From a2362b4bbcf6b356b57e18bef0e94d7c6aede716 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Pedro=20Mart=C3=ADn?= Date: Mon, 19 May 2025 09:42:04 +0200 Subject: [PATCH] fix(cis): rename and add sections and subsections (#7738) --- prowler/CHANGELOG.md | 1 + prowler/compliance/aws/cis_1.4_aws.json | 128 ++--- prowler/compliance/aws/cis_1.5_aws.json | 144 ++--- prowler/compliance/aws/cis_2.0_aws.json | 142 ++--- prowler/compliance/aws/cis_3.0_aws.json | 140 ++--- prowler/compliance/aws/cis_4.0_aws.json | 53 -- prowler/compliance/azure/cis_2.0_azure.json | 302 +++++------ prowler/compliance/azure/cis_2.1_azure.json | 298 +++++------ prowler/compliance/azure/cis_3.0_azure.json | 486 ++++++++--------- prowler/compliance/gcp/cis_2.0_gcp.json | 206 +++---- prowler/compliance/gcp/cis_3.0_gcp.json | 206 +++---- .../kubernetes/cis_1.10_kubernetes.json | 506 +++++++++--------- .../kubernetes/cis_1.8_kubernetes.json | 246 ++++----- prowler/compliance/m365/cis_4.0_m365.json | 378 ++++++++----- .../lib/outputs/compliance/cis/cis_m365.py | 2 + prowler/lib/outputs/compliance/cis/models.py | 1 + .../outputs/compliance/cis/cis_m365_test.py | 182 +++++++ tests/lib/outputs/compliance/fixtures.py | 52 ++ 18 files changed, 1892 insertions(+), 1581 deletions(-) create mode 100644 tests/lib/outputs/compliance/cis/cis_m365_test.py diff --git a/prowler/CHANGELOG.md b/prowler/CHANGELOG.md index 55107c7b56..f0f2f8a57c 100644 --- a/prowler/CHANGELOG.md +++ b/prowler/CHANGELOG.md @@ -24,6 +24,7 @@ All notable changes to the **Prowler SDK** are documented in this file. ### Fixed - Update CIS 4.0 for M365 provider. [(#7699)](https://github.com/prowler-cloud/prowler/pull/7699) +- Update and upgrade CIS for all the providers [(#7738)](https://github.com/prowler-cloud/prowler/pull/7738) - Cover policies with conditions with SNS endpoint in `sns_topics_not_publicly_accessible`. [(#7750)](https://github.com/prowler-cloud/prowler/pull/7750) - Change severity logic for `ec2_securitygroup_allow_ingress_from_internet_to_all_ports` check. [(#7764)](https://github.com/prowler-cloud/prowler/pull/7764) diff --git a/prowler/compliance/aws/cis_1.4_aws.json b/prowler/compliance/aws/cis_1.4_aws.json index 584ca284c6..0e6d1f136c 100644 --- a/prowler/compliance/aws/cis_1.4_aws.json +++ b/prowler/compliance/aws/cis_1.4_aws.json @@ -12,7 +12,7 @@ ], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 1", "AssessmentStatus": "Manual", "Description": "Ensure contact email and telephone details for AWS accounts are current and map to more than one individual in your organization. An AWS account supports a number of contact details, and AWS will use these to contact the account owner if activity judged to be in breach of Acceptable Use Policy or indicative of likely security compromise is observed by the AWS Abuse team. Contact details should not be for a single individual, as circumstances may arise where that individual is unavailable. Email contact details should point to a mail alias which forwards email to multiple individuals within the organization; where feasible, phone contact details should point to a PABX hunt group or other call-forwarding system.", @@ -33,7 +33,7 @@ ], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Multi-Factor Authentication (MFA) adds an extra layer of authentication assurance beyond traditional credentials. With MFA enabled, when a user signs in to the AWS Console, they will be prompted for their user name and password as well as for an authentication code from their physical or virtual MFA token. It is recommended that MFA be enabled for all accounts that have a console password.", @@ -54,7 +54,7 @@ ], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "AWS console defaults to no check boxes selected when creating a new IAM user. When cerating the IAM User credentials you have to determine what type of access they require. Programmatic access: The IAM user might need to make API calls, use the AWS CLI, or use the Tools for Windows PowerShell. In that case, create an access key (access key ID and a secret access key) for that user. AWS Management Console access: If the user needs to access the AWS Management Console, create a password for the user.", @@ -76,7 +76,7 @@ ], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "AWS IAM users can access AWS resources using different types of credentials, such as passwords or access keys. It is recommended that all credentials that have been unused in 45 or greater days be deactivated or removed.", @@ -97,7 +97,7 @@ ], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Access keys are long-term credentials for an IAM user or the AWS account 'root' user. You can use access keys to sign programmatic requests to the AWS CLI or AWS API (directly or using the AWS SDK)", @@ -118,7 +118,7 @@ ], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Access keys consist of an access key ID and secret access key, which are used to sign programmatic requests that you make to AWS. AWS users need their own access keys to make programmatic calls to AWS from the AWS Command Line Interface (AWS CLI), Tools for Windows PowerShell, the AWS SDKs, or direct HTTP calls using the APIs for individual AWS services. It is recommended that all access keys be regularly rotated.", @@ -139,7 +139,7 @@ ], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "IAM users are granted access to services, functions, and data through IAM policies. There are three ways to define policies for a user: 1) Edit the user policy directly, aka an inline, or user, policy; 2) attach a policy directly to a user; 3) add the user to an IAM group that has an attached policy. Only the third implementation is recommended.", @@ -161,7 +161,7 @@ ], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "IAM policies are the means by which privileges are granted to users, groups, or roles. It is recommended and considered a standard security advice to grant _least privilege_ -that is, granting only the permissions required to perform a task. Determine what users need to do and then craft policies for them that let the users perform _only_ those tasks, instead of allowing full administrative privileges.", @@ -182,7 +182,7 @@ ], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "AWS provides a support center that can be used for incident notification and response, as well as technical support and customer services. Create an IAM Role to allow authorized users to manage incidents with AWS Support.", @@ -203,7 +203,7 @@ ], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 2", "AssessmentStatus": "Manual", "Description": "AWS access from within AWS instances can be done by either encoding AWS keys into AWS API calls or by assigning the instance to a role which has an appropriate permissions policy for the required access. \"AWS Access\" means accessing the APIs of AWS in order to access AWS resources or manage AWS account resources.", @@ -224,7 +224,7 @@ ], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "To enable HTTPS connections to your website or application in AWS, you need an SSL/TLS server certificate. You can use ACM or IAM to store and deploy server certificates. Use IAM as a certificate manager only when you must support HTTPS connections in a region that is not supported by ACM. IAM securely encrypts your private keys and stores the encrypted version in IAM SSL certificate storage. IAM supports deploying server certificates in all regions, but you must obtain your certificate from an external provider for use with AWS. You cannot upload an ACM certificate to IAM. Additionally, you cannot manage your certificates from the IAM Console.", @@ -245,7 +245,7 @@ ], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 1", "AssessmentStatus": "Manual", "Description": "AWS provides customers with the option of specifying the contact information for account's security team. It is recommended that this information be provided.", @@ -266,7 +266,7 @@ ], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Enable IAM Access analyzer for IAM policies about all resources in each region. IAM Access Analyzer is a technology introduced at AWS reinvent 2019. After the Analyzer is enabled in IAM, scan results are displayed on the console showing the accessible resources. Scans show resources that other accounts and federated users can access, such as KMS keys and IAM roles. So the results allow you to determine if an unintended user is allowed, making it easier for administrators to monitor least privileges access. Access Analyzer analyzes only policies that are applied to resources in the same AWS Region.", @@ -287,7 +287,7 @@ ], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 2", "AssessmentStatus": "Manual", "Description": "In multi-account environments, IAM user centralization facilitates greater user control. User access beyond the initial account is then provided via role assumption. Centralization of users can be accomplished through federation with an external identity provider or through the use of AWS Organizations.", @@ -308,7 +308,7 @@ ], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 1", "AssessmentStatus": "Manual", "Description": "The AWS support portal allows account owners to establish security questions that can be used to authenticate individuals calling AWS customer service for support. It is recommended that security questions be established.", @@ -329,7 +329,7 @@ ], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "The 'root' user account is the most privileged user in an AWS account. AWS Access Keys provide programmatic access to a given AWS account. It is recommended that all access keys associated with the 'root' user account be removed.", @@ -350,7 +350,7 @@ ], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "The 'root' user account is the most privileged user in an AWS account. Multi-factor Authentication (MFA) adds an extra layer of protection on top of a username and password. With MFA enabled, when a user signs in to an AWS website, they will be prompted for their username and password as well as for an authentication code from their AWS MFA device. **Note:** When virtual MFA is used for 'root' accounts, it is recommended that the device used is NOT a personal device, but rather a dedicated mobile device (tablet or phone) that is managed to be kept charged and secured independent of any individual personal devices. (\"non-personal virtual MFA\") This lessens the risks of losing access to the MFA due to device loss, device trade-in or if the individual owning the device is no longer employed at the company.", @@ -371,7 +371,7 @@ ], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "The 'root' user account is the most privileged user in an AWS account. MFA adds an extra layer of protection on top of a user name and password. With MFA enabled, when a user signs in to an AWS website, they will be prompted for their user name and password as well as for an authentication code from their AWS MFA device. For Level 2, it is recommended that the 'root' user account be protected with a hardware MFA.", @@ -392,7 +392,7 @@ ], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "With the creation of an AWS account, a 'root user' is created that cannot be disabled or deleted. That user has unrestricted access to and control over all resources in the AWS account. It is highly recommended that the use of this account be avoided for everyday tasks.", @@ -413,7 +413,7 @@ ], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Password policies are, in part, used to enforce password complexity requirements. IAM password policies can be used to ensure password are at least a given length. It is recommended that the password policy require a minimum password length 14.", @@ -434,7 +434,7 @@ ], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "IAM password policies can prevent the reuse of a given password by the same user. It is recommended that the password policy prevent the reuse of passwords.", @@ -455,8 +455,8 @@ ], "Attributes": [ { - "Section": "2. Storage", - "SubSection": "2.1. Simple Storage Service (S3)", + "Section": "2 Storage", + "SubSection": "2.1 Simple Storage Service (S3)", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "Amazon S3 provides a variety of no, or low, cost encryption options to protect data at rest.", @@ -477,8 +477,8 @@ ], "Attributes": [ { - "Section": "2. Storage", - "SubSection": "2.1. Simple Storage Service (S3)", + "Section": "2 Storage", + "SubSection": "2.1 Simple Storage Service (S3)", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "At the Amazon S3 bucket level, you can configure permissions through a bucket policy making the objects accessible only through HTTPS.", @@ -499,8 +499,8 @@ ], "Attributes": [ { - "Section": "2. Storage", - "SubSection": "2.1. Simple Storage Service (S3)", + "Section": "2 Storage", + "SubSection": "2.1 Simple Storage Service (S3)", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Once MFA Delete is enabled on your sensitive and classified S3 bucket it requires the user to have two forms of authentication.", @@ -521,8 +521,8 @@ ], "Attributes": [ { - "Section": "2. Storage", - "SubSection": "2.1. Simple Storage Service (S3)", + "Section": "2 Storage", + "SubSection": "2.1 Simple Storage Service (S3)", "Profile": "Level 2", "AssessmentStatus": "Manual", "Description": "Amazon S3 buckets can contain sensitive data, that for security purposes should be discovered, monitored, classified and protected. Macie along with other 3rd party tools can automatically provide an inventory of Amazon S3 buckets.", @@ -544,8 +544,8 @@ ], "Attributes": [ { - "Section": "2. Storage", - "SubSection": "2.1. Simple Storage Service (S3)", + "Section": "2 Storage", + "SubSection": "2.1 Simple Storage Service (S3)", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Amazon S3 provides `Block public access (bucket settings)` and `Block public access (account settings)` to help you manage public access to Amazon S3 resources. By default, S3 buckets and objects are created with public access disabled. However, an IAM principal with sufficient S3 permissions can enable public access at the bucket and/or object level. While enabled, `Block public access (bucket settings)` prevents an individual bucket, and its contained objects, from becoming publicly accessible. Similarly, `Block public access (account settings)` prevents all buckets, and contained objects, from becoming publicly accessible across the entire account.", @@ -566,7 +566,7 @@ ], "Attributes": [ { - "Section": "2. Storage", + "Section": "2 Storage", "SubSection": "2.2. Elastic Compute Cloud (EC2)", "Profile": "Level 1", "AssessmentStatus": "Automated", @@ -589,8 +589,8 @@ ], "Attributes": [ { - "Section": "2. Storage", - "SubSection": "2.3. Relational Database Service (RDS)", + "Section": "2 Storage", + "SubSection": "2.3 Relational Database Service (RDS)", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Amazon RDS encrypted DB instances use the industry standard AES-256 encryption algorithm to encrypt your data on the server that hosts your Amazon RDS DB instances. After your data is encrypted, Amazon RDS handles authentication of access and decryption of your data transparently with a minimal impact on performance.", @@ -611,7 +611,7 @@ ], "Attributes": [ { - "Section": "3. Logging", + "Section": "3 Logging", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "AWS CloudTrail is a web service that records AWS API calls for your account and delivers log files to you. The recorded information includes the identity of the API caller, the time of the API call, the source IP address of the API caller, the request parameters, and the response elements returned by the AWS service. CloudTrail provides a history of AWS API calls for an account, including API calls made via the Management Console, SDKs, command line tools, and higher-level AWS services (such as CloudFormation).", @@ -632,7 +632,7 @@ ], "Attributes": [ { - "Section": "3. Logging", + "Section": "3 Logging", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "S3 object-level API operations such as GetObject, DeleteObject, and PutObject are called data events. By default, CloudTrail trails don't log data events and so it is recommended to enable Object-level logging for S3 buckets.", @@ -653,7 +653,7 @@ ], "Attributes": [ { - "Section": "3. Logging", + "Section": "3 Logging", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "S3 object-level API operations such as GetObject, DeleteObject, and PutObject are called data events. By default, CloudTrail trails don't log data events and so it is recommended to enable Object-level logging for S3 buckets.", @@ -674,7 +674,7 @@ ], "Attributes": [ { - "Section": "3. Logging", + "Section": "3 Logging", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "CloudTrail log file validation creates a digitally signed digest file containing a hash of each log that CloudTrail writes to S3. These digest files can be used to determine whether a log file was changed, deleted, or unchanged after CloudTrail delivered the log. It is recommended that file validation be enabled on all CloudTrails.", @@ -695,7 +695,7 @@ ], "Attributes": [ { - "Section": "3. Logging", + "Section": "3 Logging", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "CloudTrail logs a record of every API call made in your AWS account. These logs file are stored in an S3 bucket. It is recommended that the bucket policy or access control list (ACL) applied to the S3 bucket that CloudTrail logs to prevent public access to the CloudTrail logs.", @@ -716,7 +716,7 @@ ], "Attributes": [ { - "Section": "3. Logging", + "Section": "3 Logging", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "AWS CloudTrail is a web service that records AWS API calls made in a given AWS account. The recorded information includes the identity of the API caller, the time of the API call, the source IP address of the API caller, the request parameters, and the response elements returned by the AWS service. CloudTrail uses Amazon S3 for log file storage and delivery, so log files are stored durably. In addition to capturing CloudTrail logs within a specified S3 bucket for long term analysis, realtime analysis can be performed by configuring CloudTrail to send logs to CloudWatch Logs. For a trail that is enabled in all regions in an account, CloudTrail sends log files from all those regions to a CloudWatch Logs log group. It is recommended that CloudTrail logs be sent to CloudWatch Logs. Note: The intent of this recommendation is to ensure AWS account activity is being captured, monitored, and appropriately alarmed on. CloudWatch Logs is a native way to accomplish this using AWS services but does not preclude the use of an alternate solution.", @@ -737,7 +737,7 @@ ], "Attributes": [ { - "Section": "3. Logging", + "Section": "3 Logging", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "AWS Config is a web service that performs configuration management of supported AWS resources within your account and delivers log files to you. The recorded information includes the configuration item (AWS resource), relationships between configuration items (AWS resources), any configuration changes between resources. It is recommended AWS Config be enabled in all regions.", @@ -758,7 +758,7 @@ ], "Attributes": [ { - "Section": "3. Logging", + "Section": "3 Logging", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "S3 Bucket Access Logging generates a log that contains access records for each request made to your S3 bucket. An access log record contains details about the request, such as the request type, the resources specified in the request worked, and the time and date the request was processed. It is recommended that bucket access logging be enabled on the CloudTrail S3 bucket.", @@ -779,7 +779,7 @@ ], "Attributes": [ { - "Section": "3. Logging", + "Section": "3 Logging", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "AWS CloudTrail is a web service that records AWS API calls for an account and makes those logs available to users and resources in accordance with IAM policies. AWS Key Management Service (KMS) is a managed service that helps create and control the encryption keys used to encrypt account data, and uses Hardware Security Modules (HSMs) to protect the security of encryption keys. CloudTrail logs can be configured to leverage server side encryption (SSE) and KMS customer created master keys (CMK) to further protect CloudTrail logs. It is recommended that CloudTrail be configured to use SSE-KMS.", @@ -800,7 +800,7 @@ ], "Attributes": [ { - "Section": "3. Logging", + "Section": "3 Logging", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "AWS Key Management Service (KMS) allows customers to rotate the backing key which is key material stored within the KMS which is tied to the key ID of the Customer Created customer master key (CMK). It is the backing key that is used to perform cryptographic operations such as encryption and decryption. Automated key rotation currently retains all prior backing keys so that decryption of encrypted data can take place transparently. It is recommended that CMK key rotation be enabled for symmetric keys. Key rotation can not be enabled for any asymmetric CMK.", @@ -821,7 +821,7 @@ ], "Attributes": [ { - "Section": "3. Logging", + "Section": "3 Logging", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "VPC Flow Logs is a feature that enables you to capture information about the IP traffic going to and from network interfaces in your VPC. After you've created a flow log, you can view and retrieve its data in Amazon CloudWatch Logs. It is recommended that VPC Flow Logs be enabled for packet \"Rejects\" for VPCs.", @@ -842,7 +842,7 @@ ], "Attributes": [ { - "Section": "4. Monitoring", + "Section": "4 Monitoring", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs and establishing corresponding metric filters and alarms. It is recommended that a metric filter and alarm be established for unauthorized API calls.", @@ -863,7 +863,7 @@ ], "Attributes": [ { - "Section": "4. Monitoring", + "Section": "4 Monitoring", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs and establishing corresponding metric filters and alarms. Security Groups are a stateful packet filter that controls ingress and egress traffic within a VPC. It is recommended that a metric filter and alarm be established for detecting changes to Security Groups.", @@ -884,7 +884,7 @@ ], "Attributes": [ { - "Section": "4. Monitoring", + "Section": "4 Monitoring", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs and establishing corresponding metric filters and alarms. NACLs are used as a stateless packet filter to control ingress and egress traffic for subnets within a VPC. It is recommended that a metric filter and alarm be established for changes made to NACLs.", @@ -905,7 +905,7 @@ ], "Attributes": [ { - "Section": "4. Monitoring", + "Section": "4 Monitoring", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs and establishing corresponding metric filters and alarms. Network gateways are required to send/receive traffic to a destination outside of a VPC. It is recommended that a metric filter and alarm be established for changes to network gateways.", @@ -926,7 +926,7 @@ ], "Attributes": [ { - "Section": "4. Monitoring", + "Section": "4 Monitoring", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs and establishing corresponding metric filters and alarms. Routing tables are used to route network traffic between subnets and to network gateways. It is recommended that a metric filter and alarm be established for changes to route tables.", @@ -947,7 +947,7 @@ ], "Attributes": [ { - "Section": "4. Monitoring", + "Section": "4 Monitoring", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs and establishing corresponding metric filters and alarms. It is possible to have more than 1 VPC within an account, in addition it is also possible to create a peer connection between 2 VPCs enabling network traffic to route between VPCs. It is recommended that a metric filter and alarm be established for changes made to VPCs.", @@ -968,7 +968,7 @@ ], "Attributes": [ { - "Section": "4. Monitoring", + "Section": "4 Monitoring", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs and establishing corresponding metric filters and alarms. It is recommended that a metric filter and alarm be established for AWS Organizations changes made in the master AWS Account.", @@ -989,7 +989,7 @@ ], "Attributes": [ { - "Section": "4. Monitoring", + "Section": "4 Monitoring", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs and establishing corresponding metric filters and alarms. It is recommended that a metric filter and alarm be established for console logins that are not protected by multi-factor authentication (MFA).", @@ -1010,7 +1010,7 @@ ], "Attributes": [ { - "Section": "4. Monitoring", + "Section": "4 Monitoring", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs and establishing corresponding metric filters and alarms. It is recommended that a metric filter and alarm be established for 'root' login attempts.", @@ -1031,7 +1031,7 @@ ], "Attributes": [ { - "Section": "4. Monitoring", + "Section": "4 Monitoring", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs and establishing corresponding metric filters and alarms. It is recommended that a metric filter and alarm be established changes made to Identity and Access Management (IAM) policies.", @@ -1052,7 +1052,7 @@ ], "Attributes": [ { - "Section": "4. Monitoring", + "Section": "4 Monitoring", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs and establishing corresponding metric filters and alarms. It is recommended that a metric filter and alarm be established for detecting changes to CloudTrail's configurations.", @@ -1073,7 +1073,7 @@ ], "Attributes": [ { - "Section": "4. Monitoring", + "Section": "4 Monitoring", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs and establishing corresponding metric filters and alarms. It is recommended that a metric filter and alarm be established for failed console authentication attempts.", @@ -1094,7 +1094,7 @@ ], "Attributes": [ { - "Section": "4. Monitoring", + "Section": "4 Monitoring", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs and establishing corresponding metric filters and alarms. It is recommended that a metric filter and alarm be established for customer created CMKs which have changed state to disabled or scheduled deletion.", @@ -1115,7 +1115,7 @@ ], "Attributes": [ { - "Section": "4. Monitoring", + "Section": "4 Monitoring", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs and establishing corresponding metric filters and alarms. It is recommended that a metric filter and alarm be established for changes to S3 bucket policies.", @@ -1136,7 +1136,7 @@ ], "Attributes": [ { - "Section": "4. Monitoring", + "Section": "4 Monitoring", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs and establishing corresponding metric filters and alarms. It is recommended that a metric filter and alarm be established for detecting changes to CloudTrail's configurations.", @@ -1159,7 +1159,7 @@ ], "Attributes": [ { - "Section": "5. Networking", + "Section": "5 Networking", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "The Network Access Control List (NACL) function provide stateless filtering of ingress and egress network traffic to AWS resources. It is recommended that no NACL allows unrestricted ingress access to remote server administration ports, such as SSH to port `22` and RDP to port `3389`.", @@ -1182,7 +1182,7 @@ ], "Attributes": [ { - "Section": "5. Networking", + "Section": "5 Networking", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Security groups provide stateful filtering of ingress and egress network traffic to AWS resources. It is recommended that no security group allows unrestricted ingress access to remote server administration ports, such as SSH to port `22` and RDP to port `3389`.", @@ -1203,7 +1203,7 @@ ], "Attributes": [ { - "Section": "5. Networking", + "Section": "5 Networking", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "A VPC comes with a default security group whose initial settings deny all inbound traffic, allow all outbound traffic, and allow all traffic between instances assigned to the security group. If you don't specify a security group when you launch an instance, the instance is automatically assigned to this default security group. Security groups provide stateful filtering of ingress/egress network traffic to AWS resources. It is recommended that the default security group restrict all traffic. The default VPC in every region should have its default security group updated to comply. Any newly created VPCs will automatically contain a default security group that will need remediation to comply with this recommendation. **NOTE:** When implementing this recommendation, VPC flow logging is invaluable in determining the least privilege port access required by systems to work properly because it can log all packet acceptances and rejections occurring under the current security groups. This dramatically reduces the primary barrier to least privilege engineering - discovering the minimum ports required by systems in the environment. Even if the VPC flow logging recommendation in this benchmark is not adopted as a permanent security measure, it should be used during any period of discovery and engineering for least privileged security groups.", @@ -1224,7 +1224,7 @@ ], "Attributes": [ { - "Section": "5. Networking", + "Section": "5 Networking", "Profile": "Level 2", "AssessmentStatus": "Manual", "Description": "Once a VPC peering connection is established, routing tables must be updated to establish any connections between the peered VPCs. These routes can be as specific as desired - even peering a VPC to only a single host on the other side of the connection.", diff --git a/prowler/compliance/aws/cis_1.5_aws.json b/prowler/compliance/aws/cis_1.5_aws.json index 90ca3742e4..8c3d9a25a1 100644 --- a/prowler/compliance/aws/cis_1.5_aws.json +++ b/prowler/compliance/aws/cis_1.5_aws.json @@ -12,7 +12,7 @@ ], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 1", "AssessmentStatus": "Manual", "Description": "Ensure contact email and telephone details for AWS accounts are current and map to more than one individual in your organization. An AWS account supports a number of contact details, and AWS will use these to contact the account owner if activity judged to be in breach of Acceptable Use Policy or indicative of likely security compromise is observed by the AWS Abuse team. Contact details should not be for a single individual, as circumstances may arise where that individual is unavailable. Email contact details should point to a mail alias which forwards email to multiple individuals within the organization; where feasible, phone contact details should point to a PABX hunt group or other call-forwarding system.", @@ -33,7 +33,7 @@ ], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Multi-Factor Authentication (MFA) adds an extra layer of authentication assurance beyond traditional credentials. With MFA enabled, when a user signs in to the AWS Console, they will be prompted for their user name and password as well as for an authentication code from their physical or virtual MFA token. It is recommended that MFA be enabled for all accounts that have a console password.", @@ -54,7 +54,7 @@ ], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "AWS console defaults to no check boxes selected when creating a new IAM user. When cerating the IAM User credentials you have to determine what type of access they require. Programmatic access: The IAM user might need to make API calls, use the AWS CLI, or use the Tools for Windows PowerShell. In that case, create an access key (access key ID and a secret access key) for that user. AWS Management Console access: If the user needs to access the AWS Management Console, create a password for the user.", @@ -76,7 +76,7 @@ ], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "AWS IAM users can access AWS resources using different types of credentials, such as passwords or access keys. It is recommended that all credentials that have been unused in 45 or greater days be deactivated or removed.", @@ -97,7 +97,7 @@ ], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Access keys are long-term credentials for an IAM user or the AWS account 'root' user. You can use access keys to sign programmatic requests to the AWS CLI or AWS API (directly or using the AWS SDK)", @@ -118,7 +118,7 @@ ], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Access keys consist of an access key ID and secret access key, which are used to sign programmatic requests that you make to AWS. AWS users need their own access keys to make programmatic calls to AWS from the AWS Command Line Interface (AWS CLI), Tools for Windows PowerShell, the AWS SDKs, or direct HTTP calls using the APIs for individual AWS services. It is recommended that all access keys be regularly rotated.", @@ -139,7 +139,7 @@ ], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "IAM users are granted access to services, functions, and data through IAM policies. There are three ways to define policies for a user: 1) Edit the user policy directly, aka an inline, or user, policy; 2) attach a policy directly to a user; 3) add the user to an IAM group that has an attached policy. Only the third implementation is recommended.", @@ -161,7 +161,7 @@ ], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "IAM policies are the means by which privileges are granted to users, groups, or roles. It is recommended and considered a standard security advice to grant _least privilege_ -that is, granting only the permissions required to perform a task. Determine what users need to do and then craft policies for them that let the users perform _only_ those tasks, instead of allowing full administrative privileges.", @@ -182,7 +182,7 @@ ], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "AWS provides a support center that can be used for incident notification and response, as well as technical support and customer services. Create an IAM Role to allow authorized users to manage incidents with AWS Support.", @@ -203,7 +203,7 @@ ], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 2", "AssessmentStatus": "Manual", "Description": "AWS access from within AWS instances can be done by either encoding AWS keys into AWS API calls or by assigning the instance to a role which has an appropriate permissions policy for the required access. \"AWS Access\" means accessing the APIs of AWS in order to access AWS resources or manage AWS account resources.", @@ -224,7 +224,7 @@ ], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "To enable HTTPS connections to your website or application in AWS, you need an SSL/TLS server certificate. You can use ACM or IAM to store and deploy server certificates. Use IAM as a certificate manager only when you must support HTTPS connections in a region that is not supported by ACM. IAM securely encrypts your private keys and stores the encrypted version in IAM SSL certificate storage. IAM supports deploying server certificates in all regions, but you must obtain your certificate from an external provider for use with AWS. You cannot upload an ACM certificate to IAM. Additionally, you cannot manage your certificates from the IAM Console.", @@ -245,7 +245,7 @@ ], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 1", "AssessmentStatus": "Manual", "Description": "AWS provides customers with the option of specifying the contact information for account's security team. It is recommended that this information be provided.", @@ -266,7 +266,7 @@ ], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Enable IAM Access analyzer for IAM policies about all resources in each region. IAM Access Analyzer is a technology introduced at AWS reinvent 2019. After the Analyzer is enabled in IAM, scan results are displayed on the console showing the accessible resources. Scans show resources that other accounts and federated users can access, such as KMS keys and IAM roles. So the results allow you to determine if an unintended user is allowed, making it easier for administrators to monitor least privileges access. Access Analyzer analyzes only policies that are applied to resources in the same AWS Region.", @@ -287,7 +287,7 @@ ], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 2", "AssessmentStatus": "Manual", "Description": "In multi-account environments, IAM user centralization facilitates greater user control. User access beyond the initial account is then provided via role assumption. Centralization of users can be accomplished through federation with an external identity provider or through the use of AWS Organizations.", @@ -308,7 +308,7 @@ ], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 1", "AssessmentStatus": "Manual", "Description": "The AWS support portal allows account owners to establish security questions that can be used to authenticate individuals calling AWS customer service for support. It is recommended that security questions be established.", @@ -329,7 +329,7 @@ ], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "The 'root' user account is the most privileged user in an AWS account. AWS Access Keys provide programmatic access to a given AWS account. It is recommended that all access keys associated with the 'root' user account be removed.", @@ -350,7 +350,7 @@ ], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "The 'root' user account is the most privileged user in an AWS account. Multi-factor Authentication (MFA) adds an extra layer of protection on top of a username and password. With MFA enabled, when a user signs in to an AWS website, they will be prompted for their username and password as well as for an authentication code from their AWS MFA device. **Note:** When virtual MFA is used for 'root' accounts, it is recommended that the device used is NOT a personal device, but rather a dedicated mobile device (tablet or phone) that is managed to be kept charged and secured independent of any individual personal devices. (\"non-personal virtual MFA\") This lessens the risks of losing access to the MFA due to device loss, device trade-in or if the individual owning the device is no longer employed at the company.", @@ -371,7 +371,7 @@ ], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "The 'root' user account is the most privileged user in an AWS account. MFA adds an extra layer of protection on top of a user name and password. With MFA enabled, when a user signs in to an AWS website, they will be prompted for their user name and password as well as for an authentication code from their AWS MFA device. For Level 2, it is recommended that the 'root' user account be protected with a hardware MFA.", @@ -392,7 +392,7 @@ ], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "With the creation of an AWS account, a 'root user' is created that cannot be disabled or deleted. That user has unrestricted access to and control over all resources in the AWS account. It is highly recommended that the use of this account be avoided for everyday tasks.", @@ -413,7 +413,7 @@ ], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Password policies are, in part, used to enforce password complexity requirements. IAM password policies can be used to ensure password are at least a given length. It is recommended that the password policy require a minimum password length 14.", @@ -434,7 +434,7 @@ ], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "IAM password policies can prevent the reuse of a given password by the same user. It is recommended that the password policy prevent the reuse of passwords.", @@ -455,8 +455,8 @@ ], "Attributes": [ { - "Section": "2. Storage", - "SubSection": "2.1. Simple Storage Service (S3)", + "Section": "2 Storage", + "SubSection": "2.1 Simple Storage Service (S3)", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "Amazon S3 provides a variety of no, or low, cost encryption options to protect data at rest.", @@ -477,8 +477,8 @@ ], "Attributes": [ { - "Section": "2. Storage", - "SubSection": "2.1. Simple Storage Service (S3)", + "Section": "2 Storage", + "SubSection": "2.1 Simple Storage Service (S3)", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "At the Amazon S3 bucket level, you can configure permissions through a bucket policy making the objects accessible only through HTTPS.", @@ -499,8 +499,8 @@ ], "Attributes": [ { - "Section": "2. Storage", - "SubSection": "2.1. Simple Storage Service (S3)", + "Section": "2 Storage", + "SubSection": "2.1 Simple Storage Service (S3)", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Once MFA Delete is enabled on your sensitive and classified S3 bucket it requires the user to have two forms of authentication.", @@ -521,8 +521,8 @@ ], "Attributes": [ { - "Section": "2. Storage", - "SubSection": "2.1. Simple Storage Service (S3)", + "Section": "2 Storage", + "SubSection": "2.1 Simple Storage Service (S3)", "Profile": "Level 2", "AssessmentStatus": "Manual", "Description": "Amazon S3 buckets can contain sensitive data, that for security purposes should be discovered, monitored, classified and protected. Macie along with other 3rd party tools can automatically provide an inventory of Amazon S3 buckets.", @@ -544,8 +544,8 @@ ], "Attributes": [ { - "Section": "2. Storage", - "SubSection": "2.1. Simple Storage Service (S3)", + "Section": "2 Storage", + "SubSection": "2.1 Simple Storage Service (S3)", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Amazon S3 provides `Block public access (bucket settings)` and `Block public access (account settings)` to help you manage public access to Amazon S3 resources. By default, S3 buckets and objects are created with public access disabled. However, an IAM principal with sufficient S3 permissions can enable public access at the bucket and/or object level. While enabled, `Block public access (bucket settings)` prevents an individual bucket, and its contained objects, from becoming publicly accessible. Similarly, `Block public access (account settings)` prevents all buckets, and contained objects, from becoming publicly accessible across the entire account.", @@ -566,8 +566,8 @@ ], "Attributes": [ { - "Section": "2. Storage", - "SubSection": "2.2. Elastic Compute Cloud (EC2)", + "Section": "2 Storage", + "SubSection": "2.2 Elastic Compute Cloud (EC2)", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Elastic Compute Cloud (EC2) supports encryption at rest when using the Elastic Block Store (EBS) service. While disabled by default, forcing encryption at EBS volume creation is supported.", @@ -589,8 +589,8 @@ ], "Attributes": [ { - "Section": "2. Storage", - "SubSection": "2.3. Relational Database Service (RDS)", + "Section": "2 Storage", + "SubSection": "2.3 Relational Database Service (RDS)", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Amazon RDS encrypted DB instances use the industry standard AES-256 encryption algorithm to encrypt your data on the server that hosts your Amazon RDS DB instances. After your data is encrypted, Amazon RDS handles authentication of access and decryption of your data transparently with a minimal impact on performance.", @@ -611,8 +611,8 @@ ], "Attributes": [ { - "Section": "2. Storage", - "SubSection": "2.3. Relational Database Service (RDS)", + "Section": "2 Storage", + "SubSection": "2.3 Relational Database Service (RDS)", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Ensure that RDS database instances have the Auto Minor Version Upgrade flag enabled in order to receive automatically minor engine upgrades during the specified maintenance window. So, RDS instances can get the new features, bug fixes, and security patches for their database engines.", @@ -633,8 +633,8 @@ ], "Attributes": [ { - "Section": "2. Storage", - "SubSection": "2.3. Relational Database Service (RDS)", + "Section": "2 Storage", + "SubSection": "2.3 Relational Database Service (RDS)", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Ensure and verify that RDS database instances provisioned in your AWS account do restrict unauthorized access in order to minimize security risks. To restrict access to any publicly accessible RDS database instance, you must disable the database Publicly Accessible flag and update the VPC security group associated with the instance.", @@ -655,7 +655,7 @@ ], "Attributes": [ { - "Section": "2. Storage", + "Section": "2 Storage", "SubSection": "2.4 Elastic File System (EFS)", "Profile": "Level 1", "AssessmentStatus": "Manual", @@ -677,7 +677,7 @@ ], "Attributes": [ { - "Section": "3. Logging", + "Section": "3 Logging", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "AWS CloudTrail is a web service that records AWS API calls for your account and delivers log files to you. The recorded information includes the identity of the API caller, the time of the API call, the source IP address of the API caller, the request parameters, and the response elements returned by the AWS service. CloudTrail provides a history of AWS API calls for an account, including API calls made via the Management Console, SDKs, command line tools, and higher-level AWS services (such as CloudFormation).", @@ -698,7 +698,7 @@ ], "Attributes": [ { - "Section": "3. Logging", + "Section": "3 Logging", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "S3 object-level API operations such as GetObject, DeleteObject, and PutObject are called data events. By default, CloudTrail trails don't log data events and so it is recommended to enable Object-level logging for S3 buckets.", @@ -719,7 +719,7 @@ ], "Attributes": [ { - "Section": "3. Logging", + "Section": "3 Logging", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "S3 object-level API operations such as GetObject, DeleteObject, and PutObject are called data events. By default, CloudTrail trails don't log data events and so it is recommended to enable Object-level logging for S3 buckets.", @@ -740,7 +740,7 @@ ], "Attributes": [ { - "Section": "3. Logging", + "Section": "3 Logging", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "CloudTrail log file validation creates a digitally signed digest file containing a hash of each log that CloudTrail writes to S3. These digest files can be used to determine whether a log file was changed, deleted, or unchanged after CloudTrail delivered the log. It is recommended that file validation be enabled on all CloudTrails.", @@ -761,7 +761,7 @@ ], "Attributes": [ { - "Section": "3. Logging", + "Section": "3 Logging", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "CloudTrail logs a record of every API call made in your AWS account. These logs file are stored in an S3 bucket. It is recommended that the bucket policy or access control list (ACL) applied to the S3 bucket that CloudTrail logs to prevent public access to the CloudTrail logs.", @@ -782,7 +782,7 @@ ], "Attributes": [ { - "Section": "3. Logging", + "Section": "3 Logging", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "AWS CloudTrail is a web service that records AWS API calls made in a given AWS account. The recorded information includes the identity of the API caller, the time of the API call, the source IP address of the API caller, the request parameters, and the response elements returned by the AWS service. CloudTrail uses Amazon S3 for log file storage and delivery, so log files are stored durably. In addition to capturing CloudTrail logs within a specified S3 bucket for long term analysis, realtime analysis can be performed by configuring CloudTrail to send logs to CloudWatch Logs. For a trail that is enabled in all regions in an account, CloudTrail sends log files from all those regions to a CloudWatch Logs log group. It is recommended that CloudTrail logs be sent to CloudWatch Logs. Note: The intent of this recommendation is to ensure AWS account activity is being captured, monitored, and appropriately alarmed on. CloudWatch Logs is a native way to accomplish this using AWS services but does not preclude the use of an alternate solution.", @@ -803,7 +803,7 @@ ], "Attributes": [ { - "Section": "3. Logging", + "Section": "3 Logging", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "AWS Config is a web service that performs configuration management of supported AWS resources within your account and delivers log files to you. The recorded information includes the configuration item (AWS resource), relationships between configuration items (AWS resources), any configuration changes between resources. It is recommended AWS Config be enabled in all regions.", @@ -824,7 +824,7 @@ ], "Attributes": [ { - "Section": "3. Logging", + "Section": "3 Logging", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "S3 Bucket Access Logging generates a log that contains access records for each request made to your S3 bucket. An access log record contains details about the request, such as the request type, the resources specified in the request worked, and the time and date the request was processed. It is recommended that bucket access logging be enabled on the CloudTrail S3 bucket.", @@ -845,7 +845,7 @@ ], "Attributes": [ { - "Section": "3. Logging", + "Section": "3 Logging", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "AWS CloudTrail is a web service that records AWS API calls for an account and makes those logs available to users and resources in accordance with IAM policies. AWS Key Management Service (KMS) is a managed service that helps create and control the encryption keys used to encrypt account data, and uses Hardware Security Modules (HSMs) to protect the security of encryption keys. CloudTrail logs can be configured to leverage server side encryption (SSE) and KMS customer created master keys (CMK) to further protect CloudTrail logs. It is recommended that CloudTrail be configured to use SSE-KMS.", @@ -866,7 +866,7 @@ ], "Attributes": [ { - "Section": "3. Logging", + "Section": "3 Logging", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "AWS Key Management Service (KMS) allows customers to rotate the backing key which is key material stored within the KMS which is tied to the key ID of the Customer Created customer master key (CMK). It is the backing key that is used to perform cryptographic operations such as encryption and decryption. Automated key rotation currently retains all prior backing keys so that decryption of encrypted data can take place transparently. It is recommended that CMK key rotation be enabled for symmetric keys. Key rotation can not be enabled for any asymmetric CMK.", @@ -887,7 +887,7 @@ ], "Attributes": [ { - "Section": "3. Logging", + "Section": "3 Logging", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "VPC Flow Logs is a feature that enables you to capture information about the IP traffic going to and from network interfaces in your VPC. After you've created a flow log, you can view and retrieve its data in Amazon CloudWatch Logs. It is recommended that VPC Flow Logs be enabled for packet \"Rejects\" for VPCs.", @@ -908,7 +908,7 @@ ], "Attributes": [ { - "Section": "4. Monitoring", + "Section": "4 Monitoring", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs and establishing corresponding metric filters and alarms. It is recommended that a metric filter and alarm be established for unauthorized API calls.", @@ -929,7 +929,7 @@ ], "Attributes": [ { - "Section": "4. Monitoring", + "Section": "4 Monitoring", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs and establishing corresponding metric filters and alarms. Security Groups are a stateful packet filter that controls ingress and egress traffic within a VPC. It is recommended that a metric filter and alarm be established for detecting changes to Security Groups.", @@ -950,7 +950,7 @@ ], "Attributes": [ { - "Section": "4. Monitoring", + "Section": "4 Monitoring", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs and establishing corresponding metric filters and alarms. NACLs are used as a stateless packet filter to control ingress and egress traffic for subnets within a VPC. It is recommended that a metric filter and alarm be established for changes made to NACLs.", @@ -971,7 +971,7 @@ ], "Attributes": [ { - "Section": "4. Monitoring", + "Section": "4 Monitoring", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs and establishing corresponding metric filters and alarms. Network gateways are required to send/receive traffic to a destination outside of a VPC. It is recommended that a metric filter and alarm be established for changes to network gateways.", @@ -992,7 +992,7 @@ ], "Attributes": [ { - "Section": "4. Monitoring", + "Section": "4 Monitoring", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs and establishing corresponding metric filters and alarms. Routing tables are used to route network traffic between subnets and to network gateways. It is recommended that a metric filter and alarm be established for changes to route tables.", @@ -1013,7 +1013,7 @@ ], "Attributes": [ { - "Section": "4. Monitoring", + "Section": "4 Monitoring", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs and establishing corresponding metric filters and alarms. It is possible to have more than 1 VPC within an account, in addition it is also possible to create a peer connection between 2 VPCs enabling network traffic to route between VPCs. It is recommended that a metric filter and alarm be established for changes made to VPCs.", @@ -1034,7 +1034,7 @@ ], "Attributes": [ { - "Section": "4. Monitoring", + "Section": "4 Monitoring", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs and establishing corresponding metric filters and alarms. It is recommended that a metric filter and alarm be established for AWS Organizations changes made in the master AWS Account.", @@ -1055,7 +1055,7 @@ ], "Attributes": [ { - "Section": "4. Monitoring", + "Section": "4 Monitoring", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "Security Hub collects security data from across AWS accounts, services, and supported third-party partner products and helps you analyze your security trends and identify the highest priority security issues. When you enable Security Hub, it begins to consume, aggregate, organize, and prioritize findings from AWS services that you have enabled, such as Amazon GuardDuty, Amazon Inspector, and Amazon Macie. You can also enable integrations with AWS partner security products.", @@ -1076,7 +1076,7 @@ ], "Attributes": [ { - "Section": "4. Monitoring", + "Section": "4 Monitoring", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs and establishing corresponding metric filters and alarms. It is recommended that a metric filter and alarm be established for console logins that are not protected by multi-factor authentication (MFA).", @@ -1097,7 +1097,7 @@ ], "Attributes": [ { - "Section": "4. Monitoring", + "Section": "4 Monitoring", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs and establishing corresponding metric filters and alarms. It is recommended that a metric filter and alarm be established for 'root' login attempts.", @@ -1118,7 +1118,7 @@ ], "Attributes": [ { - "Section": "4. Monitoring", + "Section": "4 Monitoring", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs and establishing corresponding metric filters and alarms. It is recommended that a metric filter and alarm be established changes made to Identity and Access Management (IAM) policies.", @@ -1139,7 +1139,7 @@ ], "Attributes": [ { - "Section": "4. Monitoring", + "Section": "4 Monitoring", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs and establishing corresponding metric filters and alarms. It is recommended that a metric filter and alarm be established for detecting changes to CloudTrail's configurations.", @@ -1160,7 +1160,7 @@ ], "Attributes": [ { - "Section": "4. Monitoring", + "Section": "4 Monitoring", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs and establishing corresponding metric filters and alarms. It is recommended that a metric filter and alarm be established for failed console authentication attempts.", @@ -1181,7 +1181,7 @@ ], "Attributes": [ { - "Section": "4. Monitoring", + "Section": "4 Monitoring", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs and establishing corresponding metric filters and alarms. It is recommended that a metric filter and alarm be established for customer created CMKs which have changed state to disabled or scheduled deletion.", @@ -1202,7 +1202,7 @@ ], "Attributes": [ { - "Section": "4. Monitoring", + "Section": "4 Monitoring", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs and establishing corresponding metric filters and alarms. It is recommended that a metric filter and alarm be established for changes to S3 bucket policies.", @@ -1223,7 +1223,7 @@ ], "Attributes": [ { - "Section": "4. Monitoring", + "Section": "4 Monitoring", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs and establishing corresponding metric filters and alarms. It is recommended that a metric filter and alarm be established for detecting changes to CloudTrail's configurations.", @@ -1246,7 +1246,7 @@ ], "Attributes": [ { - "Section": "5. Networking", + "Section": "5 Networking", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "The Network Access Control List (NACL) function provide stateless filtering of ingress and egress network traffic to AWS resources. It is recommended that no NACL allows unrestricted ingress access to remote server administration ports, such as SSH to port `22` and RDP to port `3389`.", @@ -1269,7 +1269,7 @@ ], "Attributes": [ { - "Section": "5. Networking", + "Section": "5 Networking", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Security groups provide stateful filtering of ingress and egress network traffic to AWS resources. It is recommended that no security group allows unrestricted ingress access to remote server administration ports, such as SSH to port `22` and RDP to port `3389`.", @@ -1292,7 +1292,7 @@ ], "Attributes": [ { - "Section": "5. Networking", + "Section": "5 Networking", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Security groups provide stateful filtering of ingress and egress network traffic to AWS resources. It is recommended that no security group allows unrestricted ingress access to remote server administration ports, such as SSH to port `22` and RDP to port `3389`.", @@ -1313,7 +1313,7 @@ ], "Attributes": [ { - "Section": "5. Networking", + "Section": "5 Networking", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "A VPC comes with a default security group whose initial settings deny all inbound traffic, allow all outbound traffic, and allow all traffic between instances assigned to the security group. If you don't specify a security group when you launch an instance, the instance is automatically assigned to this default security group. Security groups provide stateful filtering of ingress/egress network traffic to AWS resources. It is recommended that the default security group restrict all traffic. The default VPC in every region should have its default security group updated to comply. Any newly created VPCs will automatically contain a default security group that will need remediation to comply with this recommendation. **NOTE:** When implementing this recommendation, VPC flow logging is invaluable in determining the least privilege port access required by systems to work properly because it can log all packet acceptances and rejections occurring under the current security groups. This dramatically reduces the primary barrier to least privilege engineering - discovering the minimum ports required by systems in the environment. Even if the VPC flow logging recommendation in this benchmark is not adopted as a permanent security measure, it should be used during any period of discovery and engineering for least privileged security groups.", @@ -1334,7 +1334,7 @@ ], "Attributes": [ { - "Section": "5. Networking", + "Section": "5 Networking", "Profile": "Level 2", "AssessmentStatus": "Manual", "Description": "Once a VPC peering connection is established, routing tables must be updated to establish any connections between the peered VPCs. These routes can be as specific as desired - even peering a VPC to only a single host on the other side of the connection.", diff --git a/prowler/compliance/aws/cis_2.0_aws.json b/prowler/compliance/aws/cis_2.0_aws.json index 1d12e296d5..b847e5e38e 100644 --- a/prowler/compliance/aws/cis_2.0_aws.json +++ b/prowler/compliance/aws/cis_2.0_aws.json @@ -12,7 +12,7 @@ ], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 1", "AssessmentStatus": "Manual", "Description": "Ensure contact email and telephone details for AWS accounts are current and map to more than one individual in your organization. An AWS account supports a number of contact details, and AWS will use these to contact the account owner if activity judged to be in breach of Acceptable Use Policy or indicative of likely security compromise is observed by the AWS Abuse team. Contact details should not be for a single individual, as circumstances may arise where that individual is unavailable. Email contact details should point to a mail alias which forwards email to multiple individuals within the organization; where feasible, phone contact details should point to a PABX hunt group or other call-forwarding system.", @@ -33,7 +33,7 @@ ], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Multi-Factor Authentication (MFA) adds an extra layer of authentication assurance beyond traditional credentials. With MFA enabled, when a user signs in to the AWS Console, they will be prompted for their user name and password as well as for an authentication code from their physical or virtual MFA token. It is recommended that MFA be enabled for all accounts that have a console password.", @@ -54,7 +54,7 @@ ], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "AWS console defaults to no check boxes selected when creating a new IAM user. When cerating the IAM User credentials you have to determine what type of access they require. Programmatic access: The IAM user might need to make API calls, use the AWS CLI, or use the Tools for Windows PowerShell. In that case, create an access key (access key ID and a secret access key) for that user. AWS Management Console access: If the user needs to access the AWS Management Console, create a password for the user.", @@ -76,7 +76,7 @@ ], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "AWS IAM users can access AWS resources using different types of credentials, such as passwords or access keys. It is recommended that all credentials that have been unused in 45 or greater days be deactivated or removed.", @@ -97,7 +97,7 @@ ], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Access keys are long-term credentials for an IAM user or the AWS account 'root' user. You can use access keys to sign programmatic requests to the AWS CLI or AWS API (directly or using the AWS SDK)", @@ -118,7 +118,7 @@ ], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Access keys consist of an access key ID and secret access key, which are used to sign programmatic requests that you make to AWS. AWS users need their own access keys to make programmatic calls to AWS from the AWS Command Line Interface (AWS CLI), Tools for Windows PowerShell, the AWS SDKs, or direct HTTP calls using the APIs for individual AWS services. It is recommended that all access keys be regularly rotated.", @@ -139,7 +139,7 @@ ], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "IAM users are granted access to services, functions, and data through IAM policies. There are three ways to define policies for a user: 1) Edit the user policy directly, aka an inline, or user, policy; 2) attach a policy directly to a user; 3) add the user to an IAM group that has an attached policy. Only the third implementation is recommended.", @@ -161,7 +161,7 @@ ], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "IAM policies are the means by which privileges are granted to users, groups, or roles. It is recommended and considered a standard security advice to grant _least privilege_ -that is, granting only the permissions required to perform a task. Determine what users need to do and then craft policies for them that let the users perform _only_ those tasks, instead of allowing full administrative privileges.", @@ -182,7 +182,7 @@ ], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "AWS provides a support center that can be used for incident notification and response, as well as technical support and customer services. Create an IAM Role to allow authorized users to manage incidents with AWS Support.", @@ -203,7 +203,7 @@ ], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 2", "AssessmentStatus": "Manual", "Description": "AWS access from within AWS instances can be done by either encoding AWS keys into AWS API calls or by assigning the instance to a role which has an appropriate permissions policy for the required access. \"AWS Access\" means accessing the APIs of AWS in order to access AWS resources or manage AWS account resources.", @@ -224,7 +224,7 @@ ], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "To enable HTTPS connections to your website or application in AWS, you need an SSL/TLS server certificate. You can use ACM or IAM to store and deploy server certificates. Use IAM as a certificate manager only when you must support HTTPS connections in a region that is not supported by ACM. IAM securely encrypts your private keys and stores the encrypted