mirror of
https://github.com/prowler-cloud/prowler.git
synced 2026-07-24 04:51:51 +00:00
chore(oraclecloud): enhance metadata for network service (#9378)
Co-authored-by: Daniel Barranquero <danielbo2001@gmail.com>
This commit is contained in:
Rubén De la Torre Vico
committed by
GitHub
GitHub
parent
be6d1823c9
commit
2e236a2cd1
@@ -26,6 +26,7 @@ All notable changes to the **Prowler SDK** are documented in this file.
|
||||
- Update Oracle Cloud File Storage service metadata to new format [(#9374)](https://github.com/prowler-cloud/prowler/pull/9374)
|
||||
- Update Oracle Cloud Integration service metadata to new format [(#9376)](https://github.com/prowler-cloud/prowler/pull/9376)
|
||||
- Update Oracle Cloud KMS service metadata to new format [(#9377)](https://github.com/prowler-cloud/prowler/pull/9377)
|
||||
- Update Oracle Cloud Network service metadata to new format [(#9378)](https://github.com/prowler-cloud/prowler/pull/9378)
|
||||
|
||||
---
|
||||
|
||||
|
||||
+18
-17
@@ -1,35 +1,36 @@
|
||||
{
|
||||
"Provider": "oraclecloud",
|
||||
"CheckID": "network_default_security_list_restricts_traffic",
|
||||
"CheckTitle": "Ensure the default security list of every VCN restricts all traffic except ICMP",
|
||||
"CheckType": [
|
||||
"Software and Configuration Checks",
|
||||
"Industry and Regulatory Standards",
|
||||
"CIS OCI Foundations Benchmark"
|
||||
],
|
||||
"CheckTitle": "Default security list restricts all traffic except ICMP within VCN",
|
||||
"CheckType": [],
|
||||
"ServiceName": "network",
|
||||
"SubServiceName": "",
|
||||
"ResourceIdTemplate": "oci:network:securitylist",
|
||||
"ResourceIdTemplate": "",
|
||||
"Severity": "high",
|
||||
"ResourceType": "OciNetworkSecurityList",
|
||||
"ResourceType": "SecurityList",
|
||||
"ResourceGroup": "network",
|
||||
"Description": "Ensure the default security list of every VCN restricts all traffic except ICMP within VCN. A default security list is automatically created when you create a VCN. It is recommended that the default security list restrict all traffic except for ICMP within the VCN.",
|
||||
"Risk": "The default security list should not be used for any purpose other than as a fail-safe. It is recommended to create custom security lists for your resources.",
|
||||
"RelatedUrl": "https://docs.oracle.com/en-us/iaas/Content/Network/Concepts/securitylists.htm",
|
||||
"Description": "**OCI default security list** of each VCN is evaluated to allow only VCN-internal `ICMP`. Non-`ICMP` ingress from `0.0.0.0/0` or sources outside the VCN, and non-`ICMP` egress to `0.0.0.0/0`, are considered overly permissive. Only default lists are in scope.",
|
||||
"Risk": "Over-permissive default rules expose subnet workloads to the Internet and enable unrestricted outbound traffic. This risks confidentiality (unauthorized access, data exfiltration), integrity (remote exploitation, lateral movement), and availability (DoS/C2) through broad non-`ICMP` `0.0.0.0/0` paths.",
|
||||
"RelatedUrl": "",
|
||||
"AdditionalURLs": [
|
||||
"https://docs.oracle.com/en-us/iaas/Content/Network/Concepts/securitylists.htm",
|
||||
"https://www.trendmicro.com/trendaivisiononecloudriskmanagement/knowledge-base/oci/OCI-Networking/restrict-traffic-for-default-security-lists.html"
|
||||
],
|
||||
"Remediation": {
