Controls

CronJobDaemonSetDeploymentJobReplicaSetStatefulSet

Consider the use of an external secrets storage and management system, instead of using Kubernetes Secrets directly, if you have more complex secret management needs. Ensure the solution requires authentication to access secrets, has auditing of access to and use of secrets, and encrypts secrets. Some solutions also make it easier to rotate secrets.

Applies to

Kubernetes

Covered asset types

6 queries

Do not setup access keys during initial user setup for all IAM users that have a console password

AWS console defaults to no check boxes selected when creating a new IAM user. When creating the IAM user access type you have to determine what type of access they require.

Applies to

Covered asset types

IAMUser

EC2 Instances Should Not Allow Metadata Response Hop Limit Higher Than 1

### Overview

Applies to

Covered asset types

Interacting with a serial port is often referred to as the serial console, which is similar to using a terminal window, in that input and output is entirely in text mode and there is no graphical interface or mouse support.

Applies to

Covered asset types

Ensure 'Enable Infrastructure Encryption' for Each Storage Account in Azure Storage is Set to 'enabled'

Enabling double encryption at the hardware level on top of the default software encryption for Storage Accounts accessing Azure storage solutions.

Applies to

Covered asset types

StorageAccount

Ensure 'Enable key rotation reminders' is enabled for each Storage Account

Access Keys authenticate application access requests to data contained in Storage Accounts. A periodic rotation of these keys is recommended to ensure that potentially compromised keys cannot result in a long-term exploitable credential. The "Rotation Reminder" is an automatic reminder feature for a manual procedure.

Applies to

Covered asset types

StorageAccount

Ensure 'Endpoint protection' component status is set to 'On'

The Endpoint protection component enables Microsoft Defender for Endpoint (formerly 'Advanced Threat Protection' or 'ATP' or 'WDATP' - see additional info) to communicate with Microsoft Defender for Cloud.

Applies to

Covered asset types

Ensure 'Enforce SSL connection' is set to 'ENABLED' for MariaDB Database Server

Enable SSL connection on MariaDB Database Servers.

Applies to

Covered asset types

MariaDBServer

Ensure 'Enforce SSL connection' is set to 'ENABLED' for MySQL Database Server

Enable SSL connection on Standard MySQL Database servers.

Applies to

Covered asset types

MySQLServer

Ensure 'Enforce SSL connection' is set to 'ENABLED' for PostgreSQL Database Server

Enable SSL connection on PostgreSQL Database Servers.

Applies to

Covered asset types

PostgreSQLServer

Ensure 'external scripts enabled' database flag for Cloud SQL SQL Server instance is set to 'off'

It is recommended to set `external scripts enabled` database flag for Cloud SQL SQL Server instance to `off`.

Applies to

Covered asset types

Ensure 'Firewalls & Networks' Is Limited to Use Selected Networks Instead of All Networks for Cosmos DB

Limiting your Cosmos DB to only communicate on whitelisted networks lowers its attack footprint.

Applies to

Covered asset types

CosmosDBAccount

Ensure 'FTP State' is set to 'FTPS Only' or 'Disabled'

By default, App Services can be deployed over FTP. If FTP is required for an essential deployment workflow, FTPS should be required for FTP login for all App Services.

Applies to

Covered asset types

Ensure 'Guest invite restrictions' is set to 'Only users assigned to specific admin roles can invite guest users'

Restrict invitations to users with specific administrative roles only.

Applies to

Covered asset types

Ensure 'Guest users access restrictions' is set to 'Guest user access is restricted to properties and memberships of their own directory objects'

Limit guest user permissions.

Applies to

Covered asset types

Ensure 'HTTPS Only' is set to 'On' for App Service

Azure App Service allows apps to run under both HTTP and HTTPS by default. Apps can be accessed by anyone using non-secure HTTP links by default. Non-secure HTTP requests can be restricted and all HTTP requests redirected to the secure HTTPS port. It is recommended to enforce HTTPS-only traffic.

Applies to

Covered asset types

Ensure 'log_error_verbosity' database flag for Cloud SQL PostgreSQL instance is set to 'DEFAULT' or stricter

The log_error_verbosity flag controls the verbosity/details of messages logged. Valid values are:

Applies to

Covered asset types

Ensure 'log_min_error_statement' database flag for Cloud SQL PostgreSQL instance is set to 'Error' or stricter

The `log_min_error_statement` flag defines the minimum message severity level that are considered as an error statement. Messages for error statements are logged with the SQL statement. Valid values include `DEBUG5`, `DEBUG4`, `DEBUG3`, `DEBUG2`, `DEBUG1`, `INFO`, `NOTICE`, `WARNING`, `ERROR`, `LOG`, `FATAL`, and `PANIC`. Each severity level includes the subsequent levels mentioned above. Ensure a value of `ERROR` or stricter is set.