version in IAM SSL certificate storage. IAM supports deploying server certificates in all regions, but you must obtain your certificate from an external provider for use with AWS. You cannot upload an ACM certificate to IAM. Additionally, you cannot manage your certificates from the IAM Console.", @@ -245,7 +245,7 @@ ], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 1", "AssessmentStatus": "Manual", "Description": "AWS provides customers with the option of specifying the contact information for account's security team. It is recommended that this information be provided.", @@ -266,7 +266,7 @@ ], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Enable IAM Access analyzer for IAM policies about all resources in each region. IAM Access Analyzer is a technology introduced at AWS reinvent 2019. After the Analyzer is enabled in IAM, scan results are displayed on the console showing the accessible resources. Scans show resources that other accounts and federated users can access, such as KMS keys and IAM roles. So the results allow you to determine if an unintended user is allowed, making it easier for administrators to monitor least privileges access. Access Analyzer analyzes only policies that are applied to resources in the same AWS Region.", @@ -287,7 +287,7 @@ ], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 2", "AssessmentStatus": "Manual", "Description": "In multi-account environments, IAM user centralization facilitates greater user control. User access beyond the initial account is then provided via role assumption. Centralization of users can be accomplished through federation with an external identity provider or through the use of AWS Organizations.", @@ -308,7 +308,7 @@ ], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 1", "AssessmentStatus": "Manual", "Description": "AWS CloudShell is a convenient way of running CLI commands against AWS services; a managed IAM policy ('AWSCloudShellFullAccess') provides full access to CloudShell, which allows file upload and download capability between a user's local system and the CloudShell environment. Within the CloudShell environment a user has sudo permissions, and can access the internet. So it is feasible to install file transfer software (for example) and move data from CloudShell to external internet servers.", @@ -329,7 +329,7 @@ ], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 1", "AssessmentStatus": "Manual", "Description": "The AWS support portal allows account owners to establish security questions that can be used to authenticate individuals calling AWS customer service for support. It is recommended that security questions be established.", @@ -350,7 +350,7 @@ ], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "The 'root' user account is the most privileged user in an AWS account. AWS Access Keys provide programmatic access to a given AWS account. It is recommended that all access keys associated with the 'root' user account be removed.", @@ -371,7 +371,7 @@ ], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "The 'root' user account is the most privileged user in an AWS account. Multi-factor Authentication (MFA) adds an extra layer of protection on top of a username and password. With MFA enabled, when a user signs in to an AWS website, they will be prompted for their username and password as well as for an authentication code from their AWS MFA device. **Note:** When virtual MFA is used for 'root' accounts, it is recommended that the device used is NOT a personal device, but rather a dedicated mobile device (tablet or phone) that is managed to be kept charged and secured independent of any individual personal devices. (\"non-personal virtual MFA\") This lessens the risks of losing access to the MFA due to device loss, device trade-in or if the individual owning the device is no longer employed at the company.", @@ -392,7 +392,7 @@ ], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "The 'root' user account is the most privileged user in an AWS account. MFA adds an extra layer of protection on top of a user name and password. With MFA enabled, when a user signs in to an AWS website, they will be prompted for their user name and password as well as for an authentication code from their AWS MFA device. For Level 2, it is recommended that the 'root' user account be protected with a hardware MFA.", @@ -413,7 +413,7 @@ ], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "With the creation of an AWS account, a 'root user' is created that cannot be disabled or deleted. That user has unrestricted access to and control over all resources in the AWS account. It is highly recommended that the use of this account be avoided for everyday tasks.", @@ -434,7 +434,7 @@ ], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Password policies are, in part, used to enforce password complexity requirements. IAM password policies can be used to ensure password are at least a given length. It is recommended that the password policy require a minimum password length 14.", @@ -455,7 +455,7 @@ ], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "IAM password policies can prevent the reuse of a given password by the same user. It is recommended that the password policy prevent the reuse of passwords.", @@ -476,7 +476,7 @@ ], "Attributes": [ { - "Section": "2. Storage", + "Section": "2 Storage", "SubSection": "2.1. Simple Storage Service (S3)", "Profile": "Level 2", "AssessmentStatus": "Automated", @@ -499,8 +499,8 @@ ], "Attributes": [ { - "Section": "2. Storage", - "SubSection": "2.1. Simple Storage Service (S3)", + "Section": "2 Storage", + "SubSection": "2.1 Simple Storage Service (S3)", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Once MFA Delete is enabled on your sensitive and classified S3 bucket it requires the user to have two forms of authentication.", @@ -521,8 +521,8 @@ ], "Attributes": [ { - "Section": "2. Storage", - "SubSection": "2.1. Simple Storage Service (S3)", + "Section": "2 Storage", + "SubSection": "2.1 Simple Storage Service (S3)", "Profile": "Level 2", "AssessmentStatus": "Manual", "Description": "Amazon S3 buckets can contain sensitive data, that for security purposes should be discovered, monitored, classified and protected. Macie along with other 3rd party tools can automatically provide an inventory of Amazon S3 buckets.", @@ -544,8 +544,8 @@ ], "Attributes": [ { - "Section": "2. Storage", - "SubSection": "2.1. Simple Storage Service (S3)", + "Section": "2 Storage", + "SubSection": "2.1 Simple Storage Service (S3)", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Amazon S3 provides `Block public access (bucket settings)` and `Block public access (account settings)` to help you manage public access to Amazon S3 resources. By default, S3 buckets and objects are created with public access disabled. However, an IAM principal with sufficient S3 permissions can enable public access at the bucket and/or object level. While enabled, `Block public access (bucket settings)` prevents an individual bucket, and its contained objects, from becoming publicly accessible. Similarly, `Block public access (account settings)` prevents all buckets, and contained objects, from becoming publicly accessible across the entire account.", @@ -566,8 +566,8 @@ ], "Attributes": [ { - "Section": "2. Storage", - "SubSection": "2.2. Elastic Compute Cloud (EC2)", + "Section": "2 Storage", + "SubSection": "2.2 Elastic Compute Cloud (EC2)", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Elastic Compute Cloud (EC2) supports encryption at rest when using the Elastic Block Store (EBS) service. While disabled by default, forcing encryption at EBS volume creation is supported.", @@ -589,8 +589,8 @@ ], "Attributes": [ { - "Section": "2. Storage", - "SubSection": "2.3. Relational Database Service (RDS)", + "Section": "2 Storage", + "SubSection": "2.3 Relational Database Service (RDS)", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Amazon RDS encrypted DB instances use the industry standard AES-256 encryption algorithm to encrypt your data on the server that hosts your Amazon RDS DB instances. After your data is encrypted, Amazon RDS handles authentication of access and decryption of your data transparently with a minimal impact on performance.", @@ -611,8 +611,8 @@ ], "Attributes": [ { - "Section": "2. Storage", - "SubSection": "2.3. Relational Database Service (RDS)", + "Section": "2 Storage", + "SubSection": "2.3 Relational Database Service (RDS)", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Ensure that RDS database instances have the Auto Minor Version Upgrade flag enabled in order to receive automatically minor engine upgrades during the specified maintenance window. So, RDS instances can get the new features, bug fixes, and security patches for their database engines.", @@ -633,8 +633,8 @@ ], "Attributes": [ { - "Section": "2. Storage", - "SubSection": "2.3. Relational Database Service (RDS)", + "Section": "2 Storage", + "SubSection": "2.3 Relational Database Service (RDS)", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Ensure and verify that RDS database instances provisioned in your AWS account do restrict unauthorized access in order to minimize security risks. To restrict access to any publicly accessible RDS database instance, you must disable the database Publicly Accessible flag and update the VPC security group associated with the instance.", @@ -655,7 +655,7 @@ ], "Attributes": [ { - "Section": "2. Storage", + "Section": "2 Storage", "SubSection": "2.4 Elastic File System (EFS)", "Profile": "Level 1", "AssessmentStatus": "Manual", @@ -677,7 +677,7 @@ ], "Attributes": [ { - "Section": "3. Logging", + "Section": "3 Logging", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "AWS CloudTrail is a web service that records AWS API calls for your account and delivers log files to you. The recorded information includes the identity of the API caller, the time of the API call, the source IP address of the API caller, the request parameters, and the response elements returned by the AWS service. CloudTrail provides a history of AWS API calls for an account, including API calls made via the Management Console, SDKs, command line tools, and higher-level AWS services (such as CloudFormation).", @@ -698,7 +698,7 @@ ], "Attributes": [ { - "Section": "3. Logging", + "Section": "3 Logging", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "S3 object-level API operations such as GetObject, DeleteObject, and PutObject are called data events. By default, CloudTrail trails don't log data events and so it is recommended to enable Object-level logging for S3 buckets.", @@ -719,7 +719,7 @@ ], "Attributes": [ { - "Section": "3. Logging", + "Section": "3 Logging", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "S3 object-level API operations such as GetObject, DeleteObject, and PutObject are called data events. By default, CloudTrail trails don't log data events and so it is recommended to enable Object-level logging for S3 buckets.", @@ -740,7 +740,7 @@ ], "Attributes": [ { - "Section": "3. Logging", + "Section": "3 Logging", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "CloudTrail log file validation creates a digitally signed digest file containing a hash of each log that CloudTrail writes to S3. These digest files can be used to determine whether a log file was changed, deleted, or unchanged after CloudTrail delivered the log. It is recommended that file validation be enabled on all CloudTrails.", @@ -761,7 +761,7 @@ ], "Attributes": [ { - "Section": "3. Logging", + "Section": "3 Logging", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "CloudTrail logs a record of every API call made in your AWS account. These logs file are stored in an S3 bucket. It is recommended that the bucket policy or access control list (ACL) applied to the S3 bucket that CloudTrail logs to prevent public access to the CloudTrail logs.", @@ -782,7 +782,7 @@ ], "Attributes": [ { - "Section": "3. Logging", + "Section": "3 Logging", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "AWS CloudTrail is a web service that records AWS API calls made in a given AWS account. The recorded information includes the identity of the API caller, the time of the API call, the source IP address of the API caller, the request parameters, and the response elements returned by the AWS service. CloudTrail uses Amazon S3 for log file storage and delivery, so log files are stored durably. In addition to capturing CloudTrail logs within a specified S3 bucket for long term analysis, realtime analysis can be performed by configuring CloudTrail to send logs to CloudWatch Logs. For a trail that is enabled in all regions in an account, CloudTrail sends log files from all those regions to a CloudWatch Logs log group. It is recommended that CloudTrail logs be sent to CloudWatch Logs. Note: The intent of this recommendation is to ensure AWS account activity is being captured, monitored, and appropriately alarmed on. CloudWatch Logs is a native way to accomplish this using AWS services but does not preclude the use of an alternate solution.", @@ -803,7 +803,7 @@ ], "Attributes": [ { - "Section": "3. Logging", + "Section": "3 Logging", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "AWS Config is a web service that performs configuration management of supported AWS resources within your account and delivers log files to you. The recorded information includes the configuration item (AWS resource), relationships between configuration items (AWS resources), any configuration changes between resources. It is recommended AWS Config be enabled in all regions.", @@ -824,7 +824,7 @@ ], "Attributes": [ { - "Section": "3. Logging", + "Section": "3 Logging", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "S3 Bucket Access Logging generates a log that contains access records for each request made to your S3 bucket. An access log record contains details about the request, such as the request type, the resources specified in the request worked, and the time and date the request was processed. It is recommended that bucket access logging be enabled on the CloudTrail S3 bucket.", @@ -845,7 +845,7 @@ ], "Attributes": [ { - "Section": "3. Logging", + "Section": "3 Logging", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "AWS CloudTrail is a web service that records AWS API calls for an account and makes those logs available to users and resources in accordance with IAM policies. AWS Key Management Service (KMS) is a managed service that helps create and control the encryption keys used to encrypt account data, and uses Hardware Security Modules (HSMs) to protect the security of encryption keys. CloudTrail logs can be configured to leverage server side encryption (SSE) and KMS customer created master keys (CMK) to further protect CloudTrail logs. It is recommended that CloudTrail be configured to use SSE-KMS.", @@ -866,7 +866,7 @@ ], "Attributes": [ { - "Section": "3. Logging", + "Section": "3 Logging", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "AWS Key Management Service (KMS) allows customers to rotate the backing key which is key material stored within the KMS which is tied to the key ID of the Customer Created customer master key (CMK). It is the backing key that is used to perform cryptographic operations such as encryption and decryption. Automated key rotation currently retains all prior backing keys so that decryption of encrypted data can take place transparently. It is recommended that CMK key rotation be enabled for symmetric keys. Key rotation can not be enabled for any asymmetric CMK.", @@ -887,7 +887,7 @@ ], "Attributes": [ { - "Section": "3. Logging", + "Section": "3 Logging", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "VPC Flow Logs is a feature that enables you to capture information about the IP traffic going to and from network interfaces in your VPC. After you've created a flow log, you can view and retrieve its data in Amazon CloudWatch Logs. It is recommended that VPC Flow Logs be enabled for packet \"Rejects\" for VPCs.", @@ -908,7 +908,7 @@ ], "Attributes": [ { - "Section": "4. Monitoring", + "Section": "4 Monitoring", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs and establishing corresponding metric filters and alarms. It is recommended that a metric filter and alarm be established for unauthorized API calls.", @@ -929,7 +929,7 @@ ], "Attributes": [ { - "Section": "4. Monitoring", + "Section": "4 Monitoring", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs and establishing corresponding metric filters and alarms. Security Groups are a stateful packet filter that controls ingress and egress traffic within a VPC. It is recommended that a metric filter and alarm be established for detecting changes to Security Groups.", @@ -950,7 +950,7 @@ ], "Attributes": [ { - "Section": "4. Monitoring", + "Section": "4 Monitoring", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs and establishing corresponding metric filters and alarms. NACLs are used as a stateless packet filter to control ingress and egress traffic for subnets within a VPC. It is recommended that a metric filter and alarm be established for changes made to NACLs.", @@ -971,7 +971,7 @@ ], "Attributes": [ { - "Section": "4. Monitoring", + "Section": "4 Monitoring", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs and establishing corresponding metric filters and alarms. Network gateways are required to send/receive traffic to a destination outside of a VPC. It is recommended that a metric filter and alarm be established for changes to network gateways.", @@ -992,7 +992,7 @@ ], "Attributes": [ { - "Section": "4. Monitoring", + "Section": "4 Monitoring", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs and establishing corresponding metric filters and alarms. Routing tables are used to route network traffic between subnets and to network gateways. It is recommended that a metric filter and alarm be established for changes to route tables.", @@ -1013,7 +1013,7 @@ ], "Attributes": [ { - "Section": "4. Monitoring", + "Section": "4 Monitoring", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs and establishing corresponding metric filters and alarms. It is possible to have more than 1 VPC within an account, in addition it is also possible to create a peer connection between 2 VPCs enabling network traffic to route between VPCs. It is recommended that a metric filter and alarm be established for changes made to VPCs.", @@ -1034,7 +1034,7 @@ ], "Attributes": [ { - "Section": "4. Monitoring", + "Section": "4 Monitoring", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs and establishing corresponding metric filters and alarms. It is recommended that a metric filter and alarm be established for AWS Organizations changes made in the master AWS Account.", @@ -1055,7 +1055,7 @@ ], "Attributes": [ { - "Section": "4. Monitoring", + "Section": "4 Monitoring", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "Security Hub collects security data from across AWS accounts, services, and supported third-party partner products and helps you analyze your security trends and identify the highest priority security issues. When you enable Security Hub, it begins to consume, aggregate, organize, and prioritize findings from AWS services that you have enabled, such as Amazon GuardDuty, Amazon Inspector, and Amazon Macie. You can also enable integrations with AWS partner security products.", @@ -1076,7 +1076,7 @@ ], "Attributes": [ { - "Section": "4. Monitoring", + "Section": "4 Monitoring", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs and establishing corresponding metric filters and alarms. It is recommended that a metric filter and alarm be established for console logins that are not protected by multi-factor authentication (MFA).", @@ -1097,7 +1097,7 @@ ], "Attributes": [ { - "Section": "4. Monitoring", + "Section": "4 Monitoring", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs and establishing corresponding metric filters and alarms. It is recommended that a metric filter and alarm be established for 'root' login attempts.", @@ -1118,7 +1118,7 @@ ], "Attributes": [ { - "Section": "4. Monitoring", + "Section": "4 Monitoring", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs and establishing corresponding metric filters and alarms. It is recommended that a metric filter and alarm be established changes made to Identity and Access Management (IAM) policies.", @@ -1139,7 +1139,7 @@ ], "Attributes": [ { - "Section": "4. Monitoring", + "Section": "4 Monitoring", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs and establishing corresponding metric filters and alarms. It is recommended that a metric filter and alarm be established for detecting changes to CloudTrail's configurations.", @@ -1160,7 +1160,7 @@ ], "Attributes": [ { - "Section": "4. Monitoring", + "Section": "4 Monitoring", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs and establishing corresponding metric filters and alarms. It is recommended that a metric filter and alarm be established for failed console authentication attempts.", @@ -1181,7 +1181,7 @@ ], "Attributes": [ { - "Section": "4. Monitoring", + "Section": "4 Monitoring", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs and establishing corresponding metric filters and alarms. It is recommended that a metric filter and alarm be established for customer created CMKs which have changed state to disabled or scheduled deletion.", @@ -1202,7 +1202,7 @@ ], "Attributes": [ { - "Section": "4. Monitoring", + "Section": "4 Monitoring", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs and establishing corresponding metric filters and alarms. It is recommended that a metric filter and alarm be established for changes to S3 bucket policies.", @@ -1223,7 +1223,7 @@ ], "Attributes": [ { - "Section": "4. Monitoring", + "Section": "4 Monitoring", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs and establishing corresponding metric filters and alarms. It is recommended that a metric filter and alarm be established for detecting changes to CloudTrail's configurations.", @@ -1246,7 +1246,7 @@ ], "Attributes": [ { - "Section": "5. Networking", + "Section": "5 Networking", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "The Network Access Control List (NACL) function provide stateless filtering of ingress and egress network traffic to AWS resources. It is recommended that no NACL allows unrestricted ingress access to remote server administration ports, such as SSH to port `22` and RDP to port `3389`.", @@ -1269,7 +1269,7 @@ ], "Attributes": [ { - "Section": "5. Networking", + "Section": "5 Networking", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Security groups provide stateful filtering of ingress and egress network traffic to AWS resources. It is recommended that no security group allows unrestricted ingress access to remote server administration ports, such as SSH to port `22` and RDP to port `3389`.", @@ -1292,7 +1292,7 @@ ], "Attributes": [ { - "Section": "5. Networking", + "Section": "5 Networking", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Security groups provide stateful filtering of ingress and egress network traffic to AWS resources. It is recommended that no security group allows unrestricted ingress access to remote server administration ports, such as SSH to port `22` and RDP to port `3389`.", @@ -1313,7 +1313,7 @@ ], "Attributes": [ { - "Section": "5. Networking", + "Section": "5 Networking", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "A VPC comes with a default security group whose initial settings deny all inbound traffic, allow all outbound traffic, and allow all traffic between instances assigned to the security group. If you don't specify a security group when you launch an instance, the instance is automatically assigned to this default security group. Security groups provide stateful filtering of ingress/egress network traffic to AWS resources. It is recommended that the default security group restrict all traffic. The default VPC in every region should have its default security group updated to comply. Any newly created VPCs will automatically contain a default security group that will need remediation to comply with this recommendation. **NOTE:** When implementing this recommendation, VPC flow logging is invaluable in determining the least privilege port access required by systems to work properly because it can log all packet acceptances and rejections occurring under the current security groups. This dramatically reduces the primary barrier to least privilege engineering - discovering the minimum ports required by systems in the environment. Even if the VPC flow logging recommendation in this benchmark is not adopted as a permanent security measure, it should be used during any period of discovery and engineering for least privileged security groups.", @@ -1334,7 +1334,7 @@ ], "Attributes": [ { - "Section": "5. Networking", + "Section": "5 Networking", "Profile": "Level 2", "AssessmentStatus": "Manual", "Description": "Once a VPC peering connection is established, routing tables must be updated to establish any connections between the peered VPCs. These routes can be as specific as desired - even peering a VPC to only a single host on the other side of the connection.", @@ -1356,7 +1356,7 @@ ], "Attributes": [ { - "Section": "5. Networking", + "Section": "5 Networking", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "When enabling the Metadata Service on AWS EC2 instances, users have the option of using either Instance Metadata Service Version 1 (IMDSv1; a request/response method) or Instance Metadata Service Version 2 (IMDSv2; a session-oriented method).", diff --git a/prowler/compliance/aws/cis_3.0_aws.json b/prowler/compliance/aws/cis_3.0_aws.json index 9b45e6c7b8..9b9ff78ded 100644 --- a/prowler/compliance/aws/cis_3.0_aws.json +++ b/prowler/compliance/aws/cis_3.0_aws.json @@ -12,7 +12,7 @@ ], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 1", "AssessmentStatus": "Manual", "Description": "Ensure contact email and telephone details for AWS accounts are current and map to more than one individual in your organization. An AWS account supports a number of contact details, and AWS will use these to contact the account owner if activity judged to be in breach of Acceptable Use Policy or indicative of likely security compromise is observed by the AWS Abuse team. Contact details should not be for a single individual, as circumstances may arise where that individual is unavailable. Email contact details should point to a mail alias which forwards email to multiple individuals within the organization; where feasible, phone contact details should point to a PABX hunt group or other call-forwarding system.", @@ -33,7 +33,7 @@ ], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Multi-Factor Authentication (MFA) adds an extra layer of authentication assurance beyond traditional credentials. With MFA enabled, when a user signs in to the AWS Console, they will be prompted for their user name and password as well as for an authentication code from their physical or virtual MFA token. It is recommended that MFA be enabled for all accounts that have a console password.", @@ -54,7 +54,7 @@ ], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "AWS console defaults to no check boxes selected when creating a new IAM user. When cerating the IAM User credentials you have to determine what type of access they require. Programmatic access: The IAM user might need to make API calls, use the AWS CLI, or use the Tools for Windows PowerShell. In that case, create an access key (access key ID and a secret access key) for that user. AWS Management Console access: If the user needs to access the AWS Management Console, create a password for the user.", @@ -76,7 +76,7 @@ ], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "AWS IAM users can access AWS resources using different types of credentials, such as passwords or access keys. It is recommended that all credentials that have been unused in 45 or greater days be deactivated or removed.", @@ -97,7 +97,7 @@ ], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Access keys are long-term credentials for an IAM user or the AWS account 'root' user. You can use access keys to sign programmatic requests to the AWS CLI or AWS API (directly or using the AWS SDK)", @@ -118,7 +118,7 @@ ], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Access keys consist of an access key ID and secret access key, which are used to sign programmatic requests that you make to AWS. AWS users need their own access keys to make programmatic calls to AWS from the AWS Command Line Interface (AWS CLI), Tools for Windows PowerShell, the AWS SDKs, or direct HTTP calls using the APIs for individual AWS services. It is recommended that all access keys be regularly rotated.", @@ -139,7 +139,7 @@ ], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "IAM users are granted access to services, functions, and data through IAM policies. There are three ways to define policies for a user: 1) Edit the user policy directly, aka an inline, or user, policy; 2) attach a policy directly to a user; 3) add the user to an IAM group that has an attached policy. Only the third implementation is recommended.", @@ -161,7 +161,7 @@ ], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "IAM policies are the means by which privileges are granted to users, groups, or roles. It is recommended and considered a standard security advice to grant _least privilege_ -that is, granting only the permissions required to perform a task. Determine what users need to do and then craft policies for them that let the users perform _only_ those tasks, instead of allowing full administrative privileges.", @@ -182,7 +182,7 @@ ], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "AWS provides a support center that can be used for incident notification and response, as well as technical support and customer services. Create an IAM Role to allow authorized users to manage incidents with AWS Support.", @@ -203,7 +203,7 @@ ], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 2", "AssessmentStatus": "Manual", "Description": "AWS access from within AWS instances can be done by either encoding AWS keys into AWS API calls or by assigning the instance to a role which has an appropriate permissions policy for the required access. \"AWS Access\" means accessing the APIs of AWS in order to access AWS resources or manage AWS account resources.", @@ -224,7 +224,7 @@ ], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "To enable HTTPS connections to your website or application in AWS, you need an SSL/TLS server certificate. You can use ACM or IAM to store and deploy server certificates. Use IAM as a certificate manager only when you must support HTTPS connections in a region that is not supported by ACM. IAM securely encrypts your private keys and stores the encrypted version in IAM SSL certificate storage. IAM supports deploying server certificates in all regions, but you must obtain your certificate from an external provider for use with AWS. You cannot upload an ACM certificate to IAM. Additionally, you cannot manage your certificates from the IAM Console.", @@ -245,7 +245,7 @@ ], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 1", "AssessmentStatus": "Manual", "Description": "AWS provides customers with the option of specifying the contact information for account's security team. It is recommended that this information be provided.", @@ -266,7 +266,7 @@ ], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Enable IAM Access analyzer for IAM policies about all resources in each region. IAM Access Analyzer is a technology introduced at AWS reinvent 2019. After the Analyzer is enabled in IAM, scan results are displayed on the console showing the accessible resources. Scans show resources that other accounts and federated users can access, such as KMS keys and IAM roles. So the results allow you to determine if an unintended user is allowed, making it easier for administrators to monitor least privileges access. Access Analyzer analyzes only policies that are applied to resources in the same AWS Region.", @@ -287,7 +287,7 @@ ], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 2", "AssessmentStatus": "Manual", "Description": "In multi-account environments, IAM user centralization facilitates greater user control. User access beyond the initial account is then provided via role assumption. Centralization of users can be accomplished through federation with an external identity provider or through the use of AWS Organizations.", @@ -306,7 +306,7 @@ "Checks": [], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 1", "AssessmentStatus": "Manual", "Description": "AWS CloudShell is a convenient way of running CLI commands against AWS services; a managed IAM policy ('AWSCloudShellFullAccess') provides full access to CloudShell, which allows file upload and download capability between a user's local system and the CloudShell environment. Within the CloudShell environment a user has sudo permissions, and can access the internet. So it is feasible to install file transfer software (for example) and move data from CloudShell to external internet servers.", @@ -327,7 +327,7 @@ ], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 1", "AssessmentStatus": "Manual", "Description": "The AWS support portal allows account owners to establish security questions that can be used to authenticate individuals calling AWS customer service for support. It is recommended that security questions be established.", @@ -348,7 +348,7 @@ ], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "The 'root' user account is the most privileged user in an AWS account. AWS Access Keys provide programmatic access to a given AWS account. It is recommended that all access keys associated with the 'root' user account be removed.", @@ -369,7 +369,7 @@ ], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "The 'root' user account is the most privileged user in an AWS account. Multi-factor Authentication (MFA) adds an extra layer of protection on top of a username and password. With MFA enabled, when a user signs in to an AWS website, they will be prompted for their username and password as well as for an authentication code from their AWS MFA device. **Note:** When virtual MFA is used for 'root' accounts, it is recommended that the device used is NOT a personal device, but rather a dedicated mobile device (tablet or phone) that is managed to be kept charged and secured independent of any individual personal devices. (\"non-personal virtual MFA\") This lessens the risks of losing access to the MFA due to device loss, device trade-in or if the individual owning the device is no longer employed at the company.", @@ -390,7 +390,7 @@ ], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "The 'root' user account is the most privileged user in an AWS account. MFA adds an extra layer of protection on top of a user name and password. With MFA enabled, when a user signs in to an AWS website, they will be prompted for their user name and password as well as for an authentication code from their AWS MFA device. For Level 2, it is recommended that the 'root' user account be protected with a hardware MFA.", @@ -411,7 +411,7 @@ ], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "With the creation of an AWS account, a 'root user' is created that cannot be disabled or deleted. That user has unrestricted access to and control over all resources in the AWS account. It is highly recommended that the use of this account be avoided for everyday tasks.", @@ -432,7 +432,7 @@ ], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Password policies are, in part, used to enforce password complexity requirements. IAM password policies can be used to ensure password are at least a given length. It is recommended that the password policy require a minimum password length 14.", @@ -453,7 +453,7 @@ ], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "IAM password policies can prevent the reuse of a given password by the same user. It is recommended that the password policy prevent the reuse of passwords.", @@ -474,8 +474,8 @@ ], "Attributes": [ { - "Section": "2. Storage", - "SubSection": "2.1. Simple Storage Service (S3)", + "Section": "2 Storage", + "SubSection": "2.1 Simple Storage Service (S3)", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "At the Amazon S3 bucket level, you can configure permissions through a bucket policy making the objects accessible only through HTTPS.", @@ -496,8 +496,8 @@ ], "Attributes": [ { - "Section": "2. Storage", - "SubSection": "2.1. Simple Storage Service (S3)", + "Section": "2 Storage", + "SubSection": "2.1 Simple Storage Service (S3)", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Once MFA Delete is enabled on your sensitive and classified S3 bucket it requires the user to have two forms of authentication.", @@ -518,8 +518,8 @@ ], "Attributes": [ { - "Section": "2. Storage", - "SubSection": "2.1. Simple Storage Service (S3)", + "Section": "2 Storage", + "SubSection": "2.1 Simple Storage Service (S3)", "Profile": "Level 2", "AssessmentStatus": "Manual", "Description": "Amazon S3 buckets can contain sensitive data, that for security purposes should be discovered, monitored, classified and protected. Macie along with other 3rd party tools can automatically provide an inventory of Amazon S3 buckets.", @@ -541,8 +541,8 @@ ], "Attributes": [ { - "Section": "2. Storage", - "SubSection": "2.1. Simple Storage Service (S3)", + "Section": "2 Storage", + "SubSection": "2.1 Simple Storage Service (S3)", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Amazon S3 provides `Block public access (bucket settings)` and `Block public access (account settings)` to help you manage public access to Amazon S3 resources. By default, S3 buckets and objects are created with public access disabled. However, an IAM principal with sufficient S3 permissions can enable public access at the bucket and/or object level. While enabled, `Block public access (bucket settings)` prevents an individual bucket, and its contained objects, from becoming publicly accessible. Similarly, `Block public access (account settings)` prevents all buckets, and contained objects, from becoming publicly accessible across the entire account.", @@ -563,8 +563,8 @@ ], "Attributes": [ { - "Section": "2. Storage", - "SubSection": "2.2. Elastic Compute Cloud (EC2)", + "Section": "2 Storage", + "SubSection": "2.2 Elastic Compute Cloud (EC2)", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Elastic Compute Cloud (EC2) supports encryption at rest when using the Elastic Block Store (EBS) service. While disabled by default, forcing encryption at EBS volume creation is supported.", @@ -585,8 +585,8 @@ ], "Attributes": [ { - "Section": "2. Storage", - "SubSection": "2.3. Relational Database Service (RDS)", + "Section": "2 Storage", + "SubSection": "2.3 Relational Database Service (RDS)", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Amazon RDS encrypted DB instances use the industry standard AES-256 encryption algorithm to encrypt your data on the server that hosts your Amazon RDS DB instances. After your data is encrypted, Amazon RDS handles authentication of access and decryption of your data transparently with a minimal impact on performance.", @@ -607,8 +607,8 @@ ], "Attributes": [ { - "Section": "2. Storage", - "SubSection": "2.3. Relational Database Service (RDS)", + "Section": "2 Storage", + "SubSection": "2.3 Relational Database Service (RDS)", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Ensure that RDS database instances have the Auto Minor Version Upgrade flag enabled in order to receive automatically minor engine upgrades during the specified maintenance window. So, RDS instances can get the new features, bug fixes, and security patches for their database engines.", @@ -629,8 +629,8 @@ ], "Attributes": [ { - "Section": "2. Storage", - "SubSection": "2.3. Relational Database Service (RDS)", + "Section": "2 Storage", + "SubSection": "2.3 Relational Database Service (RDS)", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Ensure and verify that RDS database instances provisioned in your AWS account do restrict unauthorized access in order to minimize security risks. To restrict access to anypublicly accessible RDS database instance, you must disable the database PubliclyAccessible flag and update the VPC security group associated with the instance", @@ -651,7 +651,7 @@ ], "Attributes": [ { - "Section": "2. Storage", + "Section": "2 Storage", "SubSection": "2.4 Elastic File System (EFS)", "Profile": "Level 1", "AssessmentStatus": "Automated", @@ -673,7 +673,7 @@ ], "Attributes": [ { - "Section": "3. Logging", + "Section": "3 Logging", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "AWS CloudTrail is a web service that records AWS API calls for your account and delivers log files to you. The recorded information includes the identity of the API caller, the time of the API call, the source IP address of the API caller, the request parameters, and the response elements returned by the AWS service. CloudTrail provides a history of AWS API calls for an account, including API calls made via the Management Console, SDKs, command line tools, and higher-level AWS services (such as CloudFormation).", @@ -694,7 +694,7 @@ ], "Attributes": [ { - "Section": "3. Logging", + "Section": "3 Logging", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "S3 object-level API operations such as GetObject, DeleteObject, and PutObject are called data events. By default, CloudTrail trails don't log data events and so it is recommended to enable Object-level logging for S3 buckets.", @@ -715,7 +715,7 @@ ], "Attributes": [ { - "Section": "3. Logging", + "Section": "3 Logging", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "S3 object-level API operations such as GetObject, DeleteObject, and PutObject are called data events. By default, CloudTrail trails don't log data events and so it is recommended to enable Object-level logging for S3 buckets.", @@ -736,7 +736,7 @@ ], "Attributes": [ { - "Section": "3. Logging", + "Section": "3 Logging", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "CloudTrail log file validation creates a digitally signed digest file containing a hash of each log that CloudTrail writes to S3. These digest files can be used to determine whether a log file was changed, deleted, or unchanged after CloudTrail delivered the log. It is recommended that file validation be enabled on all CloudTrails.", @@ -757,7 +757,7 @@ ], "Attributes": [ { - "Section": "3. Logging", + "Section": "3 Logging", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "AWS Config is a web service that performs configuration management of supported AWS resources within your account and delivers log files to you. The recorded information includes the configuration item (AWS resource), relationships between configuration items (AWS resources), any configuration changes between resources. It is recommended AWS Config be enabled in all regions.", @@ -778,7 +778,7 @@ ], "Attributes": [ { - "Section": "3. Logging", + "Section": "3 Logging", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "S3 Bucket Access Logging generates a log that contains access records for each request made to your S3 bucket. An access log record contains details about the request, such as the request type, the resources specified in the request worked, and the time and date the request was processed. It is recommended that bucket access logging be enabled on the CloudTrail S3 bucket.", @@ -799,7 +799,7 @@ ], "Attributes": [ { - "Section": "3. Logging", + "Section": "3 Logging", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "AWS CloudTrail is a web service that records AWS API calls for an account and makes those logs available to users and resources in accordance with IAM policies. AWS Key Management Service (KMS) is a managed service that helps create and control the encryption keys used to encrypt account data, and uses Hardware Security Modules (HSMs) to protect the security of encryption keys. CloudTrail logs can be configured to leverage server side encryption (SSE) and KMS customer created master keys (CMK) to further protect CloudTrail logs. It is recommended that CloudTrail be configured to use SSE-KMS.", @@ -820,7 +820,7 @@ ], "Attributes": [ { - "Section": "3. Logging", + "Section": "3 Logging", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "AWS Key Management Service (KMS) allows customers to rotate the backing key which is key material stored within the KMS which is tied to the key ID of the Customer Created customer master key (CMK). It is the backing key that is used to perform cryptographic operations such as encryption and decryption. Automated key rotation currently retains all prior backing keys so that decryption of encrypted data can take place transparently. It is recommended that CMK key rotation be enabled for symmetric keys. Key rotation can not be enabled for any asymmetric CMK.", @@ -841,7 +841,7 @@ ], "Attributes": [ { - "Section": "3. Logging", + "Section": "3 Logging", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "VPC Flow Logs is a feature that enables you to capture information about the IP traffic going to and from network interfaces in your VPC. After you've created a flow log, you can view and retrieve its data in Amazon CloudWatch Logs. It is recommended that VPC Flow Logs be enabled for packet \"Rejects\" for VPCs.", @@ -862,7 +862,7 @@ ], "Attributes": [ { - "Section": "4. Monitoring", + "Section": "4 Monitoring", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs and establishing corresponding metric filters and alarms. It is recommended that a metric filter and alarm be established for unauthorized API calls.", @@ -883,7 +883,7 @@ ], "Attributes": [ { - "Section": "4. Monitoring", + "Section": "4 Monitoring", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs and establishing corresponding metric filters and alarms. Security Groups are a stateful packet filter that controls ingress and egress traffic within a VPC. It is recommended that a metric filter and alarm be established for detecting changes to Security Groups.", @@ -904,7 +904,7 @@ ], "Attributes": [ { - "Section": "4. Monitoring", + "Section": "4 Monitoring", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs and establishing corresponding metric filters and alarms. NACLs are used as a stateless packet filter to control ingress and egress traffic for subnets within a VPC. It is recommended that a metric filter and alarm be established for changes made to NACLs.", @@ -925,7 +925,7 @@ ], "Attributes": [ { - "Section": "4. Monitoring", + "Section": "4 Monitoring", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs and establishing corresponding metric filters and alarms. Network gateways are required to send/receive traffic to a destination outside of a VPC. It is recommended that a metric filter and alarm be established for changes to network gateways.", @@ -946,7 +946,7 @@ ], "Attributes": [ { - "Section": "4. Monitoring", + "Section": "4 Monitoring", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs and establishing corresponding metric filters and alarms. Routing tables are used to route network traffic between subnets and to network gateways. It is recommended that a metric filter and alarm be established for changes to route tables.", @@ -967,7 +967,7 @@ ], "Attributes": [ { - "Section": "4. Monitoring", + "Section": "4 Monitoring", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs and establishing corresponding metric filters and alarms. It is possible to have more than 1 VPC within an account, in addition it is also possible to create a peer connection between 2 VPCs enabling network traffic to route between VPCs. It is recommended that a metric filter and alarm be established for changes made to VPCs.", @@ -988,7 +988,7 @@ ], "Attributes": [ { - "Section": "4. Monitoring", + "Section": "4 Monitoring", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs and establishing corresponding metric filters and alarms. It is recommended that a metric filter and alarm be established for AWS Organizations changes made in the master AWS Account.", @@ -1009,7 +1009,7 @@ ], "Attributes": [ { - "Section": "4. Monitoring", + "Section": "4 Monitoring", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "Security Hub collects security data from across AWS accounts, services, and supported third-party partner products and helps you analyze your security trends and identify the highest priority security issues. When you enable Security Hub, it begins to consume, aggregate, organize, and prioritize findings from AWS services that you have enabled, such as Amazon GuardDuty, Amazon Inspector, and Amazon Macie. You can also enable integrations with AWS partner security products.", @@ -1030,7 +1030,7 @@ ], "Attributes": [ { - "Section": "4. Monitoring", + "Section": "4 Monitoring", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs and establishing corresponding metric filters and alarms. It is recommended that a metric filter and alarm be established for console logins that are not protected by multi-factor authentication (MFA).", @@ -1051,7 +1051,7 @@ ], "Attributes": [ { - "Section": "4. Monitoring", + "Section": "4 Monitoring", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs and establishing corresponding metric filters and alarms. It is recommended that a metric filter and alarm be established for 'root' login attempts.", @@ -1072,7 +1072,7 @@ ], "Attributes": [ { - "Section": "4. Monitoring", + "Section": "4 Monitoring", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs and establishing corresponding metric filters and alarms. It is recommended that a metric filter and alarm be established changes made to Identity and Access Management (IAM) policies.", @@ -1093,7 +1093,7 @@ ], "Attributes": [ { - "Section": "4. Monitoring", + "Section": "4 Monitoring", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs and establishing corresponding metric filters and alarms. It is recommended that a metric filter and alarm be established for detecting changes to CloudTrail's configurations.", @@ -1114,7 +1114,7 @@ ], "Attributes": [ { - "Section": "4. Monitoring", + "Section": "4 Monitoring", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs and establishing corresponding metric filters and alarms. It is recommended that a metric filter and alarm be established for failed console authentication attempts.", @@ -1135,7 +1135,7 @@ ], "Attributes": [ { - "Section": "4. Monitoring", + "Section": "4 Monitoring", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs and establishing corresponding metric filters and alarms. It is recommended that a metric filter and alarm be established for customer created CMKs which have changed state to disabled or scheduled deletion.", @@ -1156,7 +1156,7 @@ ], "Attributes": [ { - "Section": "4. Monitoring", + "Section": "4 Monitoring", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs and establishing corresponding metric filters and alarms. It is recommended that a metric filter and alarm be established for changes to S3 bucket policies.", @@ -1177,7 +1177,7 @@ ], "Attributes": [ { - "Section": "4. Monitoring", + "Section": "4 Monitoring", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs and establishing corresponding metric filters and alarms. It is recommended that a metric filter and alarm be established for detecting changes to CloudTrail's configurations.", @@ -1200,7 +1200,7 @@ ], "Attributes": [ { - "Section": "5. Networking", + "Section": "5 Networking", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "The Network Access Control List (NACL) function provide stateless filtering of ingress and egress network traffic to AWS resources. It is recommended that no NACL allows unrestricted ingress access to remote server administration ports, such as SSH to port `22` and RDP to port `3389`.", @@ -1223,7 +1223,7 @@ ], "Attributes": [ { - "Section": "5. Networking", + "Section": "5 Networking", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Security groups provide stateful filtering of ingress and egress network traffic to AWS resources. It is recommended that no security group allows unrestricted ingress access to remote server administration ports, such as SSH to port `22` and RDP to port `3389`.", @@ -1246,7 +1246,7 @@ ], "Attributes": [ { - "Section": "5. Networking", + "Section": "5 Networking", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Security groups provide stateful filtering of ingress and egress network traffic to AWS resources. It is recommended that no security group allows unrestricted ingress access to remote server administration ports, such as SSH to port `22` and RDP to port `3389`.", @@ -1267,7 +1267,7 @@ ], "Attributes": [ { - "Section": "5. Networking", + "Section": "5 Networking", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "A VPC comes with a default security group whose initial settings deny all inbound traffic, allow all outbound traffic, and allow all traffic between instances assigned to the security group. If you don't specify a security group when you launch an instance, the instance is automatically assigned to this default security group. Security groups provide stateful filtering of ingress/egress network traffic to AWS resources. It is recommended that the default security group restrict all traffic. The default VPC in every region should have its default security group updated to comply. Any newly created VPCs will automatically contain a default security group that will need remediation to comply with this recommendation. **NOTE:** When implementing this recommendation, VPC flow logging is invaluable in determining the least privilege port access required by systems to work properly because it can log all packet acceptances and rejections occurring under the current security groups. This dramatically reduces the primary barrier to least privilege engineering - discovering the minimum ports required by systems in the environment. Even if the VPC flow logging recommendation in this benchmark is not adopted as a permanent security measure, it should be used during any period of discovery and engineering for least privileged security groups.", @@ -1288,7 +1288,7 @@ ], "Attributes": [ { - "Section": "5. Networking", + "Section": "5 Networking", "Profile": "Level 2", "AssessmentStatus": "Manual", "Description": "Once a VPC peering connection is established, routing tables must be updated to establish any connections between the peered VPCs. These routes can be as specific as desired - even peering a VPC to only a single host on the other side of the connection.", @@ -1309,7 +1309,7 @@ ], "Attributes": [ { - "Section": "5. Networking", + "Section": "5 Networking", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "When enabling the Metadata Service on AWS EC2 instances, users have the option of using either Instance Metadata Service Version 1 (IMDSv1; a request/response method) or Instance Metadata Service Version 2 (IMDSv2; a session-oriented method).", diff --git a/prowler/compliance/aws/cis_4.0_aws.json b/prowler/compliance/aws/cis_4.0_aws.json index d026a21962..cd8edb322a 100644 --- a/prowler/compliance/aws/cis_4.0_aws.json +++ b/prowler/compliance/aws/cis_4.0_aws.json @@ -13,7 +13,6 @@ "Attributes": [ { "Section": "1 Identity and Access Management", - "SubSection": "", "Profile": "Level 1", "AssessmentStatus": "Manual", "Description": "Ensure contact email and telephone details for AWS accounts are current and map to more than one individual in your organization.An AWS account supports a number of contact details, and AWS will use these to contact the account owner if activity judged to be in breach of the Acceptable Use Policy or indicative of a likely security compromise is observed by the AWS Abuse team. Contact details should not be for a single individual, as circumstances may arise where that individual is unavailable. Email contact details should point to a mail alias which forwards email to multiple individuals within the organization; where feasible, phone contact details should point to a PABX hunt group or other call-forwarding system.", @@ -36,7 +35,6 @@ "Attributes": [ { "Section": "1 Identity and Access Management", - "SubSection": "", "Profile": "Level 1", "AssessmentStatus": "Manual", "Description": "AWS provides customers with the option of specifying the contact information for account's security team. It is recommended that this information be provided.", @@ -59,7 +57,6 @@ "Attributes": [ { "Section": "1 Identity and Access Management", - "SubSection": "", "Profile": "Level 1", "AssessmentStatus": "Manual", "Description": "The AWS support portal allows account owners to establish security questions that can be used to authenticate individuals calling AWS customer service for support. It is recommended that security questions be established.", @@ -82,7 +79,6 @@ "Attributes": [ { "Section": "1 Identity and Access Management", - "SubSection": "", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "The 'root' user account is the most privileged user in an AWS account. AWS Access Keys provide programmatic access to a given AWS account. It is recommended that all access keys associated with the 'root' user account be deleted.", @@ -105,7 +101,6 @@ "Attributes": [ { "Section": "1 Identity and Access Management", - "SubSection": "", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "The 'root' user account is the most privileged user in an AWS account. Multi-factor Authentication (MFA) adds an extra layer of protection on top of a username and password. With MFA enabled, when a user signs in to an AWS website, they will be prompted for their username and password as well as for an authentication code from their AWS MFA device.