|
||||
"Code": {
|
||||
"CLI": "oci network security-list update --security-list-id <default-security-list-ocid> --ingress-security-rules <restricted-rules-json> --egress-security-rules <restricted-rules-json>",
|
||||
"CLI": "oci network security-list update --security-list-id <default-security-list-ocid> --ingress-security-rules '[{\"protocol\":\"1\",\"source\":\"<VCN_CIDR>\"}]' --egress-security-rules '[{\"protocol\":\"1\",\"destination\":\"<VCN_CIDR>\"}]'",
|
||||
"NativeIaC": "",
|
||||
"Other": "https://www.trendmicro.com/cloudoneconformity/knowledge-base/oci/OCI-Networking/restrict-traffic-for-default-security-lists.html",
|
||||
"Terraform": ""
|
||||
"Other": "1. Sign in to the OCI Console\n2. Go to Networking > Virtual Cloud Networks and select your VCN\n3. Open Security Lists and select the default security list\n4. Click Edit All Rules\n5. Remove all non-ICMP ingress and egress rules\n6. Add an ingress rule: Protocol ICMP, Source <VCN_CIDR>\n7. Add an egress rule: Protocol ICMP, Destination <VCN_CIDR>\n8. Save changes",
|
||||
"Terraform": "```hcl\nresource \"oci_core_default_security_list\" \"<example_resource_name>\" {\n manage_default_resource_id = \"<default_security_list_ocid>\" # Critical: targets the default security list\n\n ingress_security_rules {\n protocol = \"1\" # Critical: allow only ICMP\n source = \"<VCN_CIDR>\" # Critical: restrict to VCN\n }\n\n egress_security_rules {\n protocol = \"1\" # Critical: allow only ICMP\n destination = \"<VCN_CIDR>\" # Critical: restrict to VCN\n }\n}\n```"
|
||||
},
|
||||
"Recommendation": {
|
||||
"Text": "Configure the default security list to restrict all traffic except ICMP within the VCN. Create custom security lists for your resources.",
|
||||
"Url": "https://docs.oracle.com/en-us/iaas/Content/Network/Concepts/securitylists.htm"
|
||||
"Text": "Adopt a **deny-by-default** stance on the default list: allow only VCN-local `ICMP` for diagnostics. Use dedicated security lists or **network security groups** per application to explicitly allow needed ports and sources, and restrict egress to approved ranges. Review regularly under **least privilege**.",
|
||||
"Url": "https://hub.prowler.com/check/network_default_security_list_restricts_traffic"
|
||||
}
|
||||
},
|
||||
"Categories": [
|
||||
"network-security"
|
||||
"internet-exposed",
|
||||
"trust-boundaries"
|
||||
],
|
||||
"DependsOn": [],
|
||||
"RelatedTo": [],
|
||||
|
||||
+17
-17
@@ -1,35 +1,35 @@
|
||||
{
|
||||
"Provider": "oraclecloud",
|
||||
"CheckID": "network_security_group_ingress_from_internet_to_rdp_port",
|
||||
"CheckTitle": "Ensure no network security groups allow ingress from 0.0.0.0/0 to port 3389",
|
||||
"CheckType": [
|
||||
"Software and Configuration Checks",
|
||||
"Industry and Regulatory Standards",
|
||||
"CIS OCI Foundations Benchmark"
|
||||
],
|
||||
"CheckTitle": "Network security group restricts ingress from 0.0.0.0/0 to port 3389 (RDP)",
|
||||
"CheckType": [],
|
||||
"ServiceName": "network",
|
||||
"SubServiceName": "",
|
||||
"ResourceIdTemplate": "oci:network:vcn",
|
||||
"ResourceIdTemplate": "",
|
||||
"Severity": "high",
|
||||
"ResourceType": "OciVcn",
|
||||
"ResourceType": "NetworkSecurityGroup",
|
||||
"ResourceGroup": "network",
|
||||