Applies to

Covered asset types

Ensure 'log_statement' database flag for Cloud SQL PostgreSQL instance is set appropriately

The value of the `log_statement` flag determined the SQL statements that are logged. Valid values are:

Applies to

Covered asset types

Ensure 'Minimum TLS version' for storage accounts is set to 'Version 1.2'

In some cases, Azure Storage sets the minimum TLS version to be 1.0 by default. TLS 1.0 is a legacy version with known vulnerabilities. However, this minimum TLS version can be configured to be later protocols, such as TLS 1.2.

Applies to

Covered asset types

StorageAccount

Ensure 'Multi-Factor Auth Status' is 'Enabled' for all Non-Privileged Users

If your organization pays for Microsoft Entra ID licensing (included in Microsoft 365 E3, E5, or F5, and EM&S E3 or E5 licenses) and **can** use Conditional Access, ignore the recommendations in this section and proceed to the Conditional Access section.

Applies to

Covered asset types

It is recommended to use Instance-specific SSH key(s) instead of using common/shared project-wide SSH key(s) to access Instances.

Applies to

Covered asset types

Ensure a 'Diagnostic Setting' exists for Subscription Activity Logs

Enable Diagnostic settings for exporting activity logs.

Applies to

SubscriptionDiagnosticSettings

Covered asset types

Ensure a Custom Bad Password List is set to 'Enforce' for your Organization

Microsoft Azure provides a Global Banned Password policy for Azure administrative and normal user accounts. This is not applied to user accounts synced from an on-premise Active Directory unless Azure AD Connect is used, and you enable `EnforceCloudPasswordPolicyForPasswordSyncedUsers`. Please see the list of default values on the specifics of this policy. To further password security, it is recommended to further define a custom banned password policy. Organizational-specific terms can be added to the custom banned password list, such as the following examples:

Applies to

Covered asset types

Ensure a Custom Role is Assigned Permissions for Administering Resource Locks

Resource locking is a powerful protection mechanism that can prevent inadvertent modification/deletion of resources within Azure subscriptions/Resource Groups and is a recommended NIST configuration.

Applies to

Covered asset types

Ensure a log metric filter and alarm exist for AWS Config configuration changes

Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs and establishing corresponding metric filters and alarms. It is recommended that a metric filter and alarm be established for detecting changes to AWS Config's configurations.

Applies to

Covered asset types

Ensure a log metric filter and alarm exist for AWS Management Console authentication failures

Applies to

Covered asset types

Applies to

Covered asset types

Ensure a log metric filter and alarm exist for disabling or scheduled deletion of customer created CMKs

Applies to

Covered asset types

Ensure a log metric filter and alarm exist for IAM policy changes

Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs and establishing corresponding metric filters and alarms. It is recommended that a metric filter and alarm be established changes made to Identity and Access Management (IAM) policies.

Applies to

Covered asset types

Ensure a log metric filter and alarm exist for Management Console sign-in without MFA

Applies to

Covered asset types

Ensure a log metric filter and alarm exist for route table changes

Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs and establishing corresponding metric filters and alarms. Routing tables are used to route network traffic between subnets and to network gateways. It is recommended that a metric filter and alarm be established for changes to route tables.

Applies to

Covered asset types

Ensure a log metric filter and alarm exist for S3 bucket policy changes

Applies to

Covered asset types

Ensure a log metric filter and alarm exist for security group changes

Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs and establishing corresponding metric filters and alarms. Security Groups are a stateful packet filter that controls ingress and egress traffic within a VPC. It is recommended that a metric filter and alarm be established changes to Security Groups.

Applies to

Covered asset types

Ensure a log metric filter and alarm exist for unauthorized API calls

Applies to

Covered asset types

Applies to

Covered asset types

Ensure Access Logs is Enabled for ELB

### Overview

Applies to

Covered asset types

LoadBalancer

Ensure account 'Lockout duration in seconds' is greater than or equal to '60'

The account lockout duration value determines how long an account retains the lockout status and, therefore, how long before a user can continue to attempt to log in after passing the lockout threshold.