**Note:** When virtual MFA is used for 'root' accounts, it is recommended that the device used is NOT a personal device, but rather a dedicated mobile device (tablet or phone) that is kept charged and secured, independent of any individual personal devices (non-personal virtual MFA). This lessens the risks of losing access to the MFA due to device loss, device trade-in, or if the individual owning the device is no longer employed at the company.", @@ -128,7 +123,6 @@ "Attributes": [ { "Section": "1 Identity and Access Management", - "SubSection": "", "Profile": "Level 2", "AssessmentStatus": "Manual", "Description": "The 'root' user account is the most privileged user in an AWS account. MFA adds an extra layer of protection on top of a user name and password. With MFA enabled, when a user signs in to an AWS website, they will be prompted for their user name and password as well as for an authentication code from their AWS MFA device. For Level 2, it is recommended that the 'root' user account be protected with a hardware MFA.", @@ -151,7 +145,6 @@ "Attributes": [ { "Section": "1 Identity and Access Management", - "SubSection": "", "Profile": "Level 1", "AssessmentStatus": "Manual", "Description": "With the creation of an AWS account, a 'root user' is created that cannot be disabled or deleted. That user has unrestricted access to and control over all resources in the AWS account. It is highly recommended that the use of this account be avoided for everyday tasks.", @@ -174,7 +167,6 @@ "Attributes": [ { "Section": "1 Identity and Access Management", - "SubSection": "", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Password policies are, in part, used to enforce password complexity requirements. IAM password policies can be used to ensure passwords are at least a given length. It is recommended that the password policy require a minimum password length 14.", @@ -197,7 +189,6 @@ "Attributes": [ { "Section": "1 Identity and Access Management", - "SubSection": "", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "IAM password policies can prevent the reuse of a given password by the same user. It is recommended that the password policy prevent the reuse of passwords.", @@ -220,7 +211,6 @@ "Attributes": [ { "Section": "1 Identity and Access Management", - "SubSection": "", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Multi-Factor Authentication (MFA) adds an extra layer of authentication assurance beyond traditional credentials. With MFA enabled, when a user signs in to the AWS Console, they will be prompted for their user name and password as well as for an authentication code from their physical or virtual MFA token. It is recommended that MFA be enabled for all accounts that have a console password.", @@ -243,7 +233,6 @@ "Attributes": [ { "Section": "1 Identity and Access Management", - "SubSection": "", "Profile": "Level 1", "AssessmentStatus": "Manual", "Description": "AWS console defaults to no check boxes selected when creating a new IAM user. When creating the IAM User credentials you have to determine what type of access they require. Programmatic access: The IAM user might need to make API calls, use the AWS CLI, or use the Tools for Windows PowerShell. In that case, create an access key (access key ID and a secret access key) for that user. AWS Management Console access: If the user needs to access the AWS Management Console, create a password for the user.", @@ -267,7 +256,6 @@ "Attributes": [ { "Section": "1 Identity and Access Management", - "SubSection": "", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "AWS IAM users can access AWS resources using different types of credentials, such as passwords or access keys. It is recommended that all credentials that have been unused for 45 days or more be deactivated or removed.", @@ -290,7 +278,6 @@ "Attributes": [ { "Section": "1 Identity and Access Management", - "SubSection": "", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Access keys are long-term credentials for an IAM user or the AWS account 'root' user. You can use access keys to sign programmatic requests to the AWS CLI or AWS API (directly or using the AWS SDK)", @@ -313,7 +300,6 @@ "Attributes": [ { "Section": "1 Identity and Access Management", - "SubSection": "", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Access keys consist of an access key ID and secret access key, which are used to sign programmatic requests that you make to AWS. AWS users need their own access keys to make programmatic calls to AWS from the AWS Command Line Interface (AWS CLI), Tools for Windows PowerShell, the AWS SDKs, or direct HTTP calls using the APIs for individual AWS services. It is recommended that all access keys be rotated regularly.", @@ -336,7 +322,6 @@ "Attributes": [ { "Section": "1 Identity and Access Management", - "SubSection": "", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "IAM users are granted access to services, functions, and data through IAM policies. There are four ways to define policies for a user: 1) Edit the user policy directly, also known as an inline or user policy; 2) attach a policy directly to a user; 3) add the user to an IAM group that has an attached policy; 4) add the user to an IAM group that has an inline policy.Only the third implementation is recommended.", @@ -360,7 +345,6 @@ "Attributes": [ { "Section": "1 Identity and Access Management", - "SubSection": "", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "IAM policies are the means by which privileges are granted to users, groups, or roles. It is recommended and considered standard security advice to grant least privilege—that is, granting only the permissions required to perform a task. Determine what users need to do, and then craft policies for them that allow the users to perform only those tasks, instead of granting full administrative privileges.", @@ -383,7 +367,6 @@ "Attributes": [ { "Section": "1 Identity and Access Management", - "SubSection": "", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "AWS provides a support center that can be used for incident notification and response, as well as technical support and customer services. Create an IAM Role, with the appropriate policy assigned, to allow authorized users to manage incidents with AWS Support.", @@ -406,7 +389,6 @@ "Attributes": [ { "Section": "1 Identity and Access Management", - "SubSection": "", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "AWS access from within AWS instances can be done by either encoding AWS keys into AWS API calls or by assigning the instance to a role which has an appropriate permissions policy for the required access. AWS Access means accessing the APIs of AWS in order to access AWS resources or manage AWS account resources.", @@ -429,7 +411,6 @@ "Attributes": [ { "Section": "1 Identity and Access Management", - "SubSection": "", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "To enable HTTPS connections to your website or application in AWS, you need an SSL/TLS server certificate. You can use AWS Certificate Manager (ACM) or IAM to store and deploy server certificates. Use IAM as a certificate manager only when you must support HTTPS connections in a region that is not supported by ACM. IAM securely encrypts your private keys and stores the encrypted version in IAM SSL certificate storage. IAM supports deploying server certificates in all regions, but you must obtain your certificate from an external provider for use with AWS. You cannot upload an ACM certificate to IAM. Additionally, you cannot manage your certificates from the IAM Console.", @@ -452,7 +433,6 @@ "Attributes": [ { "Section": "1 Identity and Access Management", - "SubSection": "", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Enable the IAM Access Analyzer for IAM policies regarding all resources in each active AWS region.IAM Access Analyzer is a technology introduced at AWS reinvent 2019. After the Analyzer is enabled in IAM, scan results are displayed on the console showing the accessible resources. Scans show resources that other accounts and federated users can access, such as KMS keys and IAM roles. The results allow you to determine whether an unintended user is permitted, making it easier for administrators to monitor least privilege access. Access Analyzer analyzes only the policies that are applied to resources in the same AWS Region.", @@ -475,7 +455,6 @@ "Attributes": [ { "Section": "1 Identity and Access Management", - "SubSection": "", "Profile": "Level 2", "AssessmentStatus": "Manual", "Description": "In multi-account environments, IAM user centralization facilitates greater user control. User access beyond the initial account is then provided via role assumption. Centralization of users can be accomplished through federation with an external identity provider or through the use of AWS Organizations.", @@ -498,7 +477,6 @@ "Attributes": [ { "Section": "1 Identity and Access Management", - "SubSection": "", "Profile": "Level 1", "AssessmentStatus": "Manual", "Description": "AWS CloudShell is a convenient way of running CLI commands against AWS services; a managed IAM policy ('AWSCloudShellFullAccess') provides full access to CloudShell, which allows file upload and download capability between a user's local system and the CloudShell environment. Within the CloudShell environment, a user has sudo permissions and can access the internet. Therefore, it is feasible to install file transfer software, for example, and move data from CloudShell to external internet servers.", @@ -730,7 +708,6 @@ "Attributes": [ { "Section": "3 Logging", - "SubSection": "", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "AWS CloudTrail is a web service that records AWS API calls for your account and delivers log files to you. The recorded information includes the identity of the API caller, the time of the API call, the source IP address of the API caller, the request parameters, and the response elements returned by the AWS service. CloudTrail provides a history of AWS API calls for an account, including API calls made via the Management Console, SDKs, command line tools, and higher-level AWS services (such as CloudFormation).", @@ -753,7 +730,6 @@ "Attributes": [ { "Section": "3 Logging", - "SubSection": "", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "CloudTrail log file validation creates a digitally signed digest file containing a hash of each log that CloudTrail writes to S3. These digest files can be used to determine whether a log file was changed, deleted, or remained unchanged after CloudTrail delivered the log. It is recommended that file validation be enabled for all CloudTrails.", @@ -776,7 +752,6 @@ "Attributes": [ { "Section": "3 Logging", - "SubSection": "", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "AWS Config is a web service that performs configuration management of supported AWS resources within your account and delivers log files to you. The recorded information includes the configuration items (AWS resources), relationships between configuration items (AWS resources), and any configuration changes between resources. It is recommended that AWS Config be enabled in all regions.", @@ -799,7 +774,6 @@ "Attributes": [ { "Section": "3 Logging", - "SubSection": "", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Server access logging generates a log that contains access records for each request made to your S3 bucket. An access log record contains details about the request, such as the request type, the resources specified in the request worked, and the time and date the request was processed. It is recommended that server access logging be enabled on the CloudTrail S3 bucket.", @@ -822,7 +796,6 @@ "Attributes": [ { "Section": "3 Logging", - "SubSection": "", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "AWS CloudTrail is a web service that records AWS API calls for an account and makes those logs available to users and resources in accordance with IAM policies. AWS Key Management Service (KMS) is a managed service that helps create and control the encryption keys used to encrypt account data, and uses Hardware Security Modules (HSMs) to protect the security of encryption keys. CloudTrail logs can be configured to leverage server side encryption (SSE) and KMS customer-created master keys (CMK) to further protect CloudTrail logs. It is recommended that CloudTrail be configured to use SSE-KMS.", @@ -845,7 +818,6 @@ "Attributes": [ { "Section": "3 Logging", - "SubSection": "", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "AWS Key Management Service (KMS) allows customers to rotate the backing key, which is key material stored within the KMS that is tied to the key ID of the customer-created customer master key (CMK). The backing key is used to perform cryptographic operations such as encryption and decryption. Automated key rotation currently retains all prior backing keys so that decryption of encrypted data can occur transparently. It is recommended that CMK key rotation be enabled for symmetric keys. Key rotation cannot be enabled for any asymmetric CMK.", @@ -868,7 +840,6 @@ "Attributes": [ { "Section": "3 Logging", - "SubSection": "", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "VPC Flow Logs is a feature that enables you to capture information about the IP traffic going to and from network interfaces in your VPC. After you've created a flow log, you can view and retrieve its data in Amazon CloudWatch Logs. It is recommended that VPC Flow Logs be enabled for packet Rejects for VPCs.", @@ -891,7 +862,6 @@ "Attributes": [ { "Section": "3 Logging", - "SubSection": "", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "S3 object-level API operations, such as GetObject, DeleteObject, and PutObject, are referred to as data events. By default, CloudTrail trails do not log data events, so it is recommended to enable object-level logging for S3 buckets.", @@ -914,7 +884,6 @@ "Attributes": [ { "Section": "3 Logging", - "SubSection": "", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "S3 object-level API operations, such as GetObject, DeleteObject, and PutObject, are referred to as data events. By default, CloudTrail trails do not log data events, so it is recommended to enable object-level logging for S3 buckets.", @@ -937,7 +906,6 @@ "Attributes": [ { "Section": "4 Monitoring", - "SubSection": "", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs or an external Security Information and Event Management (SIEM) environment, and establishing corresponding metric filters and alarms. It is recommended that a metric filter and alarm be established for unauthorized API calls.", @@ -960,7 +928,6 @@ "Attributes": [ { "Section": "4 Monitoring", - "SubSection": "", "Profile": "Level 1", "AssessmentStatus": "Manual", "Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs or an external Security Information and Event Management (SIEM) environment, and establishing corresponding metric filters and alarms. It is recommended that a metric filter and alarm be established for console logins that are not protected by multi-factor authentication (MFA).", @@ -983,7 +950,6 @@ "Attributes": [ { "Section": "4 Monitoring", - "SubSection": "", "Profile": "Level 1", "AssessmentStatus": "Manual", "Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs or an external Security Information and Event Management (SIEM) environment, and establishing corresponding metric filters and alarms. It is recommended that a metric filter and alarm be established for 'root' login attempts to detect unauthorized use or attempts to use the root account.", @@ -1006,7 +972,6 @@ "Attributes": [ { "Section": "4 Monitoring", - "SubSection": "", "Profile": "Level 1", "AssessmentStatus": "Manual", "Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs or an external Security Information and Event Management (SIEM) environment, and establishing corresponding metric filters and alarms.It is recommended that a metric filter and alarm be established for changes made to Identity and Access Management (IAM) policies.", @@ -1029,7 +994,6 @@ "Attributes": [ { "Section": "4 Monitoring", - "SubSection": "", "Profile": "Level 1", "AssessmentStatus": "Manual", "Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs or an external Security Information and Event Management (SIEM) environment, and establishing corresponding metric filters and alarms. It is recommended that a metric filter and alarm be used to detect changes to CloudTrail's configurations.", @@ -1052,7 +1016,6 @@ "Attributes": [ { "Section": "4 Monitoring", - "SubSection": "", "Profile": "Level 2", "AssessmentStatus": "Manual", "Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs or an external Security Information and Event Management (SIEM) environment, and establishing corresponding metric filters and alarms. It is recommended that a metric filter and alarm be established for failed console authentication attempts.", @@ -1075,7 +1038,6 @@ "Attributes": [ { "Section": "4 Monitoring", - "SubSection": "", "Profile": "Level 2", "AssessmentStatus": "Manual", "Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs or an external Security Information and Event Management (SIEM) environment, and establishing corresponding metric filters and alarms. It is recommended that a metric filter and alarm be established for customer-created CMKs that have changed state to disabled or are scheduled for deletion.", @@ -1098,7 +1060,6 @@ "Attributes": [ { "Section": "4 Monitoring", - "SubSection": "", "Profile": "Level 1", "AssessmentStatus": "Manual", "Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs or an external Security Information and Event Management (SIEM) environment, and establishing corresponding metric filters and alarms. It is recommended that a metric filter and alarm be established for changes to S3 bucket policies.", @@ -1121,7 +1082,6 @@ "Attributes": [ { "Section": "4 Monitoring", - "SubSection": "", "Profile": "Level 2", "AssessmentStatus": "Manual", "Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs or an external Security Information and Event Management (SIEM) environment, and establishing corresponding metric filters and alarms. It is recommended that a metric filter and alarm be established for detecting changes to AWS Config's configurations.", @@ -1144,7 +1104,6 @@ "Attributes": [ { "Section": "4 Monitoring", - "SubSection": "", "Profile": "Level 2", "AssessmentStatus": "Manual", "Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs or an external Security Information and Event Management (SIEM) environment, and establishing corresponding metric filters and alarms. Security groups are stateful packet filters that control ingress and egress traffic within a VPC.It is recommended that a metric filter and alarm be established to detect changes to security groups.", @@ -1167,7 +1126,6 @@ "Attributes": [ { "Section": "4 Monitoring", - "SubSection": "", "Profile": "Level 2", "AssessmentStatus": "Manual", "Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs or an external Security Information and Event Management (SIEM) environment, and establishing corresponding metric filters and alarms. NACLs are used as a stateless packet filter to control ingress and egress traffic for subnets within a VPC. It is recommended that a metric filter and alarm be established for any changes made to NACLs.", @@ -1190,7 +1148,6 @@ "Attributes": [ { "Section": "4 Monitoring", - "SubSection": "", "Profile": "Level 1", "AssessmentStatus": "Manual", "Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs or an external Security Information and Event Management (SIEM) environment, and establishing corresponding metric filters and alarms. Network gateways are required to send and receive traffic to a destination outside of a VPC. It is recommended that a metric filter and alarm be established for changes to network gateways.", @@ -1213,7 +1170,6 @@ "Attributes": [ { "Section": "4 Monitoring", - "SubSection": "", "Profile": "Level 1", "AssessmentStatus": "Manual", "Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs or an external Security Information and Event Management (SIEM) environment, and establishing corresponding metric filters and alarms. Routing tables are used to route network traffic between subnets and to network gateways.It is recommended that a metric filter and alarm be established for changes to route tables.", @@ -1236,7 +1192,6 @@ "Attributes": [ { "Section": "4 Monitoring", - "SubSection": "", "Profile": "Level 1", "AssessmentStatus": "Manual", "Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs or an external Security Information and Event Management (SIEM) environment, and establishing corresponding metric filters and alarms. It is possible to have more than one VPC within an account; additionally, it is also possible to create a peer connection between two VPCs, enabling network traffic to route between them.It is recommended that a metric filter and alarm be established for changes made to VPCs.", @@ -1259,7 +1214,6 @@ "Attributes": [ { "Section": "4 Monitoring", - "SubSection": "", "Profile": "Level 1", "AssessmentStatus": "Manual", "Description": "Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs or an external Security Information and Event Management (SIEM) environment, and establishing corresponding metric filters and alarms. It is recommended that a metric filter and alarm be established for changes made to AWS Organizations in the master AWS account.", @@ -1282,7 +1236,6 @@ "Attributes": [ { "Section": "4 Monitoring", - "SubSection": "", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "Security Hub collects security data from various AWS accounts, services, and supported third-party partner products, helping you analyze your security trends and identify the highest-priority security issues. When you enable Security Hub, it begins to consume, aggregate, organize, and prioritize findings from the AWS services that you have enabled, such as Amazon GuardDuty, Amazon Inspector, and Amazon Macie. You can also enable integrations with AWS partner security products.", @@ -1307,7 +1260,6 @@ "Attributes": [ { "Section": "5 Networking", - "SubSection": "", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "The Network Access Control List (NACL) function provides stateless filtering of ingress and egress network traffic to AWS resources. It is recommended that no NACL allows unrestricted ingress access to remote server administration ports, such as SSH on port `22` and RDP on port `3389`, using either the TCP (6), UDP (17), or ALL (-1) protocols.", @@ -1332,7 +1284,6 @@ "Attributes": [ { "Section": "5 Networking", - "SubSection": "", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Security groups provide stateful filtering of ingress and egress network traffic to AWS resources. It is recommended that no security group allows unrestricted ingress access to remote server administration ports, such as SSH on port `22` and RDP on port `3389`, using either the TCP (6), UDP (17), or ALL (-1) protocols.", @@ -1357,7 +1308,6 @@ "Attributes": [ { "Section": "5 Networking", - "SubSection": "", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Security groups provide stateful filtering of ingress and egress network traffic to AWS resources. It is recommended that no security group allows unrestricted ingress access to remote server administration ports, such as SSH on port `22` and RDP on port `3389`.", @@ -1380,7 +1330,6 @@ "Attributes": [ { "Section": "5 Networking", - "SubSection": "", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "A VPC comes with a default security group whose initial settings deny all inbound traffic, allow all outbound traffic, and allow all traffic between instances assigned to the security group. If a security group is not specified when an instance is launched, it is automatically assigned to this default security group. Security groups provide stateful filtering of ingress/egress network traffic to AWS resources. It is recommended that the default security group restrict all traffic, both inbound and outbound.The default VPC in every region should have its default security group updated to comply with the following: - No inbound rules. - No outbound rules.Any newly created VPCs will automatically contain a default security group that will need remediation to comply with this recommendation.**Note:** When implementing this recommendation, VPC flow logging is invaluable in determining the least privilege port access required by systems to work properly, as it can log all packet acceptances and rejections occurring under the current security groups. This dramatically reduces the primary barrier to least privilege engineering by discovering the minimum ports required by systems in the environment. Even if the VPC flow logging recommendation in this benchmark is not adopted as a permanent security measure, it should be used during any period of discovery and engineering for least privileged security groups.", @@ -1403,7 +1352,6 @@ "Attributes": [ { "Section": "5 Networking", - "SubSection": "", "Profile": "Level 2", "AssessmentStatus": "Manual", "Description": "Once a VPC peering connection is established, routing tables must be updated to enable any connections between the peered VPCs. These routes can be as specific as desired, even allowing for the peering of a VPC to only a single host on the other side of the connection.", @@ -1426,7 +1374,6 @@ "Attributes": [ { "Section": "5 Networking", - "SubSection": "", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "When enabling the Metadata Service on AWS EC2 instances, users have the option of using either Instance Metadata Service Version 1 (IMDSv1; a request/response method) or Instance Metadata Service Version 2 (IMDSv2; a session-oriented method).", diff --git a/prowler/compliance/azure/cis_2.0_azure.json b/prowler/compliance/azure/cis_2.0_azure.json index 59ab14879d..94983dab94 100644 --- a/prowler/compliance/azure/cis_2.0_azure.json +++ b/prowler/compliance/azure/cis_2.0_azure.json @@ -12,7 +12,7 @@ ], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "SubSection": "1.1 Security Defaults", "Profile": "Level 1", "AssessmentStatus": "Manual", @@ -35,7 +35,7 @@ ], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "SubSection": "1.1 Security Defaults", "Profile": "Level 1", "AssessmentStatus": "Manual", @@ -58,7 +58,7 @@ ], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "SubSection": "1.1 Security Defaults", "Profile": "Level 2", "AssessmentStatus": "Manual", @@ -79,7 +79,7 @@ "Checks": [], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "SubSection": "1.1 Security Defaults", "Profile": "Level 1", "AssessmentStatus": "Manual", @@ -102,7 +102,7 @@ ], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "SubSection": "1.2 Conditional Access", "Profile": "Level 1", "AssessmentStatus": "Manual", @@ -123,7 +123,7 @@ "Checks": [], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "SubSection": "1.2 Conditional Access", "Profile": "Level 1", "AssessmentStatus": "Manual", @@ -144,7 +144,7 @@ "Checks": [], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "SubSection": "1.2 Conditional Access", "Profile": "Level 1", "AssessmentStatus": "Manual", @@ -165,7 +165,7 @@ "Checks": [], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "SubSection": "1.2 Conditional Access", "Profile": "Level 1", "AssessmentStatus": "Manual", @@ -186,7 +186,7 @@ "Checks": [], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "SubSection": "1.2 Conditional Access", "Profile": "Level 1", "AssessmentStatus": "Manual", @@ -207,7 +207,7 @@ "Checks": [], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "SubSection": "1.2 Conditional Access", "Profile": "Level 1", "AssessmentStatus": "Manual", @@ -230,7 +230,7 @@ ], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Require administrators or appropriately delegated users to create new tenants.", @@ -250,7 +250,7 @@ "Checks": [], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 2", "AssessmentStatus": "Manual", "Description": "This recommendation extends guest access review by utilizing the Azure AD Privileged Identity Management feature provided in Azure AD Premium P2. Azure AD is extended to include Azure AD B2B collaboration, allowing you to invite people from outside your organization to be guest users in your cloud account and sign in with their own work, school, or social identities. Guest users allow you to share your company's applications and services with users from any other organization, while maintaining control over your own corporate data. Work with external partners, large or small, even if they don't have Azure AD or an IT department. A simple invitation and redemption process lets partners use their own credentials to access your company's resources a a guest user.", @@ -270,7 +270,7 @@ "Checks": [], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 1", "AssessmentStatus": "Manual", "Description": "Azure AD is extended to include Azure AD B2B collaboration, allowing you to invite people from outside your organization to be guest users in your cloud account and sign in with their own work, school, or social identities. Guest users allow you to share your company's applications and services with users from any other organization, while maintaining control over your own corporate data. Work with external partners, large or small, even if they don't have Azure AD or an IT department. A simple invitation and redemption process lets partners use their own credentials to access your company's resources as a guest user. Guest users in every subscription should be review on a regular basis to ensure that inactive and unneeded accounts are removed.", @@ -290,7 +290,7 @@ "Checks": [], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 1", "AssessmentStatus": "Manual", "Description": "Ensures that two alternate forms of identification are provided before allowing a password reset.", @@ -310,7 +310,7 @@ "Checks": [], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 1", "AssessmentStatus": "Manual", "Description": "Microsoft Azure provides a Global Banned Password policy that applies to Azure administrative and normal user accounts. This is not applied to user accounts that are synced from an on-premise Active Directory unless Azure AD Connect is used and you enable EnforceCloudPasswordPolicyForPasswordSyncedUsers. Please see the list in default values on the specifics of this policy. To further password security, it is recommended to further define a custom banned password policy.", @@ -330,7 +330,7 @@ "Checks": [], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 1", "AssessmentStatus": "Manual", "Description": "Ensure that the number of days before users are asked to re-confirm their authentication information is not set to 0.", @@ -350,7 +350,7 @@ "Checks": [], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 1", "AssessmentStatus": "Manual", "Description": "Ensure that users are notified on their primary and secondary emails on password resets.", @@ -370,7 +370,7 @@ "Checks": [], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 1", "AssessmentStatus": "Manual", "Description": "Ensure that all Global Administrators are notified if any other administrator resets their password.", @@ -392,7 +392,7 @@ ], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 1", "AssessmentStatus": "Manual", "Description": "Require administrators to provide consent for applications before use.", @@ -414,7 +414,7 @@ ], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 2", "AssessmentStatus": "Manual", "Description": "Allow users to provide consent for selected permissions when a request is coming from a verified publisher.", @@ -434,7 +434,7 @@ "Checks": [], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 1", "AssessmentStatus": "Manual", "Description": "Require administrators to provide consent for the apps before use.", @@ -456,7 +456,7 @@ ], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 1", "AssessmentStatus": "Manual", "Description": "Require administrators or appropriately delegated users to register third-party applications.", @@ -478,7 +478,7 @@ ], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 1", "AssessmentStatus": "Manual", "Description": "Limit guest user permissions.", @@ -500,7 +500,7 @@ ], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 2", "AssessmentStatus": "Manual", "Description": "Restrict invitations to users with specific administrative roles only.", @@ -520,7 +520,7 @@ "Checks": [], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 1", "AssessmentStatus": "Manual", "Description": "Restrict access to the Azure AD administration portal to administrators only. NOTE: This only affects access to the Azure AD administrator's web portal. This setting does not prohibit privileged users from using other methods such as Rest API or Powershell to obtain sensitive information from Azure AD.", @@ -540,7 +540,7 @@ "Checks": [], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 2", "AssessmentStatus": "Manual", "Description": "Restricts group creation to administrators with permissions only.", @@ -562,7 +562,7 @@ ], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 2", "AssessmentStatus": "Manual", "Description": "Restrict security group creation to administrators only.", @@ -582,7 +582,7 @@ "Checks": [], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 2", "AssessmentStatus": "Manual", "Description": "Restrict security group management to administrators only.", @@ -604,7 +604,7 @@ ], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 2", "AssessmentStatus": "Manual", "Description": "Restrict Microsoft 365 group creation to administrators only.", @@ -624,7 +624,7 @@ "Checks": [], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 1", "AssessmentStatus": "Manual", "Description": "Joining or registering devices to the active directory should require Multi-factor authentication.", @@ -646,7 +646,7 @@ ], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "The principle of least privilege should be followed and only necessary privileges should be assigned instead of allowing full administrative access.", @@ -668,7 +668,7 @@ ], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 2", "AssessmentStatus": "Manual", "Description": "Resource locking is a powerful protection mechanism that can prevent inadvertent modification/deletion of resources within Azure subscriptions/Resource Groups and is a recommended NIST configuration.", @@ -688,7 +688,7 @@ "Checks": [], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 2", "AssessmentStatus": "Manual", "Description": "Users who are set as subscription owners are able to make administrative changes to the subscriptions and move them into and out of Azure Active Directories.", @@ -710,7 +710,7 @@ ], "Attributes": [ { - "Section": "2. Microsoft Defender", + "Section": "2 Microsoft Defender", "SubSection": "2.1 Microsoft Defender for Cloud", "Profile": "Level 2", "AssessmentStatus": "Manual", @@ -733,7 +733,7 @@ ], "Attributes": [ { - "Section": "2. Microsoft Defender", + "Section": "2 Microsoft Defender", "SubSection": "2.1 Microsoft Defender for Cloud", "Profile": "Level 2", "AssessmentStatus": "Manual", @@ -756,7 +756,7 @@ ], "Attributes": [ { - "Section": "2. Microsoft Defender", + "Section": "2 Microsoft Defender", "SubSection": "2.1 Microsoft Defender for Cloud", "Profile": "Level 2", "AssessmentStatus": "Manual", @@ -779,7 +779,7 @@ ], "Attributes": [ { - "Section": "2. Microsoft Defender", + "Section": "2 Microsoft Defender", "SubSection": "2.1 Microsoft Defender for Cloud", "Profile": "Level 2", "AssessmentStatus": "Manual", @@ -802,7 +802,7 @@ ], "Attributes": [ { - "Section": "2. Microsoft Defender", + "Section": "2 Microsoft Defender", "SubSection": "2.1 Microsoft Defender for Cloud", "Profile": "Level 2", "AssessmentStatus": "Manual", @@ -825,7 +825,7 @@ ], "Attributes": [ { - "Section": "2. Microsoft Defender", + "Section": "2 Microsoft Defender", "SubSection": "2.1 Microsoft Defender for Cloud", "Profile": "Level 2", "AssessmentStatus": "Manual", @@ -848,7 +848,7 @@ ], "Attributes": [ { - "Section": "2. Microsoft Defender", + "Section": "2 Microsoft Defender", "SubSection": "2.1 Microsoft Defender for Cloud", "Profile": "Level 2", "AssessmentStatus": "Manual", @@ -871,7 +871,7 @@ ], "Attributes": [ { - "Section": "2. Microsoft Defender", + "Section": "2 Microsoft Defender", "SubSection": "2.1 Microsoft Defender for Cloud", "Profile": "Level 2", "AssessmentStatus": "Manual", @@ -894,7 +894,7 @@ ], "Attributes": [ { - "Section": "2. Microsoft Defender", + "Section": "2 Microsoft Defender", "SubSection": "2.1 Microsoft Defender for Cloud", "Profile": "Level 2", "AssessmentStatus": "Manual", @@ -917,7 +917,7 @@ ], "Attributes": [ { - "Section": "2. Microsoft Defender", + "Section": "2 Microsoft Defender", "SubSection": "2.1 Microsoft Defender for Cloud", "Profile": "Level 2", "AssessmentStatus": "Manual", @@ -940,7 +940,7 @@ ], "Attributes": [ { - "Section": "2. Microsoft Defender", + "Section": "2 Microsoft Defender", "SubSection": "2.1 Microsoft Defender for Cloud", "Profile": "Level 2", "AssessmentStatus": "Manual", @@ -963,7 +963,7 @@ ], "Attributes": [ { - "Section": "2. Microsoft Defender", + "Section": "2 Microsoft Defender", "SubSection": "2.1 Microsoft Defender for Cloud", "Profile": "Level 2", "AssessmentStatus": "Manual", @@ -986,7 +986,7 @@ ], "Attributes": [ { - "Section": "2. Microsoft Defender", + "Section": "2 Microsoft Defender", "SubSection": "2.1 Microsoft Defender for Cloud", "Profile": "Level 1", "AssessmentStatus": "Manual", @@ -1009,7 +1009,7 @@ ], "Attributes": [ { - "Section": "2. Microsoft Defender", + "Section": "2 Microsoft Defender", "SubSection": "2.1 Microsoft Defender for Cloud", "Profile": "Level 1", "AssessmentStatus": "Manual", @@ -1032,7 +1032,7 @@ ], "Attributes": [ { - "Section": "2. Microsoft Defender", + "Section": "2 Microsoft Defender", "SubSection": "2.1 Microsoft Defender for Cloud", "Profile": "Level 1", "AssessmentStatus": "Manual", @@ -1055,7 +1055,7 @@ ], "Attributes": [ { - "Section": "2. Microsoft Defender", + "Section": "2 Microsoft Defender", "SubSection": "2.1 Microsoft Defender for Cloud", "Profile": "Level 2", "AssessmentStatus": "Manual", @@ -1076,7 +1076,7 @@ "Checks": [], "Attributes": [ { - "Section": "2. Microsoft Defender", + "Section": "2 Microsoft Defender", "SubSection": "2.1 Microsoft Defender for Cloud", "Profile": "Level 2", "AssessmentStatus": "Manual", @@ -1099,7 +1099,7 @@ ], "Attributes": [ { - "Section": "2. Microsoft Defender", + "Section": "2 Microsoft Defender", "SubSection": "2.1 Microsoft Defender for Cloud", "Profile": "Level 2", "AssessmentStatus": "Automated", @@ -1122,7 +1122,7 @@ ], "Attributes": [ { - "Section": "2. Microsoft Defender", + "Section": "2 Microsoft Defender", "SubSection": "2.1 Microsoft Defender for Cloud", "Profile": "Level 1", "AssessmentStatus": "Automated", @@ -1145,7 +1145,7 @@ ], "Attributes": [ { - "Section": "2. Microsoft Defender", + "Section": "2 Microsoft Defender", "SubSection": "2.1 Microsoft Defender for Cloud", "Profile": "Level 1", "AssessmentStatus": "Automated", @@ -1168,7 +1168,7 @@ ], "Attributes": [ { - "Section": "2. Microsoft Defender", + "Section": "2 Microsoft Defender", "SubSection": "2.1 Microsoft Defender for Cloud", "Profile": "Level 2", "AssessmentStatus": "Automated", @@ -1191,7 +1191,7 @@ ], "Attributes": [ { - "Section": "2. Microsoft Defender", + "Section": "2 Microsoft Defender", "SubSection": "2.1 Microsoft Defender for Cloud", "Profile": "Level 2", "AssessmentStatus": "Manual", @@ -1214,7 +1214,7 @@ ], "Attributes": [ { - "Section": "2. Microsoft Defender", + "Section": "2 Microsoft Defender", "SubSection": "2.2 Microsoft Defender for IoT", "Profile": "Level 2", "AssessmentStatus": "Manual", @@ -1237,7 +1237,7 @@ ], "Attributes": [ { - "Section": "3. Storage Accounts", + "Section": "3 Storage Accounts", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Enable data encryption in transit.", @@ -1259,7 +1259,7 @@ ], "Attributes": [ { - "Section": "3. Storage Accounts", + "Section": "3 Storage Accounts", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "Enabling encryption at the hardware level on top of the default software encryption for Storage Accounts accessing Azure storage solutions.", @@ -1279,7 +1279,7 @@ "Checks": [], "Attributes": [ { - "Section": "3. Storage Accounts", + "Section": "3 Storage Accounts", "Profile": "Level 1", "AssessmentStatus": "Manual", "Description": "Access Keys authenticate application access requests to data contained in Storage Accounts. A periodic rotation of these keys is recommended to ensure that potentially compromised keys cannot result in a long-term exploitable credential. The 'Rotation Reminder' is an automatic reminder feature for a manual procedure.", @@ -1301,7 +1301,7 @@ ], "Attributes": [ { - "Section": "3. Storage Accounts", + "Section": "3 Storage Accounts", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "For increased security, regenerate storage account access keys periodically.", @@ -1321,7 +1321,7 @@ "Checks": [], "Attributes": [ { - "Section": "3. Storage Accounts", + "Section": "3 Storage Accounts", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "The Storage Queue service stores messages that may be read by any client who has access to the storage account. A queue can contain an unlimited number of messages, each of which can be up to 64KB in size using version 2011-08-18 or newer. Storage Logging happens server-side and allows details for both successful and failed requests to be recorded in the storage account. These logs allow users to see the details of read, write, and delete operations against the queues. Storage Logging log entries contain the following information about individual requests: Timing information such as start time, end-to-end latency, and server latency, authentication details, concurrency information, and the sizes of the request and response messages.", @@ -1341,7 +1341,7 @@ "Checks": [], "Attributes": [ { - "Section": "3. Storage Accounts", + "Section": "3 Storage Accounts", "Profile": "Level 1", "AssessmentStatus": "Manual", "Description": "Expire shared access signature tokens within an hour.", @@ -1363,7 +1363,7 @@ ], "Attributes": [ { - "Section": "3. Storage Accounts", + "Section": "3 Storage Accounts", "Profile": "Level 1", "AssessmentStatus": "Manual", "Description": "Disallowing public access for a storage account overrides the public access settings for individual containers in that storage account.", @@ -1385,7 +1385,7 @@ ], "Attributes": [ { - "Section": "3. Storage Accounts", + "Section": "3 Storage Accounts", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Restricting default network access helps to provide a new layer of security, since storage accounts accept connections from clients on any network. To limit access to selected networks, the default action must be changed.", @@ -1407,7 +1407,7 @@ ], "Attributes": [ { - "Section": "3. Storage Accounts", + "Section": "3 Storage Accounts", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "Some Azure services that interact with storage accounts operate from networks that can't be granted access through network rules. To help this type of service work as intended, allow the set of trusted Azure services to bypass the network rules. These services will then use strong authentication to access the storage account. If the Allow trusted Azure services exception is enabled, the following services are granted access to the storage account: Azure Backup, Azure Site Recovery, Azure DevTest Labs, Azure Event Grid, Azure Event Hubs, Azure Networking, Azure Monitor, and Azure SQL Data Warehouse (when registered in the subscription).", @@ -1429,7 +1429,7 @@ ], "Attributes": [ { - "Section": "3. Storage Accounts", + "Section": "3 Storage Accounts", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Use private endpoints for your Azure Storage accounts to allow clients and services to securely access data located over a network via an encrypted Private Link. To do this, the private endpoint uses an IP address from the VNet for each service. Network traffic between disparate services securely traverses encrypted over the VNet. This VNet can also link addressing space, extending your network and accessing resources on it. Similarly, it can be a tunnel through public networks to connect remote infrastructures together. This creates further security through segmenting network traffic and preventing outside sources from accessing it.", @@ -1451,7 +1451,7 @@ ], "Attributes": [ { - "Section": "3. Storage Accounts", + "Section": "3 Storage Accounts", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "The Azure Storage blobs contain data like ePHI or Financial, which can be secret or personal. Data that is erroneously modified or deleted by an application or other storage account user will cause data loss or unavailability. It is recommended that both Azure Containers with attached Blob Storage and standalone containers with Blob Storage be made recoverable by enabling the soft delete configuration. This is to save and recover data when blobs or blob snapshots are deleted.", @@ -1473,7 +1473,7 @@ ], "Attributes": [ { - "Section": "3. Storage Accounts", + "Section": "3 Storage Accounts", "Profile": "Level 2", "AssessmentStatus": "Manual", "Description": "Enable sensitive data encryption at rest using Customer Managed Keys rather than Microsoft Managed keys.", @@ -1493,7 +1493,7 @@ "Checks": [], "Attributes": [ { - "Section": "3. Storage Accounts", + "Section": "3 Storage Accounts", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "The Storage Blob service provides scalable, cost-efficient object storage in the cloud. Storage Logging happens server-side and allows details for both successful and failed requests to be recorded in the storage account. These logs allow users to see the details of read, write, and delete operations against the blobs. Storage Logging log entries contain the following information about individual requests: timing information such as start time, end-to-end latency, and server latency; authentication details; concurrency information; and the sizes of the request and response messages.", @@ -1513,7 +1513,7 @@ "Checks": [], "Attributes": [ { - "Section": "3. Storage Accounts", + "Section": "3 Storage Accounts", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "Azure Table storage is a service that stores structured NoSQL data in the cloud, providing a key/attribute store with a schema-less design. Storage Logging happens server-side and allows details for both successful and failed requests to be recorded in the storage account. These logs allow users to see the details of read, write, and delete operations against the tables. Storage Logging log entries contain the following information about individual requests: timing information such as start time, end-to-end latency, and server latency; authentication details; concurrency information; and the sizes of the request and response messages.", @@ -1535,7 +1535,7 @@ ], "Attributes": [ { - "Section": "3. Storage Accounts", + "Section": "3 Storage Accounts", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "In some cases, Azure Storage sets the minimum TLS versio n to be version 1.0 by default. TLS 1.0 is a legacy version and has known vulnerabilities. This minimum TLSversion can be configured to be later protocols such as TLS 1.2.", @@ -1557,7 +1557,7 @@ ], "Attributes": [ { - "Section": "4. Database Services", + "Section": "4 Database Services", "SubSection": "4.1 SQL Server - Auditing", "Profile": "Level 1", "AssessmentStatus": "Automated", @@ -1580,7 +1580,7 @@ ], "Attributes": [ { - "Section": "4. Database Services", + "Section": "4 Database Services", "SubSection": "4.1 SQL Server - Auditing", "Profile": "Level 1", "AssessmentStatus": "Automated", @@ -1603,7 +1603,7 @@ ], "Attributes": [ { - "Section": "4. Database Services", + "Section": "4 Database Services", "SubSection": "4.1 SQL Server - Auditing", "Profile": "Level 2", "AssessmentStatus": "Automated", @@ -1626,7 +1626,7 @@ ], "Attributes": [ { - "Section": "4. Database Services", + "Section": "4 Database Services", "SubSection": "4.1 SQL Server - Auditing", "Profile": "Level 1", "AssessmentStatus": "Automated", @@ -1649,7 +1649,7 @@ ], "Attributes": [ { - "Section": "4. Database Services", + "Section": "4 Database Services", "SubSection": "4.1 SQL Server - Auditing", "Profile": "Level 1", "AssessmentStatus": "Automated", @@ -1672,7 +1672,7 @@ ], "Attributes": [ { - "Section": "4. Database Services", + "Section": "4 Database Services", "SubSection": "4.1 SQL Server - Auditing", "Profile": "Level 1", "AssessmentStatus": "Automated", @@ -1695,7 +1695,7 @@ ], "Attributes": [ { - "Section": "4. Database Services", + "Section": "4 Database Services", "SubSection": "4.2 SQL Server - Microsoft Defender for SQL", "Profile": "Level 2", "AssessmentStatus": "Automated", @@ -1718,7 +1718,7 @@ ], "Attributes": [ { - "Section": "4. Database Services", + "Section": "4 Database Services", "SubSection": "4.2 SQL Server - Microsoft Defender for SQL", "Profile": "Level 2", "AssessmentStatus": "Automated", @@ -1741,7 +1741,7 @@ ], "Attributes": [ { - "Section": "4. Database Services", + "Section": "4 Database Services", "SubSection": "4.2 SQL Server - Microsoft Defender for SQL", "Profile": "Level 2", "AssessmentStatus": "Automated", @@ -1764,7 +1764,7 @@ ], "Attributes": [ { - "Section": "4. Database Services", + "Section": "4 Database Services", "SubSection": "4.2 SQL Server - Microsoft Defender for SQL", "Profile": "Level 2", "AssessmentStatus": "Automated", @@ -1787,7 +1787,7 @@ ], "Attributes": [ { - "Section": "4. Database Services", + "Section": "4 Database Services", "SubSection": "4.2 SQL Server - Microsoft Defender for SQL", "Profile": "Level 1", "AssessmentStatus": "Automated", @@ -1810,7 +1810,7 @@ ], "Attributes": [ { - "Section": "4. Database Services", + "Section": "4 Database Services", "SubSection": "4.3 PostgreSQL Database Server", "Profile": "Level 1", "AssessmentStatus": "Automated", @@ -1833,7 +1833,7 @@ ], "Attributes": [ { - "Section": "4. Database Services", + "Section": "4 Database Services", "SubSection": "4.3 PostgreSQL Database Server", "Profile": "Level 1", "AssessmentStatus": "Automated", @@ -1856,7 +1856,7 @@ ], "Attributes": [ { - "Section": "4. Database Services", + "Section": "4 Database Services", "SubSection": "4.3 PostgreSQL Database Server", "Profile": "Level 1", "AssessmentStatus": "Automated", @@ -1879,7 +1879,7 @@ ], "Attributes": [ { - "Section": "4. Database Services", + "Section": "4 Database Services", "SubSection": "4.3 PostgreSQL Database Server", "Profile": "Level 1", "AssessmentStatus": "Automated", @@ -1902,7 +1902,7 @@ ], "Attributes": [ { - "Section": "4. Database Services", + "Section": "4 Database Services", "SubSection": "4.3 PostgreSQL Database Server", "Profile": "Level 1", "AssessmentStatus": "Automated", @@ -1925,7 +1925,7 @@ ], "Attributes": [ { - "Section": "4. Database Services", + "Section": "4 Database Services", "SubSection": "4.3 PostgreSQL Database Server", "Profile": "Level 1", "AssessmentStatus": "Automated", @@ -1948,7 +1948,7 @@ ], "Attributes": [ { - "Section": "4. Database Services", + "Section": "4 Database Services", "SubSection": "4.3 PostgreSQL Database Server", "Profile": "Level 1", "AssessmentStatus": "Automated", @@ -1969,7 +1969,7 @@ "Checks": [], "Attributes": [ { - "Section": "4. Database Services", + "Section": "4 Database Services", "SubSection": "4.3 PostgreSQL Database Server", "Profile": "Level 1", "AssessmentStatus": "Automated", @@ -1992,7 +1992,7 @@ ], "Attributes": [ { - "Section": "4. Database Services", + "Section": "4 Database Services", "SubSection": "4.4 MySQL Database", "Profile": "Level 1", "AssessmentStatus": "Automated", @@ -2015,7 +2015,7 @@ ], "Attributes": [ { - "Section": "4. Database Services", + "Section": "4 Database Services", "SubSection": "4.4 MySQL Database", "Profile": "Level 1", "AssessmentStatus": "Automated", @@ -2038,7 +2038,7 @@ ], "Attributes": [ { - "Section": "4. Database Services", + "Section": "4 Database Services", "SubSection": "4.4 MySQL Database", "Profile": "Level 2", "AssessmentStatus": "Manual", @@ -2061,7 +2061,7 @@ ], "Attributes": [ { - "Section": "4. Database Services", + "Section": "4 Database Services", "SubSection": "4.4 MySQL Database", "Profile": "Level 2", "AssessmentStatus": "Manual", @@ -2084,7 +2084,7 @@ ], "Attributes": [ { - "Section": "4. Database Services", + "Section": "4 Database Services", "SubSection": "4.5 Cosmos DB", "Profile": "Level 2", "AssessmentStatus": "Automated", @@ -2107,7 +2107,7 @@ ], "Attributes": [ { - "Section": "4. Database Services", + "Section": "4 Database Services", "SubSection": "4.5 Cosmos DB", "Profile": "Level 2", "AssessmentStatus": "Manual", @@ -2130,7 +2130,7 @@ ], "Attributes": [ { - "Section": "4. Database Services", + "Section": "4 Database Services", "SubSection": "4.5 Cosmos DB", "Profile": "Level 2", "AssessmentStatus": "Manual", @@ -2153,7 +2153,7 @@ ], "Attributes": [ { - "Section": "5. Logging and Monitoring", + "Section": "5 Logging and Monitoring", "SubSection": "5.1 Configuring Diagnostic Settings", "Profile": "Level 1", "AssessmentStatus": "Manual", @@ -2176,7 +2176,7 @@ ], "Attributes": [ { - "Section": "5. Logging and Monitoring", + "Section": "5 Logging and Monitoring", "SubSection": "5.1 Configuring Diagnostic Settings", "Profile": "Level 1", "AssessmentStatus": "Automated", @@ -2199,7 +2199,7 @@ ], "Attributes": [ { - "Section": "5. Logging and Monitoring", + "Section": "5 Logging and Monitoring", "SubSection": "5.1 Configuring Diagnostic Settings", "Profile": "Level 1", "AssessmentStatus": "Automated", @@ -2222,7 +2222,7 @@ ], "Attributes": [ { - "Section": "5. Logging and Monitoring", + "Section": "5 Logging and Monitoring", "SubSection": "5.1 Configuring Diagnostic Settings", "Profile": "Level 2", "AssessmentStatus": "Automated", @@ -2245,7 +2245,7 @@ ], "Attributes": [ { - "Section": "5. Logging and Monitoring", + "Section": "5 Logging and Monitoring", "SubSection": "5.1 Configuring Diagnostic Settings", "Profile": "Level 1", "AssessmentStatus": "Automated", @@ -2268,7 +2268,7 @@ ], "Attributes": [ { - "Section": "5. Logging and Monitoring", + "Section": "5 Logging and Monitoring", "SubSection": "5.1 Configuring Diagnostic Settings", "Profile": "Level 2", "AssessmentStatus": "Manual", @@ -2291,7 +2291,7 @@ ], "Attributes": [ { - "Section": "5. Logging and Monitoring", + "Section": "5 Logging and Monitoring", "SubSection": "5.1 Configuring Diagnostic Settings", "Profile": "Level 2", "AssessmentStatus": "Manual", @@ -2314,7 +2314,7 @@ ], "Attributes": [ { - "Section": "5. Logging and Monitoring", + "Section": "5 Logging and Monitoring", "SubSection": "5.2 Monitoring using Activity Log Alerts", "Profile": "Level 1", "AssessmentStatus": "Automated", @@ -2337,7 +2337,7 @@ ], "Attributes": [ { - "Section": "5. Logging and Monitoring", + "Section": "5 Logging and Monitoring", "SubSection": "5.2 Monitoring using Activity Log Alerts", "Profile": "Level 1", "AssessmentStatus": "Automated", @@ -2360,7 +2360,7 @@ ], "Attributes": [ { - "Section": "5. Logging and Monitoring", + "Section": "5 Logging and Monitoring", "SubSection": "5.2 Monitoring using Activity Log Alerts", "Profile": "Level 1", "AssessmentStatus": "Automated", @@ -2383,7 +2383,7 @@ ], "Attributes": [ { - "Section": "5. Logging and Monitoring", + "Section": "5 Logging and Monitoring", "SubSection": "5.2 Monitoring using Activity Log Alerts", "Profile": "Level 1", "AssessmentStatus": "Automated", @@ -2406,7 +2406,7 @@ ], "Attributes": [ { - "Section": "5. Logging and Monitoring", + "Section": "5 Logging and Monitoring", "SubSection": "5.2 Monitoring using Activity Log Alerts", "Profile": "Level 1", "AssessmentStatus": "Automated", @@ -2429,7 +2429,7 @@ ], "Attributes": [ { - "Section": "5. Logging and Monitoring", + "Section": "5 Logging and Monitoring", "SubSection": "5.2 Monitoring using Activity Log Alerts", "Profile": "Level 1", "AssessmentStatus": "Automated", @@ -2452,7 +2452,7 @@ ], "Attributes": [ { - "Section": "5. Logging and Monitoring", + "Section": "5 Logging and Monitoring", "SubSection": "5.2 Monitoring using Activity Log Alerts", "Profile": "Level 1", "AssessmentStatus": "Automated", @@ -2475,7 +2475,7 @@ ], "Attributes": [ { - "Section": "5. Logging and Monitoring", + "Section": "5 Logging and Monitoring", "SubSection": "5.2 Monitoring using Activity Log Alerts", "Profile": "Level 1", "AssessmentStatus": "Automated", @@ -2498,7 +2498,7 @@ ], "Attributes": [ { - "Section": "5. Logging and Monitoring", + "Section": "5 Logging and Monitoring", "SubSection": "5.2 Monitoring using Activity Log Alerts", "Profile": "Level 1", "AssessmentStatus": "Automated", @@ -2521,7 +2521,7 @@ ], "Attributes": [ { - "Section": "5. Logging and Monitoring", + "Section": "5 Logging and Monitoring", "SubSection": "5.2 Monitoring using Activity Log Alerts", "Profile": "Level 1", "AssessmentStatus": "Automated", @@ -2542,7 +2542,7 @@ "Checks": [], "Attributes": [ { - "Section": "5. Logging and Monitoring", + "Section": "5 Logging and Monitoring", "Profile": "Level 1", "AssessmentStatus": "Manual", "Description": "Resource Logs capture activity to the data access plane while the Activity log is a subscription-level log for the control plane. Resource-level diagnostic logs provide insight into operations that were performed within that resource itself; for example, reading or updating a secret from a Key Vault. Currently, 95 Azure resources support Azure Monitoring (See the more information section for a complete list), including Network Security Groups, Load Balancers, Key Vault, AD, Logic Apps, and CosmosDB. The content of these logs varies by resource type. A number of back-end services were not configured to log and store Resource Logs for certain activities or for a sufficient length. It is crucial that monitoring is correctly configured to log all relevant activities and retain those logs for a sufficient length of time. Given that the mean time to detection in an enterprise is 240 days, a minimum retention period of two years is recommended.", @@ -2562,7 +2562,7 @@ "Checks": [], "Attributes": [ { - "Section": "5. Logging and Monitoring", + "Section": "5 Logging and Monitoring", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "The use of Basic or Free SKUs in Azure whilst cost effective have significant limitations in terms of what can be monitored and what support can be realized from Microsoft. Typically, these SKU’s do not have a service SLA and Microsoft will usually refuse to provide support for them. Consequently Basic/Free SKUs should never be used for production workloads.", @@ -2584,7 +2584,7 @@ ], "Attributes": [ { - "Section": "5. Logging and Monitoring", + "Section": "5 Logging and Monitoring", "SubSection": "5.3 Configuring Application Insights", "Profile": "Level 2", "AssessmentStatus": "Automated", @@ -2607,7 +2607,7 @@ ], "Attributes": [ { - "Section": "6. Networking", + "Section": "6 Networking", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Network security groups should be periodically evaluated for port misconfigurations. Where certain ports and protocols may be exposed to the Internet, they should be evaluated for necessity and restricted wherever they are not explicitly required.", @@ -2629,7 +2629,7 @@ ], "Attributes": [ { - "Section": "6. Networking", + "Section": "6 Networking", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Network security groups should be periodically evaluated for port misconfigurations. Where certain ports and protocols may be exposed to the Internet, they should be evaluated for necessity and restricted wherever they are not explicitly required.", @@ -2651,7 +2651,7 @@ ], "Attributes": [ { - "Section": "6. Networking", + "Section": "6 Networking", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Network security groups should be periodically evaluated for port misconfigurations. Where certain ports and protocols may be exposed to the Internet, they should be evaluated for necessity and restricted wherever they are not explicitly required.", @@ -2673,7 +2673,7 @@ ], "Attributes": [ { - "Section": "6. Networking", + "Section": "6 Networking", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Network security groups should be periodically evaluated for port misconfigurations. Where certain ports and protocols may be exposed to the Internet, they should be evaluated for necessity and restricted wherever they are not explicitly required and narrowly configured.", @@ -2695,7 +2695,7 @@ ], "Attributes": [ { - "Section": "6. Networking", + "Section": "6 Networking", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "Network Security Group Flow Logs should be enabled and the retention period set to greater than or equal to 90 days.", @@ -2717,7 +2717,7 @@ ], "Attributes": [ { - "Section": "6. Networking", + "Section": "6 Networking", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "Enable Network Watcher for Azure subscriptions.", @@ -2737,7 +2737,7 @@ "Checks": [], "Attributes": [ { - "Section": "6. Networking", + "Section": "6 Networking", "Profile": "Level 1", "AssessmentStatus": "Manual", "Description": "Public IP Addresses provide tenant accounts with Internet connectivity for resources contained within the tenant. During the creation of certain resources in Azure, a Public IP Address may be created. All Public IP Addresses within the tenant should be periodically reviewed for accuracy and necessity.", @@ -2759,7 +2759,7 @@ ], "Attributes": [ { - "Section": "7. Virtual Machines", + "Section": "7 Virtual Machines", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "The Azure Bastion service allows secure remote access to Azure Virtual Machines over the Internet without exposing remote access protocol ports and services directly to the Internet. The Azure Bastion service provides this access using TLS over 443/TCP, and subscribes to hardened configurations within an organization's Azure Active Directory service.", @@ -2781,7 +2781,7 @@ ], "Attributes": [ { - "Section": "7. Virtual Machines", + "Section": "7 Virtual Machines", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Migrate blob-based VHDs to Managed Disks on Virtual Machines to exploit the default features of this configuration. The features include: 1. Default Disk Encryption 2. Resilience, as Microsoft will managed the disk storage and move around if underlying hardware goes faulty 3. Reduction of costs over storage accounts", @@ -2803,7 +2803,7 @@ ], "Attributes": [ { - "Section": "7. Virtual Machines", + "Section": "7 Virtual Machines", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "Ensure that OS disks (boot volumes) and data disks (non-boot volumes) are encrypted with CMK (Customer Managed Keys). Customer Managed keys can be either ADE orServer Side Encryption (SSE).", @@ -2825,7 +2825,7 @@ ], "Attributes": [ { - "Section": "7. Virtual Machines", + "Section": "7 Virtual Machines", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "Ensure that unattached disks in a subscription are encrypted with a Customer Managed Key (CMK).", @@ -2845,7 +2845,7 @@ "Checks": [], "Attributes": [ { - "Section": "7. Virtual Machines", + "Section": "7 Virtual Machines", "Profile": "Level 1", "AssessmentStatus": "Manual", "Description": "For added security, only install organization-approved extensions on VMs.", @@ -2867,7 +2867,7 @@ ], "Attributes": [ { - "Section": "7. Virtual Machines", + "Section": "7 Virtual Machines", "Profile": "Level 2", "AssessmentStatus": "Manual", "Description": "Install endpoint protection for all virtual machines.", @@ -2887,7 +2887,7 @@ "Checks": [], "Attributes": [ { - "Section": "7. Virtual Machines", + "Section": "7 Virtual Machines", "Profile": "Level 2", "AssessmentStatus": "Manual", "Description": "NOTE: This is a legacy recommendation. Managed Disks are encrypted by default and recommended for all new VM implementations. VHD (Virtual Hard Disks) are stored in blob storage and are the old-style disks that were attached to Virtual Machines. The blob VHD was then leased to the VM. By default, storage accounts are not encrypted, and Microsoft Defender will then recommend that the OS disks should be encrypted. Storage accounts can be encrypted as a whole using PMK or CMK. This should be turned on for storage accounts containing VHDs", @@ -2909,7 +2909,7 @@ ], "Attributes": [ { - "Section": "8. Key Vault", + "Section": "8 Key Vault", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Ensure that all Keys in Role Based Access Control (RBAC) Azure Key Vaults have an expiration date set.", @@ -2931,7 +2931,7 @@ ], "Attributes": [ { - "Section": "8. Key Vault", + "Section": "8 Key Vault", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Ensure that all Keys in Non Role Based Access Control (RBAC) Azure Key Vaults have an expiration date set.", @@ -2953,7 +2953,7 @@ ], "Attributes": [ { - "Section": "8. Key Vault", + "Section": "8 Key Vault", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Ensure that all Secrets in Role Based Access Control (RBAC) Azure Key Vaults have an expiration date set.", @@ -2975,7 +2975,7 @@ ], "Attributes": [ { - "Section": "8. Key Vault", + "Section": "8 Key Vault", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Ensure that all Secrets in Non Role Based Access Control (RBAC) Azure Key Vaults have an expiration date set.", @@ -2997,7 +2997,7 @@ ], "Attributes": [ { - "Section": "8. Key Vault", + "Section": "8 Key Vault", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "The Key Vault contains object keys, secrets, and certificates. Accidental unavailability of a Key Vault can cause immediate data loss or loss of security functions (authentication, validation, verification, non-repudiation, etc.) supported by the Key Vault objects. It is recommended the Key Vault be made recoverable by enabling the 'Do Not Purge' and 'Soft Delete' functions. This is in order to prevent loss of encrypted data, including storage accounts, SQL databases, and/or dependent services provided by Key Vault objects (Keys, Secrets, Certificates) etc. This may happen in the case of accidental deletion by a user or from disruptive activity by a malicious user. WARNING: A current limitation of the soft-delete feature across all Azure services is role assignments disappearing when Key Vault is deleted. All role assignments will need to be recreated after recovery.", @@ -3019,7 +3019,7 @@ ], "Attributes": [ { - "Section": "8. Key Vault", + "Section": "8 Key Vault", "Profile": "Level 2", "AssessmentStatus": "Manual", "Description": "WARNING: Role assignments disappear when a Key Vault has been deleted (soft-delete) and recovered. Afterwards it will be required to recreate all role assignments. This is a limitation of the soft-delete feature across all Azure services.", @@ -3041,7 +3041,7 @@ ], "Attributes": [ { - "Section": "8. Key Vault", + "Section": "8 Key Vault", "Profile": "Level 2", "AssessmentStatus": "Manual", "Description": "Private endpoints will secure network traffic from Azure Key Vault to the resources requesting secrets and keys.", @@ -3063,7 +3063,7 @@ ], "Attributes": [ { - "Section": "8. Key Vault", + "Section": "8 Key Vault", "Profile": "Level 2", "AssessmentStatus": "Manual", "Description": "Automatic Key Rotation is available in Public Preview. The currently supported applications are Key Vault, Managed Disks, and Storage accounts accessing keys within Key Vault. The number of supported applications will incrementally increased.", @@ -3085,7 +3085,7 @@ ], "Attributes": [ { - "Section": "9. AppService", + "Section": "9 AppService", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "Azure App Service Authentication is a feature that can prevent anonymous HTTP requests from reaching a Web Application or authenticate those with tokens before they reach the app. If an anonymous request is received from a browser, App Service will redirect to a logon page. To handle the logon process, a choice from a set of identity providers can be made, or a custom authentication mechanism can be implemented.", @@ -3107,7 +3107,7 @@ ], "Attributes": [ { - "Section": "9. AppService", + "Section": "9 AppService", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Azure Web Apps allows sites to run under both HTTP and HTTPS by default. Web apps can be accessed by anyone using non-secure HTTP links by default. Non-secure HTTP requests can be restricted and all HTTP requests redirected to the secure HTTPS port. It is recommended to enforce HTTPS-only traffic.", @@ -3129,7 +3129,7 @@ ], "Attributes": [ { - "Section": "9. AppService", + "Section": "9 AppService", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "The TLS (Transport Layer Security) protocol secures transmission of data over the internet using standard encryption technology. Encryption should be set with the latest version of TLS. App service allows TLS 1.2 by default, which is the recommended TLS level by industry standards such as PCI DSS.", @@ -3151,7 +3151,7 @@ ], "Attributes": [ { - "Section": "9. AppService", + "Section": "9 AppService", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "Client certificates allow for the app to request a certificate for incoming requests. Only clients that have a valid certificate will be able to reach the app.", @@ -3173,7 +3173,7 @@ ], "Attributes": [ { - "Section": "9. AppService", + "Section": "9 AppService", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Managed service identity in App Service provides more security by eliminating secrets from the app, such as credentials in the connection strings. When registering with Azure Active Directory in App Service, the app will connect to other Azure services securely without the need for usernames and passwords.", @@ -3195,7 +3195,7 @@ ], "Attributes": [ { - "Section": "9. AppService", + "Section": "9 AppService", "Profile": "Level 1", "AssessmentStatus": "Manual", "Description": "Periodically newer versions are released for PHP software either due to security flaws or to include additional functionality. Using the latest PHP version for web apps is recommended in order to take advantage of security fixes, if any, and/or additional functionalities of the newer version.", @@ -3217,7 +3217,7 @@ ], "Attributes": [ { - "Section": "9. AppService", + "Section": "9 AppService", "Profile": "Level 1", "AssessmentStatus": "Manual", "Description": "Periodically, newer versions are released for Python software either due to security flaws or to include additional functionality. Using the latest full Python version for web apps is recommended in order to take advantage of security fixes, if any, and/or additional functionalities of the newer version.", @@ -3239,7 +3239,7 @@ ], "Attributes": [ { - "Section": "9. AppService", + "Section": "9 AppService", "Profile": "Level 1", "AssessmentStatus": "Manual", "Description": "Periodically, newer versions are released for Java software either due to security flaws or to include additional functionality. Using the latest Java version for web apps is recommended in order to take advantage of security fixes, if any, and/or new functionalities of the newer version.", @@ -3261,7 +3261,7 @@ ], "Attributes": [ { - "Section": "9. AppService", + "Section": "9 AppService", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Periodically, newer versions are released for HTTP either due to security flaws or to include additional functionality. Using the latest HTTP version for web apps to takeadvantage of security fixes, if any, and/or new functionalities of the newer version.", @@ -3283,7 +3283,7 @@ ], "Attributes": [ { - "Section": "9. AppService", + "Section": "9 AppService", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "By default, Azure Functions, Web, and API Services can be deployed over FTP. If FTP is required for an essential deployment workflow, FTPS should be required for FTP login for all App Service Apps and Functions.", @@ -3303,7 +3303,7 @@ "Checks": [], "Attributes": [ { - "Section": "9. AppService", + "Section": "9 AppService", "Profile": "Level 2", "AssessmentStatus": "Manual", "Description": "Azure Key Vault will store multiple types of sensitive information such as encryption keys, certificate thumbprints, and Managed Identity Credentials. Access to these 'Secrets' can be controlled through granular permissions.", @@ -3323,7 +3323,7 @@ "Checks": [], "Attributes": [ { - "Section": "10. Miscellaneous", + "Section": "10 Miscellaneous", "Profile": "Level 2", "AssessmentStatus": "Manual", "Description": "Resource Manager Locks provide a way for administrators to lock down Azure resources to prevent deletion of, or modifications to, a resource. These locks sit outside of the Role Based Access Controls (RBAC) hierarchy and, when applied, will place restrictions on the resource for all users. These locks are very useful when there is an important resource in a subscription that users should not be able to delete or change. Locks can help prevent accidental and malicious changes or deletion.", diff --git a/prowler/compliance/azure/cis_2.1_azure.json b/prowler/compliance/azure/cis_2.1_azure.json