"Description": "Network security groups should not allow unrestricted RDP access from the internet.",
|
||||
"Risk": "Not meeting this network security requirement increases risk of unauthorized access.",
|
||||
"RelatedUrl": "https://docs.oracle.com/en-us/iaas/Content/Network/home.htm",
|
||||
"Description": "**OCI Network Security Groups** are evaluated for inbound source `0.0.0.0/0` permitting **RDP** on `TCP 3389`, including broad rules (all TCP or any protocol) that implicitly include that port.",
|
||||
"Risk": "Exposed **RDP** enables Internet-scale **brute-force** and **protocol exploit** attempts. Compromise yields interactive access for **data exfiltration** (C), **unauthorized changes** (I), and **service disruption** via ransomware (A), with potential **lateral movement** across the VCN.",
|
||||
"RelatedUrl": "",
|
||||
"AdditionalURLs": [
|
||||
"https://docs.oracle.com/en-us/iaas/Content/Network/home.htm",
|
||||
"https://www.trendmicro.com/trendaivisiononecloudriskmanagement/knowledge-base/oci/OCI-Networking/unrestricted-rdp-access-via-nsgs.html"
|
||||
],
|
||||
"Remediation": {
|
||||
"Code": {
|
||||
"CLI": "",
|
||||
"CLI": "oci network nsg rules delete --network-security-group-id <NSG_OCID> --security-rule-id <SECURITY_RULE_ID>",
|
||||
"NativeIaC": "",
|
||||
"Other": "https://www.trendmicro.com/cloudoneconformity/knowledge-base/oci/OCI-Networking/unrestricted-rdp-access-via-nsgs.html",
|
||||
"Terraform": ""
|
||||
"Other": "1. In the OCI Console, go to Networking > Network Security Groups\n2. Open the <NSG_NAME>\n3. Click Security Rules, then the Ingress tab\n4. Find the rule with Source 0.0.0.0/0 and Protocol TCP (or All) allowing port 3389\n5. Click Delete to remove the rule\n - If RDP is required, Edit instead and set Source to a specific CIDR (not 0.0.0.0/0)\n6. Save changes",
|
||||
"Terraform": "```hcl\nresource \"oci_core_network_security_group_security_rule\" \"<example_resource_name>\" {\n network_security_group_id = \"<example_resource_id>\"\n direction = \"INGRESS\"\n protocol = \"6\" # TCP\n source = \"10.0.0.0/8\" # Critical: not 0.0.0.0/0; restricts RDP to an internal CIDR to remove internet exposure\n\n tcp_options {\n destination_port_range {\n min = 3389 # Critical: explicit RDP port\n max = 3389 # Critical: ensures only 3389 is allowed\n }\n }\n}\n```"
|
||||
},
|
||||
"Recommendation": {
|
||||
"Text": "Ensure no network security groups allow ingress from 0.0.0.0/0 to port 3389",
|
||||
"Url": "https://hub.prowler.com/check/oci/network_security_group_ingress_from_internet_to_rdp_port"
|
||||
"Text": "Eliminate open `0.0.0.0/0` rules. Restrict **RDP** to trusted IPs and only when necessary. Prefer **private connectivity** via **VPN**, **bastion/jump hosts**, or **zero-trust** brokers. Apply **least privilege** and time-bound access, monitor logs, and disable RDP where unnecessary.",
|
||||
"Url": "https://hub.prowler.com/check/network_security_group_ingress_from_internet_to_rdp_port"
|
||||
}
|
||||
},
|
||||
"Categories": [
|
||||
"network-security"
|
||||
"internet-exposed"
|
||||
],
|
||||
"DependsOn": [],
|
||||
"RelatedTo": [],
|
||||
|
||||
+17
-18
@@ -1,36 +1,35 @@
|
||||
{
|
||||
"Provider": "oraclecloud",
|
||||
"CheckID": "network_security_group_ingress_from_internet_to_ssh_port",
|
||||