Applies to

Covered asset types

Ensure account 'Lockout Threshold' is less than or equal to '10'

The account lockout threshold determines how many failed login attempts are permitted before the account is locked out and initiated with a variable lockout duration.

Applies to

Covered asset types

Ensure administrators have multi-factor authentication enabled

Alibaba CloudAWSGoogle CloudGoogle WorkspaceMicrosoft AzureMicrosoft Entra IDOkta

Users with administrative rights are targeted by attackers. Requiring multi-factor authentication (MFA) on those accounts is an easy way to reduce the risk of those accounts being compromised.

Applies to

Covered asset types

IAMUserUser

6 queries

Ensure aggregated log sinks are configured at org or folder scope

Centralized logging helps ensure forensic and audit evidence is retained even if project-level settings change.

Applies to

Covered asset types

LogSink

### Overview

Applies to

Ensure API Keys are restricted to use by only specified hosts and apps

### Description:

Applies to

Covered asset types

APIKey

Ensure API Keys are restricted to use only APIs that application needs access to

### Description:

Applies to

Covered asset types

APIKey

Ensure API Keys Are Rotated Every 90 Days

### Description:

Applies to

Covered asset types

APIKey

Ensure App Engine Applications Enforce HTTPS Connections

In order to maintain the highest level of security all connections to an application should be secure by default.

Applies to

Covered asset types

AppEngineService

Ensure App Service Authentication is set up for apps in Azure App Service

Azure App Service Authentication is a feature that can prevent anonymous HTTP requests from reaching a Web Application or authenticate those with tokens before they reach the app. If an anonymous request is received from a browser, App Service will redirect to a logon page. To handle the logon process, a choice from a set of identity providers can be made, or a custom authentication mechanism can be implemented.

Applies to

Covered asset types

Ensure application assignments are configured through groups

You can grant users access to applications directly or through groups. The latter is preferred because it greatly simplifies access management.

Applies to

Covered asset types

Ensure Application Gateway WAF is enabled in Prevention mode

Detection-only mode provides visibility but does not block attacks. Prevention mode is required for stronger protection on internet-facing workloads.

Applies to

Covered asset types

ApplicationGateway

Ensure Application Insights are Configured

Application Insights within Azure act as an Application Performance Monitoring solution, providing valuable data into how well an application performs and additional information when responding to incidents. The types of log data collected include application metrics, telemetry data, and application trace logging data, which provide organizations with detailed information about application activity and transactions. Both data sets help organizations adopt proactive and retroactive means to handle security and performance-related metrics within their modern applications.

Applies to

Covered asset types

Ensure Application Load Balancer uses HTTPS Listener

### Overview

Applies to

Covered asset types

LoadBalancer

Ensure Artifact Registry Docker repositories enforce immutable tags

### Overview

Applies to

ArtifactRegistryRepository

Covered asset types

Ensure Artifact Registry repositories are not publicly accessible

### Overview

Applies to

ArtifactRegistryRepository

Covered asset types

Ensure Artifact Registry repositories use customer-managed encryption keys

### Overview

Applies to

ArtifactRegistryRepository

Covered asset types

Ensure at least two Google Workspace Super Admins are configured

While having too many administrators constitutes a security risk, having only one is also a risk especially when MFA is enforced. You should assign at least two Google Workspace super administrators for access redundancy.

Applies to

Google Workspace

Covered asset types

Ensure at least two Okta admins are configured

While having too many administrators constitutes a security risk, having only one is also a risk especially when MFA is enforced. You should assign at least two Okta administrators for access redundancy.

Applies to

Covered asset types

### Overview

Applies to

Covered asset types

Ensure Azure Cache for Redis disables non-SSL port and enforces TLS 1.2+

Redis often stores sensitive session and cache data. Non-SSL access and weak TLS versions increase interception risk.

Applies to

Covered asset types

RedisInstance

Ensure Azure Container Registry admin user is disabled

ACR admin user provides shared username/password access and should be disabled in favor of Entra ID and RBAC.

Applies to

Covered asset types

ContainerRegistry

Ensure Azure Container Registry public network access is disabled

Container registries should use private endpoints where possible to minimize internet exposure.

Applies to

Covered asset types

ContainerRegistry

Ensure Azure Key Vaults are used to store secrets

Azure Key Vault will store multiple types of sensitive information, such as encryption keys, certificate thumbprints, and Managed Identity Credentials. Access to these secrets can be controlled through granular permissions.