index 594b2ad851..e6b6a128cf 100644 --- a/prowler/compliance/azure/cis_2.1_azure.json +++ b/prowler/compliance/azure/cis_2.1_azure.json @@ -12,7 +12,7 @@ ], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 1", "AssessmentStatus": "Manual", "Description": "Require administrators or appropriately delegated users to create new tenants.", @@ -32,7 +32,7 @@ "Checks": [], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 1", "AssessmentStatus": "Manual", "Description": "Microsoft Entra ID is extended to include Azure AD B2B collaboration, allowing you to invite people from outside your organization to be guest users in your cloud account and sign in with their own work, school, or social identities. Guest users allow you to share your company's applications and services with users from any other organization, while maintaining control over your own corporate data. Work with external partners, large or small, even if they don't have Azure AD or an IT department. A simple invitation and redemption process lets partners use their own credentials to access your company's resources as a guest user. Guest users in every subscription should be review on a regular basis to ensure that inactive and unneeded accounts are removed.", @@ -52,7 +52,7 @@ "Checks": [], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 1", "AssessmentStatus": "Manual", "Description": "Ensures that two alternate forms of identification are provided before allowing a password reset.", @@ -72,7 +72,7 @@ "Checks": [], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 1", "AssessmentStatus": "Manual", "Description": "Microsoft Azure provides a Global Banned Password policy that applies to Azure administrative and normal user accounts. This is not applied to user accounts that are synced from an on-premise Active Directory unless Microsoft Entra ID Connect is used and you enable EnforceCloudPasswordPolicyForPasswordSyncedUsers. Please see the list in default values on the specifics of this policy. To further password security, it is recommended to further define a custom banned password policy.", @@ -92,7 +92,7 @@ "Checks": [], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 1", "AssessmentStatus": "Manual", "Description": "Ensure that the number of days before users are asked to re-confirm their authentication information is not set to 0.", @@ -112,7 +112,7 @@ "Checks": [], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 1", "AssessmentStatus": "Manual", "Description": "Ensure that users are notified on their primary and secondary emails on password resets.", @@ -132,7 +132,7 @@ "Checks": [], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 1", "AssessmentStatus": "Manual", "Description": "Ensure that all Global Administrators are notified if any other administrator resets their password.", @@ -154,7 +154,7 @@ ], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 1", "AssessmentStatus": "Manual", "Description": "Require administrators to provide consent for applications before use.", @@ -176,7 +176,7 @@ ], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 2", "AssessmentStatus": "Manual", "Description": "Allow users to provide consent for selected permissions when a request is coming from a verified publisher.", @@ -196,7 +196,7 @@ "Checks": [], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 1", "AssessmentStatus": "Manual", "Description": "Require administrators to provide consent for the apps before use.", @@ -218,7 +218,7 @@ ], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 1", "AssessmentStatus": "Manual", "Description": "Require administrators or appropriately delegated users to register third-party applications.", @@ -240,7 +240,7 @@ ], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 1", "AssessmentStatus": "Manual", "Description": "Limit guest user permissions.", @@ -262,7 +262,7 @@ ], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 2", "AssessmentStatus": "Manual", "Description": "Restrict invitations to users with specific administrative roles only.", @@ -282,7 +282,7 @@ "Checks": [], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 1", "AssessmentStatus": "Manual", "Description": "Restrict access to the Microsoft Entra ID administration center to administrators only. **NOTE**: This only affects access to the Entra ID administrator's web portal. This setting does not prohibit privileged users from using other methods such as Rest API or Powershell to obtain sensitive information from Microsoft Entra ID.", @@ -302,7 +302,7 @@ "Checks": [], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 2", "AssessmentStatus": "Manual", "Description": "Restrict access to group web interface in the Access Panel portal.", @@ -324,7 +324,7 @@ ], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 2", "AssessmentStatus": "Manual", "Description": "Restrict security group creation to administrators only.", @@ -344,7 +344,7 @@ "Checks": [], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 2", "AssessmentStatus": "Manual", "Description": "Restrict security group management to administrators only.", @@ -366,7 +366,7 @@ ], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 2", "AssessmentStatus": "Manual", "Description": "Restrict Microsoft 365 group creation to administrators only.", @@ -386,7 +386,7 @@ "Checks": [], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 1", "AssessmentStatus": "Manual", "Description": "Joining or registering devices to Microsoft Entra ID should require Multi-factor authentication.", @@ -408,7 +408,7 @@ ], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "The principle of least privilege should be followed and only necessary privileges should be assigned instead of allowing full administrative access.", @@ -430,7 +430,7 @@ ], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 2", "AssessmentStatus": "Manual", "Description": "Resource locking is a powerful protection mechanism that can prevent inadvertent modification/deletion of resources within Azure subscriptions/Resource Groups and is a recommended NIST configuration.", @@ -450,7 +450,7 @@ "Checks": [], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 2", "AssessmentStatus": "Manual", "Description": "Users who are set as subscription owners are able to make administrative changes to the subscriptions and move them into and out of Microsoft Entra ID.", @@ -472,7 +472,7 @@ ], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 1", "AssessmentStatus": "Manual", "Description": "This recommendation aims to maintain a balance between security and operational efficiency by ensuring that a minimum of 2 and a maximum of 4 users are assigned the Global Administrator role in Microsoft Entra ID. Having at least two Global Administrators ensures redundancy, while limiting the number to four reduces the risk of excessive privileged access.", @@ -494,7 +494,7 @@ ], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "SubSection": "1.1 Security Defaults Security Defaults", "Profile": "Level 1", "AssessmentStatus": "Manual", @@ -517,7 +517,7 @@ ], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "SubSection": "1.1 Security Defaults Security Defaults", "Profile": "Level 1", "AssessmentStatus": "Manual", @@ -540,7 +540,7 @@ ], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "SubSection": "1.1 Security Defaults Security Defaults", "Profile": "Level 2", "AssessmentStatus": "Manual", @@ -561,7 +561,7 @@ "Checks": [], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "SubSection": "1.1 Security Defaults Security Defaults", "Profile": "Level 1", "AssessmentStatus": "Manual", @@ -584,7 +584,7 @@ ], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "SubSection": "1.2 Conditional Access", "Profile": "Level 1", "AssessmentStatus": "Manual", @@ -605,7 +605,7 @@ "Checks": [], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "SubSection": "1.2 Conditional Access", "Profile": "Level 1", "AssessmentStatus": "Manual", @@ -626,7 +626,7 @@ "Checks": [], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "SubSection": "1.2 Conditional Access", "Profile": "Level 1", "AssessmentStatus": "Manual", @@ -647,7 +647,7 @@ "Checks": [], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "SubSection": "1.2 Conditional Access", "Profile": "Level 1", "AssessmentStatus": "Manual", @@ -668,7 +668,7 @@ "Checks": [], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "SubSection": "1.2 Conditional Access", "Profile": "Level 1", "AssessmentStatus": "Manual", @@ -691,7 +691,7 @@ ], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "SubSection": "1.2 Conditional Access", "Profile": "Level 1", "AssessmentStatus": "Manual", @@ -712,7 +712,7 @@ "Checks": [], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "SubSection": "1.2 Conditional Access", "Profile": "Level 1", "AssessmentStatus": "Manual", @@ -735,7 +735,7 @@ ], "Attributes": [ { - "Section": "2. Microsoft Defender", + "Section": "2 Microsoft Defender", "SubSection": "2.1 Microsoft Defender for Cloud", "Profile": "Level 2", "AssessmentStatus": "Automated", @@ -758,7 +758,7 @@ ], "Attributes": [ { - "Section": "2. Microsoft Defender", + "Section": "2 Microsoft Defender", "SubSection": "2.1 Microsoft Defender for Cloud", "Profile": "Level 2", "AssessmentStatus": "Automated", @@ -781,7 +781,7 @@ ], "Attributes": [ { - "Section": "2. Microsoft Defender", + "Section": "2 Microsoft Defender", "SubSection": "2.1 Microsoft Defender for Cloud", "Profile": "Level 2", "AssessmentStatus": "Automated", @@ -804,7 +804,7 @@ ], "Attributes": [ { - "Section": "2. Microsoft Defender", + "Section": "2 Microsoft Defender", "SubSection": "2.1 Microsoft Defender for Cloud", "Profile": "Level 2", "AssessmentStatus": "Automated", @@ -827,7 +827,7 @@ ], "Attributes": [ { - "Section": "2. Microsoft Defender", + "Section": "2 Microsoft Defender", "SubSection": "2.1 Microsoft Defender for Cloud", "Profile": "Level 2", "AssessmentStatus": "Automated", @@ -850,7 +850,7 @@ ], "Attributes": [ { - "Section": "2. Microsoft Defender", + "Section": "2 Microsoft Defender", "SubSection": "2.1 Microsoft Defender for Cloud", "Profile": "Level 2", "AssessmentStatus": "Automated", @@ -873,7 +873,7 @@ ], "Attributes": [ { - "Section": "2. Microsoft Defender", + "Section": "2 Microsoft Defender", "SubSection": "2.1 Microsoft Defender for Cloud", "Profile": "Level 2", "AssessmentStatus": "Automated", @@ -896,7 +896,7 @@ ], "Attributes": [ { - "Section": "2. Microsoft Defender", + "Section": "2 Microsoft Defender", "SubSection": "2.1 Microsoft Defender for Cloud", "Profile": "Level 2", "AssessmentStatus": "Automated", @@ -919,7 +919,7 @@ ], "Attributes": [ { - "Section": "2. Microsoft Defender", + "Section": "2 Microsoft Defender", "SubSection": "2.1 Microsoft Defender for Cloud", "Profile": "Level 2", "AssessmentStatus": "Automated", @@ -942,7 +942,7 @@ ], "Attributes": [ { - "Section": "2. Microsoft Defender", + "Section": "2 Microsoft Defender", "SubSection": "2.1 Microsoft Defender for Cloud", "Profile": "Level 2", "AssessmentStatus": "Automated", @@ -965,7 +965,7 @@ ], "Attributes": [ { - "Section": "2. Microsoft Defender", + "Section": "2 Microsoft Defender", "SubSection": "2.1 Microsoft Defender for Cloud", "Profile": "Level 2", "AssessmentStatus": "Automated", @@ -988,7 +988,7 @@ ], "Attributes": [ { - "Section": "2. Microsoft Defender", + "Section": "2 Microsoft Defender", "SubSection": "2.1 Microsoft Defender for Cloud", "Profile": "Level 1", "AssessmentStatus": "Automated", @@ -1011,7 +1011,7 @@ ], "Attributes": [ { - "Section": "2. Microsoft Defender", + "Section": "2 Microsoft Defender", "SubSection": "2.1 Microsoft Defender for Cloud", "Profile": "Level 1", "AssessmentStatus": "Manual", @@ -1034,7 +1034,7 @@ ], "Attributes": [ { - "Section": "2. Microsoft Defender", + "Section": "2 Microsoft Defender", "SubSection": "2.1 Microsoft Defender for Cloud", "Profile": "Level 1", "AssessmentStatus": "Automated", @@ -1057,7 +1057,7 @@ ], "Attributes": [ { - "Section": "2. Microsoft Defender", + "Section": "2 Microsoft Defender", "SubSection": "2.1 Microsoft Defender for Cloud", "Profile": "Level 2", "AssessmentStatus": "Manual", @@ -1078,7 +1078,7 @@ "Checks": [], "Attributes": [ { - "Section": "2. Microsoft Defender", + "Section": "2 Microsoft Defender", "SubSection": "2.1 Microsoft Defender for Cloud", "Profile": "Level 2", "AssessmentStatus": "Automated", @@ -1101,7 +1101,7 @@ ], "Attributes": [ { - "Section": "2. Microsoft Defender", + "Section": "2 Microsoft Defender", "SubSection": "2.1 Microsoft Defender for Cloud", "Profile": "Level 1", "AssessmentStatus": "Automated", @@ -1124,7 +1124,7 @@ ], "Attributes": [ { - "Section": "2. Microsoft Defender", + "Section": "2 Microsoft Defender", "SubSection": "2.1 Microsoft Defender for Cloud", "Profile": "Level 1", "AssessmentStatus": "Automated", @@ -1147,7 +1147,7 @@ ], "Attributes": [ { - "Section": "2. Microsoft Defender", + "Section": "2 Microsoft Defender", "SubSection": "2.1 Microsoft Defender for Cloud", "Profile": "Level 1", "AssessmentStatus": "Automated", @@ -1170,7 +1170,7 @@ ], "Attributes": [ { - "Section": "2. Microsoft Defender", + "Section": "2 Microsoft Defender", "SubSection": "2.1 Microsoft Defender for Cloud", "Profile": "Level 2", "AssessmentStatus": "Manual", @@ -1193,7 +1193,7 @@ ], "Attributes": [ { - "Section": "2. Microsoft Defender", + "Section": "2 Microsoft Defender", "SubSection": "2.1 Microsoft Defender for Cloud", "Profile": "Level 2", "AssessmentStatus": "Manual", @@ -1214,7 +1214,7 @@ "Checks": [], "Attributes": [ { - "Section": "2. Microsoft Defender", + "Section": "2 Microsoft Defender", "SubSection": "2.1 Microsoft Defender for Cloud", "Profile": "Level 2", "AssessmentStatus": "Manual", @@ -1237,7 +1237,7 @@ ], "Attributes": [ { - "Section": "2. Microsoft Defender", + "Section": "2 Microsoft Defender", "SubSection": "2.2 Microsoft Defender for IoT", "Profile": "Level 2", "AssessmentStatus": "Manual", @@ -1260,7 +1260,7 @@ ], "Attributes": [ { - "Section": "3. Storage Accounts", + "Section": "3 Storage Accounts", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Enable data encryption in transit.", @@ -1282,7 +1282,7 @@ ], "Attributes": [ { - "Section": "3. Storage Accounts", + "Section": "3 Storage Accounts", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "Enabling encryption at the hardware level on top of the default software encryption for Storage Accounts accessing Azure storage solutions.", @@ -1302,7 +1302,7 @@ "Checks": [], "Attributes": [ { - "Section": "3. Storage Accounts", + "Section": "3 Storage Accounts", "Profile": "Level 1", "AssessmentStatus": "Manual", "Description": "Access Keys authenticate application access requests to data contained in Storage Accounts. A periodic rotation of these keys is recommended to ensure that potentially compromised keys cannot result in a long-term exploitable credential. The Rotation Reminder is an automatic reminder feature for a manual procedure.", @@ -1324,7 +1324,7 @@ ], "Attributes": [ { - "Section": "3. Storage Accounts", + "Section": "3 Storage Accounts", "Profile": "Level 1", "AssessmentStatus": "Manual", "Description": "For increased security, regenerate storage account access keys periodically.", @@ -1344,7 +1344,7 @@ "Checks": [], "Attributes": [ { - "Section": "3. Storage Accounts", + "Section": "3 Storage Accounts", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "The Storage Queue service stores messages that may be read by any client who has access to the storage account. A queue can contain an unlimited number of messages, each of which can be up to 64KB in size using version 2011-08-18 or newer. Storage Logging happens server-side and allows details for both successful and failed requests to be recorded in the storage account. These logs allow users to see the details of read, write, and delete operations against the queues. Storage Logging log entries contain the following information about individual requests: Timing information such as start time, end-to-end latency, and server latency, authentication details, concurrency information, and the sizes of the request and response messages.", @@ -1364,7 +1364,7 @@ "Checks": [], "Attributes": [ { - "Section": "3. Storage Accounts", + "Section": "3 Storage Accounts", "Profile": "Level 1", "AssessmentStatus": "Manual", "Description": "Expire shared access signature tokens within an hour.", @@ -1386,7 +1386,7 @@ ], "Attributes": [ { - "Section": "3. Storage Accounts", + "Section": "3 Storage Accounts", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Disallowing public network access for a storage account overrides the public access settings for individual containers in that storage account for Azure Resource Manager Deployment Model storage accounts. Azure Storage accounts that use the classic deployment model will be retired on August 31, 2024.", @@ -1408,7 +1408,7 @@ ], "Attributes": [ { - "Section": "3. Storage Accounts", + "Section": "3 Storage Accounts", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Restricting default network access helps to provide a new layer of security, since storage accounts accept connections from clients on any network. To limit access to selected networks, the default action must be changed.", @@ -1430,7 +1430,7 @@ ], "Attributes": [ { - "Section": "3. Storage Accounts", + "Section": "3 Storage Accounts", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "Some Azure services that interact with storage accounts operate from networks that can't be granted access through network rules. To help this type of service work as intended, allow the set of trusted Azure services to bypass the network rules. These services will then use strong authentication to access the storage account. If the Allow trusted Azure services exception is enabled, the following services are granted access to the storage account: Azure Backup, Azure Site Recovery, Azure DevTest Labs, Azure Event Grid, Azure Event Hubs, Azure Networking, Azure Monitor, and Azure SQL Data Warehouse (when registered in the subscription).", @@ -1452,7 +1452,7 @@ ], "Attributes": [ { - "Section": "3. Storage Accounts", + "Section": "3 Storage Accounts", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Use private endpoints for your Azure Storage accounts to allow clients and services to securely access data located over a network via an encrypted Private Link. To do this, the private endpoint uses an IP address from the VNet for each service. Network traffic between disparate services securely traverses encrypted over the VNet. This VNet can also link addressing space, extending your network and accessing resources on it. Similarly, it can be a tunnel through public networks to connect remote infrastructures together. This creates further security through segmenting network traffic and preventing outside sources from accessing it.", @@ -1474,7 +1474,7 @@ ], "Attributes": [ { - "Section": "3. Storage Accounts", + "Section": "3 Storage Accounts", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "The Azure Storage blobs contain data like ePHI or Financial, which can be secret or personal. Data that is erroneously modified or deleted by an application or other storage account user will cause data loss or unavailability. It is recommended that both Azure Containers with attached Blob Storage and standalone containers with Blob Storage be made recoverable by enabling the **soft delete** configuration. This is to save and recover data when blobs or blob snapshots are deleted.", @@ -1496,7 +1496,7 @@ ], "Attributes": [ { - "Section": "3. Storage Accounts", + "Section": "3 Storage Accounts", "Profile": "Level 2", "AssessmentStatus": "Manual", "Description": "Enable sensitive data encryption at rest using Customer Managed Keys (CMK) rather than Microsoft Managed keys.", @@ -1516,7 +1516,7 @@ "Checks": [], "Attributes": [ { - "Section": "3. Storage Accounts", + "Section": "3 Storage Accounts", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "The Storage Blob service provides scalable, cost-efficient object storage in the cloud. Storage Logging happens server-side and allows details for both successful and failed requests to be recorded in the storage account. These logs allow users to see the details of read, write, and delete operations against the blobs. Storage Logging log entries contain the following information about individual requests: timing information such as start time, end-to-end latency, and server latency; authentication details; concurrency information; and the sizes of the request and response messages.", @@ -1536,7 +1536,7 @@ "Checks": [], "Attributes": [ { - "Section": "3. Storage Accounts", + "Section": "3 Storage Accounts", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "Azure Table storage is a service that stores structured NoSQL data in the cloud, providing a key/attribute store with a schema-less design. Storage Logging happens server-side and allows details for both successful and failed requests to be recorded in the storage account. These logs allow users to see the details of read, write, and delete operations against the tables. Storage Logging log entries contain the following information about individual requests: timing information such as start time, end-to-end latency, and server latency; authentication details; concurrency information; and the sizes of the request and response messages.", @@ -1558,7 +1558,7 @@ ], "Attributes": [ { - "Section": "3. Storage Accounts", + "Section": "3 Storage Accounts", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "In some cases, Azure Storage sets the minimum TLS version to be version 1.0 by default. TLS 1.0 is a legacy version and has known vulnerabilities. This minimum TLS version can be configured to be later protocols such as TLS 1.2.", @@ -1578,7 +1578,7 @@ "Checks": [], "Attributes": [ { - "Section": "3. Storage Accounts", + "Section": "3 Storage Accounts", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Cross Tenant Replication in Azure allows data to be replicated across multiple Azure tenants. While this feature can be beneficial for data sharing and availability, it also poses a significant security risk if not properly managed. Unauthorized data access, data leakage, and compliance violations are potential risks. Disabling Cross Tenant Replication ensures that data is not inadvertently replicated across different tenant boundaries without explicit authorization.", @@ -1598,7 +1598,7 @@ "Checks": [], "Attributes": [ { - "Section": "3. Storage Accounts", + "Section": "3 Storage Accounts", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "The Azure Storage setting ‘Allow Blob Anonymous Access’ (aka allowBlobPublicAccess) controls whether anonymous access is allowed for blob data in a storage account. When this property is set to True, it enables public read access to blob data, which can be convenient for sharing data but may carry security risks. When set to False, it disallows public access to blob data, providing a more secure storage environment.", @@ -1620,7 +1620,7 @@ ], "Attributes": [ { - "Section": "4. Database Services", + "Section": "4 Database Services", "SubSection": "4.1 SQL Server - Auditing", "Profile": "Level 1", "AssessmentStatus": "Automated", @@ -1643,7 +1643,7 @@ ], "Attributes": [ { - "Section": "4. Database Services", + "Section": "4 Database Services", "SubSection": "4.1 SQL Server - Auditing", "Profile": "Level 1", "AssessmentStatus": "Automated", @@ -1666,7 +1666,7 @@ ], "Attributes": [ { - "Section": "4. Database Services", + "Section": "4 Database Services", "SubSection": "4.1 SQL Server - Auditing", "Profile": "Level 2", "AssessmentStatus": "Automated", @@ -1689,7 +1689,7 @@ ], "Attributes": [ { - "Section": "4. Database Services", + "Section": "4 Database Services", "SubSection": "4.1 SQL Server - Auditing", "Profile": "Level 1", "AssessmentStatus": "Automated", @@ -1712,7 +1712,7 @@ ], "Attributes": [ { - "Section": "4. Database Services", + "Section": "4 Database Services", "SubSection": "4.1 SQL Server - Auditing", "Profile": "Level 1", "AssessmentStatus": "Automated", @@ -1735,7 +1735,7 @@ ], "Attributes": [ { - "Section": "4. Database Services", + "Section": "4 Database Services", "SubSection": "4.1 SQL Server - Auditing", "Profile": "Level 1", "AssessmentStatus": "Automated", @@ -1758,7 +1758,7 @@ ], "Attributes": [ { - "Section": "4. Database Services", + "Section": "4 Database Services", "SubSection": "4.3 PostgreSQL Database Server. Storage Accounts", "Profile": "Level 1", "AssessmentStatus": "Automated", @@ -1781,7 +1781,7 @@ ], "Attributes": [ { - "Section": "4. Database Services", + "Section": "4 Database Services", "SubSection": "4.3 PostgreSQL Database Server. Storage Accounts", "Profile": "Level 1", "AssessmentStatus": "Automated", @@ -1804,7 +1804,7 @@ ], "Attributes": [ { - "Section": "4. Database Services", + "Section": "4 Database Services", "SubSection": "4.3 PostgreSQL Database Server. Storage Accounts", "Profile": "Level 1", "AssessmentStatus": "Automated", @@ -1827,7 +1827,7 @@ ], "Attributes": [ { - "Section": "4. Database Services", + "Section": "4 Database Services", "SubSection": "4.3 PostgreSQL Database Server. Storage Accounts", "Profile": "Level 1", "AssessmentStatus": "Automated", @@ -1850,7 +1850,7 @@ ], "Attributes": [ { - "Section": "4. Database Services", + "Section": "4 Database Services", "SubSection": "4.3 PostgreSQL Database Server. Storage Accounts", "Profile": "Level 1", "AssessmentStatus": "Automated", @@ -1873,7 +1873,7 @@ ], "Attributes": [ { - "Section": "4. Database Services", + "Section": "4 Database Services", "SubSection": "4.3 PostgreSQL Database Server. Storage Accounts", "Profile": "Level 1", "AssessmentStatus": "Automated", @@ -1896,7 +1896,7 @@ ], "Attributes": [ { - "Section": "4. Database Services", + "Section": "4 Database Services", "SubSection": "4.3 PostgreSQL Database Server. Storage Accounts", "Profile": "Level 1", "AssessmentStatus": "Automated", @@ -1917,7 +1917,7 @@ "Checks": [], "Attributes": [ { - "Section": "4. Database Services", + "Section": "4 Database Services", "SubSection": "4.3 PostgreSQL Database Server. Storage Accounts", "Profile": "Level 1", "AssessmentStatus": "Automated", @@ -1940,7 +1940,7 @@ ], "Attributes": [ { - "Section": "4. Database Services", + "Section": "4 Database Services", "SubSection": "4.4 MySQL Database", "Profile": "Level 1", "AssessmentStatus": "Automated", @@ -1963,7 +1963,7 @@ ], "Attributes": [ { - "Section": "4. Database Services", + "Section": "4 Database Services", "SubSection": "4.4 MySQL Database", "Profile": "Level 1", "AssessmentStatus": "Automated", @@ -1986,7 +1986,7 @@ ], "Attributes": [ { - "Section": "4. Database Services", + "Section": "4 Database Services", "SubSection": "4.4 MySQL Database", "Profile": "Level 2", "AssessmentStatus": "Manual", @@ -2009,7 +2009,7 @@ ], "Attributes": [ { - "Section": "4. Database Services", + "Section": "4 Database Services", "SubSection": "4.4 MySQL Database", "Profile": "Level 2", "AssessmentStatus": "Manual", @@ -2032,7 +2032,7 @@ ], "Attributes": [ { - "Section": "4. Database Services", + "Section": "4 Database Services", "SubSection": "4.5 Cosmos DB", "Profile": "Level 2", "AssessmentStatus": "Automated", @@ -2055,7 +2055,7 @@ ], "Attributes": [ { - "Section": "4. Database Services", + "Section": "4 Database Services", "SubSection": "4.5 Cosmos DB", "Profile": "Level 2", "AssessmentStatus": "Automated", @@ -2078,7 +2078,7 @@ ], "Attributes": [ { - "Section": "4. Database Services", + "Section": "4 Database Services", "SubSection": "4.5 Cosmos DB", "Profile": "Level 1", "AssessmentStatus": "Manual", @@ -2099,7 +2099,7 @@ "Checks": [], "Attributes": [ { - "Section": "5. Logging and Monitoring", + "Section": "5 Logging and Monitoring", "Profile": "Level 1", "AssessmentStatus": "Manual", "Description": "Resource Logs capture activity to the data access plane while the Activity log is a subscription-level log for the control plane. Resource-level diagnostic logs provide insight into operations that were performed within that resource itself; for example, reading or updating a secret from a Key Vault. Currently, 95 Azure resources support Azure Monitoring (See the more information section for a complete list), including Network Security Groups, Load Balancers, Key Vault, AD, Logic Apps, and CosmosDB. The content of these logs varies by resource type. A number of back-end services were not configured to log and store Resource Logs for certain activities or for a sufficient length. It is crucial that monitoring is correctly configured to log all relevant activities and retain those logs for a sufficient length of time. Given that the mean time to detection in an enterprise is 240 days, a minimum retention period of two years is recommended.", @@ -2119,7 +2119,7 @@ "Checks": [], "Attributes": [ { - "Section": "5. Logging and Monitoring", + "Section": "5 Logging and Monitoring", "Profile": "Level 2", "AssessmentStatus": "Manual", "Description": "The use of Basic or Free SKUs in Azure whilst cost effective have significant limitations in terms of what can be monitored and what support can be realized from Microsoft. Typically, these SKU’s do not have a service SLA and Microsoft may refuse to provide support for them. Consequently Basic/Free SKUs should never be used for production workloads.", @@ -2141,7 +2141,7 @@ ], "Attributes": [ { - "Section": "5. Logging and Monitoring", + "Section": "5 Logging and Monitoring", "SubSection": "5.1 Configuring Diagnostic Settings", "Profile": "Level 1", "AssessmentStatus": "Manual", @@ -2164,7 +2164,7 @@ ], "Attributes": [ { - "Section": "5. Logging and Monitoring", + "Section": "5 Logging and Monitoring", "SubSection": "5.1 Configuring Diagnostic Settings", "Profile": "Level 1", "AssessmentStatus": "Automated", @@ -2187,7 +2187,7 @@ ], "Attributes": [ { - "Section": "5. Logging and Monitoring", + "Section": "5 Logging and Monitoring", "SubSection": "5.1 Configuring Diagnostic Settings", "Profile": "Level 2", "AssessmentStatus": "Automated", @@ -2210,7 +2210,7 @@ ], "Attributes": [ { - "Section": "5. Logging and Monitoring", + "Section": "5 Logging and Monitoring", "SubSection": "5.1 Configuring Diagnostic Settings", "Profile": "Level 1", "AssessmentStatus": "Automated", @@ -2233,7 +2233,7 @@ ], "Attributes": [ { - "Section": "5. Logging and Monitoring", + "Section": "5 Logging and Monitoring", "SubSection": "5.1 Configuring Diagnostic Settings", "Profile": "Level 2", "AssessmentStatus": "Manual", @@ -2256,7 +2256,7 @@ ], "Attributes": [ { - "Section": "5. Logging and Monitoring", + "Section": "5 Logging and Monitoring", "SubSection": "5.1 Configuring Diagnostic Settings", "Profile": "Level 2", "AssessmentStatus": "Manual", @@ -2279,7 +2279,7 @@ ], "Attributes": [ { - "Section": "5. Logging and Monitoring", + "Section": "5 Logging and Monitoring", "SubSection": "5.2 Monitoring using Activity Log Alerts", "Profile": "Level 1", "AssessmentStatus": "Automated", @@ -2302,7 +2302,7 @@ ], "Attributes": [ { - "Section": "5. Logging and Monitoring", + "Section": "5 Logging and Monitoring", "SubSection": "5.2 Monitoring using Activity Log Alerts", "Profile": "Level 1", "AssessmentStatus": "Automated", @@ -2325,7 +2325,7 @@ ], "Attributes": [ { - "Section": "5. Logging and Monitoring", + "Section": "5 Logging and Monitoring", "SubSection": "5.2 Monitoring using Activity Log Alerts", "Profile": "Level 1", "AssessmentStatus": "Automated", @@ -2348,7 +2348,7 @@ ], "Attributes": [ { - "Section": "5. Logging and Monitoring", + "Section": "5 Logging and Monitoring", "SubSection": "5.2 Monitoring using Activity Log Alerts", "Profile": "Level 1", "AssessmentStatus": "Automated", @@ -2371,7 +2371,7 @@ ], "Attributes": [ { - "Section": "5. Logging and Monitoring", + "Section": "5 Logging and Monitoring", "SubSection": "5.2 Monitoring using Activity Log Alerts", "Profile": "Level 1", "AssessmentStatus": "Automated", @@ -2394,7 +2394,7 @@ ], "Attributes": [ { - "Section": "5. Logging and Monitoring", + "Section": "5 Logging and Monitoring", "SubSection": "5.2 Monitoring using Activity Log Alerts", "Profile": "Level 1", "AssessmentStatus": "Automated", @@ -2417,7 +2417,7 @@ ], "Attributes": [ { - "Section": "5. Logging and Monitoring", + "Section": "5 Logging and Monitoring", "SubSection": "5.2 Monitoring using Activity Log Alerts", "Profile": "Level 1", "AssessmentStatus": "Automated", @@ -2440,7 +2440,7 @@ ], "Attributes": [ { - "Section": "5. Logging and Monitoring", + "Section": "5 Logging and Monitoring", "SubSection": "5.2 Monitoring using Activity Log Alerts", "Profile": "Level 1", "AssessmentStatus": "Automated", @@ -2463,7 +2463,7 @@ ], "Attributes": [ { - "Section": "5. Logging and Monitoring", + "Section": "5 Logging and Monitoring", "SubSection": "5.2 Monitoring using Activity Log Alerts", "Profile": "Level 1", "AssessmentStatus": "Automated", @@ -2486,7 +2486,7 @@ ], "Attributes": [ { - "Section": "5. Logging and Monitoring", + "Section": "5 Logging and Monitoring", "SubSection": "5.2 Monitoring using Activity Log Alerts", "Profile": "Level 1", "AssessmentStatus": "Automated", @@ -2509,7 +2509,7 @@ ], "Attributes": [ { - "Section": "5. Logging and Monitoring", + "Section": "5 Logging and Monitoring", "SubSection": "5.3 Configuring Application Insights. Storage Accounts", "Profile": "Level 2", "AssessmentStatus": "Automated", @@ -2532,7 +2532,7 @@ ], "Attributes": [ { - "Section": "6. Networking", + "Section": "6 Networking", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Network security groups should be periodically evaluated for port misconfigurations. Where certain ports and protocols may be exposed to the Internet, they should be evaluated for necessity and restricted wherever they are not explicitly required.", @@ -2554,7 +2554,7 @@ ], "Attributes": [ { - "Section": "6. Networking", + "Section": "6 Networking", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Network security groups should be periodically evaluated for port misconfigurations. Where certain ports and protocols may be exposed to the Internet, they should be evaluated for necessity and restricted wherever they are not explicitly required.", @@ -2576,7 +2576,7 @@ ], "Attributes": [ { - "Section": "6. Networking", + "Section": "6 Networking", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Network security groups should be periodically evaluated for port misconfigurations. Where certain ports and protocols may be exposed to the Internet, they should be evaluated for necessity and restricted wherever they are not explicitly required.", @@ -2598,7 +2598,7 @@ ], "Attributes": [ { - "Section": "6. Networking", + "Section": "6 Networking", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Network security groups should be periodically evaluated for port misconfigurations. Where certain ports and protocols may be exposed to the Internet, they should be evaluated for necessity and restricted wherever they are not explicitly required and narrowly configured.", @@ -2620,7 +2620,7 @@ ], "Attributes": [ { - "Section": "6. Networking", + "Section": "6 Networking", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "Network Security Group Flow Logs should be enabled and the retention period set to greater than or equal to 90 days.", @@ -2642,7 +2642,7 @@ ], "Attributes": [ { - "Section": "6. Networking", + "Section": "6 Networking", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "Enable Network Watcher for physical regions in Azure subscriptions.", @@ -2662,7 +2662,7 @@ "Checks": [], "Attributes": [ { - "Section": "6. Networking", + "Section": "6 Networking", "Profile": "Level 1", "AssessmentStatus": "Manual", "Description": "Public IP Addresses provide tenant accounts with Internet connectivity for resources contained within the tenant. During the creation of certain resources in Azure, a Public IP Address may be created. All Public IP Addresses within the tenant should be periodically reviewed for accuracy and necessity.", @@ -2684,7 +2684,7 @@ ], "Attributes": [ { - "Section": "7. Virtual Machines", + "Section": "7 Virtual Machines", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "The Azure Bastion service allows secure remote access to Azure Virtual Machines over the Internet without exposing remote access protocol ports and services directly to the Internet. The Azure Bastion service provides this access using TLS over 443/TCP, and subscribes to hardened configurations within an organization's Azure Active Directory service.", @@ -2706,7 +2706,7 @@ ], "Attributes": [ { - "Section": "7. Virtual Machines", + "Section": "7 Virtual Machines", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Migrate blob-based VHDs to Managed Disks on Virtual Machines to exploit the default features of this configuration. The features include: 1) Default Disk Encryption 2) Resilience, as Microsoft will managed the disk storage and move around if underlying hardware goes faulty 3) Reduction of costs over storage accounts", @@ -2728,7 +2728,7 @@ ], "Attributes": [ { - "Section": "7. Virtual Machines", + "Section": "7 Virtual Machines", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "Ensure that OS disks (boot volumes) and data disks (non-boot volumes) are encrypted with CMK (Customer Managed Keys). Customer Managed keys can be either ADE or Server Side Encryption (SSE).", @@ -2750,7 +2750,7 @@ ], "Attributes": [ { - "Section": "7. Virtual Machines", + "Section": "7 Virtual Machines", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "Ensure that unattached disks in a subscription are encrypted with a Customer Managed Key (CMK).", @@ -2770,7 +2770,7 @@ "Checks": [], "Attributes": [ { - "Section": "7. Virtual Machines", + "Section": "7 Virtual Machines", "Profile": "Level 1", "AssessmentStatus": "Manual", "Description": "For added security, only install organization-approved extensions on VMs.", @@ -2792,7 +2792,7 @@ ], "Attributes": [ { - "Section": "7. Virtual Machines", + "Section": "7 Virtual Machines", "Profile": "Level 2", "AssessmentStatus": "Manual", "Description": "Install endpoint protection for all virtual machines.", @@ -2812,7 +2812,7 @@ "Checks": [], "Attributes": [ { - "Section": "7. Virtual Machines", + "Section": "7 Virtual Machines", "Profile": "Level 2", "AssessmentStatus": "Manual", "Description": "**NOTE: This is a legacy recommendation. Managed Disks are encrypted by default and recommended for all new VM implementations.** VHD (Virtual Hard Disks) are stored in blob storage and are the old-style disks that were attached to Virtual Machines. The blob VHD was then leased to the VM. By default, storage accounts are not encrypted, and Microsoft Defender will then recommend that the OS disks should be encrypted. Storage accounts can be encrypted as a whole using PMK or CMK. This should be turned on for storage accounts containing VHDs.", @@ -2834,7 +2834,7 @@ ], "Attributes": [ { - "Section": "7. Virtual Machines", + "Section": "7 Virtual Machines", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "Verify identities without MFA that can log in to a privileged virtual machine using separate login credentials. An adversary can leverage the access to move laterally and perform actions with the virtual machine's managed identity. Make sure the virtual machine only has necessary permissions, and revoke the admin-level permissions according to the least privileges principal", @@ -2856,7 +2856,7 @@ ], "Attributes": [ { - "Section": "7. Virtual Machines", + "Section": "7 Virtual Machines", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "When **Secure Boot** and **vTPM** are enabled together, they provide a strong foundation for protecting your VM from boot attacks. For example, if an attacker attempts to replace the bootloader with a malicious version, Secure Boot will prevent the VM from booting. If the attacker is able to bypass Secure Boot and install a malicious bootloader, vTPM can be used to detect the intrusion and alert you.", @@ -2878,7 +2878,7 @@ ], "Attributes": [ { - "Section": "8. Key Vault", + "Section": "8 Key Vault", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Ensure that all Keys in Role Based Access Control (RBAC) Azure Key Vaults have an expiration date set.", @@ -2900,7 +2900,7 @@ ], "Attributes": [ { - "Section": "8. Key Vault", + "Section": "8 Key Vault", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Ensure that all Keys in Non Role Based Access Control (RBAC) Azure Key Vaults have an expiration date set.", @@ -2922,7 +2922,7 @@ ], "Attributes": [ { - "Section": "8. Key Vault", + "Section": "8 Key Vault", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Ensure that all Secrets in Role Based Access Control (RBAC) Azure Key Vaults have an expiration date set.", @@ -2944,7 +2944,7 @@ ], "Attributes": [ { - "Section": "8. Key Vault", + "Section": "8 Key Vault", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Ensure that all Secrets in Non Role Based Access Control (RBAC) Azure Key Vaults have an expiration date set.", @@ -2966,7 +2966,7 @@ ], "Attributes": [ { - "Section": "8. Key Vault", + "Section": "8 Key Vault", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "The Key Vault contains object keys, secrets, and certificates. Accidental unavailability of a Key Vault can cause immediate data loss or loss of security functions (authentication, validation, verification, non-repudiation, etc.) supported by the Key Vault objects. It is recommended the Key Vault be made recoverable by enabling the Do Not Purge and Soft Delete functions. This is in order to prevent loss of encrypted data, including storage accounts, SQL databases, and/or dependent services provided by Key Vault objects (Keys, Secrets, Certificates) etc. This may happen in the case of accidental deletion by a user or from disruptive activity by a malicious user. WARNING: A current limitation is that role assignments disappearing when Key Vault is deleted. All role assignments will need to be recreated after recovery.", @@ -2988,7 +2988,7 @@ ], "Attributes": [ { - "Section": "8. Key Vault", + "Section": "8 Key Vault", "Profile": "Level 2", "AssessmentStatus": "Manual", "Description": "WARNING: Role assignments disappear when a Key Vault has been deleted (soft-delete) and recovered. Afterwards it will be required to recreate all role assignments. This is a limitation of the soft-delete feature across all Azure services.", @@ -3010,7 +3010,7 @@ ], "Attributes": [ { - "Section": "8. Key Vault", + "Section": "8 Key Vault", "Profile": "Level 2", "AssessmentStatus": "Manual", "Description": "Private endpoints will secure network traffic from Azure Key Vault to the resources requesting secrets and keys.", @@ -3032,7 +3032,7 @@ ], "Attributes": [ { - "Section": "8. Key Vault", + "Section": "8 Key Vault", "Profile": "Level 2", "AssessmentStatus": "Manual", "Description": "Automatic Key Rotation is available in Public Preview. The currently supported applications are Key Vault, Managed Disks, and Storage accounts accessing keys within Key Vault. The number of supported applications will incrementally increased.", @@ -3054,7 +3054,7 @@ ], "Attributes": [ { - "Section": "9. AppService", + "Section": "9 AppService", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "Azure App Service Authentication is a feature that can prevent anonymous HTTP requests from reaching a Web Application or authenticate those with tokens before they reach the app. If an anonymous request is received from a browser, App Service will redirect to a logon page. To handle the logon process, a choice from a set of identity providers can be made, or a custom authentication mechanism can be implemented.", @@ -3076,7 +3076,7 @@ ], "Attributes": [ { - "Section": "9. AppService", + "Section": "9 AppService", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Azure Web Apps allows sites to run under both HTTP and HTTPS by default. Web apps can be accessed by anyone using non-secure HTTP links by default. Non-secure HTTP requests can be restricted and all HTTP requests redirected to the secure HTTPS port. It is recommended to enforce HTTPS-only traffic.", @@ -3098,7 +3098,7 @@ ], "Attributes": [ { - "Section": "9. AppService", + "Section": "9 AppService", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "The TLS (Transport Layer Security) protocol secures transmission of data over the internet using standard encryption technology. Encryption should be set with the latest version of TLS. App service allows TLS 1.2 by default, which is the recommended TLS level by industry standards such as PCI DSS.", @@ -3120,7 +3120,7 @@ ], "Attributes": [ { - "Section": "9. AppService", + "Section": "9 AppService", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Managed service identity in App Service provides more security by eliminating secrets from the app, such as credentials in the connection strings. When registering an App Service with Entra ID, the app will connect to other Azure services securely without the need for usernames and passwords.", @@ -3142,7 +3142,7 @@ ], "Attributes": [ { - "Section": "9. AppService", + "Section": "9 AppService", "Profile": "Level 1", "AssessmentStatus": "Manual", "Description": "Periodically newer versions are released for PHP software either due to security flaws or to include additional functionality. Using the latest PHP version for web apps is recommended in order to take advantage of security fixes, if any, and/or additional functionalities of the newer version.", @@ -3164,7 +3164,7 @@ ], "Attributes": [ { - "Section": "9. AppService", + "Section": "9 AppService", "Profile": "Level 1", "AssessmentStatus": "Manual", "Description": "Periodically, newer versions are released for Python software either due to security flaws or to include additional functionality. Using the latest full Python version for web apps is recommended in order to take advantage of security fixes, if any, and/or additional functionalities of the newer version.", @@ -3186,7 +3186,7 @@ ], "Attributes": [ { - "Section": "9. AppService", + "Section": "9 AppService", "Profile": "Level 1", "AssessmentStatus": "Manual", "Description": "Periodically, newer versions are released for Java software either due to security flaws or to include additional functionality. Using the latest Java version for web apps is recommended in order to take advantage of security fixes, if any, and/or new functionalities of the newer version.", @@ -3208,7 +3208,7 @@ ], "Attributes": [ { - "Section": "9. AppService", + "Section": "9 AppService", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Periodically, newer versions are released for HTTP either due to security flaws or to include additional functionality. Using the latest HTTP version for web apps to take advantage of security fixes, if any, and/or new functionalities of the newer version.", @@ -3230,7 +3230,7 @@ ], "Attributes": [ { - "Section": "9. AppService", + "Section": "9 AppService", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "By default, Azure Functions, Web, and API Services can be deployed over FTP. If FTP is required for an essential deployment workflow, FTPS should be required for FTP login for all App Service Apps and Functions.", @@ -3250,7 +3250,7 @@ "Checks": [], "Attributes": [ { - "Section": "9. AppService", + "Section": "9 AppService", "Profile": "Level 2", "AssessmentStatus": "Manual", "Description": "Azure Key Vault will store multiple types of sensitive information such as encryption keys, certificate thumbprints, and Managed Identity Credentials. Access to these 'Secrets' can be controlled through granular permissions.", @@ -3270,7 +3270,7 @@ "Checks": [], "Attributes": [ { - "Section": "10. Miscellaneous", + "Section": "10 Miscellaneous", "Profile": "Level 2", "AssessmentStatus": "Manual", "Description": "Resource Manager Locks provide a way for administrators to lock down Azure resources to prevent deletion of, or modifications to, a resource. These locks sit outside of the Role Based Access Controls (RBAC) hierarchy and, when applied, will place restrictions on the resource for all users. These locks are very useful when there is an important resource in a subscription that users should not be able to delete or change. Locks can help prevent accidental and malicious changes or deletion.", diff --git a/prowler/compliance/azure/cis_3.0_azure.json b/prowler/compliance/azure/cis_3.0_azure.json index 4175dd2a7e..0ba6c77444 100644 --- a/prowler/compliance/azure/cis_3.0_azure.json +++ b/prowler/compliance/azure/cis_3.0_azure.json @@ -12,7 +12,7 @@ ], "Attributes": [ { - "Section": "2. Identity", + "Section": "2 Identity", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Require administrators or appropriately delegated users to create new tenants.", @@ -32,7 +32,7 @@ "Checks": [], "Attributes": [ { - "Section": "2. Identity", + "Section": "2 Identity", "Profile": "Level 1", "AssessmentStatus": "Manual", "Description": "Microsoft Entra ID has native and extended identity functionality allowing you to invite people from outside your organization to be guest users in your cloud account and sign in with their own work, school, or social identities.", @@ -52,7 +52,7 @@ "Checks": [], "Attributes": [ { - "Section": "2. Identity", + "Section": "2 Identity", "Profile": "Level 1", "AssessmentStatus": "Manual", "Description": "Ensures that two alternate forms of identification are provided before allowing a password reset.", @@ -72,7 +72,7 @@ "Checks": [], "Attributes": [ { - "Section": "2. Identity", + "Section": "2 Identity", "Profile": "Level 1", "AssessmentStatus": "Manual", "Description": "The account lockout threshold determines how many failed login attempts are permitted prior to placing the account in a locked-out state and initiating a variable lockout duration.", @@ -92,7 +92,7 @@ "Checks": [], "Attributes": [ { - "Section": "2. Identity", + "Section": "2 Identity", "Profile": "Level 1", "AssessmentStatus": "Manual", "Description": "The account lockout duration value determines how long an account retains the status of lockout, and therefore how long before a user can continue to attempt to login after passing the lockout threshold.", @@ -112,7 +112,7 @@ "Checks": [], "Attributes": [ { - "Section": "2. Identity", + "Section": "2 Identity", "Profile": "Level 1", "AssessmentStatus": "Manual", "Description": "Microsoft Azure provides a Global Banned Password policy that applies to Azure administrative and normal user accounts. This is not applied to user accounts that are synced from an on-premise Active Directory unless Microsoft Entra ID Connect is used and you enable EnforceCloudPasswordPolicyForPasswordSyncedUsers.Please see the list in default values on the specifics of this policy. To further password security, it is recommended to further define a custom banned password policy.", @@ -132,7 +132,7 @@ "Checks": [], "Attributes": [ { - "Section": "2. Identity", + "Section": "2 Identity", "Profile": "Level 1", "AssessmentStatus": "Manual", "Description": "Ensure that the number of days before users are asked to re-confirm their authentication information is not set to 0.", @@ -152,7 +152,7 @@ "Checks": [], "Attributes": [ { - "Section": "2. Identity", + "Section": "2 Identity", "Profile": "Level 1", "AssessmentStatus": "Manual", "Description": "Ensure that users are notified on their primary and alternate emails on password resets.", @@ -172,7 +172,7 @@ "Checks": [], "Attributes": [ { - "Section": "2. Identity", + "Section": "2 Identity", "Profile": "Level 1", "AssessmentStatus": "Manual", "Description": "Ensure that all Global Administrators are notified if any other administrator resets their password.", @@ -194,7 +194,7 @@ ], "Attributes": [ { - "Section": "2. Identity", + "Section": "2 Identity", "Profile": "Level 1", "AssessmentStatus": "Manual", "Description": "Require administrators to provide consent for applications before use.", @@ -216,7 +216,7 @@ ], "Attributes": [ { - "Section": "2. Identity", + "Section": "2 Identity", "Profile": "Level 2", "AssessmentStatus": "Manual", "Description": "Allow users to provide consent for selected permissions when a request is coming from a verified publisher.", @@ -238,7 +238,7 @@ ], "Attributes": [ { - "Section": "2. Identity", + "Section": "2 Identity", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Require administrators or appropriately delegated users to register third-party applications.", @@ -260,7 +260,7 @@ ], "Attributes": [ { - "Section": "2. Identity", + "Section": "2 Identity", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Limit guest user permissions.", @@ -282,7 +282,7 @@ ], "Attributes": [ { - "Section": "2. Identity", + "Section": "2 Identity", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "Restrict invitations to users with specific administrative roles only.", @@ -302,7 +302,7 @@ "Checks": [], "Attributes": [ { - "Section": "2. Identity", + "Section": "2 Identity", "Profile": "Level 1", "AssessmentStatus": "Manual", "Description": "Restrict access to the Microsoft Entra ID administration center to administrators only.**NOTE**: This only affects access to the Entra ID administrator's web portal. This setting does not prohibit privileged users from using other methods such as Rest API or Powershell to obtain sensitive information from Microsoft Entra ID.", @@ -322,7 +322,7 @@ "Checks": [], "Attributes": [ { - "Section": "2. Identity", + "Section": "2 Identity", "Profile": "Level 2", "AssessmentStatus": "Manual", "Description": "Restrict access to group web interface in the Access Panel portal.", @@ -344,7 +344,7 @@ ], "Attributes": [ { - "Section": "2. Identity", + "Section": "2 Identity", "Profile": "Level 2", "AssessmentStatus": "Manual", "Description": "Restrict security group creation to administrators only.", @@ -364,7 +364,7 @@ "Checks": [], "Attributes": [ { - "Section": "2. Identity", + "Section": "2 Identity", "Profile": "Level 2", "AssessmentStatus": "Manual", "Description": "Restrict security group management to administrators only.", @@ -386,7 +386,7 @@ ], "Attributes": [ { - "Section": "2. Identity", + "Section": "2 Identity", "Profile": "Level 2", "AssessmentStatus": "Manual", "Description": "Restrict Microsoft 365 group creation to administrators only.", @@ -406,7 +406,7 @@ "Checks": [], "Attributes": [ { - "Section": "2. Identity", + "Section": "2 Identity", "Profile": "Level 1", "AssessmentStatus": "Manual", "Description": "**NOTE:** This recommendation is only relevant if your subscription is using Per-User MFA. If your organization is licensed to use Conditional Access, the preferred method of requiring MFA to join devices to Entra ID is to use a Conditional Access policy (see additional information below for link).Joining or registering devices to Microsoft Entra ID should require multi-factor authentication.", @@ -428,7 +428,7 @@ ], "Attributes": [ { - "Section": "2. Identity", + "Section": "2 Identity", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "The principle of least privilege should be followed and only necessary privileges should be assigned instead of allowing full administrative access.", @@ -450,7 +450,7 @@ ], "Attributes": [ { - "Section": "2. Identity", + "Section": "2 Identity", "Profile": "Level 2", "AssessmentStatus": "Manual", "Description": "Resource locking is a powerful protection mechanism that can prevent inadvertent modification/deletion of resources within Azure subscriptions/Resource Groups and is a recommended NIST configuration.", @@ -470,7 +470,7 @@ "Checks": [], "Attributes": [ { - "Section": "2. Identity", + "Section": "2 Identity", "Profile": "Level 2", "AssessmentStatus": "Manual", "Description": "Users who are set as subscription owners are able to make administrative changes to the subscriptions and move them into and out of Microsoft Entra ID.", @@ -492,7 +492,7 @@ ], "Attributes": [ { - "Section": "2. Identity", + "Section": "2 Identity", "Profile": "Level 1", "AssessmentStatus": "Manual", "Description": "This recommendation aims to maintain a balance between security and operational efficiency by ensuring that a minimum of 2 and a maximum of 4 users are assigned the Global Administrator role in Microsoft Entra ID. Having at least two Global Administrators ensures redundancy, while limiting the number to four reduces the risk of excessive privileged access.", @@ -514,8 +514,8 @@ ], "Attributes": [ { - "Section": "2. Identity", - "SubSection": "2.1. Security Defaults (Per-User MFA)", + "Section": "2 Identity", + "SubSection": "2.1 Security Defaults (Per-User MFA)", "Profile": "Level 1", "AssessmentStatus": "Manual", "Description": "[**IMPORTANT - Please read the section overview:** If your organization pays for Microsoft Entra ID licensing (included in Microsoft 365 E3, E5, or F5, and EM&S E3 or E5 licenses) and **CAN** use Conditional Access, ignore the recommendations in this section and proceed to the Conditional Access section.]Security defaults in Microsoft Entra ID make it easier to be secure and help protect your organization. Security defaults contain preconfigured security settings for common attacks.Security defaults is available to everyone. The goal is to ensure that all organizations have a basic level of security enabled at no extra cost. You may turn on security defaults in the Azure portal.", @@ -537,8 +537,8 @@ ], "Attributes": [ { - "Section": "2. Identity", - "SubSection": "2.1. Security Defaults (Per-User MFA)", + "Section": "2 Identity", + "SubSection": "2.1 Security Defaults (Per-User MFA)", "Profile": "Level 1", "AssessmentStatus": "Manual", "Description": "[**IMPORTANT - Please read the section overview:** If your organization pays for Microsoft Entra ID licensing (included in Microsoft 365 E3, E5, or F5, and EM&S E3 or E5 licenses) and **CAN** use Conditional Access, ignore the recommendations in this section and proceed to the Conditional Access section.]Enable multi-factor authentication for all roles, groups, and users that have write access or permissions to Azure resources. These include custom created objects or built-in roles such as;- Service Co-Administrators- Subscription Owners- Contributors", @@ -560,8 +560,8 @@ ], "Attributes": [ { - "Section": "2. Identity", - "SubSection": "2.1. Security Defaults (Per-User MFA)", + "Section": "2 Identity", + "SubSection": "2.1 Security Defaults (Per-User MFA)", "Profile": "Level 2", "AssessmentStatus": "Manual", "Description": "[**IMPORTANT - Please read the section overview:** If your organization pays for Microsoft Entra ID licensing (included in Microsoft 365 E3, E5, or F5, and EM&S E3 or E5 licenses) and **CAN** use Conditional Access, ignore the recommendations in this section and proceed to the Conditional Access section.]Enable multi-factor authentication for all non-privileged users.", @@ -581,8 +581,8 @@ "Checks": [], "Attributes": [ { - "Section": "2. Identity", - "SubSection": "2.1. Security Defaults (Per-User MFA)", + "Section": "2 Identity", + "SubSection": "2.1 Security Defaults (Per-User MFA)", "Profile": "Level 1", "AssessmentStatus": "Manual", "Description": "[**IMPORTANT - Please read the section overview:** If your organization pays for Microsoft Entra ID licensing (included in Microsoft 365 E3, E5, or F5, and EM&S E3 or E5 licenses) and **CAN** use Conditional Access, ignore the recommendations in this section and proceed to the Conditional Access section.]Do not allow users to remember multi-factor authentication on devices.", @@ -604,8 +604,8 @@ ], "Attributes": [ { - "Section": "2. Identity", - "SubSection": "2.2. Conditional Access", + "Section": "2 Identity", + "SubSection": "2.2 Conditional Access", "Profile": "Level 2", "AssessmentStatus": "Manual", "Description": "Microsoft Entra ID Conditional Access allows an organization to configure `Named locations` and configure whether those locations are trusted or untrusted. These settings provide organizations the means to specify Geographical locations for use in conditional access policies, or define actual IP addresses and IP ranges and whether or not those IP addresses and/or ranges are trusted by the organization.", @@ -625,8 +625,8 @@ "Checks": [], "Attributes": [ { - "Section": "2. Identity", - "SubSection": "2.2. Conditional Access", + "Section": "2 Identity", + "SubSection": "2.2 Conditional Access", "Profile": "Level 2", "AssessmentStatus": "Manual", "Description": "**CAUTION**: If these policies are created without first auditing and testing the result, misconfiguration can potentially lock out administrators or create undesired access issues.Conditional Access Policies can be used to block access from geographic locations that are deemed out-of-scope for your organization or application. The scope and variables for this policy should be carefully examined and defined.", @@ -646,8 +646,8 @@ "Checks": [], "Attributes": [ { - "Section": "2. Identity", - "SubSection": "2.2. Conditional Access", + "Section": "2 Identity", + "SubSection": "2.2 Conditional Access", "Profile": "Level 2", "AssessmentStatus": "Manual", "Description": "Conditional Access Policies can be used to prevent the Device code authentication flow. Device code flow should be permitted only for users that regularly perform duties that explicitly require the use of Device Code to authenticate, such as utilizing Azure with PowerShell.", @@ -667,8 +667,8 @@ "Checks": [], "Attributes": [ { - "Section": "2. Identity", - "SubSection": "2.2. Conditional Access", + "Section": "2 Identity", + "SubSection": "2.2 Conditional Access", "Profile": "Level 2", "AssessmentStatus": "Manual", "Description": "For designated users, they will be prompted to use their multi-factor authentication (MFA) process on login.", @@ -688,8 +688,8 @@ "Checks": [], "Attributes": [ { - "Section": "2. Identity", - "SubSection": "2.2. Conditional Access", + "Section": "2 Identity", + "SubSection": "2.2 Conditional Access", "Profile": "Level 2", "AssessmentStatus": "Manual", "Description": "For designated users, they will be prompted to use their multi-factor authentication (MFA) process on logins.", @@ -709,8 +709,8 @@ "Checks": [], "Attributes": [ { - "Section": "2. Identity", - "SubSection": "2.2. Conditional Access", + "Section": "2 Identity", + "SubSection": "2.2 Conditional Access", "Profile": "Level 2", "AssessmentStatus": "Manual", "Description": "Entra ID tracks the behavior of sign-in events. If the Entra ID domain is licensed with P2, the sign-in behavior can be used as a detection mechanism for additional scrutiny during the sign-in event. If this policy is set up, then Risky Sign-in events will prompt users to use multi-factor authentication (MFA) tokens on login for additional verification.", @@ -732,8 +732,8 @@ ], "Attributes": [ { - "Section": "2. Identity", - "SubSection": "2.2. Conditional Access", + "Section": "2 Identity", + "SubSection": "2.2 Conditional Access", "Profile": "Level 2", "AssessmentStatus": "Manual", "Description": "This recommendation ensures that users accessing the Windows Azure Service Management API (i.e. Azure Powershell, Azure CLI, Azure Resource Manager API, etc.) are required to use multi-factor authentication (MFA) credentials when accessing resources through the Windows Azure Service Management API.", @@ -755,8 +755,8 @@ ], "Attributes": [ { - "Section": "2. Identity", - "SubSection": "2.2. Conditional Access", + "Section": "2 Identity", + "SubSection": "2.2 Conditional Access", "Profile": "Level 2", "AssessmentStatus": "Manual", "Description": "This recommendation ensures that users accessing Microsoft Admin Portals (i.e. Microsoft 365 Admin, Microsoft 365 Defender, Exchange Admin Center, Azure Portal, etc.) are required to use multi-factor authentication (MFA) credentials when logging into an Admin Portal.", @@ -778,8 +778,8 @@ ], "Attributes": [ { - "Section": "3. Security", - "SubSection": "3.1. Microsoft Defender For Cloud", + "Section": "3 Security", + "SubSection": "3.1 Microsoft Defender For Cloud", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Ensure that the latest OS patches for all virtual machines are applied.", @@ -801,8 +801,8 @@ ], "Attributes": [ { - "Section": "3. Security", - "SubSection": "3.1. Microsoft Defender For Cloud", + "Section": "3 Security", + "SubSection": "3.1 Microsoft Defender For Cloud", "Profile": "Level 1", "AssessmentStatus": "Manual", "Description": "The Microsoft Cloud Security Benchmark (or 'MCSB') is an Azure Policy Initiative containing many security policies to evaluate resource configuration against best practice recommendations. If a policy in the MCSB is set with effect type `Disabled`, it is not evaluated and may prevent administrators from being informed of valuable security recommendations.", @@ -824,8 +824,8 @@ ], "Attributes": [ { - "Section": "3. Security", - "SubSection": "3.1. Microsoft Defender For Cloud", + "Section": "3 Security", + "SubSection": "3.1 Microsoft Defender For Cloud", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Enable security alert emails to subscription owners.", @@ -847,8 +847,8 @@ ], "Attributes": [ { - "Section": "3. Security", - "SubSection": "3.1. Microsoft Defender For Cloud", + "Section": "3 Security", + "SubSection": "3.1 Microsoft Defender For Cloud", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Microsoft Defender for Cloud emails the subscription owners whenever a high-severity alert is triggered for their subscription. You should provide a security contact email address as an additional email address.", @@ -870,8 +870,8 @@ ], "Attributes": [ { - "Section": "3. Security", - "SubSection": "3.1. Microsoft Defender For Cloud", + "Section": "3 Security", + "SubSection": "3.1 Microsoft Defender For Cloud", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Enables emailing security alerts to the subscription owner or other designated security contact.", @@ -891,8 +891,8 @@ "Checks": [], "Attributes": [ { - "Section": "3. Security", - "SubSection": "3.1. Microsoft Defender For Cloud", + "Section": "3 Security", + "SubSection": "3.1 Microsoft Defender For Cloud", "Profile": "Level 2", "AssessmentStatus": "Manual", "Description": "An organization's attack surface is the collection of assets with a public network identifier or URI that an external threat actor can see or access from outside your cloud. It is the set of points on the boundary of a system, a system element, system component, or an environment where an attacker can try to enter, cause an effect on, or extract data from, that system, system element, system component, or environment. The larger the attack surface, the harder it is to protect.This tool can be configured to scan your organization's online infrastructure such as specified domains, hosts, CIDR blocks, and SSL certificates, and store them in an Inventory. Inventory items can be added, reviewed, approved, and removed, and may contain enrichments ('insights') and additional information collected from the tool's different scan engines and open-source intelligence sources.A Defender EASM workspace will generate an Inventory of publicly exposed assets by crawling and scanning the internet using _Seeds_ you provide when setting up the tool. Seeds can be FQDNs, IP CIDR blocks, and WHOIS records.Defender EASM will generate Insights within 24-48 hours after Seeds are provided, and these insights include vulnerability data (CVEs), ports and protocols, and weak or expired SSL certificates that could be used by an attacker for reconnaisance or exploitation.Results are classified High/Medium/Low and some of them include proposed mitigations.", @@ -914,8 +914,8 @@ ], "Attributes": [ { - "Section": "3. Security", - "SubSection": "3.1. Microsoft Defender For Cloud", + "Section": "3 Security", + "SubSection": "3.1 Microsoft Defender For Cloud", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "[**NOTE:** As of August 1, 2023 customers with an existing subscription to Defender for DNS can continue to use the service, but new subscribers will receive alerts about suspicious DNS activity as part of Defender for Servers P2.]Microsoft Defender for DNS scans all network traffic exiting from within a subscription.", @@ -937,8 +937,8 @@ ], "Attributes": [ { - "Section": "3. Security", - "SubSection": "3.1.1 Microsoft Cloud Security Posture Management (CSPM)", + "Section": "3 Security", + "SubSection": "3.1 Microsoft Defender For Cloud", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Enable automatic provisioning of the monitoring agent to collect security data.