"CheckTitle": "Ensure no network security groups allow ingress from 0.0.0.0/0 to port 22",
|
||||
"CheckType": [
|
||||
"Software and Configuration Checks",
|
||||
"Industry and Regulatory Standards",
|
||||
"CIS OCI Foundations Benchmark"
|
||||
],
|
||||
"CheckTitle": "Network security group restricts ingress from 0.0.0.0/0 to port 22 (SSH)",
|
||||
"CheckType": [],
|
||||
"ServiceName": "network",
|
||||
"SubServiceName": "",
|
||||
"ResourceIdTemplate": "oci:network:networksecuritygroup",
|
||||
"ResourceIdTemplate": "",
|
||||
"Severity": "high",
|
||||
"ResourceType": "OciNetworkSecurityGroup",
|
||||
"ResourceType": "NetworkSecurityGroup",
|
||||
"ResourceGroup": "network",
|
||||
"Description": "Ensure no network security groups allow ingress from 0.0.0.0/0 to port 22. Network security groups provide stateful or stateless filtering of ingress and egress network traffic to OCI resources.",
|
||||
"Risk": "Removing unfettered connectivity to remote console services, such as SSH, reduces a server's exposure to risk.",
|
||||
"RelatedUrl": "https://docs.oracle.com/en-us/iaas/Content/Network/Concepts/networksecuritygroups.htm",
|
||||
"Description": "Network security groups with **ingress** from `0.0.0.0/0` exposing **SSH** are identified. This includes rules that explicitly permit `TCP` `22`, use `all` protocols, or define TCP port ranges that encompass `22`.",
|
||||
"Risk": "Public **SSH** access enables Internet-wide probing, **brute force**, and **credential stuffing** that can grant shell access. Compromise allows **lateral movement**, data exfiltration (confidentiality), unauthorized changes or malware (integrity), and service disruption or ransomware-driven lockouts (availability).",
|
||||
"RelatedUrl": "",
|
||||
"AdditionalURLs": [
|
||||
"https://www.trendmicro.com/trendaivisiononecloudriskmanagement/knowledge-base/oci/OCI-Networking/unrestricted-ssh-access-via-nsgs.html",
|
||||
"https://docs.oracle.com/en-us/iaas/Content/Network/Concepts/networksecuritygroups.htm"
|
||||
],
|
||||
"Remediation": {
|
||||
"Code": {
|
||||
"CLI": "oci network nsg rules update --nsg-id <nsg-ocid> --security-rules <updated-rules-json>",
|
||||
"CLI": "oci network nsg rules remove --nsg-id <nsg-ocid> --security-rule-ids '[\"<rule-ocid>\"]'",
|
||||
"NativeIaC": "",
|
||||
"Other": "https://www.trendmicro.com/cloudoneconformity/knowledge-base/oci/OCI-Networking/unrestricted-ssh-access-via-nsgs.html",
|
||||
"Terraform": ""
|
||||
"Other": "1. In the OCI Console, go to Networking > Network Security Groups\n2. Open the target NSG and go to the Rules tab\n3. Find the INGRESS rule with Source 0.0.0.0/0 that includes TCP port 22\n4. Click Remove to delete that rule\n5. (If SSH is required) Add a new INGRESS rule for TCP port 22 with Source set to a specific trusted CIDR (not 0.0.0.0/0), then Save",
|
||||
"Terraform": "```hcl\n# Restrict SSH so it's not from 0.0.0.0/0\nresource \"oci_core_network_security_group_security_rule\" \"<example_resource_name>\" {\n network_security_group_id = \"<example_resource_id>\"\n direction = \"INGRESS\"\n protocol = \"6\" # TCP\n source = \"10.0.0.0/8\" # CRITICAL: not 0.0.0.0/0; limits SSH to internal range\n\n tcp_options {\n destination_port_range {\n min = 22 # CRITICAL: explicitly defines SSH port\n max = 22\n }\n }\n}\n```"
|
||||
},
|
||||