Applies to

Covered asset types

FunctionAppSite

Ensure Basic Authentication is disabled on Kubernetes Engine Clusters

Basic authentication allows a user to authenticate to the cluster with a username and password and it is stored in plain text without any encryption. Disabling Basic authentication will prevent attacks like brute force. Its recommended to use either client certificate or IAM for authentication.

Applies to

Covered asset types

Applies to

Ensure Cloud KMS cryptokeys are not anonymously or publicly accessible

It is recommended that the IAM policy on Cloud KMS cryptokeys should restrict anonymous and/or public access.

Applies to

Covered asset types

KMSKey

Ensure Cloud Spanner uses CMEK for regulated data

Customer-managed encryption keys (CMEK) provide stronger governance and key lifecycle control for regulated workloads.

Applies to

Covered asset types

CloudSpanner

Ensure Cloud SQL database instances are configured with automated backups

It is recommended to have all SQL database instances set to enable automated backups.

Applies to

Covered asset types

Ensure Cloud SQL database instances do not have public IPs

It is recommended to configure Second Generation Sql instance to use private IPs instead of public IPs.

Applies to

Covered asset types

Ensure Cloud SQL Database Instances do not implicitly whitelist all public IP addresses

Database Server should accept connections only from trusted network(s)/IP(s) and restrict access from public IP addresses.

Applies to

Covered asset types

Ensure Cloud Storage buckets have uniform bucket-level access enabled

It is recommended that uniform bucket-level access is enabled on Cloud Storage buckets.

Applies to

Covered asset types

Applies to

Ensure clusters are created with Private Endpoint Enabled and Public Access Disabled

Disable access to the Kubernetes API from outside the node network if it is not required.

Applies to

Covered asset types

EKSCluster

Ensure clusters are created with Private Nodes

Disable public IP addresses for cluster nodes, so that they only have private IP

Applies to

Covered asset types

EKSNodeGroup

Ensure Compute instances are launched with Shielded VM enabled

To defend against advanced threats and ensure that the boot loader and firmware on your VMs are signed and untampered, it is recommended that Compute instances are launched with Shielded VM enabled.

Applies to

Covered asset types

Ensure Compute instances do not have public IP addresses

Compute instances should not be configured to have external IP addresses.

Applies to

Covered asset types

If you created your AWS account before December 4, 2013, you might have support for EC2-Classic in some AWS Regions. Some Amazon EC2 resources and features, such as enhanced networking and newer instance types, require a virtual private cloud (VPC).

Applies to

Covered asset types

Ensure ECR repositories use immutable tags and image scanning

Container images should be protected from tag overwrite and scanned for vulnerabilities.

Applies to

Covered asset types

ECRRepository

Ensure ECS clusters use Container Insights

Container Insights collects metrics at the cluster, task, and service levels.

Applies to

Covered asset types

ECSCluster

Ensure ECS containers run as non-privileged

ECS containers should run as non-privileged. . The control fails if the `privileged` parameter in the container definition of Amazon ECS Task Definitions is set to true.

Applies to

Covered asset types

ECSTaskDefinition

Ensure ECS services don't have public IP addresses assigned to them automatically

This control checks whether Amazon ECS services are configured to automatically assign public IP addresses.

Applies to

Covered asset types

ECSService

Ensure ECS task definitions do not share the host's process namespace

A process ID (PID) namespace provides separation between processes. It prevents system processes from being visible, and allows PIDs to be reused, including PID 1. If the host's PID namespace is shared with containers, it would allow containers to see all of the processes on the host system. This reduces the benefit of process level isolation between the host and the containers. These circumstances could lead to unauthorized access to processes on the host itself, including the ability to manipulate and terminate them. Customers shouldn't share the host's process namespace with containers running on it. This control only evaluates the in-use (RUNNING Task) revision of an Amazon ECS task definition.

Applies to

Covered asset types

Applies to

Ensure Essential Contacts is Configured for Organization

### Description:

Applies to

Covered asset types

Ensure Fewer Than 5 Users Have Global Administrator Assignment

This recommendation aims to balance security and operational efficiency by ensuring that a minimum of 2 and a maximum of 4 users are assigned the Global Administrator role in Microsoft Entra ID. Having at least two Global Administrators ensures redundancy while limiting the number to four reduces the risk of excessive privileged access.