**DEPRECATION PLANNED:** The Log Analytics Agent is slated for deprecation in August 2024. The Microsoft Defender for Endpoint agent, in tandem with new agentless capabilities will be providing replacement functionality. More detail is available here: [https://techcommunity.microsoft.com/t5/microsoft-defender-for-cloud/microsoft-defender-for-cloud-strategy-and-plan-towards-log/ba-p/3883341](https://techcommunity.microsoft.com/t5/microsoft-defender-for-cloud/microsoft-defender-for-cloud-strategy-and-plan-towards-log/ba-p/3883341).", @@ -960,8 +960,8 @@ ], "Attributes": [ { - "Section": "3. Security", - "SubSection": "3.1.1 Microsoft Cloud Security Posture Management (CSPM)", + "Section": "3 Security", + "SubSection": "3.1 Microsoft Defender For Cloud", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "This integration setting enables Microsoft Defender for Cloud Apps (formerly 'Microsoft Cloud App Security' or 'MCAS' - see additional info) to communicate with Microsoft Defender for Cloud.", @@ -983,8 +983,8 @@ ], "Attributes": [ { - "Section": "3. Security", - "SubSection": "3.1.3. Defender Plan: Servers", + "Section": "3 Security", + "SubSection": "3.1 Microsoft Defender For Cloud", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "Turning on Microsoft Defender for Servers enables threat detection for Servers, providing threat intelligence, anomaly detection, and behavior analytics in the Microsoft Defender for Cloud.", @@ -1006,8 +1006,8 @@ ], "Attributes": [ { - "Section": "3. Security", - "SubSection": "3.1.3. Defender Plan: Servers", + "Section": "3 Security", + "SubSection": "3.1 Microsoft Defender For Cloud", "Profile": "Level 2", "AssessmentStatus": "Manual", "Description": "Enable vulnerability assessment for machines on both Azure and hybrid (Arc enabled) machines.", @@ -1027,8 +1027,8 @@ "Checks": [], "Attributes": [ { - "Section": "3. Security", - "SubSection": "3.1.3. Defender Plan: Servers", + "Section": "3 Security", + "SubSection": "3.1 Microsoft Defender For Cloud", "Profile": "Level 2", "AssessmentStatus": "Manual", "Description": "The Endpoint protection component enables Microsoft Defender for Endpoint (formerly 'Advanced Threat Protection' or 'ATP' or 'WDATP' - see additional info) to communicate with Microsoft Defender for Cloud.**IMPORTANT:** When enabling integration between DfE & DfC it needs to be taken into account that this will have some side effects that may be undesirable.1. For server 2019 & above if defender is installed (default for these server SKUs) this will trigger a deployment of the new unified agent and link to any of the extended configuration in the Defender portal.1. If the new unified agent is required for server SKUs of Win 2016 or Linux and lower there is additional integration that needs to be switched on and agents need to be aligned.", @@ -1048,8 +1048,8 @@ "Checks": [], "Attributes": [ { - "Section": "3. Security", - "SubSection": "3.1.3. Defender Plan: Servers", + "Section": "3 Security", + "SubSection": "3.1 Microsoft Defender For Cloud", "Profile": "Level 2", "AssessmentStatus": "Manual", "Description": "Using disk snapshots, the agentless scanner scans for installed software, vulnerabilities, and plain text secrets.", @@ -1069,8 +1069,8 @@ "Checks": [], "Attributes": [ { - "Section": "3. Security", - "SubSection": "3.1.3. Defender Plan: Servers", + "Section": "3 Security", + "SubSection": "3.1 Microsoft Defender For Cloud", "Profile": "Level 2", "AssessmentStatus": "Manual", "Description": "File Integrity Monitoring (FIM) is a feature that monitors critical system files in Windows or Linux for potential signs of attack or compromise.", @@ -1092,8 +1092,8 @@ ], "Attributes": [ { - "Section": "3. Security", - "SubSection": "3.1.4. Defender Plan: Containers", + "Section": "3 Security", + "SubSection": "3.1 Microsoft Defender For Cloud", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "Turning on Microsoft Defender for Containers enables threat detection for Container Registries including Kubernetes, providing threat intelligence, anomaly detection, and behavior analytics in the Microsoft Defender for Cloud. The following services will be enabled for container instances:- Defender agent in Azure- Azure Policy for Kubernetes- Agentless discovery for Kubernetes- Agentless container vulnerability assessment", @@ -1113,8 +1113,8 @@ "Checks": [], "Attributes": [ { - "Section": "3. Security", - "SubSection": "3.1.4. Defender Plan: Containers", + "Section": "3 Security", + "SubSection": "3.1 Microsoft Defender For Cloud", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "Enable automatic discovery and configuration scanning of the Microsoft Kubernetes clusters.", @@ -1134,8 +1134,8 @@ "Checks": [], "Attributes": [ { - "Section": "3. Security", - "SubSection": "3.1.4. Defender Plan: Containers", + "Section": "3 Security", + "SubSection": "3.1 Microsoft Defender For Cloud", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "Enable automatic vulnerability management for images stored in ACR or running in AKS clusters.", @@ -1157,8 +1157,8 @@ ], "Attributes": [ { - "Section": "3. Security", - "SubSection": "3.1.5. Defender Plan: Storage", + "Section": "3 Security", + "SubSection": "3.1 Microsoft Defender For Cloud", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "Turning on Microsoft Defender for Storage enables threat detection for Storage, providing threat intelligence, anomaly detection, and behavior analytics in the Microsoft Defender for Cloud.", @@ -1180,8 +1180,8 @@ ], "Attributes": [ { - "Section": "3. Security", - "SubSection": "3.1.6. Defender Plan: App Service", + "Section": "3 Security", + "SubSection": "3.1 Microsoft Defender For Cloud", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "Turning on Microsoft Defender for App Service enables threat detection for App Service, providing threat intelligence, anomaly detection, and behavior analytics in the Microsoft Defender for Cloud.", @@ -1203,8 +1203,8 @@ ], "Attributes": [ { - "Section": "3. Security", - "SubSection": "3.1.7. Defender Plan: Databases", + "Section": "3 Security", + "SubSection": "3.1 Microsoft Defender For Cloud", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "Microsoft Defender for Azure Cosmos DB scans all incoming network requests for threats to your Azure Cosmos DB resources.", @@ -1226,8 +1226,8 @@ ], "Attributes": [ { - "Section": "3. Security", - "SubSection": "3.1.7. Defender Plan: Databases", + "Section": "3 Security", + "SubSection": "3.1 Microsoft Defender For Cloud", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "Turning on Microsoft Defender for Open-source relational databases enables threat detection for Open-source relational databases, providing threat intelligence, anomaly detection, and behavior analytics in the Microsoft Defender for Cloud.", @@ -1249,8 +1249,8 @@ ], "Attributes": [ { - "Section": "3. Security", - "SubSection": "3.1.7. Defender Plan: Databases", + "Section": "3 Security", + "SubSection": "3.1 Microsoft Defender For Cloud", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "Turning on Microsoft Defender for Azure SQL Databases enables threat detection for Managed Instance Azure SQL databases, providing threat intelligence, anomaly detection, and behavior analytics in Microsoft Defender for Cloud.", @@ -1272,8 +1272,8 @@ ], "Attributes": [ { - "Section": "3. Security", - "SubSection": "3.1.7. Defender Plan: Databases", + "Section": "3 Security", + "SubSection": "3.1 Microsoft Defender For Cloud", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "Turning on Microsoft Defender for SQL servers on machines enables threat detection for SQL servers on machines, providing threat intelligence, anomaly detection, and behavior analytics in Microsoft Defender for Cloud.", @@ -1295,8 +1295,8 @@ ], "Attributes": [ { - "Section": "3. Security", - "SubSection": "3.1.8. Defender Plan: Key Vault", + "Section": "3 Security", + "SubSection": "3.1 Microsoft Defender For Cloud", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "Turning on Microsoft Defender for Key Vault enables threat detection for Key Vault, providing threat intelligence, anomaly detection, and behavior analytics in the Microsoft Defender for Cloud.", @@ -1318,8 +1318,8 @@ ], "Attributes": [ { - "Section": "3. Security", - "SubSection": "3.1.9. Defender Plan: Resource Manager", + "Section": "3 Security", + "SubSection": "3.1 Microsoft Defender For Cloud", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "Microsoft Defender for Resource Manager scans incoming administrative requests to change your infrastructure from both CLI and the Azure portal.", @@ -1341,8 +1341,8 @@ ], "Attributes": [ { - "Section": "3. Security", - "SubSection": "3.2. Microsoft Defender for IoT", + "Section": "3 Security", + "SubSection": "3.2 Microsoft Defender for IoT", "Profile": "Level 2", "AssessmentStatus": "Manual", "Description": "Microsoft Defender for IoT acts as a central security hub for IoT devices within your organization.", @@ -1364,8 +1364,8 @@ ], "Attributes": [ { - "Section": "3. Security", - "SubSection": "3.3. Key Vault", + "Section": "3 Security", + "SubSection": "3.3 Key Vault", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Ensure that all Keys in Role Based Access Control (RBAC) Azure Key Vaults have an expiration date set.", @@ -1387,8 +1387,8 @@ ], "Attributes": [ { - "Section": "3. Security", - "SubSection": "3.3. Key Vault", + "Section": "3 Security", + "SubSection": "3.3 Key Vault", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Ensure that all Keys in Non Role Based Access Control (RBAC) Azure Key Vaults have an expiration date set.", @@ -1410,8 +1410,8 @@ ], "Attributes": [ { - "Section": "3. Security", - "SubSection": "3.3. Key Vault", + "Section": "3 Security", + "SubSection": "3.3 Key Vault", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Ensure that all Secrets in Role Based Access Control (RBAC) Azure Key Vaults have an expiration date set.", @@ -1433,8 +1433,8 @@ ], "Attributes": [ { - "Section": "3. Security", - "SubSection": "3.3. Key Vault", + "Section": "3 Security", + "SubSection": "3.3 Key Vault", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Ensure that all Secrets in Non Role Based Access Control (RBAC) Azure Key Vaults have an expiration date set.", @@ -1456,8 +1456,8 @@ ], "Attributes": [ { - "Section": "3. Security", - "SubSection": "3.3. Key Vault", + "Section": "3 Security", + "SubSection": "3.3 Key Vault", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "The Key Vault contains object keys, secrets, and certificates. Accidental unavailability of a Key Vault can cause immediate data loss or loss of security functions (authentication, validation, verification, non-repudiation, etc.) supported by the Key Vault objects.It is recommended the Key Vault be made recoverable by enabling the 'Do Not Purge' and 'Soft Delete' functions. This is in order to prevent loss of encrypted data, including storage accounts, SQL databases, and/or dependent services provided by Key Vault objects (Keys, Secrets, Certificates) etc. This may happen in the case of accidental deletion by a user or from disruptive activity by a malicious user.**NOTE:** In February 2025, Microsoft will enable soft-delete protection on all key vaults, and users will no longer be able to opt out of or turn off soft-delete. **WARNING:** A current limitation is that role assignments disappearing when Key Vault is deleted. All role assignments will need to be recreated after recovery.", @@ -1479,8 +1479,8 @@ ], "Attributes": [ { - "Section": "3. Security", - "SubSection": "3.3. Key Vault", + "Section": "3 Security", + "SubSection": "3.3 Key Vault", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "The recommended way to access Key Vaults is to use the Azure Role-Based Access Control (RBAC) permissions model.Azure RBAC is an authorization system built on Azure Resource Manager that provides fine-grained access management of Azure resources. It allows users to manage Key, Secret, and Certificate permissions. It provides one place to manage all permissions across all key vaults.", @@ -1502,8 +1502,8 @@ ], "Attributes": [ { - "Section": "3. Security", - "SubSection": "3.3. Key Vault", + "Section": "3 Security", + "SubSection": "3.3 Key Vault", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "Private endpoints will secure network traffic from Azure Key Vault to the resources requesting secrets and keys.", @@ -1525,8 +1525,8 @@ ], "Attributes": [ { - "Section": "3. Security", - "SubSection": "3.3. Key Vault", + "Section": "3 Security", + "SubSection": "3.3 Key Vault", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "Automatic Key Rotation is available in Public Preview. The currently supported applications are Key Vault, Managed Disks, and Storage accounts accessing keys within Key Vault. The number of supported applications will incrementally increased.", @@ -1548,7 +1548,7 @@ ], "Attributes": [ { - "Section": "4. Storage Accounts", + "Section": "4 Storage Accounts", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Enable data encryption in transit.", @@ -1568,7 +1568,7 @@ "Checks": [], "Attributes": [ { - "Section": "4. Storage Accounts", + "Section": "4 Storage Accounts", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "Enabling encryption at the hardware level on top of the default software encryption for Storage Accounts accessing Azure storage solutions.", @@ -1590,7 +1590,7 @@ ], "Attributes": [ { - "Section": "4. Storage Accounts", + "Section": "4 Storage Accounts", "Profile": "Level 1", "AssessmentStatus": "Manual", "Description": "Access Keys authenticate application access requests to data contained in Storage Accounts. A periodic rotation of these keys is recommended to ensure that potentially compromised keys cannot result in a long-term exploitable credential. The 'Rotation Reminder' is an automatic reminder feature for a manual procedure.", @@ -1612,7 +1612,7 @@ ], "Attributes": [ { - "Section": "4. Storage Accounts", + "Section": "4 Storage Accounts", "Profile": "Level 1", "AssessmentStatus": "Manual", "Description": "For increased security, regenerate storage account access keys periodically.", @@ -1632,7 +1632,7 @@ "Checks": [], "Attributes": [ { - "Section": "4. Storage Accounts", + "Section": "4 Storage Accounts", "Profile": "Level 1", "AssessmentStatus": "Manual", "Description": "Expire shared access signature tokens within an hour.", @@ -1654,7 +1654,7 @@ ], "Attributes": [ { - "Section": "4. Storage Accounts", + "Section": "4 Storage Accounts", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Disallowing public network access for a storage account overrides the public access settings for individual containers in that storage account for Azure Resource Manager Deployment Model storage accounts. Azure Storage accounts that use the classic deployment model will be retired on August 31, 2024.", @@ -1676,7 +1676,7 @@ ], "Attributes": [ { - "Section": "4. Storage Accounts", + "Section": "4 Storage Accounts", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Restricting default network access helps to provide a new layer of security, since storage accounts accept connections from clients on any network. To limit access to selected networks, the default action must be changed.", @@ -1698,7 +1698,7 @@ ], "Attributes": [ { - "Section": "4. Storage Accounts", + "Section": "4 Storage Accounts", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "_NOTE:_ This recommendation assumes that the `Public network access` parameter is set to `Enabled from selected virtual networks and IP addresses`. Please ensure the prerequisite recommendation has been implemented before proceeding: - Ensure Default Network Access Rule for Storage Accounts is Set to DenySome Azure services that interact with storage accounts operate from networks that can't be granted access through network rules. To help this type of service work as intended, allow the set of trusted Azure services to bypass the network rules. These services will then use strong authentication to access the storage account. If the `Allow Azure services on the trusted services list to access this storage account` exception is enabled, the following services are granted access to the storage account: Azure Backup, Azure Data Box, Azure DevTest Labs, Azure Event Grid, Azure Event Hubs, Azure File Sync, Azure HDInsight, Azure Import/Export, Azure Monitor, Azure Networking Services, and Azure Site Recovery (when registered in the subscription).", @@ -1720,7 +1720,7 @@ ], "Attributes": [ { - "Section": "4. Storage Accounts", + "Section": "4 Storage Accounts", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "Use private endpoints for your Azure Storage accounts to allow clients and services to securely access data located over a network via an encrypted Private Link. To do this, the private endpoint uses an IP address from the VNet for each service. Network traffic between disparate services securely traverses encrypted over the VNet. This VNet can also link addressing space, extending your network and accessing resources on it. Similarly, it can be a tunnel through public networks to connect remote infrastructures together. This creates further security through segmenting network traffic and preventing outside sources from accessing it.", @@ -1742,7 +1742,7 @@ ], "Attributes": [ { - "Section": "4. Storage Accounts", + "Section": "4 Storage Accounts", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "The Azure Storage blobs contain data like ePHI or Financial, which can be secret or personal. Data that is erroneously modified or deleted by an application or other storage account user will cause data loss or unavailability.It is recommended that both Azure Containers with attached Blob Storage and standalone containers with Blob Storage be made recoverable by enabling the **soft delete** configuration. This is to save and recover data when blobs or blob snapshots are deleted.", @@ -1764,7 +1764,7 @@ ], "Attributes": [ { - "Section": "4. Storage Accounts", + "Section": "4 Storage Accounts", "Profile": "Level 2", "AssessmentStatus": "Manual", "Description": "Enable sensitive data encryption at rest using Customer Managed Keys (CMK) rather than Microsoft Managed keys.", @@ -1784,7 +1784,7 @@ "Checks": [], "Attributes": [ { - "Section": "4. Storage Accounts", + "Section": "4 Storage Accounts", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "The Storage Queue service stores messages that may be read by any client who has access to the storage account. A queue can contain an unlimited number of messages, each of which can be up to 64KB in size using version 2011-08-18 or newer. Storage Logging happens server-side and allows details for both successful and failed requests to be recorded in the storage account. These logs allow users to see the details of read, write, and delete operations against the queues. Storage Logging log entries contain the following information about individual requests: Timing information such as start time, end-to-end latency, and server latency, authentication details, concurrency information, and the sizes of the request and response messages.", @@ -1804,7 +1804,7 @@ "Checks": [], "Attributes": [ { - "Section": "4. Storage Accounts", + "Section": "4 Storage Accounts", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "The Storage Blob service provides scalable, cost-efficient object storage in the cloud. Storage Logging happens server-side and allows details for both successful and failed requests to be recorded in the storage account. These logs allow users to see the details of read, write, and delete operations against the blobs. Storage Logging log entries contain the following information about individual requests: timing information such as start time, end-to-end latency, and server latency; authentication details; concurrency information; and the sizes of the request and response messages.", @@ -1824,7 +1824,7 @@ "Checks": [], "Attributes": [ { - "Section": "4. Storage Accounts", + "Section": "4 Storage Accounts", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "Azure Table storage is a service that stores structured NoSQL data in the cloud, providing a key/attribute store with a schema-less design. Storage Logging happens server-side and allows details for both successful and failed requests to be recorded in the storage account. These logs allow users to see the details of read, write, and delete operations against the tables. Storage Logging log entries contain the following information about individual requests: timing information such as start time, end-to-end latency, and server latency; authentication details; concurrency information; and the sizes of the request and response messages.", @@ -1846,7 +1846,7 @@ ], "Attributes": [ { - "Section": "4. Storage Accounts", + "Section": "4 Storage Accounts", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "In some cases, Azure Storage sets the minimum TLS version to be version 1.0 by default. TLS 1.0 is a legacy version and has known vulnerabilities. This minimum TLS version can be configured to be later protocols such as TLS 1.2.", @@ -1866,7 +1866,7 @@ "Checks": [], "Attributes": [ { - "Section": "4. Storage Accounts", + "Section": "4 Storage Accounts", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Cross Tenant Replication in Azure allows data to be replicated across multiple Azure tenants. While this feature can be beneficial for data sharing and availability, it also poses a significant security risk if not properly managed. Unauthorized data access, data leakage, and compliance violations are potential risks. Disabling Cross Tenant Replication ensures that data is not inadvertently replicated across different tenant boundaries without explicit authorization.", @@ -1886,7 +1886,7 @@ "Checks": [], "Attributes": [ { - "Section": "4. Storage Accounts", + "Section": "4 Storage Accounts", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "The Azure Storage setting ‘Allow Blob Anonymous Access’ (aka 'allowBlobPublicAccess') controls whether anonymous access is allowed for blob data in a storage account. When this property is set to True, it enables public read access to blob data, which can be convenient for sharing data but may carry security risks. When set to False, it disallows public access to blob data, providing a more secure storage environment.", @@ -1908,8 +1908,8 @@ ], "Attributes": [ { - "Section": "5. Database Services", - "SubSection": "5.1. Azure SQL Database", + "Section": "5 Database Services", + "SubSection": "5.1 Azure SQL Database", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Enable auditing on SQL Servers.", @@ -1931,8 +1931,8 @@ ], "Attributes": [ { - "Section": "5. Database Services", - "SubSection": "5.1. Azure SQL Database", + "Section": "5 Database Services", + "SubSection": "5.1 Azure SQL Database", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Ensure that no SQL Databases allow ingress from 0.0.0.0/0 (ANY IP).", @@ -1954,8 +1954,8 @@ ], "Attributes": [ { - "Section": "5. Database Services", - "SubSection": "5.1. Azure SQL Database", + "Section": "5 Database Services", + "SubSection": "5.1 Azure SQL Database", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "Transparent Data Encryption (TDE) with Customer-managed key support provides increased transparency and control over the TDE Protector, increased security with an HSM-backed external service, and promotion of separation of duties.With TDE, data is encrypted at rest with a symmetric key (called the database encryption key) stored in the database or data warehouse distribution. To protect this data encryption key (DEK) in the past, only a certificate that the Azure SQL Service managed could be used. Now, with Customer-managed key support for TDE, the DEK can be protected with an asymmetric key that is stored in the Azure Key Vault. The Azure Key Vault is a highly available and scalable cloud-based key store which offers central key management, leverages FIPS 140-2 Level 2 validated hardware security modules (HSMs), and allows separation of management of keys and data for additional security.Based on business needs or criticality of data/databases hosted on a SQL server, it is recommended that the TDE protector is encrypted by a key that is managed by the data owner (Customer-managed key).", @@ -1977,8 +1977,8 @@ ], "Attributes": [ { - "Section": "5. Database Services", - "SubSection": "5.1. Azure SQL Database", + "Section": "5 Database Services", + "SubSection": "5.1 Azure SQL Database", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Use Microsoft Entra authentication for authentication with SQL Database to manage credentials in a single place.", @@ -2000,8 +2000,8 @@ ], "Attributes": [ { - "Section": "5. Database Services", - "SubSection": "5.1. Azure SQL Database", + "Section": "5 Database Services", + "SubSection": "5.1 Azure SQL Database", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Enable Transparent Data Encryption on every SQL server.", @@ -2023,8 +2023,8 @@ ], "Attributes": [ { - "Section": "5. Database Services", - "SubSection": "5.1. Azure SQL Database", + "Section": "5 Database Services", + "SubSection": "5.1 Azure SQL Database", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "SQL Server Audit Retention should be configured to be greater than 90 days.", @@ -2044,8 +2044,8 @@ "Checks": [], "Attributes": [ { - "Section": "5. Database Services", - "SubSection": "5.1. Azure SQL Database", + "Section": "5 Database Services", + "SubSection": "5.1 Azure SQL Database", "Profile": "Level 1", "AssessmentStatus": "Manual", "Description": "Disabling public network access restricts the service from accessing public networks.", @@ -2067,8 +2067,8 @@ ], "Attributes": [ { - "Section": "5. Database Services", - "SubSection": "5.2. Azure SQL Database for PostgreSQL", + "Section": "5 Database Services", + "SubSection": "5.2 Azure SQL Database for PostgreSQL", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Enable `require_secure_transport` on `PostgreSQL flexible servers`.", @@ -2090,8 +2090,8 @@ ], "Attributes": [ { - "Section": "5. Database Services", - "SubSection": "5.2. Azure SQL Database for PostgreSQL", + "Section": "5 Database Services", + "SubSection": "5.2 Azure SQL Database for PostgreSQL", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Enable `log_checkpoints` on `PostgreSQL flexible servers`.", @@ -2113,8 +2113,8 @@ ], "Attributes": [ { - "Section": "5. Database Services", - "SubSection": "5.2. Azure SQL Database for PostgreSQL", + "Section": "5 Database Services", + "SubSection": "5.2 Azure SQL Database for PostgreSQL", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Enable connection throttling on `PostgreSQL flexible servers`.", @@ -2136,8 +2136,8 @@ ], "Attributes": [ { - "Section": "5. Database Services", - "SubSection": "5.2. Azure SQL Database for PostgreSQL", + "Section": "5 Database Services", + "SubSection": "5.2 Azure SQL Database for PostgreSQL", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Ensure `logfiles.retention_days` on `PostgreSQL flexible servers` is set to an appropriate value.", @@ -2159,8 +2159,8 @@ ], "Attributes": [ { - "Section": "5. Database Services", - "SubSection": "5.2. Azure SQL Database for PostgreSQL", + "Section": "5 Database Services", + "SubSection": "5.2 Azure SQL Database for PostgreSQL", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Disable access from Azure services to `PostgreSQL flexible server`.", @@ -2182,8 +2182,8 @@ ], "Attributes": [ { - "Section": "5. Database Services", - "SubSection": "5.2. Azure SQL Database for PostgreSQL", + "Section": "5 Database Services", + "SubSection": "5.2 Azure SQL Database for PostgreSQL", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Enable `log_connections` on `PostgreSQL single servers`.**NOTE:** This recommendation currently only applies to Single Server, not Flexible Server. See additional information below for details about the planned retirement of Azure PostgreSQL Single Server.", @@ -2205,8 +2205,8 @@ ], "Attributes": [ { - "Section": "5. Database Services", - "SubSection": "5.2. Azure SQL Database for PostgreSQL", + "Section": "5 Database Services", + "SubSection": "5.2 Azure SQL Database for PostgreSQL", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Enable `log_disconnections` on `PostgreSQL Servers`.**NOTE:** This recommendation currently only applies to Single Server, not Flexible Server. See additional information below for details about the planned retirement of Azure PostgreSQL Single Server.", @@ -2226,8 +2226,8 @@ "Checks": [], "Attributes": [ { - "Section": "5. Database Services", - "SubSection": "5.2. Azure SQL Database for PostgreSQL", + "Section": "5 Database Services", + "SubSection": "5.2 Azure SQL Database for PostgreSQL", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Azure Database for PostgreSQL servers should be created with 'infrastructure double encryption' enabled.**NOTE:** This recommendation currently only applies to Single Server, not Flexible Server. See additional information below for details about the planned retirement of Azure PostgreSQL Single Server.", @@ -2249,8 +2249,8 @@ ], "Attributes": [ { - "Section": "5. Database Services", - "SubSection": "5.3. Azure for MySQL", + "Section": "5 Database Services", + "SubSection": "5.3 Azure for MySQL", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Enable `require_secure_transport` on `MySQL flexible servers`.", @@ -2270,8 +2270,8 @@ "Checks": [], "Attributes": [ { - "Section": "5. Database Services", - "SubSection": "5.3. Azure for MySQL", + "Section": "5 Database Services", + "SubSection": "5.3 Azure for MySQL", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Ensure `tls_version` on `MySQL flexible servers` is set to use TLS version 1.2 or higher.", @@ -2293,8 +2293,8 @@ ], "Attributes": [ { - "Section": "5. Database Services", - "SubSection": "5.3. Azure for MySQL", + "Section": "5 Database Services", + "SubSection": "5.3 Azure for MySQL", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "Enable `audit_log_enabled` on `MySQL flexible servers`.", @@ -2316,8 +2316,8 @@ ], "Attributes": [ { - "Section": "5. Database Services", - "SubSection": "5.3. Azure for MySQL", + "Section": "5 Database Services", + "SubSection": "5.3 Azure for MySQL", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "Set `audit_log_events` to include `CONNECTION` on `MySQL flexible servers`.", @@ -2339,8 +2339,8 @@ ], "Attributes": [ { - "Section": "5. Database Services", - "SubSection": "5.4. Azure Cosmos DB", + "Section": "5 Database Services", + "SubSection": "5.4 Azure Cosmos DB", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "Limiting your Cosmos DB to only communicate on whitelisted networks lowers its attack footprint.", @@ -2362,8 +2362,8 @@ ], "Attributes": [ { - "Section": "5. Database Services", - "SubSection": "5.4. Azure Cosmos DB", + "Section": "5 Database Services", + "SubSection": "5.4 Azure Cosmos DB", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "Private endpoints limit network traffic to approved sources.", @@ -2385,8 +2385,8 @@ ], "Attributes": [ { - "Section": "5. Database Services", - "SubSection": "5.4. Azure Cosmos DB", + "Section": "5 Database Services", + "SubSection": "5.4 Azure Cosmos DB", "Profile": "Level 1", "AssessmentStatus": "Manual", "Description": "Cosmos DB can use tokens or Entra ID for client authentication which in turn will use Azure RBAC for authorization. Using Entra ID is significantly more secure because Entra ID handles the credentials and allows for MFA and centralized management, and the Azure RBAC is better integrated with the rest of Azure.", @@ -2406,7 +2406,7 @@ "Checks": [], "Attributes": [ { - "Section": "6. Logging and Monitoring", + "Section": "6 Logging and Monitoring", "Profile": "Level 1", "AssessmentStatus": "Manual", "Description": "Resource Logs capture activity to the data access plane while the Activity log is a subscription-level log for the control plane. Resource-level diagnostic logs provide insight into operations that were performed within that resource itself; for example, reading or updating a secret from a Key Vault. Currently, 95 Azure resources support Azure Monitoring (See the more information section for a complete list), including Network Security Groups, Load Balancers, Key Vault, AD, Logic Apps, and CosmosDB. The content of these logs varies by resource type.A number of back-end services were not configured to log and store Resource Logs for certain activities or for a sufficient length. It is crucial that monitoring is correctly configured to log all relevant activities and retain those logs for a sufficient length of time. Given that the mean time to detection in an enterprise is 240 days, a minimum retention period of two years is recommended.", @@ -2426,7 +2426,7 @@ "Checks": [], "Attributes": [ { - "Section": "6. Logging and Monitoring", + "Section": "6 Logging and Monitoring", "Profile": "Level 2", "AssessmentStatus": "Manual", "Description": "The use of Basic or Free SKUs in Azure whilst cost effective have significant limitations in terms of what can be monitored and what support can be realized from Microsoft. Typically, these SKU’s do not have a service SLA and Microsoft may refuse to provide support for them. Consequently Basic/Free SKUs should never be used for production workloads.", @@ -2448,8 +2448,8 @@ ], "Attributes": [ { - "Section": "6. Logging and Monitoring", - "SubSection": "6.1. Configuring Diagnostic Settings", + "Section": "6 Logging and Monitoring", + "SubSection": "6.1 Configuring Diagnostic Settings", "Profile": "Level 1", "AssessmentStatus": "Manual", "Description": "Enable Diagnostic settings for exporting activity logs.Diagnostic settings are available for each individual resource within a subscription. Settings should be configured for all appropriate resources for your environment.", @@ -2471,8 +2471,8 @@ ], "Attributes": [ { - "Section": "6. Logging and Monitoring", - "SubSection": "6.1. Configuring Diagnostic Settings", + "Section": "6 Logging and Monitoring", + "SubSection": "6.1 Configuring Diagnostic Settings", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "**Prerequisite**: A Diagnostic Setting must exist. If a Diagnostic Setting does not exist, the navigation and options within this recommendation will not be available. Please review the recommendation at the beginning of this subsection titled: 'Ensure that a 'Diagnostic Setting' exists.'The diagnostic setting should be configured to log the appropriate activities from the control/management plane.", @@ -2494,8 +2494,8 @@ ], "Attributes": [ { - "Section": "6. Logging and Monitoring", - "SubSection": "6.1. Configuring Diagnostic Settings", + "Section": "6 Logging and Monitoring", + "SubSection": "6.1 Configuring Diagnostic Settings", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "Storage accounts with the activity log exports can be configured to use Customer Managed Keys (CMK).", @@ -2517,8 +2517,8 @@ ], "Attributes": [ { - "Section": "6. Logging and Monitoring", - "SubSection": "6.1. Configuring Diagnostic Settings", + "Section": "6 Logging and Monitoring", + "SubSection": "6.1 Configuring Diagnostic Settings", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Enable AuditEvent logging for key vault instances to ensure interactions with key vaults are logged and available.", @@ -2540,8 +2540,8 @@ ], "Attributes": [ { - "Section": "6. Logging and Monitoring", - "SubSection": "6.1. Configuring Diagnostic Settings", + "Section": "6 Logging and Monitoring", + "SubSection": "6.1 Configuring Diagnostic Settings", "Profile": "Level 2", "AssessmentStatus": "Manual", "Description": "Ensure that network flow logs are captured and fed into a central log analytics workspace.", @@ -2563,8 +2563,8 @@ ], "Attributes": [ { - "Section": "6. Logging and Monitoring", - "SubSection": "6.1. Configuring Diagnostic Settings", + "Section": "6 Logging and Monitoring", + "SubSection": "6.1 Configuring Diagnostic Settings", "Profile": "Level 2", "AssessmentStatus": "Manual", "Description": "Enable AppServiceHTTPLogs diagnostic log category for Azure App Service instances to ensure all http requests are captured and centrally logged.", @@ -2586,8 +2586,8 @@ ], "Attributes": [ { - "Section": "6. Logging and Monitoring", - "SubSection": "6.2. Monitoring using Activity Log Alerts", + "Section": "6 Logging and Monitoring", + "SubSection": "6.2 Monitoring using Activity Log Alerts", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Create an activity log alert for the Create Policy Assignment event.", @@ -2609,8 +2609,8 @@ ], "Attributes": [ { - "Section": "6. Logging and Monitoring", - "SubSection": "6.2. Monitoring using Activity Log Alerts", + "Section": "6 Logging and Monitoring", + "SubSection": "6.2 Monitoring using Activity Log Alerts", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Create an activity log alert for the Delete Policy Assignment event.", @@ -2632,8 +2632,8 @@ ], "Attributes": [ { - "Section": "6. Logging and Monitoring", - "SubSection": "6.2. Monitoring using Activity Log Alerts", + "Section": "6 Logging and Monitoring", + "SubSection": "6.2 Monitoring using Activity Log Alerts", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Create an Activity Log Alert for the Create or Update Network Security Group event.", @@ -2655,8 +2655,8 @@ ], "Attributes": [ { - "Section": "6. Logging and Monitoring", - "SubSection": "6.2. Monitoring using Activity Log Alerts", + "Section": "6 Logging and Monitoring", + "SubSection": "6.2 Monitoring using Activity Log Alerts", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Create an activity log alert for the Delete Network Security Group event.", @@ -2678,8 +2678,8 @@ ], "Attributes": [ { - "Section": "6. Logging and Monitoring", - "SubSection": "6.2. Monitoring using Activity Log Alerts", + "Section": "6 Logging and Monitoring", + "SubSection": "6.2 Monitoring using Activity Log Alerts", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Create an activity log alert for the Create or Update Security Solution event.", @@ -2701,8 +2701,8 @@ ], "Attributes": [ { - "Section": "6. Logging and Monitoring", - "SubSection": "6.2. Monitoring using Activity Log Alerts", + "Section": "6 Logging and Monitoring", + "SubSection": "6.2 Monitoring using Activity Log Alerts", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Create an activity log alert for the Delete Security Solution event.", @@ -2724,8 +2724,8 @@ ], "Attributes": [ { - "Section": "6. Logging and Monitoring", - "SubSection": "6.2. Monitoring using Activity Log Alerts", + "Section": "6 Logging and Monitoring", + "SubSection": "6.2 Monitoring using Activity Log Alerts", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Create an activity log alert for the Create or Update SQL Server Firewall Rule event.", @@ -2747,8 +2747,8 @@ ], "Attributes": [ { - "Section": "6. Logging and Monitoring", - "SubSection": "6.2. Monitoring using Activity Log Alerts", + "Section": "6 Logging and Monitoring", + "SubSection": "6.2 Monitoring using Activity Log Alerts", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Create an activity log alert for the 'Delete SQL Server Firewall Rule.", @@ -2770,8 +2770,8 @@ ], "Attributes": [ { - "Section": "6. Logging and Monitoring", - "SubSection": "6.2. Monitoring using Activity Log Alerts", + "Section": "6 Logging and Monitoring", + "SubSection": "6.2 Monitoring using Activity Log Alerts", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Create an activity log alert for the Create or Update Public IP Addresses rule.", @@ -2793,8 +2793,8 @@ ], "Attributes": [ { - "Section": "6. Logging and Monitoring", - "SubSection": "6.2. Monitoring using Activity Log Alerts", + "Section": "6 Logging and Monitoring", + "SubSection": "6.2 Monitoring using Activity Log Alerts", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Create an activity log alert for the Delete Public IP Address rule.", @@ -2816,7 +2816,7 @@ ], "Attributes": [ { - "Section": "6. Logging and Monitoring", + "Section": "6 Logging and Monitoring", "SubSection": "6.3. Configuring Application Insights", "Profile": "Level 2", "AssessmentStatus": "Automated", @@ -2839,7 +2839,7 @@ ], "Attributes": [ { - "Section": "7. Networking", + "Section": "7 Networking", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Network security groups should be periodically evaluated for port misconfigurations. Where certain ports and protocols may be exposed to the Internet, they should be evaluated for necessity and restricted wherever they are not explicitly required.", @@ -2861,7 +2861,7 @@ ], "Attributes": [ { - "Section": "7. Networking", + "Section": "7 Networking", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Network security groups should be periodically evaluated for port misconfigurations. Where certain ports and protocols may be exposed to the Internet, they should be evaluated for necessity and restricted wherever they are not explicitly required.", @@ -2883,7 +2883,7 @@ ], "Attributes": [ { - "Section": "7. Networking", + "Section": "7 Networking", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Network security groups should be periodically evaluated for port misconfigurations. Where certain ports and protocols may be exposed to the Internet, they should be evaluated for necessity and restricted wherever they are not explicitly required.", @@ -2905,7 +2905,7 @@ ], "Attributes": [ { - "Section": "7. Networking", + "Section": "7 Networking", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Network security groups should be periodically evaluated for port misconfigurations. Where certain ports and protocols may be exposed to the Internet, they should be evaluated for necessity and restricted wherever they are not explicitly required and narrowly configured.", @@ -2927,7 +2927,7 @@ ], "Attributes": [ { - "Section": "7. Networking", + "Section": "7 Networking", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "Network Security Group Flow Logs should be enabled and the retention period set to greater than or equal to 90 days.", @@ -2949,7 +2949,7 @@ ], "Attributes": [ { - "Section": "7. Networking", + "Section": "7 Networking", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "Enable Network Watcher for physical regions in Azure subscriptions.", @@ -2969,7 +2969,7 @@ "Checks": [], "Attributes": [ { - "Section": "7. Networking", + "Section": "7 Networking", "Profile": "Level 1", "AssessmentStatus": "Manual", "Description": "Public IP Addresses provide tenant accounts with Internet connectivity for resources contained within the tenant. During the creation of certain resources in Azure, a Public IP Address may be created. All Public IP Addresses within the tenant should be periodically reviewed for accuracy and necessity.", @@ -2991,7 +2991,7 @@ ], "Attributes": [ { - "Section": "8. Virtual Machines", + "Section": "8 Virtual Machines", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "The Azure Bastion service allows secure remote access to Azure Virtual Machines over the Internet without exposing remote access protocol ports and services directly to the Internet. The Azure Bastion service provides this access using TLS over 443/TCP, and subscribes to hardened configurations within an organization's Azure Active Directory service.", @@ -3013,7 +3013,7 @@ ], "Attributes": [ { - "Section": "8. Virtual Machines", + "Section": "8 Virtual Machines", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Migrate blob-based VHDs to Managed Disks on Virtual Machines to exploit the default features of this configuration.The features include: 1) Default Disk Encryption2) Resilience, as Microsoft will managed the disk storage and move around if underlying hardware goes faulty3) Reduction of costs over storage accounts", @@ -3035,7 +3035,7 @@ ], "Attributes": [ { - "Section": "8. Virtual Machines", + "Section": "8 Virtual Machines", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "Ensure that OS disks (boot volumes) and data disks (non-boot volumes) are encrypted with CMK (Customer Managed Keys).Customer Managed keys can be either ADE or Server Side Encryption (SSE).", @@ -3057,7 +3057,7 @@ ], "Attributes": [ { - "Section": "8. Virtual Machines", + "Section": "8 Virtual Machines", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "Ensure that unattached disks in a subscription are encrypted with a Customer Managed Key (CMK).", @@ -3077,7 +3077,7 @@ "Checks": [], "Attributes": [ { - "Section": "8. Virtual Machines", + "Section": "8 Virtual Machines", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Virtual Machine Disks and snapshots can be configured to allow access from different network resources.", @@ -3097,7 +3097,7 @@ "Checks": [], "Attributes": [ { - "Section": "8. Virtual Machines", + "Section": "8 Virtual Machines", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Data Access Authentication Mode provides a method of uploading or exporting Virtual Machine Disks.", @@ -3117,7 +3117,7 @@ "Checks": [], "Attributes": [ { - "Section": "8. Virtual Machines", + "Section": "8 Virtual Machines", "Profile": "Level 1", "AssessmentStatus": "Manual", "Description": "For added security, only install organization-approved extensions on VMs.", @@ -3139,7 +3139,7 @@ ], "Attributes": [ { - "Section": "8. Virtual Machines", + "Section": "8 Virtual Machines", "Profile": "Level 2", "AssessmentStatus": "Manual", "Description": "Install endpoint protection for all virtual machines.", @@ -3159,7 +3159,7 @@ "Checks": [], "Attributes": [ { - "Section": "8. Virtual Machines", + "Section": "8 Virtual Machines", "Profile": "Level 2", "AssessmentStatus": "Manual", "Description": "**NOTE: This is a legacy recommendation. Managed Disks are encrypted by default and recommended for all new VM implementations.**VHD (Virtual Hard Disks) are stored in blob storage and are the old-style disks that were attached to Virtual Machines. The blob VHD was then leased to the VM. By default, storage accounts are not encrypted, and Microsoft Defender will then recommend that the OS disks should be encrypted. Storage accounts can be encrypted as a whole using PMK or CMK. This should be turned on for storage accounts containing VHDs.", @@ -3181,7 +3181,7 @@ ], "Attributes": [ { - "Section": "8. Virtual Machines", + "Section": "8 Virtual Machines", "Profile": "Level 2", "AssessmentStatus": "Manual", "Description": "Verify identities without MFA that can log in to a privileged virtual machine using separate login credentials. An adversary can leverage the access to move laterally and perform actions with the virtual machine's managed identity. Make sure the virtual machine only has necessary permissions, and revoke the admin-level permissions according to the least privileges principal", @@ -3203,7 +3203,7 @@ ], "Attributes": [ { - "Section": "8. Virtual Machines", + "Section": "8 Virtual Machines", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "When **Secure Boot** and **vTPM** are enabled together, they provide a strong foundation for protecting your VM from boot attacks. For example, if an attacker attempts to replace the bootloader with a malicious version, Secure Boot will prevent the VM from booting. If the attacker is able to bypass Secure Boot and install a malicious bootloader, vTPM can be used to detect the intrusion and alert you.", @@ -3225,7 +3225,7 @@ ], "Attributes": [ { - "Section": "9. AppService", + "Section": "9 AppService", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Azure App Service allows apps to run under both HTTP and HTTPS by default. Apps can be accessed by anyone using non-secure HTTP links by default. Non-secure HTTP requests can be restricted and all HTTP requests redirected to the secure HTTPS port. It is recommended to enforce HTTPS-only traffic.", @@ -3247,7 +3247,7 @@ ], "Attributes": [ { - "Section": "9. AppService", + "Section": "9 AppService", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "Azure App Service Authentication is a feature that can prevent anonymous HTTP requests from reaching a Web Application or authenticate those with tokens before they reach the app. If an anonymous request is received from a browser, App Service will redirect to a logon page. To handle the logon process, a choice from a set of identity providers can be made, or a custom authentication mechanism can be implemented.", @@ -3269,7 +3269,7 @@ ], "Attributes": [ { - "Section": "9. AppService", + "Section": "9 AppService", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "By default, App Services can be deployed over FTP. If FTP is required for an essential deployment workflow, FTPS should be required for FTP login for all App Services.If FTPS is not expressly required for the App, the recommended setting is `Disabled.`", @@ -3291,7 +3291,7 @@ ], "Attributes": [ { - "Section": "9. AppService", + "Section": "9 AppService", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "The TLS (Transport Layer Security) protocol secures transmission of data over the internet using standard encryption technology. Encryption should be set with the latest version of TLS. App service allows TLS 1.2 by default, which is the recommended TLS level by industry standards such as PCI DSS.", @@ -3313,7 +3313,7 @@ ], "Attributes": [ { - "Section": "9. AppService", + "Section": "9 AppService", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Managed service identity in App Service provides more security by eliminating secrets from the app, such as credentials in the connection strings. When registering an App Service with Entra ID, the app will connect to other Azure services securely without the need for usernames and passwords.", @@ -3333,7 +3333,7 @@ "Checks": [], "Attributes": [ { - "Section": "9. AppService", + "Section": "9 AppService", "Profile": "Level 1", "AssessmentStatus": "Manual", "Description": "Basic Authentication provides the ability to create identities and authentication for an App Service without a centralized Identity Provider. For a more effective, capable, and secure solution for Identity, Authentication, Authorization, and Accountability, a centralized Identity Provider such as Entra ID is strongly advised.", @@ -3355,7 +3355,7 @@ ], "Attributes": [ { - "Section": "9. AppService", + "Section": "9 AppService", "Profile": "Level 1", "AssessmentStatus": "Manual", "Description": "Periodically, older versions of PHP may be deprecated and no longer supported. Using a supported version of PHP for app services is recommended to avoid potential unpatched vulnerabilities.", @@ -3377,7 +3377,7 @@ ], "Attributes": [ { - "Section": "9. AppService", + "Section": "9 AppService", "Profile": "Level 1", "AssessmentStatus": "Manual", "Description": "Periodically, older versions of Python may be deprecated and no longer supported. Using a supported version of Python for app services is recommended to avoid potential unpatched vulnerabilities.", @@ -3399,7 +3399,7 @@ ], "Attributes": [ { - "Section": "9. AppService", + "Section": "9 AppService", "Profile": "Level 1", "AssessmentStatus": "Manual", "Description": "Periodically, older versions of Java may be deprecated and no longer supported. Using a supported version of Java for app services is recommended to avoid potential unpatched vulnerabilities.", @@ -3421,7 +3421,7 @@ ], "Attributes": [ { - "Section": "9. AppService", + "Section": "9 AppService", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Periodically, newer versions are released for HTTP either due to security flaws or to include additional functionality. Using the latest HTTP version for apps to take advantage of security fixes, if any, and/or new functionalities of the newer version.", @@ -3441,7 +3441,7 @@ "Checks": [], "Attributes": [ { - "Section": "9. AppService", + "Section": "9 AppService", "Profile": "Level 2", "AssessmentStatus": "Manual", "Description": "Azure Key Vault will store multiple types of sensitive information such as encryption keys, certificate thumbprints, and Managed Identity Credentials. Access to these 'Secrets' can be controlled through granular permissions.", @@ -3461,7 +3461,7 @@ "Checks": [], "Attributes": [ { - "Section": "9. AppService", + "Section": "9 AppService", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Remote Debugging allows Azure App Service to be debugged in real-time directly on the Azure environment. When remote debugging is enabled, it opens a communication channel that could potentially be exploited by unauthorized users if not properly secured.", @@ -3481,7 +3481,7 @@ "Checks": [], "Attributes": [ { - "Section": "10. Miscellaneous", + "Section": "10 Miscellaneous", "Profile": "Level 2", "AssessmentStatus": "Manual", "Description": "Resource Manager Locks provide a way for administrators to lock down Azure resources to prevent deletion of, or modifications to, a resource. These locks sit outside of the Role Based Access Controls (RBAC) hierarchy and, when applied, will place restrictions on the resource for all users. These locks are very useful when there is an important resource in a subscription that users should not be able to delete or change. Locks can help prevent accidental and malicious changes or deletion.", diff --git a/prowler/compliance/gcp/cis_2.0_gcp.json b/prowler/compliance/gcp/cis_2.0_gcp.json index abc6238a09..6ef4d575e4 100644 --- a/prowler/compliance/gcp/cis_2.0_gcp.json +++ b/prowler/compliance/gcp/cis_2.0_gcp.json @@ -10,7 +10,7 @@ "Checks": [], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 1", "AssessmentStatus": "Manual", "Description": "Use corporate login credentials instead of personal accounts, such as Gmail accounts.", @@ -29,7 +29,7 @@ "Checks": [], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 1", "AssessmentStatus": "Manual", "Description": "Setup multi-factor authentication for Google Cloud Platform accounts.", @@ -48,7 +48,7 @@ "Checks": [], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 2", "AssessmentStatus": "Manual", "Description": "Setup Security Key Enforcement for Google Cloud Platform admin accounts.", @@ -69,7 +69,7 @@ ], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "API Keys should only be used for services in cases where other authentication methods are unavailable. API keys are always at risk because they can be viewed publicly, such as from within a browser, or they can be accessed on a device where the key resides. It is recommended to restrict API keys to use (call) only APIs required by an application.", @@ -90,7 +90,7 @@ ], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "API Keys should only be used for services in cases where other authentication methods are unavailable. If they are in use it is recommended to rotate API keys every 90 days.", @@ -111,7 +111,7 @@ ], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "API Keys should only be used for services in cases where other authentication methods are unavailable. Unused keys with their permissions in tact may still exist within a project. Keys are insecure because they can be viewed publicly, such as from within a browser, or they can be accessed on a device where the key resides. It is recommended to use standard authentication flow instead.", @@ -132,7 +132,7 @@ ], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "It is recommended that Essential Contacts is configured to designate email addresses for Google Cloud services to notify of important technical or security information.", @@ -153,7 +153,7 @@ ], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Google Cloud Key Management Service stores cryptographic keys in a hierarchical structure designed for useful and elegant access control management. The format for the rotation schedule depends on the client library that is used. For the gcloud command-line tool, the next rotation time must be in `ISO` or `RFC3339` format, and the rotation period must be in the form `INTEGERUNIT`, where units can be one of seconds (s), minutes (m), hours (h) or days (d).", @@ -174,7 +174,7 @@ ], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "It is recommended that the IAM policy on Cloud KMS `cryptokeys` should restrict anonymous and/or public access.", @@ -195,7 +195,7 @@ ], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "When you use Dataproc, cluster and job data is stored on Persistent Disks (PDs) associated with the Compute Engine VMs in your cluster and in a Cloud Storage staging bucket. This PD and bucket data is encrypted using a Google-generated data encryption key (DEK) and key encryption key (KEK). The CMEK feature allows you to create, use, and revoke the key encryption key (KEK). Google still controls the data encryption key (DEK).", @@ -216,7 +216,7 @@ ], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "It is recommended to assign the `Service Account User (iam.serviceAccountUser)` and `Service Account Token Creator (iam.serviceAccountTokenCreator)` roles to a user for a specific service account rather than assigning the role to a user at project level.", @@ -237,7 +237,7 @@ ], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "It is recommended that the principle of 'Separation of Duties' is enforced while assigning KMS related roles to users.", @@ -256,7 +256,7 @@ "Checks": [], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 2", "AssessmentStatus": "Manual", "Description": "API Keys should only be used for services in cases where other authentication methods are unavailable. In this case, unrestricted keys are insecure because they can be viewed publicly, such as from within a browser, or they can be accessed on a device where the key resides. It is recommended to restrict API key usage to trusted hosts, HTTP referrers and apps. It is recommended to use the more secure standard authentication flow instead.", @@ -277,7 +277,7 @@ ], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "It is recommended that the principle of 'Separation of Duties' is enforced while assigning service-account related roles to users.", @@ -298,7 +298,7 @@ ], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "A service account is a special Google account that belongs to an application or a VM, instead of to an individual end-user. The application uses the service account to call the service's Google API so that users aren't directly involved. It's recommended not to use admin access for ServiceAccount.", @@ -319,7 +319,7 @@ ], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "User managed service accounts should not have user-managed keys.", @@ -340,7 +340,7 @@ ], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Service Account keys consist of a key ID (Private_key_Id) and Private key, which are used to sign programmatic requests users make to Google cloud services accessible to that particular service account. It is recommended that all Service Account keys are regularly rotated.", @@ -359,7 +359,7 @@ "Checks": [], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 1", "AssessmentStatus": "Manual", "Description": "Google Cloud Functions allow you to host serverless code that is executed when an event is triggered, without the requiring the management a host operating system. These functions can also store environment variables to be used by the code that may contain authentication or other information that needs to remain confidential.", @@ -380,7 +380,7 @@ ], "Attributes": [ { - "Section": "2. Logging and Monitoring", + "Section": "2 Logging and Monitoring", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "GCP Access Approval enables you to require your organizations' explicit approval whenever Google support try to access your projects. You can then select users within your organization who can approve these requests through giving them a security role in IAM. All access requests display which Google Employee requested them in an email or Pub/Sub message that you can choose to Approve. This adds an additional control and logging of who in your organization approved/denied these requests.", @@ -401,7 +401,7 @@ ], "Attributes": [ { - "Section": "2. Logging and Monitoring", + "Section": "2 Logging and Monitoring", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "GCP Cloud Asset Inventory is services that provides a historical view of GCP resources and IAM policies through a time-series database. The information recorded includes metadata on Google Cloud resources, metadata on policies set on Google Cloud projects or resources, and runtime information gathered within a Google Cloud resource.", @@ -422,7 +422,7 @@ ], "Attributes": [ { - "Section": "2. Logging and Monitoring", + "Section": "2 Logging and Monitoring", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "In order to prevent unnecessary project ownership assignments to users/service-accounts and further misuses of projects and resources, all `roles/Owner` assignments should be monitored. Members (users/Service-Accounts) with a role assignment to primitive role `roles/Owner` are project owners. The project owner has all the privileges on the project the role belongs to. These are summarized below: - All viewer permissions on all GCP Services within the project - Permissions for actions that modify the state of all GCP services within the project - Manage roles and permissions for a project and all resources within the project - Set up billing for a project Granting the owner role to a member (user/Service-Account) will allow that member to modify the Identity and Access Management (IAM) policy. Therefore, grant the owner role only if the member has a legitimate purpose to manage the IAM policy. This is because the project IAM policy contains sensitive access control data. Having a minimal set of users allowed to manage IAM policy will simplify any auditing that may be necessary.", @@ -443,7 +443,7 @@ ], "Attributes": [ { - "Section": "2. Logging and Monitoring", + "Section": "2 Logging and Monitoring", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "Logging enabled on a HTTPS Load Balancer will show all network traffic and its destination.", @@ -464,7 +464,7 @@ ], "Attributes": [ { - "Section": "2. Logging and Monitoring", + "Section": "2 Logging and Monitoring", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "It is recommended that Cloud Audit Logging is configured to track all admin activities and read, write access to user data.", @@ -485,7 +485,7 @@ ], "Attributes": [ { - "Section": "2. Logging and Monitoring", + "Section": "2 Logging and Monitoring", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Cloud DNS logging records the queries from the name servers within your VPC to Stackdriver. Logged queries can come from Compute Engine VMs, GKE containers, or other GCP resources provisioned within the VPC.", @@ -506,7 +506,7 @@ ], "Attributes": [ { - "Section": "2. Logging and Monitoring", + "Section": "2 Logging and Monitoring", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "Enabling retention policies on log buckets will protect logs stored in cloud storage buckets from being overwritten or accidentally deleted. It is recommended to set up retention policies and configure Bucket Lock on all storage buckets that are used as log sinks.", @@ -527,7 +527,7 @@ ], "Attributes": [ { - "Section": "2. Logging and Monitoring", + "Section": "2 Logging and Monitoring", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "It is recommended to create a sink that will export copies of all the log entries. This can help aggregate logs from multiple projects and export them to a Security Information and Event Management (SIEM).", @@ -548,7 +548,7 @@ ], "Attributes": [ { - "Section": "2. Logging and Monitoring", + "Section": "2 Logging and Monitoring", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Google Cloud Platform (GCP) services write audit log entries to the Admin Activity and Data Access logs to help answer the questions of, \"who did what, where, and when?