"Recommendation": {
|
||||
"Text": "Update network security groups to remove ingress rules allowing access from 0.0.0.0/0 to port 22. Restrict SSH access to known IP addresses.",
|
||||
"Url": "https://docs.oracle.com/en-us/iaas/Content/Network/Concepts/networksecuritygroups.htm"
|
||||
"Text": "Enforce **least privilege**: limit SSH in NSG rules to trusted CIDRs or private networks. Prefer **bastion access** (e.g., OCI Bastion) or **VPN/private connectivity** over direct Internet exposure. Use key-based auth, disable `PasswordAuthentication`, log and monitor access, and segment workloads for **defense in depth**.",
|
||||
"Url": "https://hub.prowler.com/check/network_security_group_ingress_from_internet_to_ssh_port"
|
||||
}
|
||||
},
|
||||
"Categories": [
|
||||
"internet-exposed",
|
||||
"network-security"
|
||||
"internet-exposed"
|
||||
],
|
||||
"DependsOn": [],
|
||||
"RelatedTo": [],
|
||||
|
||||
+16
-16
@@ -1,35 +1,35 @@
|
||||
{
|
||||
"Provider": "oraclecloud",
|
||||
"CheckID": "network_security_list_ingress_from_internet_to_rdp_port",
|
||||
"CheckTitle": "Ensure no security lists allow ingress from 0.0.0.0/0 to port 3389",
|
||||
"CheckType": [
|
||||
"Software and Configuration Checks",
|
||||
"Industry and Regulatory Standards",
|
||||
"CIS OCI Foundations Benchmark"
|
||||
],
|
||||
"CheckTitle": "Security list restricts ingress from 0.0.0.0/0 to port 3389 (RDP)",
|
||||
"CheckType": [],
|
||||
"ServiceName": "network",
|
||||
"SubServiceName": "",
|
||||
"ResourceIdTemplate": "oci:network:vcn",
|
||||
"ResourceIdTemplate": "",
|
||||
"Severity": "high",
|
||||
"ResourceType": "OciVcn",
|
||||
"ResourceType": "SecurityList",
|
||||
"ResourceGroup": "network",
|
||||
"Description": "Security lists should not allow unrestricted RDP access from the internet.",
|
||||
"Risk": "Not meeting this network security requirement increases risk of unauthorized access.",
|
||||
"RelatedUrl": "https://docs.oracle.com/en-us/iaas/Content/Network/home.htm",
|
||||
"Description": "**OCI security lists** are evaluated for rules that permit **inbound RDP** from the Internet: any source `0.0.0.0/0` allowing **TCP 3389**-including rules that allow all TCP ports or all protocols-signals public RDP exposure.",
|
||||
"Risk": "Exposed RDP enables:\n- **Brute-force/credential stuffing** to gain console access\n- **RCE via RDP flaws** and **lateral movement**\n\nImpact: data exfiltration (confidentiality), unauthorized changes (integrity), and disruption or ransomware (availability).",
|
||||
"RelatedUrl": "",
|
||||
"AdditionalURLs": [
|
||||
"https://docs.oracle.com/en-us/iaas/Content/Network/home.htm",
|
||||
"https://www.trendmicro.com/trendaivisiononecloudriskmanagement/knowledge-base/oci/OCI-Networking/unrestricted-rdp-access.html"
|
||||
],
|
||||
"Remediation": {
|
||||
"Code": {
|
||||
"CLI": "",
|
||||
"NativeIaC": "",
|
||||
"Other": "https://www.trendmicro.com/cloudoneconformity/knowledge-base/oci/OCI-Networking/unrestricted-rdp-access.html",
|
||||
"Terraform": ""
|
||||
"Other": "1. In the OCI Console, go to Networking > Virtual Cloud Networks and select your VCN\n2. Under Resources, click Security Lists and open the list attached to the affected subnet\n3. In Ingress Rules, locate any rule with Source CIDR 0.0.0.0/0 that allows TCP port 3389 or All Protocols\n4. Delete that rule, or edit it so Source CIDR is a restricted range (e.g., your IP) and Destination Port is 3389 only\n5. Click Save Changes",