Applies to

Covered asset types

Ensure firewall rule does not allow all traffic for MongoDB (port 27017)

### Overview

Applies to

Covered asset types

Ensure firewall rule does not allow all traffic for MySQL (port 3306)

### Overview

Applies to

Covered asset types

Ensure firewall rule does not allow all traffic for Oracle DB (port 1521)

### Overview

Applies to

Covered asset types

Ensure firewall rule does not allow all traffic for PostgreSQL DB (port 5432)

### Overview

Applies to

Covered asset types

Ensure firewall rule does not allow all traffic on all ports

### Overview

Applies to

Covered asset types

Ensure firewall rule does not allow all traffic on port 80

### Overview

Applies to

Covered asset types

Ensure Firewalls do not allow traffic from the internet

Firewalls/security groups allowing all traffic from the internet increase the **attack surface** of your cloud estate. When these are used to control the traffic to compute resources (most commonly VMs), attackers might be able to take advantage of various vulnerabilities present on these resources to infiltrate into the cloud environment. Then, if the compute resource has permissions to access data stores or other resources, the attacker might **move laterally** through the environment or **access potentially sensitive data**.

Applies to

Covered asset types

FirewallSecurityGroup

Ensure Functions are not publicly accessible

Cyscale looks for functions directly reachable over the internet from any sources - i.e. functions with HTTP triggers/URLs.

Applies to

Covered asset types

Function

4 queries

Ensure Guest Users Are Reviewed on a Regular Basis (Manual)

Microsoft Entra ID is extended to include Azure AD B2B collaboration, allowing you to invite people outside your organization to be guest users in your cloud account and sign in with their work, school, or social identities. Guest users allow you to share your company's applications and services with users from any other organization while maintaining control over your corporate data.

Applies to

Covered asset types

Ensure hardware MFA is enabled for the "root" account (Hardware MFA)

The root account is the most privileged user in an AWS account. MFA adds an extra layer of protection on top of a user name and password. With MFA enabled, when a user signs in to an AWS website, they will be prompted for their user name and password as well as for an authentication code from their AWS MFA device. For Level 2, it is recommended that the root account be protected with a hardware MFA.

Applies to

Covered asset types

Ensure high-risk cloud events have alerting policies

Detection without alerting delays incident response. High-risk events should always trigger notifications.

Applies to

Covered asset types

AlertPolicy

Ensure HTTP(S) access from the Internet is evaluated and restricted

Network security groups should be periodically evaluated for port misconfigurations. Where certain ports and protocols may be exposed to the Internet, they should be evaluated for necessity and restricted wherever they are not explicitly required and narrowly configured.

Applies to

Covered asset types

SecurityGroup

Ensure IAM Access Analyzer is enabled in all active regions

IAM Access Analyzer helps identify unintended external access paths to resources.

Applies to

Covered asset types

Applies to

Covered asset types

Ensure IAM password policy requires at least one symbol

Applies to

Covered asset types

It is recommended to configure your instance to not use the default Compute Engine service account because it has the Editor role on the project.

Applies to

Covered asset types

Ensure Key Vaults are Recoverable

The Key Vault contains object keys, secrets, and certificates. Accidental unavailability of a Key Vault can cause immediate data loss or loss of security functions (authentication, validation, verification, non-repudiation, etc.) supported by the Key Vault objects.

Applies to

Covered asset types

KMSVault

Ensure Kinesis Data Streams use encryption at rest

With server-side encryption, your Kinesis stream producers and consumers don't need to manage master keys or cryptographic operations. Your data is automatically encrypted as it enters and leaves the Kinesis Data Streams service, so your data at rest is encrypted.

Applies to

Covered asset types

KinesisDataStream

Ensure KMS encryption keys are rotated within a period of 90 days

Google Cloud Key Management Service stores cryptographic keys in a hierarchical structure designed for useful and elegant access control management.

Applies to

Covered asset types

KMSKey

Ensure KMSKeys are not exposed through publicly accessible VMs

### Overview

Applies to

Covered asset types

Applies to

Ensure Legacy Authorization is set to Disabled on Kubernetes Engine Clusters

In Kubernetes, authorizers interact by granting a permission if any authorizer grants the permission. The legacy authorizer in Kubernetes Engine grants broad, statically defined permissions. To ensure that RBAC limits permissions correctly, you must disable the legacy authorizer. RBAC has significant security advantages, can help you ensure that users only have access to cluster resources within their own namespace and is now stable in Kubernetes.