\" within GCP projects. Cloud audit logging records information includes the identity of the API caller, the time of the API call, the source IP address of the API caller, the request parameters, and the response elements returned by GCP services. Cloud audit logging provides a history of GCP API calls for an account, including API calls made via the console, SDKs, command-line tools, and other GCP services.", @@ -569,7 +569,7 @@ ], "Attributes": [ { - "Section": "2. Logging and Monitoring", + "Section": "2 Logging and Monitoring", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "It is recommended that a metric filter and alarm be established for Cloud Storage Bucket IAM changes.", @@ -590,7 +590,7 @@ ], "Attributes": [ { - "Section": "2. Logging and Monitoring", + "Section": "2 Logging and Monitoring", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "It is recommended that a metric filter and alarm be established for changes to Identity and Access Management (IAM) role creation, deletion and updating activities.", @@ -611,7 +611,7 @@ ], "Attributes": [ { - "Section": "2. Logging and Monitoring", + "Section": "2 Logging and Monitoring", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "It is recommended that a metric filter and alarm be established for SQL instance configuration changes.", @@ -632,7 +632,7 @@ ], "Attributes": [ { - "Section": "2. Logging and Monitoring", + "Section": "2 Logging and Monitoring", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "It is recommended that a metric filter and alarm be established for Virtual Private Cloud (VPC) network changes.", @@ -651,7 +651,7 @@ "Checks": [], "Attributes": [ { - "Section": "2. Logging and Monitoring", + "Section": "2 Logging and Monitoring", "Profile": "Level 2", "AssessmentStatus": "Manual", "Description": "GCP Access Transparency provides audit logs for all actions that Google personnel take in your Google Cloud resources.", @@ -672,7 +672,7 @@ ], "Attributes": [ { - "Section": "2. Logging and Monitoring", + "Section": "2 Logging and Monitoring", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "It is recommended that a metric filter and alarm be established for Virtual Private Cloud (VPC) Network Firewall rule changes.", @@ -693,7 +693,7 @@ ], "Attributes": [ { - "Section": "2. Logging and Monitoring", + "Section": "2 Logging and Monitoring", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "It is recommended that a metric filter and alarm be established for Virtual Private Cloud (VPC) network route changes.", @@ -714,7 +714,7 @@ ], "Attributes": [ { - "Section": "3. Networking", + "Section": "3 Networking", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "In order to prevent use of legacy networks, a project should not have a legacy network configured. As of now, Legacy Networks are gradually being phased out, and you can no longer create projects with them. This recommendation is to check older projects to ensure that they are not using Legacy Networks.", @@ -735,7 +735,7 @@ ], "Attributes": [ { - "Section": "3. Networking", + "Section": "3 Networking", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Cloud Domain Name System (DNS) is a fast, reliable and cost-effective domain name system that powers millions of domains on the internet. Domain Name System Security Extensions (DNSSEC) in Cloud DNS enables domain owners to take easy steps to protect their domains against DNS hijacking and man-in-the-middle and other attacks.", @@ -756,7 +756,7 @@ ], "Attributes": [ { - "Section": "3. Networking", + "Section": "3 Networking", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "GCP `Firewall Rules` are specific to a `VPC Network`. Each rule either `allows` or `denies` traffic when its conditions are met. Its conditions allow users to specify the type of traffic, such as ports and protocols, and the source or destination of the traffic, including IP addresses, subnets, and instances. Firewall rules are defined at the VPC network level and are specific to the network in which they are defined. The rules themselves cannot be shared among networks. Firewall rules only support IPv4 traffic. When specifying a source for an ingress rule or a destination for an egress rule by address, an `IPv4` address or `IPv4 block in CIDR` notation can be used. Generic `(0.0.0.0/0)` incoming traffic from the Internet to a VPC or VM instance using `RDP` on `Port 3389` can be avoided.", @@ -777,7 +777,7 @@ ], "Attributes": [ { - "Section": "3. Networking", + "Section": "3 Networking", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "NOTE: Currently, the SHA1 algorithm has been removed from general use by Google, and, if being used, needs to be whitelisted on a project basis by Google and will also, therefore, require a Google Cloud support contract. DNSSEC algorithm numbers in this registry may be used in CERT RRs. Zone signing (DNSSEC) and transaction security mechanisms (SIG(0) and TSIG) make use of particular subsets of these algorithms. The algorithm used for key signing should be a recommended one and it should be strong.", @@ -798,7 +798,7 @@ ], "Attributes": [ { - "Section": "3. Networking", + "Section": "3 Networking", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "NOTE: Currently, the SHA1 algorithm has been removed from general use by Google, and, if being used, needs to be whitelisted on a project basis by Google and will also, therefore, require a Google Cloud support contract. DNSSEC algorithm numbers in this registry may be used in CERT RRs. Zone signing (DNSSEC) and transaction security mechanisms (SIG(0) and TSIG) make use of particular subsets of these algorithms. The algorithm used for key signing should be a recommended one and it should be strong.", @@ -819,7 +819,7 @@ ], "Attributes": [ { - "Section": "3. Networking", + "Section": "3 Networking", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "GCP `Firewall Rules` are specific to a `VPC Network`. Each rule either `allows` or `denies` traffic when its conditions are met. Its conditions allow the user to specify the type of traffic, such as ports and protocols, and the source or destination of the traffic, including IP addresses, subnets, and instances. Firewall rules are defined at the VPC network level and are specific to the network in which they are defined. The rules themselves cannot be shared among networks. Firewall rules only support IPv4 traffic. When specifying a source for an ingress rule or a destination for an egress rule by address, only an `IPv4` address or `IPv4 block in CIDR` notation can be used. Generic `(0.0.0.0/0)` incoming traffic from the internet to VPC or VM instance using `SSH` on `Port 22` can be avoided.", @@ -840,7 +840,7 @@ ], "Attributes": [ { - "Section": "3. Networking", + "Section": "3 Networking", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "To prevent use of `default` network, a project should not have a `default` network.", @@ -861,7 +861,7 @@ ], "Attributes": [ { - "Section": "3. Networking", + "Section": "3 Networking", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "Flow Logs is a feature that enables users to capture information about the IP traffic going to and from network interfaces in the organization's VPC Subnets. Once a flow log is created, the user can view and retrieve its data in Stackdriver Logging. It is recommended that Flow Logs be enabled for every business-critical VPC subnet.", @@ -880,7 +880,7 @@ "Checks": [], "Attributes": [ { - "Section": "3. Networking", + "Section": "3 Networking", "Profile": "Level 1", "AssessmentStatus": "Manual", "Description": "Secure Sockets Layer (SSL) policies determine what port Transport Layer Security (TLS) features clients are permitted to use when connecting to load balancers. To prevent usage of insecure features, SSL policies should use (a) at least TLS 1.2 with the MODERN profile; or (b) the RESTRICTED profile, because it effectively requires clients to use TLS 1.2 regardless of the chosen minimum TLS version; or (3) a CUSTOM profile that does not support any of the following features: ``` TLS_RSA_WITH_AES_128_GCM_SHA256 TLS_RSA_WITH_AES_256_GCM_SHA384 TLS_RSA_WITH_AES_128_CBC_SHA TLS_RSA_WITH_AES_256_CBC_SHA TLS_RSA_WITH_3DES_EDE_CBC_SHA ```", @@ -899,7 +899,7 @@ "Checks": [], "Attributes": [ { - "Section": "3. Networking", + "Section": "3 Networking", "Profile": "Level 2", "AssessmentStatus": "Manual", "Description": "IAP authenticates the user requests to your apps via a Google single sign in. You can then manage these users with permissions to control access. It is recommended to use both IAP permissions and firewalls to restrict this access to your apps with sensitive information.", @@ -920,7 +920,7 @@ ], "Attributes": [ { - "Section": "4. Virtual Machines", + "Section": "4 Virtual Machines", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Interacting with a serial port is often referred to as the serial console, which is similar to using a terminal window, in that input and output is entirely in text mode and there is no graphical interface or mouse support. If you enable the interactive serial console on an instance, clients can attempt to connect to that instance from any IP address. Therefore interactive serial console support should be disabled.", @@ -941,7 +941,7 @@ ], "Attributes": [ { - "Section": "4. Virtual Machines", + "Section": "4 Virtual Machines", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "It is recommended to use Instance specific SSH key(s) instead of using common/shared project-wide SSH key(s) to access Instances.", @@ -962,7 +962,7 @@ ], "Attributes": [ { - "Section": "4. Virtual Machines", + "Section": "4 Virtual Machines", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "To defend against advanced threats and ensure that the boot loader and firmware on your VMs are signed and untampered, it is recommended that Compute instances are launched with Shielded VM enabled.", @@ -983,7 +983,7 @@ ], "Attributes": [ { - "Section": "4. Virtual Machines", + "Section": "4 Virtual Machines", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Enabling OS login binds SSH certificates to IAM users and facilitates effective SSH certificate management.", @@ -1004,7 +1004,7 @@ ], "Attributes": [ { - "Section": "4. Virtual Machines", + "Section": "4 Virtual Machines", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "Compute instances should not be configured to have external IP addresses.", @@ -1025,7 +1025,7 @@ ], "Attributes": [ { - "Section": "4. Virtual Machines", + "Section": "4 Virtual Machines", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "Google Cloud encrypts data at-rest and in-transit, but customer data must be decrypted for processing. Confidential Computing is a breakthrough technology which encrypts data in-use—while it is being processed. Confidential Computing environments keep data encrypted in memory and elsewhere outside the central processing unit (CPU). Confidential VMs leverage the Secure Encrypted Virtualization (SEV) feature of AMD EPYC™ CPUs. Customer data will stay encrypted while it is used, indexed, queried, or trained on. Encryption keys are generated in hardware, per VM, and not exportable. Thanks to built-in hardware optimizations of both performance and security, there is no significant performance penalty to Confidential Computing workloads.", @@ -1046,7 +1046,7 @@ ], "Attributes": [ { - "Section": "4. Virtual Machines", + "Section": "4 Virtual Machines", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "It is recommended to configure your instance to not use the default Compute Engine service account because it has the Editor role on the project.", @@ -1067,7 +1067,7 @@ ], "Attributes": [ { - "Section": "4. Virtual Machines", + "Section": "4 Virtual Machines", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "To support principle of least privileges and prevent potential privilege escalation it is recommended that instances are not assigned to default service account `Compute Engine default service account` with Scope `Allow full access to all Cloud APIs`.", @@ -1088,7 +1088,7 @@ ], "Attributes": [ { - "Section": "4. Virtual Machines", + "Section": "4 Virtual Machines", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Compute Engine instance cannot forward a packet unless the source IP address of the packet matches the IP address of the instance. Similarly, GCP won't deliver a packet whose destination IP address is different than the IP address of the instance receiving the packet. However, both capabilities are required if you want to use instances to help route packets. Forwarding of data packets should be disabled to prevent data loss or information disclosure.", @@ -1107,7 +1107,7 @@ "Checks": [], "Attributes": [ { - "Section": "4. Virtual Machines", + "Section": "4 Virtual Machines", "Profile": "Level 2", "AssessmentStatus": "Manual", "Description": "In order to maintain the highest level of security all connections to an application should be secure by default.", @@ -1128,7 +1128,7 @@ ], "Attributes": [ { - "Section": "4. Virtual Machines", + "Section": "4 Virtual Machines", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "Customer-Supplied Encryption Keys (CSEK) are a feature in Google Cloud Storage and Google Compute Engine. If you supply your own encryption keys, Google uses your key to protect the Google-generated keys used to encrypt and decrypt your data. By default, Google Compute Engine encrypts all data at rest. Compute Engine handles and manages this encryption for you without any additional actions on your part. However, if you wanted to control and manage this encryption yourself, you can provide your own encryption keys.", @@ -1147,7 +1147,7 @@ "Checks": [], "Attributes": [ { - "Section": "4. Virtual Machines", + "Section": "4 Virtual Machines", "Profile": "Level 2", "AssessmentStatus": "Manual", "Description": "Google Cloud Virtual Machines have the ability via an OS Config agent API to periodically (about every 10 minutes) report OS inventory data. A patch compliance API periodically reads this data, and cross references metadata to determine if the latest updates are installed. This is not the only Patch Management solution available to your organization and you should weigh your needs before committing to using this method.", @@ -1168,7 +1168,7 @@ ], "Attributes": [ { - "Section": "5. Storage", + "Section": "5 Storage", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "It is recommended that IAM policy on Cloud Storage bucket does not allows anonymous or public access.", @@ -1189,7 +1189,7 @@ ], "Attributes": [ { - "Section": "5. Storage", + "Section": "5 Storage", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "It is recommended that uniform bucket-level access is enabled on Cloud Storage buckets.", @@ -1210,7 +1210,7 @@ ], "Attributes": [ { - "Section": "6. Cloud SQL Database Services", + "Section": "6 Cloud SQL Database Services", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "It is recommended to have all SQL database instances set to enable automated backups.", @@ -1231,7 +1231,7 @@ ], "Attributes": [ { - "Section": "6. Cloud SQL Database Services", + "Section": "6 Cloud SQL Database Services", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "It is recommended to configure Second Generation Sql instance to use private IPs instead of public IPs.", @@ -1252,7 +1252,7 @@ ], "Attributes": [ { - "Section": "6. Cloud SQL Database Services", + "Section": "6 Cloud SQL Database Services", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Database Server should accept connections only from trusted Network(s)/IP(s) and restrict access from public IP addresses.", @@ -1273,7 +1273,7 @@ ], "Attributes": [ { - "Section": "6. Cloud SQL Database Services", + "Section": "6 Cloud SQL Database Services", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "It is recommended to enforce all incoming connections to SQL database instance to use SSL.", @@ -1292,8 +1292,8 @@ "Checks": [], "Attributes": [ { - "Section": "6. Cloud SQL Database Services", - "SubSection": "6.1. MySQL Database", + "Section": "6 Cloud SQL Database Services", + "SubSection": "6.1 MySQL Database", "Profile": "Level 1", "AssessmentStatus": "Manual", "Description": "It is recommended to set a password for the administrative user (`root` by default) to prevent unauthorized access to the SQL database instances. This recommendation is applicable only for MySQL Instances. PostgreSQL does not offer any setting for No Password from the cloud console.", @@ -1314,8 +1314,8 @@ ], "Attributes": [ { - "Section": "6. Cloud SQL Database Services", - "SubSection": "6.1. MySQL Database", + "Section": "6 Cloud SQL Database Services", + "SubSection": "6.1 MySQL Database", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "It is recommended to set `skip_show_database` database flag for Cloud SQL Mysql instance to `on`", @@ -1336,8 +1336,8 @@ ], "Attributes": [ { - "Section": "6. Cloud SQL Database Services", - "SubSection": "6.1. MySQL Database", + "Section": "6 Cloud SQL Database Services", + "SubSection": "6.1 MySQL Database", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "It is recommended to set the `local_infile` database flag for a Cloud SQL MySQL instance to `off`.", @@ -1358,8 +1358,8 @@ ], "Attributes": [ { - "Section": "6. Cloud SQL Database Services", - "SubSection": "6.2. PostgreSQL Database", + "Section": "6 Cloud SQL Database Services", + "SubSection": "6.2 PostgreSQL Database", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "The `log_error_verbosity` flag controls the verbosity/details of messages logged. Valid values are: - `TERSE` - `DEFAULT` - `VERBOSE` `TERSE` excludes the logging of `DETAIL`, `HINT`, `QUERY`, and `CONTEXT` error information. `VERBOSE` output includes the `SQLSTATE` error code, source code file name, function name, and line number that generated the error. Ensure an appropriate value is set to 'DEFAULT' or stricter.", @@ -1380,8 +1380,8 @@ ], "Attributes": [ { - "Section": "6. Cloud SQL Database Services", - "SubSection": "6.2. PostgreSQL Database", + "Section": "6 Cloud SQL Database Services", + "SubSection": "6.2 PostgreSQL Database", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "The `log_min_error_statement` flag defines the minimum message severity level that are considered as an error statement. Messages for error statements are logged with the SQL statement. Valid values include `DEBUG5`, `DEBUG4`, `DEBUG3`, `DEBUG2`, `DEBUG1`, `INFO`, `NOTICE`, `WARNING`, `ERROR`, `LOG`, `FATAL`, and `PANIC`. Each severity level includes the subsequent levels mentioned above. Ensure a value of `ERROR` or stricter is set.", @@ -1402,8 +1402,8 @@ ], "Attributes": [ { - "Section": "6. Cloud SQL Database Services", - "SubSection": "6.2. PostgreSQL Database", + "Section": "6 Cloud SQL Database Services", + "SubSection": "6.2 PostgreSQL Database", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "The value of `log_statement` flag determined the SQL statements that are logged. Valid values are: - `none` - `ddl` - `mod` - `all` The value `ddl` logs all data definition statements. The value `mod` logs all ddl statements, plus data-modifying statements. The statements are logged after a basic parsing is done and statement type is determined, thus this does not logs statements with errors. When using extended query protocol, logging occurs after an Execute message is received and values of the Bind parameters are included. A value of 'ddl' is recommended unless otherwise directed by your organization's logging policy.", @@ -1424,8 +1424,8 @@ ], "Attributes": [ { - "Section": "6. Cloud SQL Database Services", - "SubSection": "6.2. PostgreSQL Database", + "Section": "6 Cloud SQL Database Services", + "SubSection": "6.2 PostgreSQL Database", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Instance addresses can be public IP or private IP. Public IP means that the instance is accessible through the public internet. In contrast, instances using only private IP are not accessible through the public internet, but are accessible through a Virtual Private Cloud (VPC). Limiting network access to your database will limit potential attacks.", @@ -1446,8 +1446,8 @@ ], "Attributes": [ { - "Section": "6. Cloud SQL Database Services", - "SubSection": "6.2. PostgreSQL Database", + "Section": "6 Cloud SQL Database Services", + "SubSection": "6.2 PostgreSQL Database", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Ensure `cloudsql.enable_pgaudit` database flag for Cloud SQL PostgreSQL instance is set to `on` to allow for centralized logging.", @@ -1468,8 +1468,8 @@ ], "Attributes": [ { - "Section": "6. Cloud SQL Database Services", - "SubSection": "6.2. PostgreSQL Database", + "Section": "6 Cloud SQL Database Services", + "SubSection": "6.2 PostgreSQL Database", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Enabling the `log_connections` setting causes each attempted connection to the server to be logged, along with successful completion of client authentication. This parameter cannot be changed after the session starts.", @@ -1490,8 +1490,8 @@ ], "Attributes": [ { - "Section": "6. Cloud SQL Database Services", - "SubSection": "6.2. PostgreSQL Database", + "Section": "6 Cloud SQL Database Services", + "SubSection": "6.2 PostgreSQL Database", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Enabling the `log_disconnections` setting logs the end of each session, including the session duration.", @@ -1512,8 +1512,8 @@ ], "Attributes": [ { - "Section": "6. Cloud SQL Database Services", - "SubSection": "6.2. PostgreSQL Database", + "Section": "6 Cloud SQL Database Services", + "SubSection": "6.2 PostgreSQL Database", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "The `log_min_duration_statement` flag defines the minimum amount of execution time of a statement in milliseconds where the total duration of the statement is logged. Ensure that `log_min_duration_statement` is disabled, i.e., a value of `-1` is set.", @@ -1534,8 +1534,8 @@ ], "Attributes": [ { - "Section": "6. Cloud SQL Database Services", - "SubSection": "6.2. PostgreSQL Database", + "Section": "6 Cloud SQL Database Services", + "SubSection": "6.2 PostgreSQL Database", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "The `log_min_messages` flag defines the minimum message severity level that is considered as an error statement. Messages for error statements are logged with the SQL statement. Valid values include `DEBUG5`, `DEBUG4`, `DEBUG3`, `DEBUG2`, `DEBUG1`, `INFO`, `NOTICE`, `WARNING`, `ERROR`, `LOG`, `FATAL`, and `PANIC`. Each severity level includes the subsequent levels mentioned above. ERROR is considered the best practice setting. Changes should only be made in accordance with the organization's logging policy.", @@ -1556,8 +1556,8 @@ ], "Attributes": [ { - "Section": "6. Cloud SQL Database Services", - "SubSection": "6.3. SQL Server", + "Section": "6 Cloud SQL Database Services", + "SubSection": "6.3 SQL Server", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "It is recommended to set `3625 (trace flag)` database flag for Cloud SQL SQL Server instance to `on`.", @@ -1578,8 +1578,8 @@ ], "Attributes": [ { - "Section": "6. Cloud SQL Database Services", - "SubSection": "6.3. SQL Server", + "Section": "6 Cloud SQL Database Services", + "SubSection": "6.3 SQL Server", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "It is recommended to set `external scripts enabled` database flag for Cloud SQL SQL Server instance to `off`", @@ -1600,8 +1600,8 @@ ], "Attributes": [ { - "Section": "6. Cloud SQL Database Services", - "SubSection": "6.3. SQL Server", + "Section": "6 Cloud SQL Database Services", + "SubSection": "6.3 SQL Server", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "It is recommended to set `remote access` database flag for Cloud SQL SQL Server instance to `off`.", @@ -1622,8 +1622,8 @@ ], "Attributes": [ { - "Section": "6. Cloud SQL Database Services", - "SubSection": "6.3. SQL Server", + "Section": "6 Cloud SQL Database Services", + "SubSection": "6.3 SQL Server", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "It is recommended to check the `user connections` for a Cloud SQL SQL Server instance to ensure that it is not artificially limiting connections.", @@ -1644,8 +1644,8 @@ ], "Attributes": [ { - "Section": "6. Cloud SQL Database Services", - "SubSection": "6.3. SQL Server", + "Section": "6 Cloud SQL Database Services", + "SubSection": "6.3 SQL Server", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "It is recommended that, `user options` database flag for Cloud SQL SQL Server instance should not be configured.", @@ -1666,8 +1666,8 @@ ], "Attributes": [ { - "Section": "6. Cloud SQL Database Services", - "SubSection": "6.3. SQL Server", + "Section": "6 Cloud SQL Database Services", + "SubSection": "6.3 SQL Server", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "It is recommended to set `contained database authentication` database flag for Cloud SQL on the SQL Server instance to `off`.", @@ -1688,8 +1688,8 @@ ], "Attributes": [ { - "Section": "6. Cloud SQL Database Services", - "SubSection": "6.3. SQL Server", + "Section": "6 Cloud SQL Database Services", + "SubSection": "6.3 SQL Server", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "It is recommended to set `cross db ownership chaining` database flag for Cloud SQL SQL Server instance to `off`.", @@ -1710,7 +1710,7 @@ ], "Attributes": [ { - "Section": "7. BigQuery", + "Section": "7 BigQuery", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "BigQuery by default encrypts the data as rest by employing `Envelope Encryption` using Google managed cryptographic keys. The data is encrypted using the `data encryption keys` and data encryption keys themselves are further encrypted using `key encryption keys`. This is seamless and do not require any additional input from the user. However, if you want to have greater control, Customer-managed encryption keys (CMEK) can be used as encryption key management solution for BigQuery Data Sets.", @@ -1731,7 +1731,7 @@ ], "Attributes": [ { - "Section": "7. BigQuery", + "Section": "7 BigQuery", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "BigQuery by default encrypts the data as rest by employing `Envelope Encryption` using Google managed cryptographic keys. The data is encrypted using the `data encryption keys` and data encryption keys themselves are further encrypted using `key encryption keys`. This is seamless and do not require any additional input from the user. However, if you want to have greater control, Customer-managed encryption keys (CMEK) can be used as encryption key management solution for BigQuery Data Sets. If CMEK is used, the CMEK is used to encrypt the data encryption keys instead of using google-managed encryption keys.", @@ -1752,7 +1752,7 @@ ], "Attributes": [ { - "Section": "7. BigQuery", + "Section": "7 BigQuery", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "It is recommended that the IAM policy on BigQuery datasets does not allow anonymous and/or public access.", diff --git a/prowler/compliance/gcp/cis_3.0_gcp.json b/prowler/compliance/gcp/cis_3.0_gcp.json index a0e860e81d..8ebe8cd6df 100644 --- a/prowler/compliance/gcp/cis_3.0_gcp.json +++ b/prowler/compliance/gcp/cis_3.0_gcp.json @@ -10,7 +10,7 @@ "Checks": [], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 1", "AssessmentStatus": "Manual", "Description": "Use corporate login credentials instead of consumer accounts, such as Gmail accounts.", @@ -30,7 +30,7 @@ "Checks": [], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 1", "AssessmentStatus": "Manual", "Description": "Setup multi-factor authentication for Google Cloud Platform accounts.", @@ -50,7 +50,7 @@ "Checks": [], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 2", "AssessmentStatus": "Manual", "Description": "Setup Security Key Enforcement for Google Cloud Platform admin accounts.", @@ -72,7 +72,7 @@ ], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "User-managed service accounts should not have user-managed keys.", @@ -94,7 +94,7 @@ ], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "A service account is a special Google account that belongs to an application or a VM, instead of to an individual end-user. The application uses the service account to call the service's Google API so that users aren't directly involved. It's recommended not to use admin access for ServiceAccount.", @@ -116,7 +116,7 @@ ], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "It is recommended to assign the `Service Account User (iam.serviceAccountUser)` and `Service Account Token Creator (iam.serviceAccountTokenCreator)` roles to a user for a specific service account rather than assigning the role to a user at project level.", @@ -138,7 +138,7 @@ ], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Service Account keys consist of a key ID (Private_key_Id) and Private key, which are used to sign programmatic requests users make to Google cloud services accessible to that particular service account. It is recommended that all Service Account keys are regularly rotated.", @@ -160,7 +160,7 @@ ], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "It is recommended that the principle of 'Separation of Duties' is enforced while assigning service-account related roles to users.", @@ -182,7 +182,7 @@ ], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "It is recommended that the IAM policy on Cloud KMS `cryptokeys` should restrict anonymous and/or public access.", @@ -204,7 +204,7 @@ ], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Google Cloud Key Management Service stores cryptographic keys in a hierarchical structure designed for useful and elegant access control management. The format for the rotation schedule depends on the client library that is used. For the gcloud command-line tool, the next rotation time must be in `ISO` or `RFC3339` format, and the rotation period must be in the form `INTEGER[UNIT]`, where units can be one of seconds (s), minutes (m), hours (h) or days (d).", @@ -226,7 +226,7 @@ ], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "It is recommended that the principle of 'Separation of Duties' is enforced while assigning KMS related roles to users.", @@ -248,7 +248,7 @@ ], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "API Keys should only be used for services in cases where other authentication methods are unavailable. Unused keys with their permissions in tact may still exist within a project. Keys are insecure because they can be viewed publicly, such as from within a browser, or they can be accessed on a device where the key resides. It is recommended to use standard authentication flow instead.", @@ -268,7 +268,7 @@ "Checks": [], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 2", "AssessmentStatus": "Manual", "Description": "API Keys should only be used for services in cases where other authentication methods are unavailable. In this case, unrestricted keys are insecure because they can be viewed publicly, such as from within a browser, or they can be accessed on a device where the key resides. It is recommended to restrict API key usage to trusted hosts, HTTP referrers and apps. It is recommended to use the more secure standard authentication flow instead.", @@ -290,7 +290,7 @@ ], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "API Keys should only be used for services in cases where other authentication methods are unavailable. API keys are always at risk because they can be viewed publicly, such as from within a browser, or they can be accessed on a device where the key resides. It is recommended to restrict API keys to use (call) only APIs required by an application.", @@ -312,7 +312,7 @@ ], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "API Keys should only be used for services in cases where other authentication methods are unavailable. If they are in use it is recommended to rotate API keys every 90 days.", @@ -334,7 +334,7 @@ ], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "It is recommended that Essential Contacts is configured to designate email addresses for Google Cloud services to notify of important technical or security information.", @@ -354,7 +354,7 @@ "Checks": [], "Attributes": [ { - "Section": "1. Identity and Access Management", + "Section": "1 Identity and Access Management", "Profile": "Level 1", "AssessmentStatus": "Manual", "Description": "Google Cloud Functions allow you to host serverless code that is executed when an event is triggered, without the requiring the management a host operating system. These functions can also store environment variables to be used by the code that may contain authentication or other information that needs to remain confidential.", @@ -376,7 +376,7 @@ ], "Attributes": [ { - "Section": "2. Logging and Monitoring", + "Section": "2 Logging and Monitoring", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "It is recommended that Cloud Audit Logging is configured to track all admin activities and read, write access to user data.", @@ -398,7 +398,7 @@ ], "Attributes": [ { - "Section": "2. Logging and Monitoring", + "Section": "2 Logging and Monitoring", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "It is recommended to create a sink that will export copies of all the log entries. This can help aggregate logs from multiple projects and export them to a Security Information and Event Management (SIEM).", @@ -420,7 +420,7 @@ ], "Attributes": [ { - "Section": "2. Logging and Monitoring", + "Section": "2 Logging and Monitoring", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "Enabling retention policies on log buckets will protect logs stored in cloud storage buckets from being overwritten or accidentally deleted. It is recommended to set up retention policies and configure Bucket Lock on all storage buckets that are used as log sinks.", @@ -442,7 +442,7 @@ ], "Attributes": [ { - "Section": "2. Logging and Monitoring", + "Section": "2 Logging and Monitoring", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "In order to prevent unnecessary project ownership assignments to users/service-accounts and further misuses of projects and resources, all `roles/Owner` assignments should be monitored.Members (users/Service-Accounts) with a role assignment to primitive role `roles/Owner` are project owners.The project owner has all the privileges on the project the role belongs to. These are summarized below:- All viewer permissions on all GCP Services within the project- Permissions for actions that modify the state of all GCP services within the project- Manage roles and permissions for a project and all resources within the project- Set up billing for a projectGranting the owner role to a member (user/Service-Account) will allow that member to modify the Identity and Access Management (IAM) policy. Therefore, grant the owner role only if the member has a legitimate purpose to manage the IAM policy. This is because the project IAM policy contains sensitive access control data. Having a minimal set of users allowed to manage IAM policy will simplify any auditing that may be necessary.", @@ -464,7 +464,7 @@ ], "Attributes": [ { - "Section": "2. Logging and Monitoring", + "Section": "2 Logging and Monitoring", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Google Cloud Platform (GCP) services write audit log entries to the Admin Activity and Data Access logs to help answer the questions of, \"who did what, where, and when?\" within GCP projects.Cloud audit logging records information includes the identity of the API caller, the time of the API call, the source IP address of the API caller, the request parameters, and the response elements returned by GCP services. Cloud audit logging provides a history of GCP API calls for an account, including API calls made via the console, SDKs, command-line tools, and other GCP services.", @@ -486,7 +486,7 @@ ], "Attributes": [ { - "Section": "2. Logging and Monitoring", + "Section": "2 Logging and Monitoring", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "It is recommended that a metric filter and alarm be established for changes to Identity and Access Management (IAM) role creation, deletion and updating activities.", @@ -508,7 +508,7 @@ ], "Attributes": [ { - "Section": "2. Logging and Monitoring", + "Section": "2 Logging and Monitoring", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "It is recommended that a metric filter and alarm be established for Virtual Private Cloud (VPC) Network Firewall rule changes.", @@ -530,7 +530,7 @@ ], "Attributes": [ { - "Section": "2. Logging and Monitoring", + "Section": "2 Logging and Monitoring", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "It is recommended that a metric filter and alarm be established for Virtual Private Cloud (VPC) network route changes.", @@ -552,7 +552,7 @@ ], "Attributes": [ { - "Section": "2. Logging and Monitoring", + "Section": "2 Logging and Monitoring", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "It is recommended that a metric filter and alarm be established for Virtual Private Cloud (VPC) network changes.", @@ -574,7 +574,7 @@ ], "Attributes": [ { - "Section": "2. Logging and Monitoring", + "Section": "2 Logging and Monitoring", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "It is recommended that a metric filter and alarm be established for Cloud Storage Bucket IAM changes.", @@ -596,7 +596,7 @@ ], "Attributes": [ { - "Section": "2. Logging and Monitoring", + "Section": "2 Logging and Monitoring", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "It is recommended that a metric filter and alarm be established for SQL instance configuration changes.", @@ -616,7 +616,7 @@ "Checks": [], "Attributes": [ { - "Section": "2. Logging and Monitoring", + "Section": "2 Logging and Monitoring", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Cloud DNS logging records the queries from the name servers within your VPC to Stackdriver. Logged queries can come from Compute Engine VMs, GKE containers, or other GCP resources provisioned within the VPC.", @@ -638,7 +638,7 @@ ], "Attributes": [ { - "Section": "2. Logging and Monitoring", + "Section": "2 Logging and Monitoring", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "GCP Cloud Asset Inventory is services that provides a historical view of GCP resources and IAM policies through a time-series database. The information recorded includes metadata on Google Cloud resources, metadata on policies set on Google Cloud projects or resources, and runtime information gathered within a Google Cloud resource.Cloud Asset Inventory Service (CAIS) API enablement is not required for operation of the service, but rather enables the mechanism for searching/exporting CAIS asset data directly.", @@ -658,7 +658,7 @@ "Checks": [], "Attributes": [ { - "Section": "2. Logging and Monitoring", + "Section": "2 Logging and Monitoring", "Profile": "Level 2", "AssessmentStatus": "Manual", "Description": "GCP Access Transparency provides audit logs for all actions that Google personnel take in your Google Cloud resources.", @@ -680,7 +680,7 @@ ], "Attributes": [ { - "Section": "2. Logging and Monitoring", + "Section": "2 Logging and Monitoring", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "GCP Access Approval enables you to require your organizations' explicit approval whenever Google support try to access your projects. You can then select users within your organization who can approve these requests through giving them a security role in IAM. All access requests display which Google Employee requested them in an email or Pub/Sub message that you can choose to Approve. This adds an additional control and logging of who in your organization approved/denied these requests.", @@ -702,7 +702,7 @@ ], "Attributes": [ { - "Section": "2. Logging and Monitoring", + "Section": "2 Logging and Monitoring", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "Logging enabled on a HTTPS Load Balancer will show all network traffic and its destination.", @@ -724,7 +724,7 @@ ], "Attributes": [ { - "Section": "3. Networking", + "Section": "3 Networking", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "To prevent use of `default` network, a project should not have a `default` network.", @@ -746,7 +746,7 @@ ], "Attributes": [ { - "Section": "3. Networking", + "Section": "3 Networking", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "In order to prevent use of legacy networks, a project should not have a legacy network configured. As of now, Legacy Networks are gradually being phased out, and you can no longer create projects with them. This recommendation is to check older projects to ensure that they are not using Legacy Networks.", @@ -768,7 +768,7 @@ ], "Attributes": [ { - "Section": "3. Networking", + "Section": "3 Networking", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Cloud Domain Name System (DNS) is a fast, reliable and cost-effective domain name system that powers millions of domains on the internet. Domain Name System Security Extensions (DNSSEC) in Cloud DNS enables domain owners to take easy steps to protect their domains against DNS hijacking and man-in-the-middle and other attacks.", @@ -790,7 +790,7 @@ ], "Attributes": [ { - "Section": "3. Networking", + "Section": "3 Networking", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "NOTE: Currently, the SHA1 algorithm has been removed from general use by Google, and, if being used, needs to be whitelisted on a project basis by Google and will also, therefore, require a Google Cloud support contract.DNSSEC algorithm numbers in this registry may be used in CERT RRs. Zone signing (DNSSEC) and transaction security mechanisms (SIG(0) and TSIG) make use of particular subsets of these algorithms. The algorithm used for key signing should be a recommended one and it should be strong.", @@ -812,7 +812,7 @@ ], "Attributes": [ { - "Section": "3. Networking", + "Section": "3 Networking", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "NOTE: Currently, the SHA1 algorithm has been removed from general use by Google, and, if being used, needs to be whitelisted on a project basis by Google and will also, therefore, require a Google Cloud support contract.DNSSEC algorithm numbers in this registry may be used in CERT RRs. Zone signing (DNSSEC) and transaction security mechanisms (SIG(0) and TSIG) make use of particular subsets of these algorithms. The algorithm used for key signing should be a recommended one and it should be strong.", @@ -834,7 +834,7 @@ ], "Attributes": [ { - "Section": "3. Networking", + "Section": "3 Networking", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "GCP `Firewall Rules` are specific to a `VPC Network`. Each rule either `allows` or `denies` traffic when its conditions are met. Its conditions allow the user to specify the type of traffic, such as ports and protocols, and the source or destination of the traffic, including IP addresses, subnets, and instances.Firewall rules are defined at the VPC network level and are specific to the network in which they are defined. The rules themselves cannot be shared among networks. Firewall rules only support IPv4 traffic. When specifying a source for an ingress rule or a destination for an egress rule by address, only an `IPv4` address or `IPv4 block in CIDR` notation can be used. Generic `(0.0.0.0/0)` incoming traffic from the internet to VPC or VM instance using `SSH` on `Port 22` can be avoided.", @@ -856,7 +856,7 @@ ], "Attributes": [ { - "Section": "3. Networking", + "Section": "3 Networking", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "GCP `Firewall Rules` are specific to a `VPC Network`. Each rule either `allows` or `denies` traffic when its conditions are met. Its conditions allow users to specify the type of traffic, such as ports and protocols, and the source or destination of the traffic, including IP addresses, subnets, and instances.Firewall rules are defined at the VPC network level and are specific to the network in which they are defined. The rules themselves cannot be shared among networks. Firewall rules only support IPv4 traffic. When specifying a source for an ingress rule or a destination for an egress rule by address, an `IPv4` address or `IPv4 block in CIDR` notation can be used. Generic `(0.0.0.0/0)` incoming traffic from the Internet to a VPC or VM instance using `RDP` on `Port 3389` can be avoided.", @@ -878,7 +878,7 @@ ], "Attributes": [ { - "Section": "3. Networking", + "Section": "3 Networking", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "Flow Logs is a feature that enables users to capture information about the IP traffic going to and from network interfaces in the organization's VPC Subnets. Once a flow log is created, the user can view and retrieve its data in Stackdriver Logging. It is recommended that Flow Logs be enabled for every business-critical VPC subnet.", @@ -898,7 +898,7 @@ "Checks": [], "Attributes": [ { - "Section": "3. Networking", + "Section": "3 Networking", "Profile": "Level 1", "AssessmentStatus": "Manual", "Description": "Secure Sockets Layer (SSL) policies determine what port Transport Layer Security (TLS) features clients are permitted to use when connecting to load balancers. To prevent usage of insecure features, SSL policies should use (a) at least TLS 1.2 with the MODERN profile; or (b) the RESTRICTED profile, because it effectively requires clients to use TLS 1.2 regardless of the chosen minimum TLS version; or (3) a CUSTOM profile that does not support any of the following features: ```TLS_RSA_WITH_AES_128_GCM_SHA256TLS_RSA_WITH_AES_256_GCM_SHA384TLS_RSA_WITH_AES_128_CBC_SHATLS_RSA_WITH_AES_256_CBC_SHATLS_RSA_WITH_3DES_EDE_CBC_SHA```", @@ -918,7 +918,7 @@ "Checks": [], "Attributes": [ { - "Section": "3. Networking", + "Section": "3 Networking", "Profile": "Level 2", "AssessmentStatus": "Manual", "Description": "IAP authenticates the user requests to your apps via a Google single sign in. You can then manage these users with permissions to control access. It is recommended to use both IAP permissions and firewalls to restrict this access to your apps with sensitive information.", @@ -940,7 +940,7 @@ ], "Attributes": [ { - "Section": "4. Virtual Machines", + "Section": "4 Virtual Machines", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "It is recommended to configure your instance to not use the default Compute Engine service account because it has the Editor role on the project.", @@ -962,7 +962,7 @@ ], "Attributes": [ { - "Section": "4. Virtual Machines", + "Section": "4 Virtual Machines", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "To support principle of least privileges and prevent potential privilege escalation it is recommended that instances are not assigned to default service account `Compute Engine default service account` with Scope `Allow full access to all Cloud APIs`.", @@ -984,7 +984,7 @@ ], "Attributes": [ { - "Section": "4. Virtual Machines", + "Section": "4 Virtual Machines", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "It is recommended to use Instance specific SSH key(s) instead of using common/shared project-wide SSH key(s) to access Instances.", @@ -1006,7 +1006,7 @@ ], "Attributes": [ { - "Section": "4. Virtual Machines", + "Section": "4 Virtual Machines", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Enabling OS login binds SSH certificates to IAM users and facilitates effective SSH certificate management.", @@ -1028,7 +1028,7 @@ ], "Attributes": [ { - "Section": "4. Virtual Machines", + "Section": "4 Virtual Machines", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Interacting with a serial port is often referred to as the serial console, which is similar to using a terminal window, in that input and output is entirely in text mode and there is no graphical interface or mouse support.If you enable the interactive serial console on an instance, clients can attempt to connect to that instance from any IP address. Therefore interactive serial console support should be disabled.", @@ -1050,7 +1050,7 @@ ], "Attributes": [ { - "Section": "4. Virtual Machines", + "Section": "4 Virtual Machines", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Compute Engine instance cannot forward a packet unless the source IP address of the packet matches the IP address of the instance. Similarly, GCP won't deliver a packet whose destination IP address is different than the IP address of the instance receiving the packet. However, both capabilities are required if you want to use instances to help route packets.Forwarding of data packets should be disabled to prevent data loss or information disclosure.", @@ -1072,7 +1072,7 @@ ], "Attributes": [ { - "Section": "4. Virtual Machines", + "Section": "4 Virtual Machines", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "Customer-Supplied Encryption Keys (CSEK) are a feature in Google Cloud Storage and Google Compute Engine. If you supply your own encryption keys, Google uses your key to protect the Google-generated keys used to encrypt and decrypt your data. By default, Google Compute Engine encrypts all data at rest. Compute Engine handles and manages this encryption for you without any additional actions on your part. However, if you wanted to control and manage this encryption yourself, you can provide your own encryption keys.", @@ -1094,7 +1094,7 @@ ], "Attributes": [ { - "Section": "4. Virtual Machines", + "Section": "4 Virtual Machines", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "To defend against advanced threats and ensure that the boot loader and firmware on your VMs are signed and untampered, it is recommended that Compute instances are launched with Shielded VM enabled.", @@ -1116,7 +1116,7 @@ ], "Attributes": [ { - "Section": "4. Virtual Machines", + "Section": "4 Virtual Machines", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "Compute instances should not be configured to have external IP addresses.", @@ -1136,7 +1136,7 @@ "Checks": [], "Attributes": [ { - "Section": "4. Virtual Machines", + "Section": "4 Virtual Machines", "Profile": "Level 2", "AssessmentStatus": "Manual", "Description": "In order to maintain the highest level of security all connections to an application should be secure by default.", @@ -1158,7 +1158,7 @@ ], "Attributes": [ { - "Section": "4. Virtual Machines", + "Section": "4 Virtual Machines", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "Google Cloud encrypts data at-rest and in-transit, but customer data must be decrypted for processing. Confidential Computing is a breakthrough technology which encrypts data in-use—while it is being processed. Confidential Computing environments keep data encrypted in memory and elsewhere outside the central processing unit (CPU). Confidential VMs leverage the Secure Encrypted Virtualization (SEV) feature of AMD EPYC™ CPUs. Customer data will stay encrypted while it is used, indexed, queried, or trained on. Encryption keys are generated in hardware, per VM, and not exportable. Thanks to built-in hardware optimizations of both performance and security, there is no significant performance penalty to Confidential Computing workloads.", @@ -1178,7 +1178,7 @@ "Checks": [], "Attributes": [ { - "Section": "4. Virtual Machines", + "Section": "4 Virtual Machines", "Profile": "Level 2", "AssessmentStatus": "Manual", "Description": "Google Cloud Virtual Machines have the ability via an OS Config agent API to periodically (about every 10 minutes) report OS inventory data. A patch compliance API periodically reads this data, and cross references metadata to determine if the latest updates are installed.This is not the only Patch Management solution available to your organization and you should weigh your needs before committing to using this method.", @@ -1200,7 +1200,7 @@ ], "Attributes": [ { - "Section": "5. Storage", + "Section": "5 Storage", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "It is recommended that IAM policy on Cloud Storage bucket does not allows anonymous or public access.", @@ -1222,7 +1222,7 @@ ], "Attributes": [ { - "Section": "5. Storage", + "Section": "5 Storage", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "It is recommended that uniform bucket-level access is enabled on Cloud Storage buckets.", @@ -1244,7 +1244,7 @@ ], "Attributes": [ { - "Section": "6. Cloud SQL Database Services", + "Section": "6 Cloud SQL Database Services", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "It is recommended to enforce all incoming connections to SQL database instance to use SSL.", @@ -1266,7 +1266,7 @@ ], "Attributes": [ { - "Section": "6. Cloud SQL Database Services", + "Section": "6 Cloud SQL Database Services", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Database Server should accept connections only from trusted Network(s)/IP(s) and restrict access from public IP addresses.", @@ -1288,7 +1288,7 @@ ], "Attributes": [ { - "Section": "6. Cloud SQL Database Services", + "Section": "6 Cloud SQL Database Services", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "It is recommended to configure Second Generation Sql instance to use private IPs instead of public IPs.", @@ -1310,7 +1310,7 @@ ], "Attributes": [ { - "Section": "6. Cloud SQL Database Services", + "Section": "6 Cloud SQL Database Services", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "It is recommended to have all SQL database instances set to enable automated backups.", @@ -1330,8 +1330,8 @@ "Checks": [], "Attributes": [ { - "Section": "6. Cloud SQL Database Services", - "SubSection": "6.1. MySQL Database", + "Section": "6 Cloud SQL Database Services", + "SubSection": "6.1 MySQL Database", "Profile": "Level 1", "AssessmentStatus": "Manual", "Description": "It is recommended to set a password for the administrative user (`root` by default) to prevent unauthorized access to the SQL database instances.This recommendation is applicable only for MySQL Instances. PostgreSQL does not offer any setting for No Password from the cloud console.", @@ -1353,8 +1353,8 @@ ], "Attributes": [ { - "Section": "6. Cloud SQL Database Services", - "SubSection": "6.1. MySQL Database", + "Section": "6 Cloud SQL Database Services", + "SubSection": "6.1 MySQL Database", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "It is recommended to set `skip_show_database` database flag for Cloud SQL Mysql instance to `on`", @@ -1376,8 +1376,8 @@ ], "Attributes": [ { - "Section": "6. Cloud SQL Database Services", - "SubSection": "6.1. MySQL Database", + "Section": "6 Cloud SQL Database Services", + "SubSection": "6.1 MySQL Database", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "It is recommended to set the `local_infile` database flag for a Cloud SQL MySQL instance to `off`.", @@ -1399,8 +1399,8 @@ ], "Attributes": [ { - "Section": "6. Cloud SQL Database Services", - "SubSection": "6.2. PostgreSQL Database", + "Section": "6 Cloud SQL Database Services", + "SubSection": "6.2 PostgreSQL Database", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "The `log_error_verbosity` flag controls the verbosity/details of messages logged. Valid values are:- `TERSE`- `DEFAULT`- `VERBOSE``TERSE` excludes the logging of `DETAIL`, `HINT`, `QUERY`, and `CONTEXT` error information.