|
||||
"Terraform": "```hcl\nresource \"oci_core_security_list\" \"<example_resource_name>\" {\n compartment_id = \"<example_resource_id>\"\n vcn_id = \"<example_resource_id>\"\n\n ingress_security_rules {\n protocol = \"6\" # TCP\n source = \"10.0.0.0/8\" # CRITICAL: not 0.0.0.0/0; restricts RDP to trusted range to avoid open Internet\n tcp_options {\n destination_port_range {\n min = 3389 # CRITICAL: limit to RDP port only\n max = 3389\n }\n }\n }\n}\n```"
|
||||
},
|
||||
"Recommendation": {
|
||||
"Text": "Ensure no security lists allow ingress from 0.0.0.0/0 to port 3389",
|
||||
"Url": "https://hub.prowler.com/check/oci/network_security_list_ingress_from_internet_to_rdp_port"
|
||||
"Text": "Block Internet access to RDP. \n- Deny `0.0.0.0/0` to `3389`; allow only trusted CIDRs.\n- Prefer **private access** via a bastion, VPN, or zero-trust remote management.\n- Enforce **least privilege** network rules, use **defense in depth**, and adopt *just-in-time* administrative access.",
|
||||
"Url": "https://hub.prowler.com/check/network_security_list_ingress_from_internet_to_rdp_port"
|
||||
}
|
||||
},
|
||||
"Categories": [
|
||||
"network-security"
|
||||
"internet-exposed"
|
||||
],
|
||||
"DependsOn": [],
|
||||
"RelatedTo": [],
|
||||
|
||||
+17
-18
@@ -1,36 +1,35 @@
|
||||
{
|
||||
"Provider": "oraclecloud",
|
||||
"CheckID": "network_security_list_ingress_from_internet_to_ssh_port",
|
||||
"CheckTitle": "Ensure no security lists allow ingress from 0.0.0.0/0 to port 22",
|
||||
"CheckType": [
|
||||
"Software and Configuration Checks",
|
||||
"Industry and Regulatory Standards",
|
||||
"CIS OCI Foundations Benchmark"
|
||||
],
|
||||
"CheckTitle": "Security list restricts ingress from 0.0.0.0/0 to port 22 (SSH)",
|
||||
"CheckType": [],
|
||||
"ServiceName": "network",
|
||||
"SubServiceName": "",
|
||||
"ResourceIdTemplate": "oci:network:securitylist",
|
||||
"ResourceIdTemplate": "",
|
||||
"Severity": "high",
|
||||
"ResourceType": "OciNetworkSecurityList",
|
||||
"ResourceType": "SecurityList",
|
||||
"ResourceGroup": "network",
|
||||
"Description": "Ensure no security lists allow ingress from 0.0.0.0/0 to port 22. Security lists provide stateful or stateless filtering of ingress and egress network traffic to OCI resources.",
|
||||
"Risk": "Removing unfettered connectivity to remote console services, such as SSH, reduces a server's exposure to risk.",
|
||||
"RelatedUrl": "https://docs.oracle.com/en-us/iaas/Content/Network/Concepts/securitylists.htm",
|
||||
"Description": "**OCI security lists** are evaluated for rules that permit **inbound SSH** from `0.0.0.0/0`. Any rule where the destination includes `TCP 22`-or broader rules allowing all TCP or all protocols from `0.0.0.0/0`-indicates public SSH exposure.",
|
||||
"Risk": "**Public SSH access** enables Internet-wide **brute force** and **credential stuffing**, risking unauthorized shell access. Compromise can cause data exfiltration (**confidentiality**), command tampering (**integrity**), service disruption (**availability**), and lateral movement in the VCN.",
|
||||
"RelatedUrl": "",
|
||||