Applies to

Covered asset types

Applies to

Covered asset types

FirewallSecurityGroup

Ensure Master authorized networks is set to Enabled on Kubernetes Engine Clusters

Authorized networks are a way of specifying a restricted range of IP addresses that are permitted to access your container cluster's Kubernetes master endpoint. Kubernetes Engine uses both Transport Layer Security (TLS) and authentication to provide secure access to your container cluster's Kubernetes master endpoint from the public internet. This provides you the flexibility to administer your cluster from anywhere; however, you might want to further restrict access to a set of IP addresses that you control. You can set this restriction by specifying an authorized network.

Applies to

Covered asset types

Cluster

Ensure MFA Delete is enabled on S3 buckets

### Overview

Applies to

Covered asset types

Bucket

Ensure MFA is configured with strong factors

While adopting MFA is a great step forward, some factors are safer than others. As you might imagine a code (OTP) sent through SMS or email, which is still prone to phishing attacks, is considerably less secure than a biometric factor for example.

Applies to

Covered asset types

Policy

Ensure MFA is enabled for the 'root' account

Applies to

Applies to

Ensure Network Load Balancer uses TLS Listener

Use secure listeners to support encrypted communication between clients and your load balancers. You can use AWS Certificate Manager (ACM) or AWS Identity and Access Management (IAM) to manage the server certificates installed on your load balancer.

Applies to

Covered asset types

Applies to

Ensure no SSL certificates expire in the next 14 days

ACMSSLCertificateComputeSSLCertificateIAMServerCertificateSSLCertificate

SSL/TLS server certificate is required to enable HTTPS connections to your website or application.

Applies to

AWSGoogle Cloud

Covered asset types

Ensure Only Approved Extensions Are Installed (Manual)

Only install organization-approved extensions on VMs.

Applies to

Covered asset types

Ensure only MFA enabled identities can access privileged Virtual Machine

Verify identities without MFA that can log in to a privileged virtual machine using separate login credentials. An adversary can leverage the access to move laterally and perform actions with the virtual machine's managed identity. Ensure the virtual machine only has necessary permissions, and revoke the admin-level permissions according to the least privileges principle.

Applies to

Covered asset types

Ensure oslogin is enabled for a Project

Enabling OS login binds SSH certificates to IAM users and facilitates effective SSH certificate management.

Applies to

Covered asset types

Project

Ensure parameter 'log_connections' is set to 'ON' for PostgreSQL Database

Applies to

Applies to

Covered asset types

Applies to

Covered asset types

Ensure RAM policies are attached only to groups or roles

### Description

Applies to

Alibaba Cloud

Covered asset types

IAMUser

Ensure RAM policies that allow full ':'' administrative privileges are not created

Applies to

Covered asset types

Applies to

Ensure rotation for customer-created symmetric CMKs is enabled

AWS Key Management Service (KMS) allows customers to rotate the backing key which is key material stored within the KMS which is tied to the key ID of the Customer Created customer master key (CMK). It is the backing key that is used to perform cryptographic operations such as encryption and decryption. Automated key rotation currently retains all prior backing keys so that decryption of encrypted data can take place transparently. It is recommended that CMK key rotation be enabled.

Applies to

Covered asset types

KMSKey

Ensure routing tables for VPC peering are 'least access'

Applies to

Ensure routing tables for VPC peering are "least access"

Once a VPC peering connection is established, routing tables must be updated to establish any connections between the peered VPCs. These routes can be as specific as desired - even peering a VPC to only a single host on the other side of the connection.

Applies to

Ensure RSASHA1 is not used for the key-signing key in Cloud DNS DNSSEC

NOTE: Currently, the SHA1 algorithm has been removed from general use by Google, and, if being used, needs to be whitelisted on a project basis by Google and will also, therefore, require a Google Cloud support contract.

Applies to

Covered asset types

Applies to

Ensure security contact information is registered

### Overview

Applies to

Ensure Security Defaults is enabled on Microsoft Entra ID

> If your organization pays for Microsoft Entra ID licensing (included in Microsoft 365 E3, E5, or F5, and EM&S E3 or E5 licenses) and CAN use Conditional Access, ignore the recommendations in this section and proceed to the Conditional Access section.

Applies to

Covered asset types

Applies to

Applies to

Ensure that OS disks (boot volumes) and data disks (non-boot volumes) are encrypted with CMK (Customer Managed Keys). Customer Managed Keys can be used with either ADE (Azure Disk Encryption) or SSE (Server Side Encryption).

