions: remote workstation security (Q47) and systems management (Q60).
For the NGPT question (Q80): optional. Endpoint detection is one common part of NGPT monitoring, but the question doesn’t require it. GuardDuty’s anomaly detection and threat intelligence on the cloud environment can carry a “Yes” on its own. Laptop EDR is still worth considering because the two admin laptops hold the keys to production: a compromised laptop is the most realistic path for a persistent attacker. At about $6/month it is cheap insurance, not a requirement.
Personally owned laptops. If staff use personally owned laptops for Gevell work, other questions and the policies need to say so accurately. Q60 asks about “company and employee owned” devices. The Information Security and Media Handling policies currently refer to Company laptops and Company-owned devices, and the Q47 draft answer says “Company laptops”.