"AdditionalURLs": [
|
||||
"https://docs.oracle.com/en-us/iaas/Content/Network/Concepts/securitylists.htm",
|
||||
"https://www.trendmicro.com/trendaivisiononecloudriskmanagement/knowledge-base/oci/OCI-Networking/unrestricted-ssh-access.html"
|
||||
],
|
||||
"Remediation": {
|
||||
"Code": {
|
||||
"CLI": "",
|
||||
"CLI": "oci network security-list update --security-list-id <example_resource_id> --ingress-security-rules '[{\"protocol\":\"6\",\"source\":\"<ALLOWED_CIDR>\",\"tcp-options\":{\"destination-port-range\":{\"min\":22,\"max\":22}}}]'",
|
||||
"NativeIaC": "",
|
||||
"Other": "https://www.trendmicro.com/cloudoneconformity/knowledge-base/oci/OCI-Networking/unrestricted-ssh-access.html",
|
||||
"Terraform": ""
|
||||
"Other": "1. In the OCI Console, go to Networking > Virtual Cloud Networks and open your VCN\n2. Click Security Lists, then select <example_resource_name>\n3. In Ingress Rules, locate any rule with Source CIDR 0.0.0.0/0 and Protocol TCP (or All) that includes port 22\n4. Edit the rule: change Source CIDR to a specific allowed range (e.g., your office IP/CIDR) and set Destination Port Range to 22, or delete the rule\n5. Click Save changes",
|
||||
"Terraform": "```hcl\nresource \"oci_core_security_list\" \"<example_resource_name>\" {\n compartment_id = \"<example_compartment_ocid>\"\n vcn_id = \"<example_vcn_id>\"\n\n ingress_security_rules {\n protocol = \"6\"\n source = \"<ALLOWED_CIDR>\" # Critical: restrict source; do not use 0.0.0.0/0 to block public SSH\n\n tcp_options {\n destination_port_range {\n min = 22 # Critical: only SSH port\n max = 22\n }\n }\n }\n}\n```"
|
||||
},
|
||||
"Recommendation": {
|
||||
"Text": "Update security lists to remove ingress rules allowing access from 0.0.0.0/0 to port 22. Restrict SSH access to known IP addresses.",
|
||||
"Url": "https://docs.oracle.com/en-us/iaas/Content/Network/Concepts/securitylists.htm"
|
||||
"Text": "Restrict **SSH** to trusted sources using least-privilege network rules; avoid `0.0.0.0/0`. Prefer **private access** via VPN/peering or a hardened **bastion**. Apply **network segmentation** (NSGs/security lists) to narrow scope. Enforce **key-based authentication**, disable password login, and monitor access.",
|
||||
"Url": "https://hub.prowler.com/check/network_security_list_ingress_from_internet_to_ssh_port"
|
||||
}
|
||||
},
|
||||
"Categories": [
|
||||
"internet-exposed",
|
||||
"network-security"
|
||||
"internet-exposed"
|
||||
],
|
||||
"DependsOn": [],
|
||||
"RelatedTo": [],
|
||||
|
||||
+18
-16
@@ -1,35 +1,37 @@
|
||||
{
|
||||
"Provider": "oraclecloud",
|
||||
"CheckID": "network_vcn_subnet_flow_logs_enabled",
|
||||
"CheckTitle": "Ensure VCN flow logging is enabled for all subnets",
|
||||
"CheckType": [
|
||||
"Software and Configuration Checks",
|
||||
"Industry and Regulatory Standards",
|
||||
"CIS OCI Foundations Benchmark"
|
||||
],
|
||||
"CheckTitle": "Subnet has VCN flow logging enabled",
|
||||
"CheckType": [],
|
||||
"ServiceName": "network",
|
||||
"SubServiceName": "",
|
||||
"ResourceIdTemplate": "oci:network:subnet",
|
||||
"ResourceIdTemplate": "",
|
||||
"Severity": "medium",
|
||||
"ResourceType": "OciSubnet",
|
||||
"ResourceType": "Subnet",
|
||||
"ResourceGroup": "network",
|
||||
"Description": "VCN flow logging should be enabled for all subnets.",