Applies to

Covered asset types

Ensure that 'PHP version' is currently supported (if in use)

Periodically, older versions of PHP may be deprecated and no longer supported. Using a supported version of PHP for app services is recommended to avoid potential unpatched vulnerabilities.

Applies to

Covered asset types

Ensure that 'Python version' is currently supported (if in use)

Periodically, newer versions are released for Python software either due to security flaws or to include additional functionality. Using the latest Python version for web apps is recommended in order to take advantage of security fixes, if any, and/or new functionalities of the newer version.

Applies to

Covered asset types

Ensure that 'Secure transfer required' is set to 'Enabled'

Applies to

Ensure that 'TDE' is set to 'Enabled' for applicable database instances

### Description

Applies to

Alibaba Cloud

Covered asset types

DBInstance

Ensure that 'Unattached disks' are encrypted

Applies to

Covered asset types

Ensure that 'Unattached disks' are encrypted with Customer Managed Keys (CMK)

Ensure that unattached disks in a subscription are encrypted with a Customer Managed Key (CMK).

Applies to

Covered asset types

Install endpoint protection for all virtual machines.

Applies to

Ensure that IAM Access analyzer is enabled for all regions

Enable IAM Access analyzer for IAM policies about all resources in each region.

Applies to

Covered asset types

Ensure that instances are not configured to use the default service account with full access to all Cloud APIs

To support principle of least privileges and prevent potential privilege escalation it is recommended that instances are not assigned to default service account `Compute Engine default service account` with Scope `Allow full access to all Cloud APIs`.

Applies to

Covered asset types

Ensure that IP forwarding is not enabled on Instances

Compute Engine instance cannot forward a packet unless the source IP address of the packet matches the IP address of the instance. Similarly, GCP won't deliver a packet whose destination IP address is different than the IP address of the instance receiving the packet. However, both capabilities are required if you want to use instances to help route packets.

Applies to

Covered asset types

Ensure that logging is enabled for Cloud Storage buckets

Storage Access Logging generates a log that contains access records for each request made to the Storage bucket. An access log record contains details about the request, such as the request type, the resources specified in the request worked, and the time and date the request was processed. Cloud Storage offers access logs and storage logs in the form of CSV files that can be downloaded and used for analysis/incident response. Access logs provide information for all of the requests made on a specified bucket and are created hourly, while the daily storage logs provide information about the storage consumption of that bucket for the last day. The access logs and storage logs are automatically created as new objects in a bucket that you specify. An access log record contains details about the request, such as the request type, the resources specified in the request worked, and the time and date the request was processed. While storage Logs helps to keep track the amount of data stored in the bucket. It is recommended that storage Access Logs and Storage logs are enabled for every Storage Bucket.

Applies to

Covered asset types

Bucket

Ensure that logging is enabled for OSS buckets

Applies to

Covered asset types

Ensure that Logstore data retention period is set to 365 days or greater

Applies to

Ensure that MySql database instances do not allow root login from any Host

It is recommended that root access to a MySql Database Instance should be allowed only through specific white-listed trusted IPs.

Applies to

Covered asset types

Applies to

Covered asset types

Ensure that RDS instances are not open to the world

Applies to

Alibaba Cloud

Ensure that Resource Locks are set for mission critical Azure resources

Resource Manager Locks provide a way for administrators to lock down Azure resources to prevent deletion of, or modifications to, a resource. These locks sit outside of the Role Based Access Controls (RBAC) hierarchy and, when applied, will place restrictions on the resource for all users. These locks are very useful when there is an important resource in a subscription that users should not be able to delete or change. Locks can help prevent accidental and malicious changes or deletion

Applies to

Ensure that S3 Buckets are configured with 'Block public access (bucket settings)'

Amazon S3 provides *Block public access (bucket settings)* and *Block public access (account settings)* to help you manage public access to Amazon S3 resources. By default, S3 buckets and objects are created with public access disabled. However with an IAM principle with sufficient S3 permissions can enable public access at the bucket and/or object level.

Applies to

Covered asset types

Bucket

Ensure that scheduled vulnerability scan is enabled on all servers

Applies to

Applies to

Ensure that the latest OS Patches for all Virtual Machines are applied

Applies to

Ensure that the shared URL signature expires within an hour

Applies to

Ensure that there are only GCP-managed service account keys for each service account

User-managed service accounts should not have user-managed keys.

