How to check overlapped controls in AWS Security Hub provided Security Standards?

Can you leverage this piece of code to see if it gives you the result, what you are trying to achieve:

Lambda version:

 import json
 import boto3

 securityhub = boto3.client('securityhub')

 def get_control_mappings():
     standards = securityhub.get_enabled_standards()
     controls = {}

     for standard in standards['StandardsSubscriptions']:
         response = securityhub.describe_standards_controls(
             StandardsSubscriptionArn=standard['StandardsSubscriptionArn']
         )
    
         for control in response['Controls']:
             if control['Title'] not in controls:
                 controls[control['Title']] = []
             controls[control['Title']].append(standard['StandardsArn'])

     return controls

 def lambda_handler(event, context):
     # TODO implement
     # Find controls that appear in multiple standards
     overlapped_controls = {k:v for k,v in get_control_mappings().items() if len(v) > 1}
     print(overlapped_controls)

Boto3 version:

 import boto3

 securityhub = boto3.client('securityhub')

 def get_control_mappings():
     standards = securityhub.get_enabled_standards()
     controls = {}

     for standard in standards['StandardsSubscriptions']:
         response = securityhub.describe_standards_controls(
             StandardsSubscriptionArn=standard['StandardsSubscriptionArn']
         )
    
         for control in response['Controls']:
             if control['Title'] not in controls:
                 controls[control['Title']] = []
             controls[control['Title']].append(standard['StandardsArn'])

     return controls

 # Find controls that appear in multiple standards
 overlapped_controls = {k:v for k,v in get_control_mappings().items() if len(v) > 1}

AWS Security Hub control documentation: https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-controls-reference.html

Comment here if you have additional questions, happy to help.

Abhishek

Standards such as a AWS Foundational Best Practices or NIST standards may be, and often are, overlapping and so multiple standards can be addressed in a single AWS Security Hub control (It's the standards that overlap). Each control is given a unique control ID (For example [CloudTrail.1]) and is also assigned a category (for example Category: Category: Identify > Logging or another being Protect > Data Protection > Encryption of data-in-transit). Important to note each AWS Security Hub control is executed through a managed config rule. This underpinning config rule, and therefore the AWS Security Hub Control, may not be available in all AWS Regions. For more information, see Availability of controls by Region here https://docs.aws.amazon.com/securityhub/latest/userguide/regions-controls.html.

AWS Audit Manager which is built to help assure controls are operating effectively has a Control Library function with mapping for Common, Core and Standard controls and includes a lookup for building your own custom framework. This helps you to demonstrate compliance with a framework which may include a range of overlapping regulations and standards. Each Common control maps to a group of Core controls that collect evidence from AWS managed data sources (such as AWS API calls, AWS CloudTrail and AWS Config). https://docs.aws.amazon.com/audit-manager/latest/userguide/control-library.html

Common controls help you to fulfill a control objective. They aren’t specific to any compliance standard, and they collect evidence that can support overlapping compliance obligations. Each common control consists of a group of core controls that collect evidence from AWS managed data sources. You can’t edit common controls, but you can use them as an evidence source.

Core controls help you meet the requirements of a common control. Like common controls, they aren’t specific to any compliance standard. Each core control supports a common control by collecting evidence about your AWS environment from AWS managed data sources. You can’t edit core controls, but you can use them as an evidence source.

**Standard controls ** help you to demonstrate compliance with a specific compliance standard. Each standard control is related to a standard framework in Audit Manager, and collects evidence from underlying data sources that are managed by AWS. You can’t edit standard controls, but you can make an editable copy of any standard control.