|
||||
"Risk": "Not meeting this network security requirement increases risk of unauthorized access.",
|
||||
"RelatedUrl": "https://docs.oracle.com/en-us/iaas/Content/Network/home.htm",
|
||||
"Description": "**OCI subnets** in a VCN have **network flow logging** configured. Evaluation considers an active `flowlogs` configuration targeting the `VCN` or the specific `subnet` in the same region and associated with a log group.",
|
||||
"Risk": "Without flow logs, east-west and ingress/egress traffic is opaque, weakening detection and forensics. Scans, data exfiltration, and lateral movement can go unnoticed, undermining confidentiality and integrity, and delaying response to availability threats like DDoS.",
|
||||
"RelatedUrl": "",
|
||||
"AdditionalURLs": [
|
||||
"https://www.ateam-oracle.com/post/enable-oci-flow-logs-for-all-subnets-and-stream-logs-to-object-storage-via-service-connector-hub",
|
||||
"https://www.trendmicro.com/trendaivisiononecloudriskmanagement/knowledge-base/oci/OCI-Networking/enable-flow-logging.html",
|
||||
"https://docs.oracle.com/en-us/iaas/Content/Network/Tasks/vcn-flow-logs-enable.htm"
|
||||
],
|
||||
"Remediation": {
|
||||
"Code": {
|
||||
"CLI": "",
|
||||
"NativeIaC": "",
|
||||
"Other": "https://www.trendmicro.com/cloudoneconformity/knowledge-base/oci/OCI-Networking/enable-flow-logging.html",
|
||||
"Terraform": ""
|
||||
"Other": "1. In OCI Console, go to Networking > Flow logs\n2. Click Enable flow logs\n3. Select a Log group (or create one) and a Capture filter (or create one)\n4. Click Next, then Add enablement points\n5. Choose Virtual cloud network and select your VCN (or choose Subnet and select the subnet)\n6. Click Add enablement points, then Next, then Enable flow logs",
|
||||
"Terraform": "```hcl\n# Enable VCN flow logs (covers all subnets in the VCN)\nresource \"oci_logging_log\" \"<example_resource_name>\" {\n display_name = \"<example_resource_name>\"\n log_group_id = \"<example_resource_id>\" # Existing Log Group OCID\n log_type = \"SERVICE\"\n is_enabled = true\n\n configuration {\n source {\n source_type = \"OCISERVICE\"\n service = \"flowlogs\" # CRITICAL: enables VCN/Subnet flow logging\n resource = \"<example_resource_id>\" # CRITICAL: VCN OCID (use subnet OCID if enabling per-subnet)\n category = \"vcn\" # CRITICAL: set to \"vcn\" (or \"subnet\" for subnet-level)\n parameters = { capture_filter = \"<example_resource_id>\" } # Capture Filter OCID\n }\n }\n}\n```"
|
||||
},
|
||||
"Recommendation": {
|
||||
"Text": "Ensure VCN flow logging is enabled for all subnets",
|
||||
"Url": "https://hub.prowler.com/check/oci/network_vcn_subnet_flow_logs_enabled"
|
||||
"Text": "Enable **VCN flow logs** for all subnets-prefer VCN-wide enablement for complete coverage-and route to centralized log groups. Enforce least privilege on log access, set retention, and integrate with a SIEM. Use `capture filters` and `sampling` to control volume. Review logs to support defense-in-depth.",
|
||||
"Url": "https://hub.prowler.com/check/network_vcn_subnet_flow_logs_enabled"
|
||||
}
|
||||
},
|
||||
"Categories": [
|
||||
"network-security"
|
||||
"logging",
|
||||
"forensics-ready"
|
||||
],
|
||||
"DependsOn": [],
|
||||
"RelatedTo": [],
|
||||
|
||||
Reference in New Issue
Block a user