Applies to

Covered asset types

IAMServiceAccount

Ensure that URL signature is allowed only over https

Applies to

Applies to

Covered asset types

Ensure the S3 bucket used to store CloudTrail logs is not publicly accessible

CloudTrail logs a record of every API call made in your AWS account. These logs file are stored in an S3 bucket. It is recommended that the bucket policy, or access control list (ACL), applied to the S3 bucket that CloudTrail logs to prevents public access to the CloudTrail logs.

Applies to

Covered asset types

When **Secure Boot** and **vTPM** are enabled together, they provide a strong foundation for protecting your VM from boot attacks. For example, if an attacker attempts to replace the bootloader with a malicious version, Secure Boot will prevent the VM from booting. If the attacker is able to bypass Secure Boot and install a malicious bootloader, vTPM can detect the intrusion and alert you.

Applies to

Covered asset types

Ensure Trusted Locations Are Defined

Microsoft Entra ID Conditional Access allows an organization to configure `Named locations` and configure whether those locations are trusted or untrusted. These settings provide organizations the means to specify `Geographical locations` for use in conditional access policies, or define actual IP addresses and IP ranges and whether or not those IP addresses and/or ranges are trusted by the organization.

Applies to

Covered asset types

Migrate BLOB based VHDs to Managed Disks on Virtual Machines to exploit the default features of this configuration. The features include:

Applies to

Covered asset types

Ensure virtual network flow log service is enabled

Applies to

Ensure VM disks for critical VMs are encrypted with Customer-Supplied Encryption Keys (CSEK)

Customer-Supplied Encryption Keys (CSEK) are a feature in Google Cloud Storage and Google Compute Engine. If you supply your own encryption keys, Google uses your key to protect the Google-generated keys used to encrypt and decrypt your data. By default, Google Compute Engine encrypts all data at rest. Compute Engine handles and manages this encryption for you without any additional actions on your part. However, if you wanted to control and manage this encryption yourself, you can provide your own encryption keys.

Applies to

Covered asset types

Disk

Ensure VMs are not publicly accessible

Cyscale looks for virtual machines reachable from the internet on administration ports (22, 3389). To reduce the risk of data breaches, configure the security groups/firewalls to allow access only from specific sources or re-consider whether you really need SSH/RDP access.

Applies to

Covered asset types

3 queries

Ensure VPC flow logging is enabled in all VPCs

VPC Flow Logs is a feature that enables you to capture information about the IP traffic going to and from network interfaces in your VPC. After you've created a flow log, you can view and retrieve its data in Amazon CloudWatch Logs. It is recommended that VPC Flow Logs be enabled for packet "Rejects" for VPCs.

Applies to

Covered asset types

Applies to

Covered asset types

Identities allowing external access

Identities that can be assumed or impersonated by external principals create a direct cross-tenant access path.

Applies to

AWSGoogle Cloud

Covered asset types

IAMRoleIAMServiceAccount

Identity Provider Inactive Users

Check Identity Provider Users with last login older than 30 days

Applies to

Covered asset types

Identity Provider Super Administrators

Get super administrators from added identity provider connectors

Applies to

Covered asset types

Identity Provider Users With Old Password

Get Identity Provider Users with passwords older than 90 days

Applies to

Covered asset types

Launch Templates Should Not Allow Metadata Response Hop Limit Higher Than 1

Launch templates should not allow a metadata hop count greater than 1 when source/destination check is disabled.

Applies to

Covered asset types

LaunchTemplateVersion

Launch Templates Should Only Allow IMDSv2

With IMDSv2, every request is now protected by session authentication. A session begins and ends a series of requests that software running on an EC2 instance uses to access the locally-stored EC2 instance metadata and credentials. The software starts a session with a simple HTTP PUT request to IMDSv2.

Applies to

Covered asset types

LaunchTemplateVersion

Launch Templates with Disk Configuration Should Encrypt the Disks

### Overview

Applies to

Covered asset types

LaunchTemplateVersion

Limit the use of bind, impersonate and escalate permissions

ClusterRoleBindingRoleBinding

Cluster roles and roles with the impersonate, bind or escalate permissions should not be granted unless strictly required. Each of these permissions allow a particular subject to escalate their privileges beyond those explicitly granted by cluster administrators.

Applies to

Kubernetes

Covered asset types

9 queries

Maintain current contact details

### Overview

Applies to