`VERBOSE` output includes the `SQLSTATE` error code, source code file name, function name, and line number that generated the error.Ensure an appropriate value is set to 'DEFAULT' or stricter.", @@ -1422,8 +1422,8 @@ ], "Attributes": [ { - "Section": "6. Cloud SQL Database Services", - "SubSection": "6.2. PostgreSQL Database", + "Section": "6 Cloud SQL Database Services", + "SubSection": "6.2 PostgreSQL Database", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Enabling the `log_connections` setting causes each attempted connection to the server to be logged, along with successful completion of client authentication. This parameter cannot be changed after the session starts.", @@ -1445,8 +1445,8 @@ ], "Attributes": [ { - "Section": "6. Cloud SQL Database Services", - "SubSection": "6.2. PostgreSQL Database", + "Section": "6 Cloud SQL Database Services", + "SubSection": "6.2 PostgreSQL Database", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Enabling the `log_disconnections` setting logs the end of each session, including the session duration.", @@ -1468,8 +1468,8 @@ ], "Attributes": [ { - "Section": "6. Cloud SQL Database Services", - "SubSection": "6.2. PostgreSQL Database", + "Section": "6 Cloud SQL Database Services", + "SubSection": "6.2 PostgreSQL Database", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "The value of `log_statement` flag determined the SQL statements that are logged. Valid values are:- `none`- `ddl`- `mod`- `all`The value `ddl` logs all data definition statements.The value `mod` logs all ddl statements, plus data-modifying statements.The statements are logged after a basic parsing is done and statement type is determined, thus this does not logs statements with errors. When using extended query protocol, logging occurs after an Execute message is received and values of the Bind parameters are included.A value of 'ddl' is recommended unless otherwise directed by your organization's logging policy.", @@ -1491,8 +1491,8 @@ ], "Attributes": [ { - "Section": "6. Cloud SQL Database Services", - "SubSection": "6.2. PostgreSQL Database", + "Section": "6 Cloud SQL Database Services", + "SubSection": "6.2 PostgreSQL Database", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "The `log_min_messages` flag defines the minimum message severity level that is considered as an error statement. Messages for error statements are logged with the SQL statement. Valid values include (from lowest to highest severity) `DEBUG5`, `DEBUG4`, `DEBUG3`, `DEBUG2`, `DEBUG1`, `INFO`, `NOTICE`, `WARNING`, `ERROR`, `LOG`, `FATAL`, and `PANIC`.Each severity level includes the subsequent levels mentioned above. ERROR is considered the best practice setting. Changes should only be made in accordance with the organization's logging policy.", @@ -1514,8 +1514,8 @@ ], "Attributes": [ { - "Section": "6. Cloud SQL Database Services", - "SubSection": "6.2. PostgreSQL Database", + "Section": "6 Cloud SQL Database Services", + "SubSection": "6.2 PostgreSQL Database", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "The `log_min_error_statement` flag defines the minimum message severity level that are considered as an error statement. Messages for error statements are logged with the SQL statement. Valid values include (from lowest to highest severity) `DEBUG5`, `DEBUG4`, `DEBUG3`, `DEBUG2`, `DEBUG1`, `INFO`, `NOTICE`, `WARNING`, `ERROR`, `LOG`, `FATAL`, and `PANIC`.Each severity level includes the subsequent levels mentioned above. Ensure a value of `ERROR` or stricter is set.", @@ -1537,8 +1537,8 @@ ], "Attributes": [ { - "Section": "6. Cloud SQL Database Services", - "SubSection": "6.2. PostgreSQL Database", + "Section": "6 Cloud SQL Database Services", + "SubSection": "6.2 PostgreSQL Database", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "The `log_min_duration_statement` flag defines the minimum amount of execution time of a statement in milliseconds where the total duration of the statement is logged. Ensure that `log_min_duration_statement` is disabled, i.e., a value of `-1` is set.", @@ -1560,8 +1560,8 @@ ], "Attributes": [ { - "Section": "6. Cloud SQL Database Services", - "SubSection": "6.2. PostgreSQL Database", + "Section": "6 Cloud SQL Database Services", + "SubSection": "6.2 PostgreSQL Database", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "Ensure `cloudsql.enable_pgaudit` database flag for Cloud SQL PostgreSQL instance is set to `on` to allow for centralized logging.", @@ -1583,8 +1583,8 @@ ], "Attributes": [ { - "Section": "6. Cloud SQL Database Services", - "SubSection": "6.3. SQL Server", + "Section": "6 Cloud SQL Database Services", + "SubSection": "6.3 SQL Server", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "It is recommended to set `external scripts enabled` database flag for Cloud SQL SQL Server instance to `off`", @@ -1606,8 +1606,8 @@ ], "Attributes": [ { - "Section": "6. Cloud SQL Database Services", - "SubSection": "6.3. SQL Server", + "Section": "6 Cloud SQL Database Services", + "SubSection": "6.3 SQL Server", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "It is recommended to set `cross db ownership chaining` database flag for Cloud SQL SQL Server instance to `off`.This flag is deprecated for all SQL Server versions in CGP. Going forward, you can't set its value to on. However, if you have this flag enabled, we strongly recommend that you either remove the flag from your database or set it to off. For cross-database access, use the [Microsoft tutorial for signing stored procedures with a certificate](https://learn.microsoft.com/en-us/sql/relational-databases/tutorial-signing-stored-procedures-with-a-certificate?view=sql-server-ver16).", @@ -1629,8 +1629,8 @@ ], "Attributes": [ { - "Section": "6. Cloud SQL Database Services", - "SubSection": "6.3. SQL Server", + "Section": "6 Cloud SQL Database Services", + "SubSection": "6.3 SQL Server", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "It is recommended to check the `user connections` for a Cloud SQL SQL Server instance to ensure that it is not artificially limiting connections.", @@ -1652,8 +1652,8 @@ ], "Attributes": [ { - "Section": "6. Cloud SQL Database Services", - "SubSection": "6.3. SQL Server", + "Section": "6 Cloud SQL Database Services", + "SubSection": "6.3 SQL Server", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "It is recommended that, `user options` database flag for Cloud SQL SQL Server instance should not be configured.", @@ -1675,8 +1675,8 @@ ], "Attributes": [ { - "Section": "6. Cloud SQL Database Services", - "SubSection": "6.3. SQL Server", + "Section": "6 Cloud SQL Database Services", + "SubSection": "6.3 SQL Server", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "It is recommended to set `remote access` database flag for Cloud SQL SQL Server instance to `off`.", @@ -1694,12 +1694,12 @@ "Id": "6.3.6", "Description": "Ensure '3625 (trace flag)' database flag for all Cloud SQL Server instances is set to 'on'", "Checks": [ - "cloudsql_instance_sqlserver_trace_flag\"" + "cloudsql_instance_sqlserver_trace_flag" ], "Attributes": [ { - "Section": "6. Cloud SQL Database Services", - "SubSection": "6.3. SQL Server", + "Section": "6 Cloud SQL Database Services", + "SubSection": "6.3 SQL Server", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "It is recommended to set `3625 (trace flag)` database flag for Cloud SQL SQL Server instance to `on`.", @@ -1721,8 +1721,8 @@ ], "Attributes": [ { - "Section": "6. Cloud SQL Database Services", - "SubSection": "6.3. SQL Server", + "Section": "6 Cloud SQL Database Services", + "SubSection": "6.3 SQL Server", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "It is recommended not to set `contained database authentication` database flag for Cloud SQL on the SQL Server instance to `on`.", @@ -1744,7 +1744,7 @@ ], "Attributes": [ { - "Section": "7. BigQuery", + "Section": "7 BigQuery", "Profile": "Level 1", "AssessmentStatus": "Automated", "Description": "It is recommended that the IAM policy on BigQuery datasets does not allow anonymous and/or public access.", @@ -1766,7 +1766,7 @@ ], "Attributes": [ { - "Section": "7. BigQuery", + "Section": "7 BigQuery", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "BigQuery by default encrypts the data as rest by employing `Envelope Encryption` using Google managed cryptographic keys. The data is encrypted using the `data encryption keys` and data encryption keys themselves are further encrypted using `key encryption keys`. This is seamless and do not require any additional input from the user. However, if you want to have greater control, Customer-managed encryption keys (CMEK) can be used as encryption key management solution for BigQuery Data Sets. If CMEK is used, the CMEK is used to encrypt the data encryption keys instead of using google-managed encryption keys.", @@ -1788,7 +1788,7 @@ ], "Attributes": [ { - "Section": "7. BigQuery", + "Section": "7 BigQuery", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "BigQuery by default encrypts the data as rest by employing `Envelope Encryption` using Google managed cryptographic keys. The data is encrypted using the `data encryption keys` and data encryption keys themselves are further encrypted using `key encryption keys`. This is seamless and do not require any additional input from the user. However, if you want to have greater control, Customer-managed encryption keys (CMEK) can be used as encryption key management solution for BigQuery Data Sets.", @@ -1808,7 +1808,7 @@ "Checks": [], "Attributes": [ { - "Section": "7. BigQuery", + "Section": "7 BigQuery", "Profile": "Level 2", "AssessmentStatus": "Manual", "Description": "BigQuery tables can contain sensitive data that for security purposes should be discovered, monitored, classified, and protected. Google Cloud's Sensitive Data Protection tools can automatically provide data classification of all BigQuery data across an organization.", @@ -1830,7 +1830,7 @@ ], "Attributes": [ { - "Section": "8. Dataproc", + "Section": "8 Dataproc", "Profile": "Level 2", "AssessmentStatus": "Automated", "Description": "When you use Dataproc, cluster and job data is stored on Persistent Disks (PDs) associated with the Compute Engine VMs in your cluster and in a Cloud Storage staging bucket. This PD and bucket data is encrypted using a Google-generated data encryption key (DEK) and key encryption key (KEK). The CMEK feature allows you to create, use, and revoke the key encryption key (KEK). Google still controls the data encryption key (DEK).", diff --git a/prowler/compliance/kubernetes/cis_1.10_kubernetes.json b/prowler/compliance/kubernetes/cis_1.10_kubernetes.json index 7c7c9e6898..379504a127 100644 --- a/prowler/compliance/kubernetes/cis_1.10_kubernetes.json +++ b/prowler/compliance/kubernetes/cis_1.10_kubernetes.json @@ -10,8 +10,8 @@ "Checks": [], "Attributes": [ { - "Section": "1. Control Plane Components", - "SubSection": "1.1. Control Plane Node Configuration Files", + "Section": "1 Control Plane Components", + "SubSection": "1.1 Control Plane Node Configuration Files", "Profile": "Level 1 - Master Node", "AssessmentStatus": "Automated", "Description": "Ensure that the API server pod specification file has permissions of `600` or more restrictive.", @@ -31,8 +31,8 @@ "Checks": [], "Attributes": [ { - "Section": "1. Control Plane Components", - "SubSection": "1.1. Control Plane Node Configuration Files", + "Section": "1 Control Plane Components", + "SubSection": "1.1 Control Plane Node Configuration Files", "Profile": "Level 1 - Master Node", "AssessmentStatus": "Automated", "Description": "Ensure that the API server pod specification file ownership is set to `root:root`.", @@ -52,8 +52,8 @@ "Checks": [], "Attributes": [ { - "Section": "1. Control Plane Components", - "SubSection": "1.1. Control Plane Node Configuration Files", + "Section": "1 Control Plane Components", + "SubSection": "1.1 Control Plane Node Configuration Files", "Profile": "Level 1 - Master Node", "AssessmentStatus": "Automated", "Description": "Ensure that the controller manager pod specification file has permissions of `600` or more restrictive.", @@ -73,8 +73,8 @@ "Checks": [], "Attributes": [ { - "Section": "1. Control Plane Components", - "SubSection": "1.1. Control Plane Node Configuration Files", + "Section": "1 Control Plane Components", + "SubSection": "1.1 Control Plane Node Configuration Files", "Profile": "Level 1 - Master Node", "AssessmentStatus": "Automated", "Description": "Ensure that the controller manager pod specification file ownership is set to `root:root`.", @@ -94,8 +94,8 @@ "Checks": [], "Attributes": [ { - "Section": "1. Control Plane Components", - "SubSection": "1.1. Control Plane Node Configuration Files", + "Section": "1 Control Plane Components", + "SubSection": "1.1 Control Plane Node Configuration Files", "Profile": "Level 1 - Master Node", "AssessmentStatus": "Automated", "Description": "Ensure that the scheduler pod specification file has permissions of `600` or more restrictive.", @@ -115,8 +115,8 @@ "Checks": [], "Attributes": [ { - "Section": "1. Control Plane Components", - "SubSection": "1.1. Control Plane Node Configuration Files", + "Section": "1 Control Plane Components", + "SubSection": "1.1 Control Plane Node Configuration Files", "Profile": "Level 1 - Master Node", "AssessmentStatus": "Automated", "Description": "Ensure that the scheduler pod specification file ownership is set to `root:root`.", @@ -136,8 +136,8 @@ "Checks": [], "Attributes": [ { - "Section": "1. Control Plane Components", - "SubSection": "1.1. Control Plane Node Configuration Files", + "Section": "1 Control Plane Components", + "SubSection": "1.1 Control Plane Node Configuration Files", "Profile": "Level 1 - Master Node", "AssessmentStatus": "Automated", "Description": "Ensure that the `/etc/kubernetes/manifests/etcd.yaml` file has permissions of `600` or more restrictive.", @@ -157,8 +157,8 @@ "Checks": [], "Attributes": [ { - "Section": "1. Control Plane Components", - "SubSection": "1.1. Control Plane Node Configuration Files", + "Section": "1 Control Plane Components", + "SubSection": "1.1 Control Plane Node Configuration Files", "Profile": "Level 1 - Master Node", "AssessmentStatus": "Automated", "Description": "Ensure that the `/etc/kubernetes/manifests/etcd.yaml` file ownership is set to `root:root`.", @@ -178,8 +178,8 @@ "Checks": [], "Attributes": [ { - "Section": "1. Control Plane Components", - "SubSection": "1.1. Control Plane Node Configuration Files", + "Section": "1 Control Plane Components", + "SubSection": "1.1 Control Plane Node Configuration Files", "Profile": "Level 1 - Master Node", "AssessmentStatus": "Manual", "Description": "Ensure that the Container Network Interface files have permissions of `600` or more restrictive.", @@ -199,8 +199,8 @@ "Checks": [], "Attributes": [ { - "Section": "1. Control Plane Components", - "SubSection": "1.1. Control Plane Node Configuration Files", + "Section": "1 Control Plane Components", + "SubSection": "1.1 Control Plane Node Configuration Files", "Profile": "Level 1 - Master Node", "AssessmentStatus": "Manual", "Description": "Ensure that the Container Network Interface files have ownership set to `root:root`.", @@ -220,8 +220,8 @@ "Checks": [], "Attributes": [ { - "Section": "1. Control Plane Components", - "SubSection": "1.1. Control Plane Node Configuration Files", + "Section": "1 Control Plane Components", + "SubSection": "1.1 Control Plane Node Configuration Files", "Profile": "Level 1 - Master Node", "AssessmentStatus": "Automated", "Description": "Ensure that the etcd data directory has permissions of `700` or more restrictive.", @@ -241,8 +241,8 @@ "Checks": [], "Attributes": [ { - "Section": "1. Control Plane Components", - "SubSection": "1.1. Control Plane Node Configuration Files", + "Section": "1 Control Plane Components", + "SubSection": "1.1 Control Plane Node Configuration Files", "Profile": "Level 1 - Master Node", "AssessmentStatus": "Automated", "Description": "Ensure that the etcd data directory ownership is set to `etcd:etcd`.", @@ -262,8 +262,8 @@ "Checks": [], "Attributes": [ { - "Section": "1. Control Plane Components", - "SubSection": "1.1. Control Plane Node Configuration Files", + "Section": "1 Control Plane Components", + "SubSection": "1.1 Control Plane Node Configuration Files", "Profile": "Level 1 - Master Node", "AssessmentStatus": "Automated", "Description": "Ensure that the `admin.conf` file (and `super-admin.conf` file, where it exists) have permissions of `600`.", @@ -283,8 +283,8 @@ "Checks": [], "Attributes": [ { - "Section": "1. Control Plane Components", - "SubSection": "1.1. Control Plane Node Configuration Files", + "Section": "1 Control Plane Components", + "SubSection": "1.1 Control Plane Node Configuration Files", "Profile": "Level 1 - Master Node", "AssessmentStatus": "Automated", "Description": "Ensure that the `admin.conf` (and `super-admin.conf` file, where it exists) file ownership is set to `root:root`.", @@ -304,8 +304,8 @@ "Checks": [], "Attributes": [ { - "Section": "1. Control Plane Components", - "SubSection": "1.1. Control Plane Node Configuration Files", + "Section": "1 Control Plane Components", + "SubSection": "1.1 Control Plane Node Configuration Files", "Profile": "Level 1 - Master Node", "AssessmentStatus": "Automated", "Description": "Ensure that the `scheduler.conf` file has permissions of `600` or more restrictive.", @@ -325,8 +325,8 @@ "Checks": [], "Attributes": [ { - "Section": "1. Control Plane Components", - "SubSection": "1.1. Control Plane Node Configuration Files", + "Section": "1 Control Plane Components", + "SubSection": "1.1 Control Plane Node Configuration Files", "Profile": "Level 1 - Master Node", "AssessmentStatus": "Automated", "Description": "Ensure that the `scheduler.conf` file ownership is set to `root:root`.", @@ -346,8 +346,8 @@ "Checks": [], "Attributes": [ { - "Section": "1. Control Plane Components", - "SubSection": "1.1. Control Plane Node Configuration Files", + "Section": "1 Control Plane Components", + "SubSection": "1.1 Control Plane Node Configuration Files", "Profile": "Level 1 - Master Node", "AssessmentStatus": "Automated", "Description": "Ensure that the `controller-manager.conf` file has permissions of 600 or more restrictive.", @@ -367,8 +367,8 @@ "Checks": [], "Attributes": [ { - "Section": "1. Control Plane Components", - "SubSection": "1.1. Control Plane Node Configuration Files", + "Section": "1 Control Plane Components", + "SubSection": "1.1 Control Plane Node Configuration Files", "Profile": "Level 1 - Master Node", "AssessmentStatus": "Automated", "Description": "Ensure that the `controller-manager.conf` file ownership is set to `root:root`.", @@ -388,8 +388,8 @@ "Checks": [], "Attributes": [ { - "Section": "1. Control Plane Components", - "SubSection": "1.1. Control Plane Node Configuration Files", + "Section": "1 Control Plane Components", + "SubSection": "1.1 Control Plane Node Configuration Files", "Profile": "Level 1 - Master Node", "AssessmentStatus": "Automated", "Description": "Ensure that the Kubernetes PKI directory and file ownership is set to `root:root`.", @@ -409,8 +409,8 @@ "Checks": [], "Attributes": [ { - "Section": "1. Control Plane Components", - "SubSection": "1.1. Control Plane Node Configuration Files", + "Section": "1 Control Plane Components", + "SubSection": "1.1 Control Plane Node Configuration Files", "Profile": "Level 1 - Master Node", "AssessmentStatus": "Manual", "Description": "Ensure that Kubernetes PKI certificate files have permissions of `600` or more restrictive.", @@ -430,8 +430,8 @@ "Checks": [], "Attributes": [ { - "Section": "1. Control Plane Components", - "SubSection": "1.1. Control Plane Node Configuration Files", + "Section": "1 Control Plane Components", + "SubSection": "1.1 Control Plane Node Configuration Files", "Profile": "Level 1 - Master Node", "AssessmentStatus": "Manual", "Description": "Ensure that Kubernetes PKI key files have permissions of `600`.", @@ -453,8 +453,8 @@ ], "Attributes": [ { - "Section": "1. Control Plane Components", - "SubSection": "1.2. API Server", + "Section": "1 Control Plane Components", + "SubSection": "1.2 API Server", "Profile": "Level 1 - Master Node", "AssessmentStatus": "Manual", "Description": "Disable anonymous requests to the API server.", @@ -476,8 +476,8 @@ ], "Attributes": [ { - "Section": "1. Control Plane Components", - "SubSection": "1.2. API Server", + "Section": "1 Control Plane Components", + "SubSection": "1.2 API Server", "Profile": "Level 1 - Master Node", "AssessmentStatus": "Automated", "Description": "Do not use token based authentication.", @@ -499,8 +499,8 @@ ], "Attributes": [ { - "Section": "1. Control Plane Components", - "SubSection": "1.2. API Server", + "Section": "1 Control Plane Components", + "SubSection": "1.2 API Server", "Profile": "Level 1 - Master Node", "AssessmentStatus": "Manual", "Description": "This admission controller rejects all net-new usage of the Service field externalIPs.", @@ -522,8 +522,8 @@ ], "Attributes": [ { - "Section": "1. Control Plane Components", - "SubSection": "1.2. API Server", + "Section": "1 Control Plane Components", + "SubSection": "1.2 API Server", "Profile": "Level 1 - Master Node", "AssessmentStatus": "Automated", "Description": "Enable certificate based kubelet authentication.", @@ -545,8 +545,8 @@ ], "Attributes": [ { - "Section": "1. Control Plane Components", - "SubSection": "1.2. API Server", + "Section": "1 Control Plane Components", + "SubSection": "1.2 API Server", "Profile": "Level 1 - Master Node", "AssessmentStatus": "Automated", "Description": "Verify kubelet's certificate before establishing connection.", @@ -568,8 +568,8 @@ ], "Attributes": [ { - "Section": "1. Control Plane Components", - "SubSection": "1.2. API Server", + "Section": "1 Control Plane Components", + "SubSection": "1.2 API Server", "Profile": "Level 1 - Master Node", "AssessmentStatus": "Automated", "Description": "Do not always authorize all requests.", @@ -591,8 +591,8 @@ ], "Attributes": [ { - "Section": "1. Control Plane Components", - "SubSection": "1.2. API Server", + "Section": "1 Control Plane Components", + "SubSection": "1.2 API Server", "Profile": "Level 1 - Master Node", "AssessmentStatus": "Automated", "Description": "Restrict kubelet nodes to reading only objects associated with them.", @@ -614,8 +614,8 @@ ], "Attributes": [ { - "Section": "1. Control Plane Components", - "SubSection": "1.2. API Server", + "Section": "1 Control Plane Components", + "SubSection": "1.2 API Server", "Profile": "Level 1 - Master Node", "AssessmentStatus": "Automated", "Description": "Turn on Role Based Access Control.", @@ -637,8 +637,8 @@ ], "Attributes": [ { - "Section": "1. Control Plane Components", - "SubSection": "1.2. API Server", + "Section": "1 Control Plane Components", + "SubSection": "1.2 API Server", "Profile": "Level 1 - Master Node", "AssessmentStatus": "Manual", "Description": "Limit the rate at which the API server accepts requests.", @@ -660,8 +660,8 @@ ], "Attributes": [ { - "Section": "1. Control Plane Components", - "SubSection": "1.2. API Server", + "Section": "1 Control Plane Components", + "SubSection": "1.2 API Server", "Profile": "Level 1 - Master Node", "AssessmentStatus": "Automated", "Description": "Do not allow all requests.", @@ -683,8 +683,8 @@ ], "Attributes": [ { - "Section": "1. Control Plane Components", - "SubSection": "1.2. API Server", + "Section": "1 Control Plane Components", + "SubSection": "1.2 API Server", "Profile": "Level 1 - Master Node", "AssessmentStatus": "Manual", "Description": "Always pull images.", @@ -706,8 +706,8 @@ ], "Attributes": [ { - "Section": "1. Control Plane Components", - "SubSection": "1.2. API Server", + "Section": "1 Control Plane Components", + "SubSection": "1.2 API Server", "Profile": "Level 2 - Master Node", "AssessmentStatus": "Automated", "Description": "Automate service accounts management.", @@ -729,8 +729,8 @@ ], "Attributes": [ { - "Section": "1. Control Plane Components", - "SubSection": "1.2. API Server", + "Section": "1 Control Plane Components", + "SubSection": "1.2 API Server", "Profile": "Level 2 - Master Node", "AssessmentStatus": "Automated", "Description": "Reject creating objects in a namespace that is undergoing termination.", @@ -752,8 +752,8 @@ ], "Attributes": [ { - "Section": "1. Control Plane Components", - "SubSection": "1.2. API Server", + "Section": "1 Control Plane Components", + "SubSection": "1.2 API Server", "Profile": "Level 2 - Master Node", "AssessmentStatus": "Automated", "Description": "Limit the `Node` and `Pod` objects that a kubelet could modify.", @@ -775,8 +775,8 @@ ], "Attributes": [ { - "Section": "1. Control Plane Components", - "SubSection": "1.2. API Server", + "Section": "1 Control Plane Components", + "SubSection": "1.2 API Server", "Profile": "Level 1 - Master Node", "AssessmentStatus": "Automated", "Description": "Disable profiling, if not needed.", @@ -798,8 +798,8 @@ ], "Attributes": [ { - "Section": "1. Control Plane Components", - "SubSection": "1.2. API Server", + "Section": "1 Control Plane Components", + "SubSection": "1.2 API Server", "Profile": "Level 1 - Master Node", "AssessmentStatus": "Automated", "Description": "Enable auditing on the Kubernetes API Server and set the desired audit log path.", @@ -821,8 +821,8 @@ ], "Attributes": [ { - "Section": "1. Control Plane Components", - "SubSection": "1.2. API Server", + "Section": "1 Control Plane Components", + "SubSection": "1.2 API Server", "Profile": "Level 1 - Master Node", "AssessmentStatus": "Automated", "Description": "Retain the logs for at least 30 days or as appropriate.", @@ -844,8 +844,8 @@ ], "Attributes": [ { - "Section": "1. Control Plane Components", - "SubSection": "1.2. API Server", + "Section": "1 Control Plane Components", + "SubSection": "1.2 API Server", "Profile": "Level 1 - Master Node", "AssessmentStatus": "Automated", "Description": "Retain 10 or an appropriate number of old log files.", @@ -867,8 +867,8 @@ ], "Attributes": [ { - "Section": "1. Control Plane Components", - "SubSection": "1.2. API Server", + "Section": "1 Control Plane Components", + "SubSection": "1.2 API Server", "Profile": "Level 1 - Master Node", "AssessmentStatus": "Automated", "Description": "Rotate log files on reaching 100 MB or as appropriate.", @@ -890,8 +890,8 @@ ], "Attributes": [ { - "Section": "1. Control Plane Components", - "SubSection": "1.2. API Server", + "Section": "1 Control Plane Components", + "SubSection": "1.2 API Server", "Profile": "Level 1 - Master Node", "AssessmentStatus": "Manual", "Description": "Set global request timeout for API server requests as appropriate.", @@ -913,8 +913,8 @@ ], "Attributes": [ { - "Section": "1. Control Plane Components", - "SubSection": "1.2. API Server", + "Section": "1 Control Plane Components", + "SubSection": "1.2 API Server", "Profile": "Level 1 - Master Node", "AssessmentStatus": "Automated", "Description": "Validate service account before validating token.", @@ -936,8 +936,8 @@ ], "Attributes": [ { - "Section": "1. Control Plane Components", - "SubSection": "1.2. API Server", + "Section": "1 Control Plane Components", + "SubSection": "1.2 API Server", "Profile": "Level 1 - Master Node", "AssessmentStatus": "Automated", "Description": "Explicitly set a service account public key file for service accounts on the apiserver.", @@ -959,8 +959,8 @@ ], "Attributes": [ { - "Section": "1. Control Plane Components", - "SubSection": "1.2. API Server", + "Section": "1 Control Plane Components", + "SubSection": "1.2 API Server", "Profile": "Level 1 - Master Node", "AssessmentStatus": "Automated", "Description": "etcd should be configured to make use of TLS encryption for client connections.", @@ -982,8 +982,8 @@ ], "Attributes": [ { - "Section": "1. Control Plane Components", - "SubSection": "1.2. API Server", + "Section": "1 Control Plane Components", + "SubSection": "1.2 API Server", "Profile": "Level 1 - Master Node", "AssessmentStatus": "Automated", "Description": "Setup TLS connection on the API server.", @@ -1005,8 +1005,8 @@ ], "Attributes": [ { - "Section": "1. Control Plane Components", - "SubSection": "1.2. API Server", + "Section": "1 Control Plane Components", + "SubSection": "1.2 API Server", "Profile": "Level 1 - Master Node", "AssessmentStatus": "Automated", "Description": "Setup TLS connection on the API server.", @@ -1028,8 +1028,8 @@ ], "Attributes": [ { - "Section": "1. Control Plane Components", - "SubSection": "1.2. API Server", + "Section": "1 Control Plane Components", + "SubSection": "1.2 API Server", "Profile": "Level 1 - Master Node", "AssessmentStatus": "Automated", "Description": "etcd should be configured to make use of TLS encryption for client connections.", @@ -1051,8 +1051,8 @@ ], "Attributes": [ { - "Section": "1. Control Plane Components", - "SubSection": "1.2. API Server", + "Section": "1 Control Plane Components", + "SubSection": "1.2 API Server", "Profile": "Level 1 - Master Node", "AssessmentStatus": "Manual", "Description": "Encrypt etcd key-value store.", @@ -1072,8 +1072,8 @@ "Checks": [], "Attributes": [ { - "Section": "1. Control Plane Components", - "SubSection": "1.2. API Server", + "Section": "1 Control Plane Components", + "SubSection": "1.2 API Server", "Profile": "Level 1 - Master Node", "AssessmentStatus": "Manual", "Description": "Where `etcd` encryption is used, appropriate providers should be configured.", @@ -1095,8 +1095,8 @@ ], "Attributes": [ { - "Section": "1. Control Plane Components", - "SubSection": "1.2. API Server", + "Section": "1 Control Plane Components", + "SubSection": "1.2 API Server", "Profile": "Level 1 - Master Node", "AssessmentStatus": "Manual", "Description": "Ensure that the API server is configured to only use strong cryptographic ciphers.", @@ -1118,8 +1118,8 @@ ], "Attributes": [ { - "Section": "1. Control Plane Components", - "SubSection": "1.3. Controller Manager", + "Section": "1 Control Plane Components", + "SubSection": "1.3 Controller Manager", "Profile": "Level 1 - Master Node", "AssessmentStatus": "Manual", "Description": "Activate garbage collector on pod termination, as appropriate.", @@ -1141,8 +1141,8 @@ ], "Attributes": [ { - "Section": "1. Control Plane Components", - "SubSection": "1.3. Controller Manager", + "Section": "1 Control Plane Components", + "SubSection": "1.3 Controller Manager", "Profile": "Level 1 - Master Node", "AssessmentStatus": "Automated", "Description": "Disable profiling, if not needed.", @@ -1164,8 +1164,8 @@ ], "Attributes": [ { - "Section": "1. Control Plane Components", - "SubSection": "1.3. Controller Manager", + "Section": "1 Control Plane Components", + "SubSection": "1.3 Controller Manager", "Profile": "Level 1 - Master Node", "AssessmentStatus": "Automated", "Description": "Use individual service account credentials for each controller.", @@ -1187,8 +1187,8 @@ ], "Attributes": [ { - "Section": "1. Control Plane Components", - "SubSection": "1.3. Controller Manager", + "Section": "1 Control Plane Components", + "SubSection": "1.3 Controller Manager", "Profile": "Level 1 - Master Node", "AssessmentStatus": "Automated", "Description": "Explicitly set a service account private key file for service accounts on the controller manager.", @@ -1210,8 +1210,8 @@ ], "Attributes": [ { - "Section": "1. Control Plane Components", - "SubSection": "1.3. Controller Manager", + "Section": "1 Control Plane Components", + "SubSection": "1.3 Controller Manager", "Profile": "Level 1 - Master Node", "AssessmentStatus": "Automated", "Description": "Allow pods to verify the API server's serving certificate before establishing connections.", @@ -1233,8 +1233,8 @@ ], "Attributes": [ { - "Section": "1. Control Plane Components", - "SubSection": "1.3. Controller Manager", + "Section": "1 Control Plane Components", + "SubSection": "1.3 Controller Manager", "Profile": "Level 1 - Master Node", "AssessmentStatus": "Automated", "Description": "Enable kubelet server certificate rotation on controller-manager.", @@ -1256,8 +1256,8 @@ ], "Attributes": [ { - "Section": "1. Control Plane Components", - "SubSection": "1.3. Controller Manager", + "Section": "1 Control Plane Components", + "SubSection": "1.3 Controller Manager", "Profile": "Level 1 - Master Node", "AssessmentStatus": "Automated", "Description": "Do not bind the Controller Manager service to non-loopback insecure addresses.", @@ -1279,8 +1279,8 @@ ], "Attributes": [ { - "Section": "1. Control Plane Components", - "SubSection": "1.4. Scheduler", + "Section": "1 Control Plane Components", + "SubSection": "1.4 Scheduler", "Profile": "Level 1 - Master Node", "AssessmentStatus": "Automated", "Description": "Disable profiling, if not needed.", @@ -1302,8 +1302,8 @@ ], "Attributes": [ { - "Section": "1. Control Plane Components", - "SubSection": "1.4. Scheduler", + "Section": "1 Control Plane Components", + "SubSection": "1.4 Scheduler", "Profile": "Level 1 - Master Node", "AssessmentStatus": "Automated", "Description": "Do not bind the scheduler service to non-loopback insecure addresses.", @@ -1325,7 +1325,7 @@ ], "Attributes": [ { - "Section": "2. etcd", + "Section": "2 etcd", "Profile": "Level 1 - Master Node", "AssessmentStatus": "Automated", "Description": "Configure TLS encryption for the etcd service.", @@ -1347,7 +1347,7 @@ ], "Attributes": [ { - "Section": "2. etcd", + "Section": "2 etcd", "Profile": "Level 1 - Master Node", "AssessmentStatus": "Automated", "Description": "Enable client authentication on etcd service.", @@ -1369,7 +1369,7 @@ ], "Attributes": [ { - "Section": "2. etcd", + "Section": "2 etcd", "Profile": "Level 1 - Master Node", "AssessmentStatus": "Automated", "Description": "Do not use self-signed certificates for TLS.", @@ -1391,7 +1391,7 @@ ], "Attributes": [ { - "Section": "2. etcd", + "Section": "2 etcd", "Profile": "Level 1 - Master Node", "AssessmentStatus": "Automated", "Description": "etcd should be configured to make use of TLS encryption for peer connections.", @@ -1413,7 +1413,7 @@ ], "Attributes": [ { - "Section": "2. etcd", + "Section": "2 etcd", "Profile": "Level 1 - Master Node", "AssessmentStatus": "Automated", "Description": "etcd should be configured for peer authentication.", @@ -1435,7 +1435,7 @@ ], "Attributes": [ { - "Section": "2. etcd", + "Section": "2 etcd", "Profile": "Level 1 - Master Node", "AssessmentStatus": "Automated", "Description": "Do not use automatically generated self-signed certificates for TLS connections between peers.", @@ -1457,7 +1457,7 @@ ], "Attributes": [ { - "Section": "2. etcd", + "Section": "2 etcd", "Profile": "Level 2 - Master Node", "AssessmentStatus": "Manual", "Description": "Use a different certificate authority for etcd from the one used for Kubernetes.", @@ -1477,8 +1477,8 @@ "Checks": [], "Attributes": [ { - "Section": "3. Control Plane Configuration", - "SubSection": "3.1. Authentication and Authorization", + "Section": "3 Control Plane Configuration", + "SubSection": "3.1 Authentication and Authorization", "Profile": "Level 1 - Master Node", "AssessmentStatus": "Manual", "Description": "Kubernetes provides the option to use client certificates for user authentication. However as there is no way to revoke these certificates when a user leaves an organization or loses their credential, they are not suitable for this purpose.It is not possible to fully disable client certificate use within a cluster as it is used for component to component authentication.", @@ -1498,8 +1498,8 @@ "Checks": [], "Attributes": [ { - "Section": "3. Control Plane Configuration", - "SubSection": "3.1. Authentication and Authorization", + "Section": "3 Control Plane Configuration", + "SubSection": "3.1 Authentication and Authorization", "Profile": "Level 1 - Master Node", "AssessmentStatus": "Manual", "Description": "Kubernetes provides service account tokens which are intended for use by workloads running in the Kubernetes cluster, for authentication to the API server.These tokens are not designed for use by end-users and do not provide for features such as revocation or expiry, making them insecure. A newer version of the feature (Bound service account token volumes) does introduce expiry but still does not allow for specific revocation.", @@ -1519,8 +1519,8 @@ "Checks": [], "Attributes": [ { - "Section": "3. Control Plane Configuration", - "SubSection": "3.1. Authentication and Authorization", + "Section": "3 Control Plane Configuration", + "SubSection": "3.1 Authentication and Authorization", "Profile": "Level 1 - Master Node", "AssessmentStatus": "Manual", "Description": "Kubernetes provides bootstrap tokens which are intended for use by new nodes joining the clusterThese tokens are not designed for use by end-users they are specifically designed for the purpose of bootstrapping new nodes and not for general authentication", @@ -1540,8 +1540,8 @@ "Checks": [], "Attributes": [ { - "Section": "3. Control Plane Configuration", - "SubSection": "3.2. Logging", + "Section": "3 Control Plane Configuration", + "SubSection": "3.2 Logging", "Profile": "Level 1 - Master Node", "AssessmentStatus": "Manual", "Description": "Kubernetes can audit the details of requests made to the API server. The `--audit-policy-file` flag must be set for this logging to be enabled.", @@ -1561,8 +1561,8 @@ "Checks": [], "Attributes": [ { - "Section": "3. Control Plane Configuration", - "SubSection": "3.2. Logging", + "Section": "3 Control Plane Configuration", + "SubSection": "3.2 Logging", "Profile": "Level 2 - Master Node", "AssessmentStatus": "Manual", "Description": "Ensure that the audit policy created for the cluster covers key security concerns.", @@ -1584,8 +1584,8 @@ ], "Attributes": [ { - "Section": "4. Worker Nodes", - "SubSection": "4.1. Worker Node Configuration Files", + "Section": "4 Worker Nodes", + "SubSection": "4.1 Worker Node Configuration Files", "Profile": "Level 1 - Master Node", "AssessmentStatus": "Automated", "Description": "Ensure that the `kubelet` service file has permissions of `600` or more restrictive.", @@ -1607,8 +1607,8 @@ ], "Attributes": [ { - "Section": "4. Worker Nodes", - "SubSection": "4.1. Worker Node Configuration Files", + "Section": "4 Worker Nodes", + "SubSection": "4.1 Worker Node Configuration Files", "Profile": "Level 1 - Worker Node", "AssessmentStatus": "Automated", "Description": "Ensure that the `kubelet` service file ownership is set to `root:root`.", @@ -1628,8 +1628,8 @@ "Checks": [], "Attributes": [ { - "Section": "4. Worker Nodes", - "SubSection": "4.1. Worker Node Configuration Files", + "Section": "4 Worker Nodes", + "SubSection": "4.1 Worker Node Configuration Files", "Profile": "Level 1 - Worker Node", "AssessmentStatus": "Manual", "Description": "If `kube-proxy` is running, and if it is using a file-based kubeconfig file, ensure that the proxy kubeconfig file has permissions of `600` or more restrictive.", @@ -1649,8 +1649,8 @@ "Checks": [], "Attributes": [ { - "Section": "4. Worker Nodes", - "SubSection": "4.1. Worker Node Configuration Files", + "Section": "4 Worker Nodes", + "SubSection": "4.1 Worker Node Configuration Files", "Profile": "Level 1 - Worker Node", "AssessmentStatus": "Manual", "Description": "If `kube-proxy` is running, ensure that the file ownership of its kubeconfig file is set to `root:root`.", @@ -1672,8 +1672,8 @@ ], "Attributes": [ { - "Section": "4. Worker Nodes", - "SubSection": "4.1. Worker Node Configuration Files", + "Section": "4 Worker Nodes", + "SubSection": "4.1 Worker Node Configuration Files", "Profile": "Level 1 - Worker Node", "AssessmentStatus": "Automated", "Description": "Ensure that the `kubelet.conf` file has permissions of `600` or more restrictive.", @@ -1695,8 +1695,8 @@ ], "Attributes": [ { - "Section": "4. Worker Nodes", - "SubSection": "4.1. Worker Node Configuration Files", + "Section": "4 Worker Nodes", + "SubSection": "4.1 Worker Node Configuration Files", "Profile": "Level 1 - Worker Node", "AssessmentStatus": "Automated", "Description": "Ensure that the `kubelet.conf` file ownership is set to `root:root`.", @@ -1716,8 +1716,8 @@ "Checks": [], "Attributes": [ { - "Section": "4. Worker Nodes", - "SubSection": "4.1. Worker Node Configuration Files", + "Section": "4 Worker Nodes", + "SubSection": "4.1 Worker Node Configuration Files", "Profile": "Level 1 - Worker Node", "AssessmentStatus": "Manual", "Description": "Ensure that the certificate authorities file has permissions of `600` or more restrictive.", @@ -1737,8 +1737,8 @@ "Checks": [], "Attributes": [ { - "Section": "4. Worker Nodes", - "SubSection": "4.1. Worker Node Configuration Files", + "Section": "4 Worker Nodes", + "SubSection": "4.1 Worker Node Configuration Files", "Profile": "Level 1 - Worker Node", "AssessmentStatus": "Manual", "Description": "Ensure that the certificate authorities file ownership is set to `root:root`.", @@ -1760,8 +1760,8 @@ ], "Attributes": [ { - "Section": "4. Worker Nodes", - "SubSection": "4.1. Worker Node Configuration Files", + "Section": "4 Worker Nodes", + "SubSection": "4.1 Worker Node Configuration Files", "Profile": "Level 1 - Worker Node", "AssessmentStatus": "Automated", "Description": "Ensure that if the kubelet refers to a configuration file with the `--config` argument, that file has permissions of 600 or more restrictive.", @@ -1783,8 +1783,8 @@ ], "Attributes": [ { - "Section": "4. Worker Nodes", - "SubSection": "4.1. Worker Node Configuration Files", + "Section": "4 Worker Nodes", + "SubSection": "4.1 Worker Node Configuration Files", "Profile": "Level 1 - Worker Node", "AssessmentStatus": "Automated", "Description": "Ensure that if the kubelet refers to a configuration file with the `--config` argument, that file is owned by root:root.", @@ -1806,8 +1806,8 @@ ], "Attributes": [ { - "Section": "4. Worker Nodes", - "SubSection": "4.2. Kubelet", + "Section": "4 Worker Nodes", + "SubSection": "4.2 Kubelet", "Profile": "Level 1 - Worker Node", "AssessmentStatus": "Automated", "Description": "Disable anonymous requests to the Kubelet server.", @@ -1829,8 +1829,8 @@ ], "Attributes": [ { - "Section": "4. Worker Nodes", - "SubSection": "4.2. Kubelet", + "Section": "4 Worker Nodes", + "SubSection": "4.2 Kubelet", "Profile": "Level 1 - Worker Node", "AssessmentStatus": "Automated", "Description": "Do not allow all requests. Enable explicit authorization.", @@ -1852,8 +1852,8 @@ ], "Attributes": [ { - "Section": "4. Worker Nodes", - "SubSection": "4.2. Kubelet", + "Section": "4 Worker Nodes", + "SubSection": "4.2 Kubelet", "Profile": "Level 1 - Worker Node", "AssessmentStatus": "Automated", "Description": "Enable Kubelet authentication using certificates.", @@ -1875,8 +1875,8 @@ ], "Attributes": [ { - "Section": "4. Worker Nodes", - "SubSection": "4.2. Kubelet", + "Section": "4 Worker Nodes", + "SubSection": "4.2 Kubelet", "Profile": "Level 1 - Worker Node", "AssessmentStatus": "Manual", "Description": "Disable the read-only port.", @@ -1898,8 +1898,8 @@ ], "Attributes": [ { - "Section": "4. Worker Nodes", - "SubSection": "4.2. Kubelet", + "Section": "4 Worker Nodes", + "SubSection": "4.2 Kubelet", "Profile": "Level 1 - Worker Node", "AssessmentStatus": "Manual", "Description": "Do not disable timeouts on streaming connections.", @@ -1921,8 +1921,8 @@ ], "Attributes": [ { - "Section": "4. Worker Nodes", - "SubSection": "4.2. Kubelet", + "Section": "4 Worker Nodes", + "SubSection": "4.2 Kubelet", "Profile": "Level 1 - Worker Node", "AssessmentStatus": "Automated", "Description": "Allow Kubelet to manage iptables.", @@ -1942,8 +1942,8 @@ "Checks": [], "Attributes": [ { - "Section": "4. Worker Nodes", - "SubSection": "4.2. Kubelet", + "Section": "4 Worker Nodes", + "SubSection": "4.2 Kubelet", "Profile": "Level 1 - Worker Node", "AssessmentStatus": "Manual", "Description": "Do not override node hostnames.", @@ -1965,8 +1965,8 @@ ], "Attributes": [ { - "Section": "4. Worker Nodes", - "SubSection": "4.2. Kubelet", + "Section": "4 Worker Nodes", + "SubSection": "4.2 Kubelet", "Profile": "Level 2 - Worker Node", "AssessmentStatus": "Manual", "Description": "Security relevant information should be captured. The eventRecordQPS on the Kubelet configuration can be used to limit the rate at which events are gathered and sets the maximum event creations per second. Setting this too low could result in relevant events not being logged, however the unlimited setting of `0` could result in a denial of service on the kubelet.", @@ -1988,8 +1988,8 @@ ], "Attributes": [ { - "Section": "4. Worker Nodes", - "SubSection": "4.2. Kubelet", + "Section": "4 Worker Nodes", + "SubSection": "4.2 Kubelet", "Profile": "Level 1 - Worker Node", "AssessmentStatus": "Manual", "Description": "Setup TLS connection on the Kubelets.", @@ -2011,8 +2011,8 @@ ], "Attributes": [ { - "Section": "4. Worker Nodes", - "SubSection": "4.2. Kubelet", + "Section": "4 Worker Nodes", + "SubSection": "4.2 Kubelet", "Profile": "Level 1 - Worker Node", "AssessmentStatus": "Automated", "Description": "Enable kubelet client certificate rotation.", @@ -2032,8 +2032,8 @@ "Checks": [], "Attributes": [ { - "Section": "4. Worker Nodes", - "SubSection": "4.2. Kubelet", + "Section": "4 Worker Nodes", + "SubSection": "4.2 Kubelet", "Profile": "Level 1 - Worker Node", "AssessmentStatus": "Manual", "Description": "Enable kubelet server certificate rotation.", @@ -2055,8 +2055,8 @@ ], "Attributes": [ { - "Section": "4. Worker Nodes", - "SubSection": "4.2. Kubelet", + "Section": "4 Worker Nodes", + "SubSection": "4.2 Kubelet", "Profile": "Level 1 - Worker Node", "AssessmentStatus": "Manual", "Description": "Ensure that the Kubelet is configured to only use strong cryptographic ciphers.", @@ -2076,8 +2076,8 @@ "Checks": [], "Attributes": [ { - "Section": "4. Worker Nodes", - "SubSection": "4.2. Kubelet", + "Section": "4 Worker Nodes", + "SubSection": "4.2 Kubelet", "Profile": "Level 1 - Worker Node", "AssessmentStatus": "Manual", "Description": "Ensure that the Kubelet sets limits on the number of PIDs that can be created by pods running on the node.", @@ -2097,8 +2097,8 @@ "Checks": [], "Attributes": [ { - "Section": "4. Worker Nodes", - "SubSection": "4.3. kube-proxy", + "Section": "4 Worker Nodes", + "SubSection": "4.3 kube-proxy", "Profile": "Level 1 - Worker Node", "AssessmentStatus": "Manual", "Description": "Do not bind the kube-proxy metrics port to non-loopback addresses.", @@ -2120,8 +2120,8 @@ ], "Attributes": [ { - "Section": "5. Policies", - "SubSection": "5.1. RBAC and Service Accounts", + "Section": "5 Policies", + "SubSection": "5.1 RBAC and Service Accounts", "Profile": "Level 1 - Master Node", "AssessmentStatus": "Automated", "Description": "The RBAC role `cluster-admin` provides wide-ranging powers over the environment and should be used only where and when needed.", @@ -2143,8 +2143,8 @@ ], "Attributes": [ { - "Section": "5. Policies", - "SubSection": "5.1. RBAC and Service Accounts", + "Section": "5 Policies", + "SubSection": "5.1 RBAC and Service Accounts", "Profile": "Level 1 - Master Node", "AssessmentStatus": "Automated", "Description": "The Kubernetes API stores secrets, which may be service account tokens for the Kubernetes API or credentials used by workloads in the cluster. Access to these secrets should be restricted to the smallest possible group of users to reduce the risk of privilege escalation.", @@ -2166,8 +2166,8 @@ ], "Attributes": [ { - "Section": "5. Policies", - "SubSection": "5.1. RBAC and Service Accounts", + "Section": "5 Policies", + "SubSection": "5.1 RBAC and Service Accounts", "Profile": "Level 1 - Worker Node", "AssessmentStatus": "Automated", "Description": "Kubernetes Roles and ClusterRoles provide access to resources based on sets of objects and actions that can be taken on those objects. It is possible to set either of these to be the wildcard \"*\" which matches all items. Use of wildcards is not optimal from a security perspective as it may allow for inadvertent access to be granted when new resources are added to the Kubernetes API either as CRDs or in later versions of the product.", @@ -2189,8 +2189,8 @@ ], "Attributes": [ { - "Section": "5. Policies", - "SubSection": "5.1. RBAC and Service Accounts", + "Section": "5 Policies", + "SubSection": "5.1 RBAC and Service Accounts", "Profile": "Level 1 - Master Node", "AssessmentStatus": "Automated", "Description": "The ability to create pods in a namespace can provide a number of opportunities for privilege escalation, such as assigning privileged service accounts to these pods or mounting hostPaths with access to sensitive data (unless Pod Security Policies are implemented to restrict this access)As such, access to create new pods should be restricted to the smallest possible group of users.", @@ -2210,8 +2210,8 @@ "Checks": [], "Attributes": [ { - "Section": "5. Policies", - "SubSection": "5.1. RBAC and Service Accounts", + "Section": "5 Policies", + "SubSection": "5.1 RBAC and Service Accounts", "Profile": "Level 1 - Master Node", "AssessmentStatus": "Automated", "Description": "The `default` service account should not be used to ensure that rights granted to applications can be more easily audited and reviewed.", @@ -2231,8 +2231,8 @@ "Checks": [], "Attributes": [ { - "Section": "5. Policies", - "SubSection": "5.1. RBAC and Service Accounts", + "Section": "5 Policies", + "SubSection": "5.1 RBAC and Service Accounts", "Profile": "Level 1 - Master Node", "AssessmentStatus": "Automated", "Description": "Service accounts tokens should not be mounted in pods except where the workload running in the pod explicitly needs to communicate with the API server", @@ -2252,8 +2252,8 @@ "Checks": [], "Attributes": [ { - "Section": "5. Policies", - "SubSection": "5.1. RBAC and Service Accounts", + "Section": "5 Policies", + "SubSection": "5.1 RBAC and Service Accounts", "Profile": "Level 1 - Master Node", "AssessmentStatus": "Manual", "Description": "The special group `system:masters` should not be used to grant permissions to any user or service account, except where strictly necessary (e.g. bootstrapping access prior to RBAC being fully available)", @@ -2273,8 +2273,8 @@ "Checks": [], "Attributes": [ { - "Section": "5. Policies", - "SubSection": "5.1. RBAC and Service Accounts", + "Section": "5 Policies", + "SubSection": "5.1 RBAC and Service Accounts", "Profile": "Level 1 - Master Node", "AssessmentStatus": "Manual", "Description": "Cluster roles and roles with the impersonate, bind or escalate permissions should not be granted unless strictly required. Each of these permissions allow a particular subject to escalate their privileges beyond those explicitly granted by cluster administrators", @@ -2296,8 +2296,8 @@ ], "Attributes": [ { - "Section": "5. Policies", - "SubSection": "5.1. RBAC and Service Accounts", + "Section": "5 Policies", + "SubSection": "5.1 RBAC and Service Accounts", "Profile": "Level 1 - Master Node", "AssessmentStatus": "Manual", "Description": "The ability to create persistent volumes in a cluster can provide an opportunity for privilege escalation, via the creation of `hostPath` volumes. As persistent volumes are not covered by Pod Security Admission, a user with access to create persistent volumes may be able to get access to sensitive files from the underlying host even where restrictive Pod Security Admission policies are in place.", @@ -2319,8 +2319,8 @@ ], "Attributes": [ { - "Section": "5. Policies", - "SubSection": "5.1. RBAC and Service Accounts", + "Section": "5 Policies", + "SubSection": "5.1 RBAC and Service Accounts", "Profile": "Level 1 - Master Node", "AssessmentStatus": "Manual", "Description": "Users with access to the `Proxy` sub-resource of `Node` objects automatically have permissions to use the Kubelet API, which may allow for privilege escalation or bypass cluster security controls such as audit logs.The Kubelet provides an API which includes rights to execute commands in any container running on the node. Access to this API is covered by permissions to the main Kubernetes API via the `node` object. The proxy sub-resource specifically allows wide ranging access to the Kubelet API.Direct access to the Kubelet API bypasses controls like audit logging (there is no audit log of Kubelet API access) and admission control.", @@ -2342,8 +2342,8 @@ ], "Attributes": [ { - "Section": "5. Policies", - "SubSection": "5.1. RBAC and Service Accounts", + "Section": "5 Policies", + "SubSection": "5.1 RBAC and Service Accounts", "Profile": "Level 1 - Master Node", "AssessmentStatus": "Manual", "Description": "Users with access to the update the `approval` sub-resource of `certificateaigningrequests` objects can approve new client certificates for the Kubernetes API effectively allowing them to create new high-privileged user accounts.This can allow for privilege escalation to full cluster administrator, depending on users configured in the cluster", @@ -2365,8 +2365,8 @@ ], "Attributes": [ { - "Section": "5. Policies", - "SubSection": "5.1. RBAC and Service Accounts", + "Section": "5 Policies", + "SubSection": "5.1 RBAC and Service Accounts", "Profile": "Level 1 - Master Node", "AssessmentStatus": "Manual", "Description": "Users with rights to create/modify/delete `validatingwebhookconfigurations` or `mutatingwebhookconfigurations` can control webhooks that can read any object admitted to the cluster, and in the case of mutating webhooks, also mutate admitted objects. This could allow for privilege escalation or disruption of the operation of the cluster.", @@ -2388,8 +2388,8 @@ ], "Attributes": [ { - "Section": "5. Policies", - "SubSection": "5.1. RBAC and Service Accounts", + "Section": "5 Policies", + "SubSection": "5.1 RBAC and Service Accounts", "Profile": "Level 1 - Master Node", "AssessmentStatus": "Manual", "Description": "Users with rights to create new service account tokens at a cluster level, can create long-lived privileged credentials in the cluster. This could allow for privilege escalation and persistent access to the cluster, even if the users account has been revoked.", @@ -2409,8 +2409,8 @@ "Checks": [], "Attributes": [ { - "Section": "5. Policies", - "SubSection": "5.2. Ensure that the cluster has at least one active policy control mechanism in place", + "Section": "5 Policies", + "SubSection": "5.2 Ensure that the cluster has at least one active policy control mechanism in place", "Profile": "Level 1 - Master Node", "AssessmentStatus": "Manual", "Description": "Every Kubernetes cluster should have at least one policy control mechanism in place to enforce the other requirements in this section. This could be the in-built Pod Security Admission controller, or a third party policy control system.", @@ -2432,8 +2432,8 @@ ], "Attributes": [ { - "Section": "5. Policies", - "SubSection": "5.2. Ensure that the cluster has at least one active policy control mechanism in place", + "Section": "5 Policies", + "SubSection": "5.2 Ensure that the cluster has at least one active policy control mechanism in place", "Profile": "Level 1 - Master Node", "AssessmentStatus": "Manual", "Description": "Do not generally permit containers to be run with the `securityContext.privileged` flag set to `true`.", @@ -2455,8 +2455,8 @@ ], "Attributes": [ { - "Section": "5. Policies", - "SubSection": "5.2. Ensure that the cluster has at least one active policy control mechanism in place", + "Section": "5 Policies", + "SubSection": "5.2 Ensure that the cluster has at least one active policy control mechanism in place", "Profile": "Level 1 - Master Node", "AssessmentStatus": "Manual", "Description": "Do not generally permit containers to be run with the `hostPID` flag set to true.", @@ -2478,8 +2478,8 @@ ], "Attributes": [ { - "Section": "5. Policies", - "SubSection": "5.2. Ensure that the cluster has at least one active policy control mechanism in place", + "Section": "5 Policies", + "SubSection": "5.2 Ensure that the cluster has at least one active policy control mechanism in place", "Profile": "Level 1 - Master Node", "AssessmentStatus": "Manual", "Description": "Do not generally permit containers to be run with the `hostIPC` flag set to true.", @@ -2501,8 +2501,8 @@ ], "Attributes": [ { - "Section": "5. Policies", - "SubSection": "5.2. Ensure that the cluster has at least one active policy control mechanism in place", + "Section": "5 Policies", + "SubSection": "5.2 Ensure that the cluster has at least one active policy control mechanism in place", "Profile": "Level 1 - Master Node", "AssessmentStatus": "Manual", "Description": "Do not generally permit containers to be run with the `hostNetwork` flag set to true.", @@ -2524,8 +2524,8 @@ ], "Attributes": [ { - "Section": "5. Policies", - "SubSection": "5.2. Ensure that the cluster has at least one active policy control mechanism in place", + "Section": "5 Policies", + "SubSection": "5.2 Ensure that the cluster has at least one active policy control mechanism in place", "Profile": "Level 1 - Master Node", "AssessmentStatus": "Manual", "Description": "Do not generally permit containers to be run with the `allowPrivilegeEscalation` flag set to true. Allowing this right can lead to a process running a container getting more rights than it started with.It's important to note that these rights are still constrained by the overall container sandbox, and this setting does not relate to the use of privileged containers.", @@ -2547,8 +2547,8 @@ ], "Attributes": [ { - "Section": "5. Policies", - "SubSection": "5.2. Ensure that the cluster has at least one active policy control mechanism in place", + "Section": "5 Policies", + "SubSection": "5.2 Ensure that the cluster has at least one active policy control mechanism in place", "Profile": "Level 2 - Master Node", "AssessmentStatus": "Manual", "Description": "Do not generally permit containers to be run as the root user.", @@ -2570,8 +2570,8 @@ ], "Attributes": [ { - "Section": "5. Policies", - "SubSection": "5.2. Ensure that the cluster has at least one active policy control mechanism in place", + "Section": "5 Policies", + "SubSection": "5.2 Ensure that the cluster has at least one active policy control mechanism in place", "Profile": "Level 1 - Master Node", "AssessmentStatus": "Manual", "Description": "Do not generally permit containers with the potentially dangerous NET_RAW capability.", @@ -2593,8 +2593,8 @@ ], "Attributes": [ { - "Section": "5. Policies", - "SubSection": "5.2. Ensure that the cluster has at least one active policy control mechanism in place", + "Section": "5 Policies", + "SubSection": "5.2 Ensure that the cluster has at least one active policy control mechanism in place", "Profile": "Level 1 - Master Node", "AssessmentStatus": "Manual", "Description": "Do not generally permit containers with capabilities assigned beyond the default set.", @@ -2616,8 +2616,8 @@ ], "Attributes": [ { - "Section": "5. Policies", - "SubSection": "5.2. Ensure that the cluster has at least one active policy control mechanism in place", + "Section": "5 Policies", + "SubSection": "5.2 Ensure that the cluster has at least one active policy control mechanism in place", "Profile": "Level 2 - Master Node", "AssessmentStatus": "Manual", "Description": "Do not generally permit containers with capabilities", @@ -2639,8 +2639,8 @@ ], "Attributes": [ { - "Section": "5. Policies", - "SubSection": "5.2. Ensure that the cluster has at least one active policy control mechanism in place", + "Section": "5 Policies", + "SubSection": "5.2 Ensure that the cluster has at least one active policy control mechanism in place", "Profile": "Level 1 - Master Node", "AssessmentStatus": "Manual", "Description": "Do not generally permit Windows containers to be run with the `hostProcess` flag set to true.", @@ -2660,8 +2660,8 @@ "Checks": [], "Attributes": [ { - "Section": "5. Policies", - "SubSection": "5.2. Ensure that the cluster has at least one active policy control mechanism in place", + "Section": "5 Policies", + "SubSection": "5.2 Ensure that the cluster has at least one active policy control mechanism in place", "Profile": "Level 1 - Master Node", "AssessmentStatus": "Manual", "Description": "Do not generally admit containers which make use of `hostPath` volumes.", @@ -2683,8 +2683,8 @@ ], "Attributes": [ { - "Section": "5. Policies", - "SubSection": "5.2. Ensure that the cluster has at least one active policy control mechanism in place", + "Section": "5 Policies", + "SubSection": "5.2 Ensure that the cluster has at least one active policy control mechanism in place", "Profile": "Level 1 - Master Node", "AssessmentStatus": "Manual", "Description": "Do not generally permit containers which require the use of HostPorts.", @@ -2704,8 +2704,8 @@ "Checks": [], "Attributes": [ { - "Section": "5. Policies", - "SubSection": "5.3. Network Policies and CNI", + "Section": "5 Policies", + "SubSection": "5.3 Network Policies and CNI", "Profile": "Level 1 - Master Node", "AssessmentStatus": "Manual", "Description": "There are a variety of CNI plugins available for Kubernetes. If the CNI in use does not support Network Policies it may not be possible to effectively restrict traffic in the cluster.", @@ -2725,8 +2725,8 @@ "Checks": [], "Attributes": [ { - "Section": "5. Policies", - "SubSection": "5.3. Network Policies and CNI", + "Section": "5 Policies", + "SubSection": "5.3 Network Policies and CNI", "Profile": "Level 2 - Master Node", "AssessmentStatus": "Manual", "Description": "Use network policies to isolate traffic in your cluster network.", @@ -2748,8 +2748,8 @@ ], "Attributes": [ { - "Section": "5. Policies", - "SubSection": "5.4. Secrets Management", + "Section": "5 Policies", + "SubSection": "5.4 Secrets Management", "Profile": "Level 2 - Master Node", "AssessmentStatus": "Manual", "Description": "Kubernetes supports mounting secrets as data volumes or as environment variables. Minimize the use of environment variable secrets.", @@ -2769,8 +2769,8 @@ "Checks": [], "Attributes": [ { - "Section": "5. Policies", - "SubSection": "5.4. Secrets Management", + "Section": "5 Policies", + "SubSection": "5.4 Secrets Management", "Profile": "Level 2 - Master Node", "AssessmentStatus": "Manual", "Description": "Consider the use of an external secrets storage and management system, instead of using Kubernetes Secrets directly, if you have more complex secret management needs. Ensure the solution requires authentication to access secrets, has auditing of access to and use of secrets, and encrypts secrets. Some solutions also make it easier to rotate secrets.", @@ -2790,8 +2790,8 @@ "Checks": [], "Attributes": [ { - "Section": "5. Policies", - "SubSection": "5.5. Extensible Admission Control", + "Section": "5 Policies", + "SubSection": "5.5 Extensible Admission Control", "Profile": "Level 2 - Master Node", "AssessmentStatus": "Manual", "Description": "Configure Image Provenance for your deployment.", @@ -2811,8 +2811,8 @@ "Checks": [], "Attributes": [ { - "Section": "5. Policies", - "SubSection": "5.7. General Policies", + "Section": "5 Policies", + "SubSection": "5.7 General Policies", "Profile": "Level 1 - Master Node", "AssessmentStatus": "Manual", "Description": "Use namespaces to isolate your Kubernetes objects.", @@ -2834,8 +2834,8 @@ ], "Attributes": [ { - "Section": "5. Policies", - "SubSection": "5.7. General Policies", + "Section": "5 Policies", + "SubSection": "5.7 General Policies", "Profile": "Level 2 - Master Node", "AssessmentStatus": "Manual", "Description": "Enable `docker/default` seccomp profile in your pod definitions.", @@ -2855,8 +2855,8 @@ "Checks": [], "Attributes": [ { - "Section": "5. Policies", - "SubSection": "5.7. General Policies", + "Section": "5 Policies", + "SubSection": "5.7 General Policies", "Profile": "Level 2 - Master Node", "AssessmentStatus": "Manual", "Description": "Apply Security Context to Your Pods and Containers", @@ -2876,8 +2876,8 @@ "Checks": [], "Attributes": [ { - "Section": "5. Policies", - "SubSection": "5.7. General Policies", + "Section": "5 Policies", + "SubSection": "5.7 General Policies", "Profile": "Level 2 - Master Node", "AssessmentStatus": "Manual", "Description": "Kubernetes provides a default namespace, where objects are placed if no namespace is specified for them. Placing objects in this namespace makes application of RBAC and other controls more difficult.", diff --git a/prowler/compliance/kubernetes/cis_1.8_kubernetes.json b/prowler/compliance/kubernetes/cis_1.8_kubernetes.json index d5786b6668..88fcfd59b2 100644 --- a/prowler/compliance/kubernetes/cis_1.8_kubernetes.json +++ b/prowler/compliance/kubernetes/cis_1.8_kubernetes.json @@ -10,7 +10,7 @@ "Checks": [], "Attributes": [ { - "Section": "1. Control Plane Components", + "Section": "1 Control Plane Components", "SubSection": "1.1 Control Plane Node Configuration Files", "Profile": "Level 1 - Master Node", "AssessmentStatus": "Automated", @@ -31,7 +31,7 @@ "Checks": [], "Attributes": [ { - "Section": "1. Control Plane Components", + "Section": "1 Control Plane Components", "SubSection": "1.1 Control Plane Node Configuration Files", "Profile": "Level 1 - Master Node", "AssessmentStatus": "Automated", @@ -52,7 +52,7 @@ "Checks": [], "Attributes": [ { - "Section": "1. Control Plane Components", + "Section": "1 Control Plane Components", "SubSection": "1.1 Control Plane Node Configuration Files", "Profile": "Level 1 - Master Node", "AssessmentStatus": "Automated", @@ -73,7 +73,7 @@ "Checks": [], "Attributes": [ { - "Section": "1. Control Plane Components", + "Section": "1 Control Plane Components", "SubSection": "1.1 Control Plane Node Configuration Files", "Profile": "Level 1 - Master Node", "AssessmentStatus": "Automated", @@ -94,7 +94,7 @@ "Checks": [], "Attributes": [ { - "Section": "1. Control Plane Components", + "Section": "1 Control Plane Components", "SubSection": "1.1 Control Plane Node Configuration Files", "Profile": "Level 1 - Master Node", "AssessmentStatus": "Automated", @@ -115,7 +115,7 @@ "Checks": [], "Attributes": [ { - "Section": "1. Control Plane Components", + "Section": "1 Control Plane Components", "SubSection": "1.1 Control Plane Node Configuration Files", "Profile": "Level 1 - Master Node", "AssessmentStatus": "Automated", @@ -136,7 +136,7 @@ "Checks": [], "Attributes": [ { - "Section": "1. Control Plane Components", + "Section": "1 Control Plane Components", "SubSection": "1.1 Control Plane Node Configuration Files", "Profile": "Level 1 - Master Node", "AssessmentStatus": "Automated", @@ -157,7 +157,7 @@ "Checks": [], "Attributes": [ { - "Section": "1. Control Plane Components", + "Section": "1 Control Plane Components", "SubSection": "1.1 Control Plane Node Configuration Files", "Profile": "Level 1 - Master Node", "AssessmentStatus": "Automated", @@ -178,7 +178,7 @@ "Checks": [], "Attributes": [ { - "Section": "1. Control Plane Components", + "Section": "1 Control Plane Components", "SubSection": "1.1 Control Plane Node Configuration Files", "Profile": "Level 1 - Master Node", "AssessmentStatus": "Manual", @@ -199,7 +199,7 @@ "Checks": [], "Attributes": [ { - "Section": "1. Control Plane Components", + "Section": "1 Control Plane Components", "SubSection": "1.1 Control Plane Node Configuration Files", "Profile": "Level 1 - Master Node", "AssessmentStatus": "Manual", @@ -220,7 +220,7 @@ "Checks": [], "Attributes": [ { - "Section": "1. Control Plane Components", + "Section": "1 Control Plane Components", "SubSection": "1.1 Control Plane Node Configuration Files", "Profile": "Level 1 - Master Node", "AssessmentStatus": "Automated", @@ -241,7 +241,7 @@ "Checks": [], "Attributes": [ { - "Section": "1. Control Plane Components", + "Section": "1 Control Plane Components", "SubSection": "1.1 Control Plane Node Configuration Files", "Profile": "Level 1 - Master Node", "AssessmentStatus": "Automated", @@ -262,7 +262,7 @@ "Checks": [], "Attributes": [ { - "Section": "1. Control Plane Components", + "Section": "1 Control Plane Components", "SubSection": "1.1 Control Plane Node Configuration Files", "Profile": "Level 1 - Master Node", "AssessmentStatus": "Automated", @@ -283,7 +283,7 @@ "Checks": [], "Attributes": [ { - "Section": "1. Control Plane Components", + "Section": "1 Control Plane Components", "SubSection": "1.1 Control Plane Node Configuration Files", "Profile": "Level 1 - Master Node", "AssessmentStatus": "Automated", @@ -304,7 +304,7 @@ "Checks": [], "Attributes": [ { - "Section": "1. Control Plane Components", + "Section": "1 Control Plane Components", "SubSection": "1.1 Control Plane Node Configuration Files", "Profile": "Level 1 - Master Node", "AssessmentStatus": "Automated", @@ -325,7 +325,7 @@ "Checks": [], "Attributes": [ { - "Section": "1. Control Plane Components", + "Section": "1 Control Plane Components", "SubSection": "1.1 Control Plane Node Configuration Files", "Profile": "Level 1 - Master Node", "AssessmentStatus": "Automated", @@ -346,7 +346,7 @@ "Checks": [], "Attributes": [ { - "Section": "1. Control Plane Components", + "Section": "1 Control Plane Components", "SubSection": "1.1 Control Plane Node Configuration Files", "Profile": "Level 1 - Master Node", "AssessmentStatus": "Automated", @@ -367,7 +367,7 @@ "Checks": [], "Attributes": [ { - "Section": "1. Control Plane Components", + "Section": "1 Control Plane Components", "SubSection": "1.1 Control Plane Node Configuration Files", "Profile": "Level 1 - Master Node", "AssessmentStatus": "Automated", @@ -388,7 +388,7 @@ "Checks": [], "Attributes": [ { - "Section": "1. Control Plane Components", + "Section": "1 Control Plane Components", "SubSection": "1.1 Control Plane Node Configuration Files", "Profile": "Level 1 - Master Node", "AssessmentStatus": "Automated", @@ -409,7 +409,7 @@ "Checks": [], "Attributes": [ { - "Section": "1. Control Plane Components", + "Section": "1 Control Plane Components", "SubSection": "1.1 Control Plane Node Configuration Files", "Profile": "Level 1 - Master Node", "AssessmentStatus": "Manual", @@ -430,7 +430,7 @@ "Checks": [], "Attributes": [ { - "Section": "1. Control Plane Components", + "Section": "1 Control Plane Components", "SubSection": "1.1 Control Plane Node Configuration Files", "Profile": "Level 1 - Master Node", "AssessmentStatus": "Manual", @@ -453,7 +453,7 @@ ], "Attributes": [ { - "Section": "1. Control Plane Components", + "Section": "1 Control Plane Components", "SubSection": "1.2 API Server", "Profile": "Level 1 - Master Node", "AssessmentStatus": "Manual", @@ -476,7 +476,7 @@ ], "Attributes": [ { - "Section": "1. Control Plane Components", + "Section": "1 Control Plane Components", "SubSection": "1.2 API Server", "Profile": "Level 1 - Master Node", "AssessmentStatus": "Automated", @@ -499,7 +499,7 @@ ], "Attributes": [ { - "Section": "1. Control Plane Components", + "Section": "1 Control Plane Components", "SubSection": "1.2 API Server", "Profile": "Level 1 - Master Node", "AssessmentStatus": "Manual", @@ -522,7 +522,7 @@ ], "Attributes": [ { - "Section": "1. Control Plane Components", + "Section": "1 Control Plane Components", "SubSection": "1.2 API Server", "Profile": "Level 1 - Master Node", "AssessmentStatus": "Automated", @@ -545,7 +545,7 @@ ], "Attributes": [ { - "Section": "1. Control Plane Components", + "Section": "1 Control Plane Components", "SubSection": "1.2 API Server", "Profile": "Level 1 - Master Node", "AssessmentStatus": "Automated", @@ -568,7 +568,7 @@ ], "Attributes": [ { - "Section": "1. Control Plane Components", + "Section": "1 Control Plane Components", "SubSection": "1.2 API Server", "Profile": "Level 1 - Master Node", "AssessmentStatus": "Automated", @@ -591,7 +591,7 @@ ], "Attributes": [ { - "Section": "1. Control Plane Components", + "Section": "1 Control Plane Components", "SubSection": "1.2 API Server", "Profile": "Level 1 - Master Node", "AssessmentStatus": "Automated", @@ -614,7 +614,7 @@ ], "Attributes": [ { - "Section": "1. Control Plane Components", + "Section": "1 Control Plane Components", "SubSection": "1.2 API Server", "Profile": "Level 1 - Master Node", "AssessmentStatus": "Automated", @@ -637,7 +637,7 @@ ], "Attributes": [ { - "Section": "1. Control Plane Components", + "Section": "1 Control Plane Components", "SubSection": "1.2 API Server", "Profile": "Level 1 - Master Node", "AssessmentStatus": "Manual", @@ -660,7 +660,7 @@ ], "Attributes": [ { - "Section": "1. Control Plane Components", + "Section": "1 Control Plane Components", "SubSection": "1.2 API Server", "Profile": "Level 1 - Master Node", "AssessmentStatus": "Automated", @@ -683,7 +683,7 @@ ], "Attributes": [ { - "Section": "1. Control Plane Components", + "Section": "1 Control Plane Components", "SubSection": "1.2 API Server", "Profile": "Level 1 - Master Node", "AssessmentStatus": "Manual", @@ -706,7 +706,7 @@ ], "Attributes": [ { - "Section": "1. Control Plane Components", + "Section": "1 Control Plane Components", "SubSection": "1.2 API Server", "Profile": "Level 2 - Master Node", "AssessmentStatus": "Manual", @@ -729,7 +729,7 @@ ], "Attributes": [ { - "Section": "1. Control Plane Components", + "Section": "1 Control Plane Components", "SubSection": "1.2 API Server", "Profile": "Level 2 - Master Node", "AssessmentStatus": "Automated", @@ -752,7 +752,7 @@ ], "Attributes": [ { - "Section": "1. Control Plane Components", + "Section": "1 Control Plane Components", "SubSection": "1.2 API Server", "Profile": "Level 2 - Master Node", "AssessmentStatus": "Automated", @@ -775,7 +775,7 @@ ], "Attributes": [ { - "Section": "1. Control Plane Components", + "Section": "1 Control Plane Components", "SubSection": "1.2 API Server", "Profile": "Level 2 - Master Node", "AssessmentStatus": "Automated", @@ -798,7 +798,7 @@ ], "Attributes": [ { - "Section": "1. Control Plane Components", + "Section": "1 Control Plane Components", "SubSection": "1.2 API Server", "Profile": "Level 1 - Master Node", "AssessmentStatus": "Automated", @@ -821,7 +821,7 @@ ], "Attributes": [ { - "Section": "1. Control Plane Components", + "Section": "1 Control Plane Components", "SubSection": "1.2 API Server", "Profile": "Level 1 - Master Node", "AssessmentStatus": "Automated", @@ -844,7 +844,7 @@ ], "Attributes": [ { - "Section": "1. Control Plane Components", + "Section": "1 Control Plane Components", "SubSection": "1.2 API Server", "Profile": "Level 1 - Master Node", "AssessmentStatus": "Automated", @@ -867,7 +867,7 @@ ], "Attributes": [ { - "Section": "1. Control Plane Components", + "Section": "1 Control Plane Components", "SubSection": "1.2 API Server", "Profile": "Level 1 - Master Node", "AssessmentStatus": "Automated", @@ -890,7 +890,7 @@ ], "Attributes": [ { - "Section": "1. Control Plane Components", + "Section": "1 Control Plane Components", "SubSection": "1.2 API Server", "Profile": "Level 1 - Master Node", "AssessmentStatus": "Automated", @@ -913,7 +913,7 @@ ], "Attributes": [ { - "Section": "1. Control Plane Components", + "Section": "1 Control Plane Components", "SubSection": "1.2 API Server", "Profile": "Level 1 - Master Node", "AssessmentStatus": "Manual", @@ -936,7 +936,7 @@ ], "Attributes": [ { - "Section": "1. Control Plane Components", + "Section": "1 Control Plane Components", "SubSection": "1.2 API Server", "Profile": "Level 1 - Master Node", "AssessmentStatus": "Automated", @@ -959,7 +959,7 @@ ], "Attributes": [ { - "Section": "1. Control Plane Components", + "Section": "1 Control Plane Components", "SubSection": "1.2 API Server", "Profile": "Level 1 - Master Node", "AssessmentStatus": "Automated", @@ -982,7 +982,7 @@ ], "Attributes": [ { - "Section": "1. Control Plane Components", + "Section": "1 Control Plane Components", "SubSection": "1.2 API Server", "Profile": "Level 1 - Master Node", "AssessmentStatus": "Automated", @@ -1005,7 +1005,7 @@ ], "Attributes": [ { - "Section": "1. Control Plane Components", + "Section": "1 Control Plane Components", "SubSection": "1.2 API Server", "Profile": "Level 1 - Master Node", "AssessmentStatus": "Automated", @@ -1028,7 +1028,7 @@ ], "Attributes": [ { - "Section": "1. Control Plane Components", + "Section": "1 Control Plane Components", "SubSection": "1.2 API Server", "Profile": "Level 1 - Master Node", "AssessmentStatus": "Automated", @@ -1051,7 +1051,7 @@ ], "Attributes": [ { - "Section": "1. Control Plane Components", + "Section": "1 Control Plane Components", "SubSection": "1.2 API Server", "Profile": "Level 1 - Master Node", "AssessmentStatus": "Automated", @@ -1074,7 +1074,7 @@ ], "Attributes": [ { - "Section": "1. Control Plane Components", + "Section": "1 Control Plane Components", "SubSection": "1.2 API Server", "Profile": "Level 1 - Master Node", "AssessmentStatus": "Manual", @@ -1095,7 +1095,7 @@ "Checks": [], "Attributes": [ { - "Section": "1. Control Plane Components", + "Section": "1 Control Plane Components", "SubSection": "1.2 API Server", "Profile": "Level 1 - Master Node", "AssessmentStatus": "Manual", @@ -1118,7 +1118,7 @@ ], "Attributes": [ { - "Section": "1. Control Plane Components", + "Section": "1 Control Plane Components", "SubSection": "1.2 API Server", "Profile": "Level 1 - Master Node", "AssessmentStatus": "Manual", @@ -1141,7 +1141,7 @@ ], "Attributes": [ { - "Section": "1. Control Plane Components", + "Section": "1 Control Plane Components", "SubSection": "1.3 Controller Manager", "Profile": "Level 1 - Master Node", "AssessmentStatus": "Manual", @@ -1164,7 +1164,7 @@ ], "Attributes": [ { - "Section": "1. Control Plane Components", + "Section": "1 Control Plane Components", "SubSection": "1.3 Controller Manager", "Profile": "Level 1 - Master Node", "AssessmentStatus": "Automated", @@ -1187,7 +1187,7 @@ ], "Attributes": [ { - "Section": "1. Control Plane Components", + "Section": "1 Control Plane Components", "SubSection": "1.3 Controller Manager", "Profile": "Level 1 - Master Node", "AssessmentStatus": "Automated", @@ -1210,7 +1210,7 @@ ], "Attributes": [ { - "Section": "1. Control Plane Components", + "Section": "1 Control Plane Components", "SubSection": "1.3 Controller Manager", "Profile": "Level 1 - Master Node", "AssessmentStatus": "Automated", @@ -1233,7 +1233,7 @@ ], "Attributes": [ { - "Section": "1. Control Plane Components", + "Section": "1 Control Plane Components", "SubSection": "1.3 Controller Manager", "Profile": "Level 1 - Master Node", "AssessmentStatus": "Automated", @@ -1256,7 +1256,7 @@ ], "Attributes": [ { - "Section": "1. Control Plane Components", + "Section": "1 Control Plane Components", "SubSection": "1.3 Controller Manager", "Profile": "Level 1 - Master Node", "AssessmentStatus": "Automated", @@ -1279,7 +1279,7 @@ ], "Attributes": [ { - "Section": "1. Control Plane Components", + "Section": "1 Control Plane Components", "SubSection": "1.3 Controller Manager", "Profile": "Level 1 - Master Node", "AssessmentStatus": "Automated", @@ -1302,7 +1302,7 @@ ], "Attributes": [ { - "Section": "1. Control Plane Components", + "Section": "1 Control Plane Components", "SubSection": "1.4 Scheduler", "Profile": "Level 1 - Master Node", "AssessmentStatus": "Automated", @@ -1325,7 +1325,7 @@ ], "Attributes": [ { - "Section": "1. Control Plane Components", + "Section": "1 Control Plane Components", "SubSection": "1.4 Scheduler", "Profile": "Level 1 - Master Node", "AssessmentStatus": "Automated", @@ -1500,7 +1500,7 @@ "Checks": [], "Attributes": [ { - "Section": "3. Control Plane Configuration", + "Section": "3 Control Plane Configuration", "SubSection": "3.1 Authentication and Authorization", "Profile": "Level 1 - Master Node", "AssessmentStatus": "Manual", @@ -1521,7 +1521,7 @@ "Checks": [], "Attributes": [ { - "Section": "3. Control Plane Configuration", + "Section": "3 Control Plane Configuration", "SubSection": "3.1 Authentication and Authorization", "Profile": "Level 1 - Master Node", "AssessmentStatus": "Manual", @@ -1542,7 +1542,7 @@ "Checks": [], "Attributes": [ { - "Section": "3. Control Plane Configuration", + "Section": "3 Control Plane Configuration", "SubSection": "3.1 Authentication and Authorization", "Profile": "Level 1 - Master Node", "AssessmentStatus": "Manual", @@ -1563,7 +1563,7 @@ "Checks": [], "Attributes": [ { - "Section": "3. Control Plane Configuration", + "Section": "3 Control Plane Configuration", "SubSection": "3.2 Logging", "Profile": "Level 1 - Master Node", "AssessmentStatus": "Manual", @@ -1584,7 +1584,7 @@ "Checks": [], "Attributes": [ { - "Section": "3. Control Plane Configuration", + "Section": "3 Control Plane Configuration", "SubSection": "3.2 Logging", "Profile": "Level 2 - Master Node", "AssessmentStatus": "Manual", @@ -1607,7 +1607,7 @@ ], "Attributes": [ { - "Section": "4. Worker Nodes", + "Section": "4 Worker Nodes", "SubSection": "4.1 Worker Node Configuration Files", "Profile": "Level 1 - Master Node", "AssessmentStatus": "Automated", @@ -1630,7 +1630,7 @@ ], "Attributes": [ { - "Section": "4. Worker Nodes", + "Section": "4 Worker Nodes", "SubSection": "4.1 Worker Node Configuration Files", "Profile": "Level 1 - Worker Node", "AssessmentStatus": "Automated", @@ -1651,7 +1651,7 @@ "Checks": [], "Attributes": [ { - "Section": "4. Worker Nodes", + "Section": "4 Worker Nodes", "SubSection": "4.1 Worker Node Configuration Files", "Profile": "Level 1 - Worker Node", "AssessmentStatus": "Manual", @@ -1672,7 +1672,7 @@ "Checks": [], "Attributes": [ { - "Section": "4. Worker Nodes", + "Section": "4 Worker Nodes", "SubSection": "4.1 Worker Node Configuration Files", "Profile": "Level 1 - Worker Node", "AssessmentStatus": "Manual", @@ -1695,7 +1695,7 @@ ], "Attributes": [ { - "Section": "4. Worker Nodes", + "Section": "4 Worker Nodes", "SubSection": "4.1 Worker Node Configuration Files", "Profile": "Level 1 - Worker Node", "AssessmentStatus": "Automated", @@ -1718,7 +1718,7 @@ ], "Attributes": [ { - "Section": "4. Worker Nodes", + "Section": "4 Worker Nodes", "SubSection": "4.1 Worker Node Configuration Files", "Profile": "Level 1 - Worker Node", "AssessmentStatus": "Automated", @@ -1739,7 +1739,7 @@ "Checks": [], "Attributes": [ { - "Section": "4. Worker Nodes", + "Section": "4 Worker Nodes", "SubSection": "4.1 Worker Node Configuration Files", "Profile": "Level 1 - Worker Node", "AssessmentStatus": "Manual", @@ -1760,7 +1760,7 @@ "Checks": [], "Attributes": [ { - "Section": "4. Worker Nodes", + "Section": "4 Worker Nodes", "SubSection": "4.1 Worker Node Configuration Files", "Profile": "Level 1 - Worker Node", "AssessmentStatus": "Manual", @@ -1783,7 +1783,7 @@ ], "Attributes": [ { - "Section": "4. Worker Nodes", + "Section": "4 Worker Nodes", "SubSection": "4.1 Worker Node Configuration Files", "Profile": "Level 1 - Worker Node", "AssessmentStatus": "Automated", @@ -1806,7 +1806,7 @@ ], "Attributes": [ { - "Section": "4. Worker Nodes", + "Section": "4 Worker Nodes", "SubSection": "4.1 Worker Node Configuration Files", "Profile": "Level 1 - Worker Node", "AssessmentStatus": "Automated", @@ -1829,7 +1829,7 @@ ], "Attributes": [ { - "Section": "4. Worker Nodes", + "Section": "4 Worker Nodes", "SubSection": "4.2 Kubelet", "Profile": "Level 1 - Worker Node", "AssessmentStatus": "Automated", @@ -1852,7 +1852,7 @@ ], "Attributes": [ { - "Section": "4. Worker Nodes", + "Section": "4 Worker Nodes", "SubSection": "4.2 Kubelet", "Profile": "Level 1 - Worker Node", "AssessmentStatus": "Automated", @@ -1875,7 +1875,7 @@ ], "Attributes": [ { - "Section": "4. Worker Nodes", + "Section": "4 Worker Nodes", "SubSection": "4.2 Kubelet", "Profile": "Level 1 - Worker Node", "AssessmentStatus": "Automated", @@ -1898,7 +1898,7 @@ ], "Attributes": [ { - "Section": "4. Worker Nodes", + "Section": "4 Worker Nodes", "SubSection": "4.2 Kubelet", "Profile": "Level 1 - Worker Node", "AssessmentStatus": "Manual", @@ -1921,7 +1921,7 @@ ], "Attributes": [ { - "Section": "4. Worker Nodes", + "Section": "4 Worker Nodes", "SubSection": "4.2 Kubelet", "Profile": "Level 1 - Worker Node", "AssessmentStatus": "Manual", @@ -1944,7 +1944,7 @@ ], "Attributes": [ { - "Section": "4. Worker Nodes", + "Section": "4 Worker Nodes", "SubSection": "4.2 Kubelet", "Profile": "Level 1 - Worker Node", "AssessmentStatus": "Automated", @@ -1965,7 +1965,7 @@ "Checks": [], "Attributes": [ { - "Section": "4. Worker Nodes", + "Section": "4 Worker Nodes", "SubSection": "4.2 Kubelet", "Profile": "Level 1 - Worker Node", "AssessmentStatus": "Manual", @@ -1988,7 +1988,7 @@ ], "Attributes": [ { - "Section": "4. Worker Nodes", + "Section": "4 Worker Nodes", "SubSection": "4.2 Kubelet", "Profile": "Level 2 - Worker Node", "AssessmentStatus": "Manual", @@ -2011,7 +2011,7 @@ ], "Attributes": [ { - "Section": "4. Worker Nodes", + "Section": "4 Worker Nodes", "SubSection": "4.2 Kubelet", "Profile": "Level 1 - Worker Node", "AssessmentStatus": "Manual", @@ -2034,7 +2034,7 @@ ], "Attributes": [ { - "Section": "4. Worker Nodes", + "Section": "4 Worker Nodes", "SubSection": "4.2 Kubelet", "Profile": "Level 1 - Worker Node", "AssessmentStatus": "Automated", @@ -2055,7 +2055,7 @@ "Checks": [], "Attributes": [ { - "Section": "4. Worker Nodes", + "Section": "4 Worker Nodes", "SubSection": "4.2 Kubelet", "Profile": "Level 1 - Worker Node", "AssessmentStatus": "Manual", @@ -2078,7 +2078,7 @@ ], "Attributes": [ { - "Section": "4. Worker Nodes", + "Section": "4 Worker Nodes", "SubSection": "4.2 Kubelet", "Profile": "Level 1 - Worker Node", "AssessmentStatus": "Manual", @@ -2099,7 +2099,7 @@ "Checks": [], "Attributes": [ { - "Section": "4. Worker Nodes", + "Section": "4 Worker Nodes", "SubSection": "4.2 Kubelet", "Profile": "Level 1 - Worker Node", "AssessmentStatus": "Manual", @@ -2122,7 +2122,7 @@ ], "Attributes": [ { - "Section": "5. Policies", + "Section": "5 Policies", "SubSection": "5.1 RBAC and Service Accounts", "Profile": "Level 1 - Master Node", "AssessmentStatus": "Manual", @@ -2145,7 +2145,7 @@ ], "Attributes": [ { - "Section": "5. Policies", + "Section": "5 Policies", "SubSection": "5.1 RBAC and Service Accounts", "Profile": "Level 1 - Master Node", "AssessmentStatus": "Manual", @@ -2168,7 +2168,7 @@ ], "Attributes": [ { - "Section": "5. Policies", + "Section": "5 Policies", "SubSection": "5.1 RBAC and Service Accounts", "Profile": "Level 1 - Worker Node", "AssessmentStatus": "Manual", @@ -2191,7 +2191,7 @@ ], "Attributes": [ { - "Section": "5. Policies", + "Section": "5 Policies", "SubSection": "5.1 RBAC and Service Accounts", "Profile": "Level 1 - Master Node", "AssessmentStatus": "Manual", @@ -2212,7 +2212,7 @@ "Checks": [], "Attributes": [ { - "Section": "5. Policies", + "Section": "5 Policies", "SubSection": "5.1 RBAC and Service Accounts", "Profile": "Level 1 - Master Node", "AssessmentStatus": "Manual", @@ -2233,7 +2233,7 @@ "Checks": [], "Attributes": [ { - "Section": "5. Policies", + "Section": "5 Policies", "SubSection": "5.1 RBAC and Service Accounts", "Profile": "Level 1 - Master Node", "AssessmentStatus": "Manual", @@ -2254,7 +2254,7 @@ "Checks": [], "Attributes": [ { - "Section": "5. Policies", + "Section": "5 Policies", "SubSection": "5.1 RBAC and Service Accounts", "Profile": "Level 1 - Master Node", "AssessmentStatus": "Manual", @@ -2275,7 +2275,7 @@ "Checks": [], "Attributes": [ { - "Section": "5. Policies", + "Section": "5 Policies", "SubSection": "5.1 RBAC and Service Accounts", "Profile": "Level 1 - Master Node", "AssessmentStatus": "Manual", @@ -2298,7 +2298,7 @@ ], "Attributes": [ { - "Section": "5. Policies", + "Section": "5 Policies", "SubSection": "5.1 RBAC and Service Accounts", "Profile": "Level 1 - Master Node", "AssessmentStatus": "Manual", @@ -2321,7 +2321,7 @@ ], "Attributes": [ { - "Section": "5. Policies", + "Section": "5 Policies", "SubSection": "5.1 RBAC and Service Accounts", "Profile": "Level 1 - Master Node", "AssessmentStatus": "Manual", @@ -2344,7 +2344,7 @@ ], "Attributes": [ { - "Section": "5. Policies", + "Section": "5 Policies", "SubSection": "5.1 RBAC and Service Accounts", "Profile": "Level 1 - Master Node", "AssessmentStatus": "Manual", @@ -2367,7 +2367,7 @@ ], "Attributes": [ { - "Section": "5. Policies", + "Section": "5 Policies", "SubSection": "5.1 RBAC and Service Accounts", "Profile": "Level 1 - Master Node", "AssessmentStatus": "Manual", @@ -2390,7 +2390,7 @@ ], "Attributes": [ { - "Section": "5. Policies", + "Section": "5 Policies", "SubSection": "5.1 RBAC and Service Accounts", "Profile": "Level 1 - Master Node", "AssessmentStatus": "Manual", @@ -2411,7 +2411,7 @@ "Checks": [], "Attributes": [ { - "Section": "5. Policies", + "Section": "5 Policies", "SubSection": "5.2 Pod Security Standards", "Profile": "Level 1 - Master Node", "AssessmentStatus": "Manual", @@ -2434,7 +2434,7 @@ ], "Attributes": [ { - "Section": "5. Policies", + "Section": "5 Policies", "SubSection": "5.2 Pod Security Standards", "Profile": "Level 1 - Master Node", "AssessmentStatus": "Manual", @@ -2457,7 +2457,7 @@ ], "Attributes": [ { - "Section": "5. Policies", + "Section": "5 Policies", "SubSection": "5.2 Pod Security Standards", "Profile": "Level 1 - Master Node", "AssessmentStatus": "Automated", @@ -2480,7 +2480,7 @@ ], "Attributes": [ { - "Section": "5. Policies", + "Section": "5 Policies", "SubSection": "5.2 Pod Security Standards", "Profile": "Level 1 - Master Node", "AssessmentStatus": "Automated", @@ -2503,7 +2503,7 @@ ], "Attributes": [ { - "Section": "5. Policies", + "Section": "5 Policies", "SubSection": "5.2 Pod Security Standards", "Profile": "Level 1 - Master Node", "AssessmentStatus": "Automated", @@ -2526,7 +2526,7 @@ ], "Attributes": [ { - "Section": "5. Policies", + "Section": "5 Policies", "SubSection": "5.2 Pod Security Standards", "Profile": "Level 1 - Master Node", "AssessmentStatus": "Automated", @@ -2549,7 +2549,7 @@ ], "Attributes": [ { - "Section": "5. Policies", + "Section": "5 Policies", "SubSection": "5.2 Pod Security Standards", "Profile": "Level 2 - Master Node", "AssessmentStatus": "Automated", @@ -2572,7 +2572,7 @@ ], "Attributes": [ { - "Section": "5. Policies", + "Section": "5 Policies", "SubSection": "5.2 Pod Security Standards", "Profile": "Level 1 - Master Node", "AssessmentStatus": "Automated", @@ -2595,7 +2595,7 @@ ], "Attributes": [ { - "Section": "5. Policies", + "Section": "5 Policies", "SubSection": "5.2 Pod Security Standards", "Profile": "Level 1 - Master Node", "AssessmentStatus": "Automated", @@ -2618,7 +2618,7 @@ ], "Attributes": [ { - "Section": "5. Policies", + "Section": "5 Policies", "SubSection": "5.2 Pod Security Standards", "Profile": "Level 2 - Master Node", "AssessmentStatus": "Manual", @@ -2641,7 +2641,7 @@ ], "Attributes": [ { - "Section": "5. Policies", + "Section": "5 Policies", "SubSection": "5.2 Pod Security Standards", "Profile": "Level 1 - Master Node", "AssessmentStatus": "Manual", @@ -2662,7 +2662,7 @@ "Checks": [], "Attributes": [ { - "Section": "5. Policies", + "Section": "5 Policies", "SubSection": "5.2 Pod Security Standards", "Profile": "Level 1 - Master Node", "AssessmentStatus": "Manual", @@ -2685,7 +2685,7 @@ ], "Attributes": [ { - "Section": "5. Policies", + "Section": "5 Policies", "SubSection": "5.2 Pod Security Standards", "Profile": "Level 1 - Master Node", "AssessmentStatus": "Manual", @@ -2706,7 +2706,7 @@ "Checks": [], "Attributes": [ { - "Section": "5. Policies", + "Section": "5 Policies", "SubSection": "5.3 Network Policies and CNI", "Profile": "Level 1 - Master Node", "AssessmentStatus": "Manual", @@ -2727,7 +2727,7 @@ "Checks": [], "Attributes": [ { - "Section": "5. Policies", + "Section": "5 Policies", "SubSection": "5.3 Network Policies and CNI", "Profile": "Level 2 - Master Node", "AssessmentStatus": "Manual", @@ -2750,7 +2750,7 @@ ], "Attributes": [ { - "Section": "5. Policies", + "Section": "5 Policies", "SubSection": "5.4 Secrets Management", "Profile": "Level 2 - Master Node", "AssessmentStatus": "Manual", @@ -2771,7 +2771,7 @@ "Checks": [], "Attributes": [ { - "Section": "5. Policies", + "Section": "5 Policies", "SubSection": "5.4 Secrets Management", "Profile": "Level 2 - Master Node", "AssessmentStatus": "Manual", @@ -2792,7 +2792,7 @@ "Checks": [], "Attributes": [ { - "Section": "5. Policies", + "Section": "5 Policies", "SubSection": "5.4 Secrets Management", "Profile": "Level 2 - Master Node", "AssessmentStatus": "Manual", @@ -2813,7 +2813,7 @@ "Checks": [], "Attributes": [ { - "Section": "5. Policies", + "Section": "5 Policies", "SubSection": "5.7 General Policies", "Profile": "Level 1 - Master Node", "AssessmentStatus": "Manual", @@ -2836,7 +2836,7 @@ ], "Attributes": [ { - "Section": "5. Policies", + "Section": "5 Policies", "SubSection": "5.7 General Policies", "Profile": "Level 2 - Master Node", "AssessmentStatus": "Manual", @@ -2857,7 +2857,7 @@ "Checks": [], "Attributes": [ { - "Section": "5. Policies", + "Section": "5 Policies", "SubSection": "5.7 General Policies", "Profile": "Level 2 - Master Node", "AssessmentStatus": "Manual", @@ -2878,7 +2878,7 @@ "Checks": [], "Attributes": [ { - "Section": "5. Policies", + "Section": "5 Policies", "SubSection": "5.7 General Policies", "Profile": "Level 2 - Master Node", "AssessmentStatus": "Manual", diff --git a/prowler/compliance/m365/cis_4.0_m365.json b/prowler/compliance/m365/cis_4.0_m365.json index 608258a387..07f2bc2d29 100644 --- a/prowler/compliance/m365/cis_4.0_m365.json +++ b/prowler/compliance/m365/cis_4.0_m365.json @@ -12,7 +12,8 @@ ], "Attributes": [ { - "Section": "1.1", + "Section": "1 Microsoft 365 admin center", + "SubSection": "1.1 Users", "Profile": "E3 Level 1", "AssessmentStatus": "Automated", "Description": "Administrative accounts are special privileged accounts that could have varying levels of access to data, users, and settings. Regular user accounts should never be utilized for administrative tasks and care should be taken, in the case of a hybrid environment, to keep Administrative accounts separated from on-prem accounts. Administrative accounts should not have applications assigned so that they have no access to potentially vulnerable services (EX. email, Teams, SharePoint, etc.) and only access to perform tasks as needed for administrative purposes.Ensure administrative accounts are not `On-premises sync enabled`.", @@ -32,7 +33,8 @@ "Checks": [], "Attributes": [ { - "Section": "1.1", + "Section": "1 Microsoft 365 admin center", + "SubSection": "1.1 Users", "Profile": "E3 Level 1", "AssessmentStatus": "Manual", "Description": "Emergency access or \"break glass\" accounts are limited for emergency scenarios where normal administrative accounts are unavailable. They are not assigned to a specific user and will have a combination of physical and technical controls to prevent them from being accessed outside a true emergency. These emergencies could be due to several things, including:- Technical failures of a cellular provider or Microsoft related service such as MFA.- The last remaining Global Administrator account is inaccessible.Ensure two `Emergency Access` accounts have been defined.**Note:** Microsoft provides several recommendations for these accounts and how to configure them. For more information on this, please refer to the references section. The CIS Benchmark outlines the more critical things to consider.", @@ -54,7 +56,8 @@ ], "Attributes": [ { - "Section": "1.1", + "Section": "1 Microsoft 365 admin center", + "SubSection": "1.1 Users", "Profile": "E3 Level 1", "AssessmentStatus": "Automated", "Description": "More than one global administrator should be designated so a single admin can be monitored and to provide redundancy should a single admin leave an organization. Additionally, there should be no more than four global admins set for any tenant. Ideally global administrators will have no licenses assigned to them.", @@ -76,7 +79,8 @@ ], "Attributes": [ { - "Section": "1.1", + "Section": "1 Microsoft 365 admin center", + "SubSection": "1.1 Users", "Profile": "E3 Level 1", "AssessmentStatus": "Automated", "Description": "Administrative accounts are special privileged accounts that could have varying levels of access to data, users, and settings. A license can enable an account to gain access to a variety of different applications, depending on the license assigned.The recommended state is to not license a privileged account or use `Microsoft Entra ID P1` or `Microsoft Entra ID P2` licenses.", @@ -98,7 +102,8 @@ ], "Attributes": [ { - "Section": "1.2", + "Section": "1 Microsoft 365 admin center", + "SubSection": "1.2 Teams & groups", "Profile": "E3 Level 2", "AssessmentStatus": "Automated", "Description": "Microsoft 365 Groups is the foundational membership service that drives all teamwork across Microsoft 365. With Microsoft 365 Groups, you can give a group of people access to a collection of shared resources. While there are several different group types this recommendation concerns **Microsoft 365 Groups**.In the Administration panel, when a group is created, the default privacy value is \"Public\".", @@ -118,7 +123,8 @@ "Checks": [], "Attributes": [ { - "Section": "1.2", + "Section": "1 Microsoft 365 admin center", + "SubSection": "1.2 Teams & groups", "Profile": "E3 Level 1", "AssessmentStatus": "Automated", "Description": "Shared mailboxes are used when multiple people need access to the same mailbox, such as a company information or support email address, reception desk, or other function that might be shared by multiple people.Users with permissions to the group mailbox can send as or send on behalf of the mailbox email address if the administrator has given that user permissions to do that. This is particularly useful for help and support mailboxes because users can send emails from \"Contoso Support\" or \"Building A Reception Desk.\"Shared mailboxes are created with a corresponding user account using a system generated password that is unknown at the time of creation.The recommended state is `Sign in blocked` for `Shared mailboxes`.", @@ -140,7 +146,8 @@ ], "Attributes": [ { - "Section": "1.3", + "Section": "1 Microsoft 365 admin center", + "SubSection": "1.3 Settings", "Profile": "E3 Level 1", "AssessmentStatus": "Automated", "Description": "Microsoft cloud-only accounts have a pre-defined password policy that cannot be changed. The only items that can change are the number of days until a password expires and whether or whether passwords expire at all.", @@ -160,7 +167,8 @@ "Checks": [], "Attributes": [ { - "Section": "1.3", + "Section": "1 Microsoft 365 admin center", + "SubSection": "1.3 Settings", "Profile": "E3 Level 1", "AssessmentStatus": "Manual", "Description": "Idle session timeout allows the configuration of a setting which will timeout inactive users after a pre-determined amount of time. When a user reaches the set idle timeout session, they'll get a notification that they're about to be signed out. They have to select to stay signed in or they'll be automatically signed out of all Microsoft 365 web apps. Combined with a Conditional Access rule this will only impact unmanaged devices. A managed device is considered a device managed that is compliant or joined to a domain and using a supported browser like Microsoft Edge or Google Chrome (with the Microsoft Single Sign On) extension.The following Microsoft 365 web apps are supported.- Outlook Web App- OneDrive- SharePoint- Microsoft Fabric- Microsoft365.com and other start pages- Microsoft 365 web apps (Word, Excel, PowerPoint)- Microsoft 365 Admin Center- M365 Defender Portal- Microsoft Purview Compliance PortalThe recommended setting is `3 hours` (or less) for unmanaged devices. **Note:** Idle session timeout doesn't affect Microsoft 365 desktop and mobile apps.", @@ -180,7 +188,8 @@ "Checks": [], "Attributes": [ { - "Section": "1.3", + "Section": "1 Microsoft 365 admin center", + "SubSection": "1.3 Settings", "Profile": "E3 Level 2", "AssessmentStatus": "Automated", "Description": "External calendar sharing allows an administrator to enable the ability for users to share calendars with anyone outside of the organization. Outside users will be sent a URL that can be used to view the calendar.", @@ -200,7 +209,8 @@ "Checks": [], "Attributes": [ { - "Section": "1.3", + "Section": "1 Microsoft 365 admin center", + "SubSection": "1.3 Settings", "Profile": "E3 Level 1", "AssessmentStatus": "Manual", "Description": "By default, users can install add-ins in their Microsoft Word, Excel, and PowerPoint applications, allowing data access within the application.Do not allow users to install add-ins in Word, Excel, or PowerPoint.", @@ -220,7 +230,8 @@ "Checks": [], "Attributes": [ { - "Section": "1.3", + "Section": "1 Microsoft 365 admin center", + "SubSection": "1.3 Settings", "Profile": "E3 Level 1", "AssessmentStatus": "Manual", "Description": "Microsoft Forms can be used for phishing attacks by asking personal or sensitive information and collecting the results. Microsoft 365 has built-in protection that will proactively scan for phishing attempt in forms such personal information request.", @@ -240,7 +251,8 @@ "Checks": [], "Attributes": [ { - "Section": "1.3", + "Section": "1 Microsoft 365 admin center", + "SubSection": "1.3 Settings", "Profile": "E5 Level 2", "AssessmentStatus": "Automated", "Description": "Customer Lockbox is a security feature that provides an additional layer of control and transparency to customer data in Microsoft 365. It offers an approval process for Microsoft support personnel to access organization data and creates an audited trail to meet compliance requirements.", @@ -260,7 +272,8 @@ "Checks": [], "Attributes": [ { - "Section": "1.3", + "Section": "1 Microsoft 365 admin center", + "SubSection": "1.3 Settings", "Profile": "E3 Level 2", "AssessmentStatus": "Manual", "Description": "Third-party storage can be enabled for users in Microsoft 365, allowing them to store and share documents using services such as Dropbox, alongside OneDrive and team sites.Ensure `Microsoft 365 on the web` third-party storage services are restricted.", @@ -280,7 +293,8 @@ "Checks": [], "Attributes": [ { - "Section": "1.3", + "Section": "1 Microsoft 365 admin center", + "SubSection": "1.3 Settings", "Profile": "E3 Level 2", "AssessmentStatus": "Manual", "Description": "Sway is a Microsoft 365 app that lets organizations create interactive, web-based presentations using images, text, videos and other media. Its design engine simplifies the process, allowing for quick customization. Presentations can then be shared via a link.This setting controls user Sway sharing capability, both within and outside of the organization. By default, Sway is enabled for everyone in the organization.", @@ -300,7 +314,8 @@ "Checks": [], "Attributes": [ { - "Section": "2.1", + "Section": "2 Microsoft 365 Defender", + "SubSection": "2.1 Email & collaboration", "Profile": "E5 Level 2", "AssessmentStatus": "Automated", "Description": "Enabling Safe Links policy for Office applications allows URL's that exist inside of Office documents and email applications opened by Office, Office Online and Office mobile to be processed against Defender for Office time-of-click verification and rewritten if required.**Note:** E5 Licensing includes a number of Built-in Protection policies. When auditing policies note which policy you are viewing, and keep in mind CIS recommendations often extend the Default or Build-in Policies provided by MS. In order to **Pass** the highest priority policy must match all settings recommended.", @@ -322,7 +337,8 @@ ], "Attributes": [ { - "Section": "2.1", + "Section": "2 Microsoft 365 Defender", + "SubSection": "2.1 Email & collaboration", "Profile": "E3 Level 1", "AssessmentStatus": "Automated", "Description": "The Common Attachment Types Filter lets a user block known and custom malicious file types from being attached to emails.", @@ -344,7 +360,8 @@ ], "Attributes": [ { - "Section": "2.1", + "Section": "2 Microsoft 365 Defender", + "SubSection": "2.1 Email & collaboration", "Profile": "E3 Level 1", "AssessmentStatus": "Automated", "Description": "Exchange Online Protection (EOP) is the cloud-based filtering service that protects organizations against spam, malware, and other email threats. EOP is included in all Microsoft 365 organizations with Exchange Online mailboxes.EOP uses flexible anti-malware policies for malware protection settings. These policies can be set to notify Admins of malicious activity.", @@ -364,7 +381,8 @@ "Checks": [], "Attributes": [ { - "Section": "2.1", + "Section": "2 Microsoft 365 Defender", + "SubSection": "2.1 Email & collaboration", "Profile": "E5 Level 2", "AssessmentStatus": "Automated", "Description": "The Safe Attachments policy helps protect users from malware in email attachments by scanning attachments for viruses, malware, and other malicious content. When an email attachment is received by a user, Safe Attachments will scan the attachment in a secure environment and provide a verdict on whether the attachment is safe or not.", @@ -384,7 +402,8 @@ "Checks": [], "Attributes": [ { - "Section": "2.1", + "Section": "2 Microsoft 365 Defender", + "SubSection": "2.1 Email & collaboration", "Profile": "E5 Level 2", "AssessmentStatus": "Automated", "Description": "Safe Attachments for SharePoint, OneDrive, and Microsoft Teams scans these services for malicious files.", @@ -406,7 +425,8 @@ ], "Attributes": [ { - "Section": "2.1", + "Section": "2 Microsoft 365 Defender", + "SubSection": "2.1 Email & collaboration", "Profile": "E3 Level 1", "AssessmentStatus": "Automated", "Description": "In Microsoft 365 organizations with mailboxes in Exchange Online or standalone Exchange Online Protection (EOP) organizations without Exchange Online mailboxes, email messages are automatically protected against spam (junk email) by EOP.Configure Exchange Online Spam Policies to copy emails and notify someone when a sender in the organization has been blocked for sending spam emails.", @@ -428,7 +448,8 @@ ], "Attributes": [ { - "Section": "2.1", + "Section": "2 Microsoft 365 Defender", + "SubSection": "2.1 Email & collaboration", "Profile": "E5 Level 2", "AssessmentStatus": "Automated", "Description": "By default, Office 365 includes built-in features that help protect users from phishing attacks. Set up anti-phishing polices to increase this protection, for example by refining settings to better detect and prevent impersonation and spoofing attacks. The default policy applies to all users within the organization and is a single view to fine-tune anti-phishing protection. Custom policies can be created and configured for specific users, groups or domains within the organization and will take precedence over the default policy for the scoped users.", @@ -448,7 +469,8 @@ "Checks": [], "Attributes": [ { - "Section": "2.1", + "Section": "2 Microsoft 365 Defender", + "SubSection": "2.1 Email & collaboration", "Profile": "E3 Level 1", "AssessmentStatus": "Manual", "Description": "For each domain that is configured in Exchange, a corresponding Sender Policy Framework (SPF) record should be created.", @@ -470,7 +492,8 @@ ], "Attributes": [ { - "Section": "2.1", + "Section": "2 Microsoft 365 Defender", + "SubSection": "2.1 Email & collaboration", "Profile": "E3 Level 1", "AssessmentStatus": "Automated", "Description": "DKIM is one of the trio of Authentication methods (SPF, DKIM and DMARC) that help prevent attackers from sending messages that look like they come from your domain. DKIM lets an organization add a digital signature to outbound email messages in the message header. When DKIM is configured, the organization authorizes it's domain to associate, or sign, its name to an email message using cryptographic authentication. Email systems that get email from this domain can use a digital signature to help verify whether incoming email is legitimate.Use of DKIM in addition to SPF and DMARC to help prevent malicious actors using spoofing techniques from sending messages that look like they are coming from your domain.", @@ -490,7 +513,8 @@ "Checks": [], "Attributes": [ { - "Section": "2.1", + "Section": "2 Microsoft 365 Defender", + "SubSection": "2.1 Email & collaboration", "Profile": "E3 Level 1", "AssessmentStatus": "Manual", "Description": "DMARC, or Domain-based Message Authentication, Reporting, and Conformance, assists recipient mail systems in determining the appropriate action to take when messages from a domain fail to meet SPF or DKIM authentication criteria.", @@ -512,7 +536,8 @@ ], "Attributes": [ { - "Section": "2.1", + "Section": "2 Microsoft 365 Defender", + "SubSection": "2.1 Email & collaboration", "Profile": "E3 Level 2", "AssessmentStatus": "Automated", "Description": "The Common Attachment Types Filter lets a user block known and custom malicious file types from being attached to emails. The policy provided by Microsoft covers 53 extensions, and an additional custom list of extensions can be defined.The list of 186 extensions provided in this recommendation is comprehensive but not exhaustive.", @@ -534,7 +559,8 @@ ], "Attributes": [ { - "Section": "2.1", + "Section": "2 Microsoft 365 Defender", + "SubSection": "2.1 Email & collaboration", "Profile": "E3 Level 1", "AssessmentStatus": "Automated", "Description": "In Microsoft 365 organizations with Exchange Online mailboxes or standalone Exchange Online Protection (EOP) organizations without Exchange Online mailboxes, connection filtering and the default connection filter policy identify good or bad source email servers by IP addresses. The key components of the default connection filter policy are **IP Allow List**, **IP Block List** and **Safe list**.The recommended state is `IP Allow List` empty or undefined.", @@ -556,7 +582,8 @@ ], "Attributes": [ { - "Section": "2.1", + "Section": "2 Microsoft 365 Defender", + "SubSection": "2.1 Email & collaboration", "Profile": "E3 Level 1", "AssessmentStatus": "Automated", "Description": "In Microsoft 365 organizations with Exchange Online mailboxes or standalone Exchange Online Protection (EOP) organizations without Exchange Online mailboxes, connection filtering and the default connection filter policy identify good or bad source email servers by IP addresses. The key components of the default connection filter policy are **IP Allow List**, **IP Block List** and **Safe list**.The safe list is a pre-configured allow list that is dynamically updated by Microsoft.The recommended safe list state is: `Off` or `False`", @@ -578,7 +605,8 @@ ], "Attributes": [ { - "Section": "2.1", + "Section": "2 Microsoft 365 Defender", + "SubSection": "2.1 Email & collaboration", "Profile": "E3 Level 1", "AssessmentStatus": "Automated", "Description": "Anti-spam protection is a feature of Exchange Online that utilizes policies to help to reduce the amount of junk email, bulk and phishing emails a mailbox receives. These policies contain lists to allow or block specific senders or domains. - The allowed senders list- The allowed domains list- The blocked senders list- The blocked domains listThe recommended state is: Do not define any `Allowed domains`", @@ -598,7 +626,8 @@ "Checks": [], "Attributes": [ { - "Section": "2.4", + "Section": "2 Microsoft 365 Defender", + "SubSection": "2.4 System", "Profile": "E5 Level 1", "AssessmentStatus": "Manual", "Description": "Identify _priority accounts_ to utilize Microsoft 365's advanced custom security features. This is an essential tool to bolster protection for users who are frequently targeted due to their critical positions, such as executives, leaders, managers, or others who have access to sensitive, confidential, financial, or high-priority information.Once these accounts are identified, several services and features can be enabled, including threat policies, enhanced sign-in protection through conditional access policies, and alert policies, enabling faster response times for incident response teams.", @@ -618,7 +647,8 @@ "Checks": [], "Attributes": [ { - "Section": "2.4", + "Section": "2 Microsoft 365 Defender", + "SubSection": "2.4 System", "Profile": "E5 Level 1", "AssessmentStatus": "Manual", "Description": "Preset security policies have been established by Microsoft, utilizing observations and experiences within datacenters to strike a balance between the exclusion of malicious content from users and limiting unwarranted disruptions. These policies can apply to all, or select users and encompass recommendations for addressing spam, malware, and phishing threats. The policy parameters are pre-determined and non-adjustable.`Strict protection` has the most aggressive protection of the 3 presets.- EOP: Anti-spam, Anti-malware and Anti-phishing- Defender: Spoof protection, Impersonation protection and Advanced phishing- Defender: Safe Links and Safe Attachments**NOTE: The preset security polices cannot target Priority account TAGS currently, groups should be used instead.**", @@ -638,7 +668,8 @@ "Checks": [], "Attributes": [ { - "Section": "2.4", + "Section": "2 Microsoft 365 Defender", + "SubSection": "2.4 System", "Profile": "E5 Level 2", "AssessmentStatus": "Manual", "Description": "Microsoft Defender for Cloud Apps is a Cloud Access Security Broker (CASB). It provides visibility into suspicious activity in Microsoft 365, enabling investigation into potential security issues and facilitating the implementation of remediation measures if necessary.Some risk detection methods provided by Entra Identity Protection also require Microsoft Defender for Cloud Apps:- Suspicious manipulation of inbox rules- Suspicious inbox forwarding- New country detection- Impossible travel detection- Activity from anonymous IP addresses- Mass access to sensitive files", @@ -658,7 +689,8 @@ "Checks": [], "Attributes": [ { - "Section": "2.4", + "Section": "2 Microsoft 365 Defender", + "SubSection": "2.4 System", "Profile": "E5 Level 1", "AssessmentStatus": "Automated", "Description": "Zero-hour auto purge (ZAP) is a protection feature that retroactively detects and neutralizes malware and high confidence phishing. When ZAP for Teams protection blocks a message, the message is blocked for everyone in the chat. The initial block happens right after delivery, but ZAP occurs up to 48 hours after delivery.", @@ -680,7 +712,8 @@ ], "Attributes": [ { - "Section": "3.1", + "Section": "3 Microsoft Purview", + "SubSection": "3.1 Audit", "Profile": "E3 Level 1", "AssessmentStatus": "Automated", "Description": "When audit log search is enabled in the Microsoft Purview compliance portal, user and admin activity within the organization is recorded in the audit log and retained for 90 days. However, some organizations may prefer to use a third-party security information and event management (SIEM) application to access their auditing data. In this scenario, a global admin can choose to turn off audit log search in Microsoft 365.", @@ -700,7 +733,8 @@ "Checks": [], "Attributes": [ { - "Section": "3.2", + "Section": "3 Microsoft Purview", + "SubSection": "3.1 Audit", "Profile": "E3 Level 1", "AssessmentStatus": "Manual", "Description": "Data Loss Prevention (DLP) policies allow Exchange Online and SharePoint Online content to be scanned for specific types of data like social security numbers, credit card numbers, or passwords.", @@ -720,7 +754,8 @@ "Checks": [], "Attributes": [ { - "Section": "3.2", + "Section": "3 Microsoft Purview", + "SubSection": "3.1 Audit", "Profile": "E5 Level 1", "AssessmentStatus": "Manual", "Description": "The default Teams Data Loss Prevention (DLP) policy rule in Microsoft 365 is a preconfigured rule that is automatically applied to all Teams conversations and channels. The default rule helps prevent accidental sharing of sensitive information by detecting and blocking certain types of content that are deemed sensitive or inappropriate by the organization. By default, the rule includes a check for the sensitive info type _Credit Card Number_ which is pre-defined by Microsoft.", @@ -740,7 +775,8 @@ "Checks": [], "Attributes": [ { - "Section": "3.3", + "Section": "3 Microsoft Purview", + "SubSection": "3.3 Information protection", "Profile": "E3 Level 1", "AssessmentStatus": "Manual", "Description": "SharePoint Online Data Classification Policies enables organizations to classify and label content in SharePoint Online based on its sensitivity and business impact. This setting helps organizations to manage and protect sensitive data by automatically applying labels to content, which can then be used to apply policy-based protection and governance controls.", @@ -760,7 +796,8 @@ "Checks": [], "Attributes": [ { - "Section": "5.1.1", + "Section": "5 Microsoft Entra admin center", + "SubSection": "5.1 Identity", "Profile": "E3 Level 1", "AssessmentStatus": "Manual", "Description": "Security defaults in Microsoft Entra ID make it easier to be secure and help protect the organization. Security defaults contain preconfigured security settings for common attacks.By default, Microsoft enables security defaults. The goal is to ensure that all organizations have a basic level of security enabled. The security default setting is manipulated in the Entra admin center.The use of security defaults, however, will prohibit custom settings which are being set with more advanced settings from this benchmark.", @@ -780,7 +817,8 @@ "Checks": [], "Attributes": [ { - "Section": "5.1.2", + "Section": "5 Microsoft Entra admin center", + "SubSection": "5.1 Identity", "Profile": "E3 Level 1", "AssessmentStatus": "Manual", "Description": "Legacy per-user Multi-Factor Authentication (MFA) can be configured to require individual users to provide multiple authentication factors, such as passwords and additional verification codes, to access their accounts. It was introduced in earlier versions of Office 365, prior to the more comprehensive implementation of Conditional Access (CA).", @@ -802,7 +840,8 @@ ], "Attributes": [ { - "Section": "5.1.2", + "Section": "5 Microsoft Entra admin center", + "SubSection": "5.1 Identity", "Profile": "E3 Level 2", "AssessmentStatus": "Automated", "Description": "App registration allows users to register custom-developed applications for use within the directory.", @@ -824,7 +863,8 @@ ], "Attributes": [ { - "Section": "5.1.2", + "Section": "5 Microsoft Entra admin center", + "SubSection": "5.1 Identity", "Profile": "E3 Level 1", "AssessmentStatus": "Automated", "Description": "Non-privileged users can create tenants in the Entra administration portal under Manage tenant. The creation of a tenant is recorded in the Audit log as category \"DirectoryManagement\" and activity \"Create Company\". Anyone who creates a tenant becomes the Global Administrator of that tenant. The newly created tenant doesn't inherit any settings or configurations.", @@ -844,7 +884,8 @@ "Checks": [], "Attributes": [ { - "Section": "5.1.2", + "Section": "5 Microsoft Entra admin center", + "SubSection": "5.1 Identity", "Profile": "E3 Level 1", "AssessmentStatus": "Manual", "Description": "Restrict non-privileged users from signing into the Microsoft Entra admin center.**Note:** This recommendation only affects access to the web portal. It does not prevent privileged users from using other methods such as Rest API or PowerShell to obtain information. Those channels are addressed elsewhere in this document.", @@ -864,7 +905,8 @@ "Checks": [], "Attributes": [ { - "Section": "5.1.2", + "Section": "5 Microsoft Entra admin center", + "SubSection": "5.1 Identity", "Profile": "E3 Level 2", "AssessmentStatus": "Manual", "Description": "The option for the user to `Stay signed in`, or the `Keep me signed in` option, will prompt a user after a successful login. When the user selects this option, a persistent refresh token is created. The refresh token lasts for 90 days by default and does not prompt for sign-in or multifactor.", @@ -884,7 +926,8 @@ "Checks": [], "Attributes": [ { - "Section": "5.1.2", + "Section": "5 Microsoft Entra admin center", + "SubSection": "5.1 Identity", "Profile": "E3 Level 2", "AssessmentStatus": "Manual", "Description": "LinkedIn account connections allow users to connect their Microsoft work or school account with LinkedIn. After a user connects their accounts, information and highlights from LinkedIn are available in some Microsoft apps and services.", @@ -906,7 +949,8 @@ ], "Attributes": [ { - "Section": "5.1.3", + "Section": "5 Microsoft Entra admin center", + "SubSection": "5.1 Identity", "Profile": "E3 Level 1", "AssessmentStatus": "Automated", "Description": "A dynamic group is a dynamic configuration of security group membership for Microsoft Entra ID. Administrators can set rules to populate groups that are created in Entra ID based on user attributes (such as userType, department, or country/region). Members can be automatically added to or removed from a security group based on their attributes.The recommended state is to create a dynamic group that includes guest accounts.", @@ -928,7 +972,8 @@ ], "Attributes": [ { - "Section": "5.1.5", + "Section": "5 Microsoft Entra admin center", + "SubSection": "5.1 Identity", "Profile": "E3 Level 2", "AssessmentStatus": "Automated", "Description": "Control when end users and group owners are allowed to grant consent to applications, and when they will be required to request administrator review and approval. Allowing users to grant apps access to data helps them acquire useful applications and be productive but can represent a risk in some situations if it's not monitored and controlled carefully.", @@ -950,7 +995,8 @@ ], "Attributes": [ { - "Section": "5.1.5", + "Section": "5 Microsoft Entra admin center", + "SubSection": "5.1 Identity", "Profile": "E3 Level 1", "AssessmentStatus": "Manual", "Description": "The admin consent workflow gives admins a secure way to grant access to applications that require admin approval. When a user tries to access an application but is unable to provide consent, they can send a request for admin approval. The request is sent via email to admins who have been designated as reviewers. A reviewer takes action on the request, and the user is notified of the action.", @@ -970,7 +1016,8 @@ "Checks": [], "Attributes": [ { - "Section": "5.1.6", + "Section": "5 Microsoft Entra admin center", + "SubSection": "5.1 Identity", "Profile": "E3 Level 2", "AssessmentStatus": "Manual", "Description": "B2B collaboration is a feature within Microsoft Entra External ID that allows for guest invitations to an organization.Ensure users can only send invitations to `specified domains`.**Note:** This list works independently from OneDrive for Business and SharePoint Online allow/block lists. To restrict individual file sharing in SharePoint Online, set up an allow or blocklist for OneDrive for Business and SharePoint Online. For instance, in SharePoint or OneDrive users can still share with external users from prohibited domains by using Anyone links if they haven't been disabled.", @@ -992,7 +1039,8 @@ ], "Attributes": [ { - "Section": "5.1.6", + "Section": "5 Microsoft Entra admin center", + "SubSection": "5.1 Identity", "Profile": "E3 Level 1", "AssessmentStatus": "Automated", "Description": "Microsoft Entra ID, part of Microsoft Entra, allows you to restrict what external guest users can see in their organization in Microsoft Entra ID. Guest users are set to a limited permission level by default in Microsoft Entra ID, while the default for member users is the full set of user permissions. These directory level permissions are enforced across Microsoft Entra services including Microsoft Graph, PowerShell v2, the Azure portal, and My Apps portal. Microsoft 365 services leveraging Microsoft 365 groups for collaboration scenarios are also affected, specifically Outlook, Microsoft Teams, and SharePoint. They do not override the SharePoint or Microsoft Teams guest settings.The recommended state is at least `Guest users have limited access to properties and memberships of directory objects` or more restrictive.", @@ -1014,7 +1062,8 @@ ], "Attributes": [ { - "Section": "5.1.6", + "Section": "5 Microsoft Entra admin center", + "SubSection": "5.1 Identity", "Profile": "E3 Level 2", "AssessmentStatus": "Automated", "Description": "By default, all users in the organization, including B2B collaboration guest users, can invite external users to B2B collaboration. The ability to send invitations can be limited by turning it on or off for everyone, or by restricting invitations to certain roles.The recommended state for guest invite restrictions is `Only users assigned to specific admin roles can invite guest users`.", @@ -1036,7 +1085,8 @@ ], "Attributes": [ { - "Section": "5.1.8", + "Section": "5 Microsoft Entra admin center", + "SubSection": "5.1 Identity", "Profile": "E3 Level 1", "AssessmentStatus": "Automated", "Description": "Password hash synchronization is one of the sign-in methods used to accomplish hybrid identity synchronization. Microsoft Entra Connect synchronizes a hash, of the hash, of a user's password from an on-premises Active Directory instance to a cloud-based Entra ID instance.**Note:** Audit and remediation procedures in this recommendation only apply to Microsoft 365 tenants operating in a hybrid configuration using Entra Connect sync, and does not apply to federated domains.", @@ -1058,7 +1108,8 @@ ], "Attributes": [ { - "Section": "5.2.2", + "Section": "5 Microsoft Entra admin center", + "SubSection": "5.2 Protection", "Profile": "E3 Level 1", "AssessmentStatus": "Manual", "Description": "Multifactor authentication is a process that requires an additional form of identification during the sign-in process, such as a code from a mobile device or a fingerprint scan, to enhance security.Ensure users in administrator roles have MFA capabilities enabled.", @@ -1080,7 +1131,8 @@ ], "Attributes": [ { - "Section": "5.2.2", + "Section": "5 Microsoft Entra admin center", + "SubSection": "5.2 Protection", "Profile": "E3 Level 1", "AssessmentStatus": "Manual", "Description": "Enable multifactor authentication for all users in the Microsoft 365 tenant. Users will be prompted to authenticate with a second factor upon logging in to Microsoft 365 services. The second factor is most commonly a text message to a registered mobile phone number where they type in an authorization code, or with a mobile application like Microsoft Authenticator.", @@ -1102,7 +1154,8 @@ ], "Attributes": [ { - "Section": "5.2.2", + "Section": "5 Microsoft Entra admin center", + "SubSection": "5.2 Protection", "Profile": "E3 Level 1", "AssessmentStatus": "Manual", "Description": "Entra ID supports the most widely used authentication and authorization protocols including legacy authentication. This authentication pattern includes basic authentication, a widely used industry-standard method for collecting username and password information.The following messaging protocols support legacy authentication:- Authenticated SMTP - Used to send authenticated email messages.- Autodiscover - Used by Outlook and EAS clients to find and connect to mailboxes in Exchange Online.- Exchange ActiveSync (EAS) - Used to connect to mailboxes in Exchange Online.- Exchange Online PowerShell - Used to connect to Exchange Online with remote PowerShell. If you block Basic authentication for Exchange Online PowerShell, you need to use the Exchange Online PowerShell Module to connect. For instructions, see Connect to Exchange Online PowerShell using multifactor authentication.- Exchange Web Services (EWS) - A programming interface that's used by Outlook, Outlook for Mac, and third-party apps.- IMAP4 - Used by IMAP email clients.- MAPI over HTTP (MAPI/HTTP) - Primary mailbox access protocol used by Outlook 2010 SP2 and later.- Offline Address Book (OAB) - A copy of address list collections that are downloaded and used by Outlook.- Outlook Anywhere (RPC over HTTP) - Legacy mailbox access protocol supported by all current Outlook versions.- POP3 - Used by POP email clients.- Reporting Web Services - Used to retrieve report data in Exchange Online.- Universal Outlook - Used by the Mail and Calendar app for Windows 10.- Other clients - Other protocols identified as utilizing legacy authentication.", @@ -1124,7 +1177,8 @@ ], "Attributes": [ { - "Section": "5.2.2", + "Section": "5 Microsoft Entra admin center", + "SubSection": "5.2 Protection", "Profile": "E3 Level 1", "AssessmentStatus": "Manual", "Description": "In complex deployments, organizations might have a need to restrict authentication sessions. Conditional Access policies allow for the targeting of specific user accounts. Some scenarios might include:- Resource access from an unmanaged or shared device- Access to sensitive information from an external network- High-privileged users- Business-critical applicationsEnsure Sign-in frequency periodic reauthentication does not exceed `4 hours` for E3 tenants, or `24 hours` for E5 tenants using Privileged Identity Management.Ensure `Persistent browser session` is set to `Never persistent`**Note:** This CA policy can be added to the previous CA policy in this benchmark \"Ensure multifactor authentication is enabled for all users in administrative roles\"", @@ -1146,7 +1200,8 @@ ], "Attributes": [ { - "Section": "5.2.2", + "Section": "5 Microsoft Entra admin center", + "SubSection": "5.2 Protection", "Profile": "E3 Level 2", "AssessmentStatus": "Manual", "Description": "Authentication strength is a Conditional Access control that allows administrators to specify which combination of authentication methods can be used to access a resource. For example, they can make only phishing-resistant authentication methods available to access a sensitive resource. But to access a non-sensitive resource, they can allow less secure multifactor authentication (MFA) combinations, such as password + SMS.Microsoft has 3 built-in authentication strengths. MFA strength, Passwordless MFA strength, and Phishing-resistant MFA strength. Ensure administrator roles are using a CA policy with `Phishing-resistant MFA strength`.Administrators can then enroll using one of 3 methods:- FIDO2 Security Key- Windows Hello for Business- Certificate-based authentication (Multi-Factor)**Note:** Additional steps to configure methods such as FIDO2 keys are not covered here but can be found in related MS articles in the references section. The Conditional Access policy only ensures 1 of the 3 methods is used.**Warning:** Administrators should be pre-registered for a strong authentication mechanism before this Conditional Access Policy is enforced. Additionally, as stated elsewhere in the CIS Benchmark a break-glass administrator account should be excluded from this policy to ensure unfettered access in the case of an emergency.", @@ -1168,7 +1223,8 @@ ], "Attributes": [ { - "Section": "5.2.2", + "Section": "5 Microsoft Entra admin center", + "SubSection": "5.2 Protection", "Profile": "E5 Level 1", "AssessmentStatus": "Manual", "Description": "Microsoft Entra ID Protection user risk policies detect the probability that a user account has been compromised. **Note:** While Identity Protection also provides two risk policies with limited conditions, Microsoft highly recommends setting up risk-based policies in Conditional Access as opposed to the \"legacy method\" for the following benefits:- Enhanced diagnostic data- Report-only mode integration- Graph API support- Use more Conditional Access attributes like sign-in frequency in the policy", @@ -1190,7 +1246,8 @@ ], "Attributes": [ { - "Section": "5.2.2", + "Section": "5 Microsoft Entra admin center", + "SubSection": "5.2 Protection", "Profile": "E5 Level 1", "AssessmentStatus": "Manual", "Description": "Microsoft Entra ID Protection sign-in risk detects risks in real-time and offline. A risky sign-in is an indicator for a sign-in attempt that might not have been performed by the legitimate owner of a user account.**Note:** While Identity Protection also provides two risk policies with limited conditions, Microsoft highly recommends setting up risk-based policies in Conditional Access as opposed to the \"legacy method\" for the following benefits:- Enhanced diagnostic data- Report-only mode integration- Graph API support- Use more Conditional Access attributes like sign-in frequency in the policy", @@ -1212,7 +1269,8 @@ ], "Attributes": [ { - "Section": "5.2.2", + "Section": "5 Microsoft Entra admin center", + "SubSection": "5.2 Protection", "Profile": "E3 Level 2", "AssessmentStatus": "Manual", "Description": "When a Conditional Access policy targets the Microsoft Admin Portals cloud app, the policy is enforced for tokens issued to application IDs of the following Microsoft administrative portals:- Azure portal- Exchange admin center- Microsoft 365 admin center- Microsoft 365 Defender portal- Microsoft Entra admin center- Microsoft Intune admin center- Microsoft Purview compliance portal- Power Platform admin center- SharePoint admin center- Microsoft Teams admin center`Microsoft Admin Portals` should be restricted to specific pre-determined administrative roles.", @@ -1232,7 +1290,8 @@ "Checks": [], "Attributes": [ { - "Section": "5.2.2", + "Section": "5 Microsoft Entra admin center", + "SubSection": "5.2 Protection", "Profile": "E5 Level 2", "AssessmentStatus": "Manual", "Description": "Microsoft Entra ID Protection sign-in risk detects risks in real-time and offline. A risky sign-in is an indicator for a sign-in attempt that might not have been performed by the legitimate owner of a user account.**Note:** While Identity Protection also provides two risk policies with limited conditions, Microsoft highly recommends setting up risk-based policies in Conditional Access as opposed to the \"legacy method\" for the following benefits:- Enhanced diagnostic data- Report-only mode integration- Graph API support- Use more Conditional Access attributes like sign-in frequency in the policy", @@ -1254,7 +1313,8 @@ ], "Attributes": [ { - "Section": "5.2.2", + "Section": "5 Microsoft Entra admin center", + "SubSection": "5.2 Protection", "Profile": "E3 Level 1", "AssessmentStatus": "Manual", "Description": "Conditional Access (CA) can be configured to enforce access based on the device's compliance status or whether it is Entra hybrid joined. Collectively this allows CA to classify devices as managed or unmanaged, providing more granular control over authentication policies.When using `Require device to be marked as compliant`, the device must pass checks configured in **Compliance** policies defined within Intune (Endpoint Manager). Before these checks can be applied, the device must first be enrolled in Intune MDM.By selecting `Require Microsoft Entra hybrid joined device` this means the device must first be synchronized from an on-premises Active Directory to qualify for authentication.When configured to the recommended state below only one condition needs to be met for the user to authenticate from the device. This functions as an \"OR\" operator.The recommended state is:- `Require device to be marked as compliant`- `Require Microsoft Entra hybrid joined device`- `Require one of the selected controls`", @@ -1276,7 +1336,8 @@ ], "Attributes": [ { - "Section": "5.2.2", + "Section": "5 Microsoft Entra admin center", + "SubSection": "5.2 Protection", "Profile": "E3 Level 1", "AssessmentStatus": "Manual", "Description": "Conditional Access (CA) can be configured to enforce access based on the device's compliance status or whether it is Entra hybrid joined. Collectively this allows CA to classify devices as managed or not, providing more granular control over whether or not a user can register MFA on a device.When using `Require device to be marked as compliant`, the device must pass checks configured in **Compliance** policies defined within Intune (Endpoint Manager). Before these checks can be applied, the device must first be enrolled in Intune MDM.By selecting `Require Microsoft Entra hybrid joined device` this means the device must first be synchronized from an on-premises Active Directory to qualify for authentication.When configured to the recommended state below only one condition needs to be met for the user to register MFA from the device. This functions as an \"OR\" operator.The recommended state is to restrict `Register security information` to a device that is marked as compliant or Entra hybrid joined.", @@ -1296,7 +1357,8 @@ "Checks": [], "Attributes": [ { - "Section": "5.2.3", + "Section": "5 Microsoft Entra admin center", + "SubSection": "5.2 Protection", "Profile": "E3 Level 1", "AssessmentStatus": "Manual", "Description": "Microsoft has released additional settings to enhance the configuration of the Microsoft Authenticator application. These settings provide additional information and context to users who receive MFA passwordless and push requests, such as geographic location the request came from, the requesting application and requiring a number match.Ensure the following are `Enabled`.- `Require number matching for push notifications`- `Show application name in push and passwordless notifications`- `Show geographic location in push and passwordless notifications`**NOTE:** On February 27, 2023 Microsoft started enforcing number matching tenant-wide for all users using Microsoft Authenticator.", @@ -1316,7 +1378,8 @@ "Checks": [], "Attributes": [ { - "Section": "5.2.3", + "Section": "5 Microsoft Entra admin center", + "SubSection": "5.2 Protection", "Profile": "E3 Level 1", "AssessmentStatus": "Manual", "Description": "With Entra Password Protection, default global banned password lists are automatically applied to all users in an Entra ID tenant. To support business and security needs, custom banned password lists can be defined. When users change or reset their passwords, these banned password lists are checked to enforce the use of strong passwords.A custom banned password list should include some of the following examples:- Brand names- Product names- Locations, such as company headquarters- Company-specific internal terms- Abbreviations that have specific company meaning", @@ -1336,7 +1399,8 @@ "Checks": [], "Attributes": [ { - "Section": "5.2.3", + "Section": "5 Microsoft Entra admin center", + "SubSection": "5.2 Protection", "Profile": "E3 Level 1", "AssessmentStatus": "Manual", "Description": "Microsoft Entra Password Protection provides a global and custom banned password list. A password change request fails if there's a match in these banned password list. To protect on-premises Active Directory Domain Services (AD DS) environment, install and configure Entra Password Protection.**Note**: This recommendation applies to Hybrid deployments only and will have no impact unless working with on-premises Active Directory.", @@ -1356,7 +1420,8 @@ "Checks": [], "Attributes": [ { - "Section": "5.2.3", + "Section": "5 Microsoft Entra admin center", + "SubSection": "5.2 Protection", "Profile": "E3 Level 1", "AssessmentStatus": "Manual", "Description": "Microsoft defines Multifactor authentication capable as being registered and enabled for a strong authentication method. The method must also be allowed by the authentication methods policy.Ensure all member users are `MFA capable`.", @@ -1376,7 +1441,8 @@ "Checks": [], "Attributes": [ { - "Section": "5.2.3", + "Section": "5 Microsoft Entra admin center", + "SubSection": "5.2 Protection", "Profile": "E3 Level 1", "AssessmentStatus": "Manual", "Description": "Authentication methods support a wide variety of scenarios for signing in to Microsoft 365 resources. Some of these methods are inherently more secure than others but require more investment in time to get users enrolled and operational.SMS and Voice Call rely on telephony carrier communication methods to deliver the authenticating factor.The email one-time passcode feature is a way to authenticate B2B collaboration users when they can't be authenticated through other means, such as Microsoft Entra ID, Microsoft account (MSA), or social identity providers. When a B2B guest user tries to redeem your invitation or sign in to your shared resources, they can request a temporary passcode, which is sent to their email address. Then they enter this passcode to continue signing in.The recommended state is to `Disable` these methods:- SMS- Voice Call- Email OTP", @@ -1396,7 +1462,8 @@ "Checks": [], "Attributes": [ { - "Section": "5.2.4", + "Section": "5 Microsoft Entra admin center", + "SubSection": "5.2 Protection", "Profile": "E3 Level 1", "AssessmentStatus": "Manual", "Description": "Enabling self-service password reset allows users to reset their own passwords in Entra ID. When users sign in to Microsoft 365, they will be prompted to enter additional contact information that will help them reset their password in the future. If combined registration is enabled additional information, outside of multi-factor, will not be needed. **Note:** Effective Oct. 1st, 2022, Microsoft will begin to enable combined registration for all users in Entra ID tenants created before August 15th, 2020. Tenants created after this date are enabled with combined registration by default.", @@ -1416,7 +1483,8 @@ "Checks": [], "Attributes": [ { - "Section": "5.3", + "Section": "5 Microsoft Entra admin center", + "SubSection": "5.3 Identity Governance", "Profile": "E5 Level 2", "AssessmentStatus": "Manual", "Description": "Microsoft Entra Privileged Identity Management can be used to audit roles, allow just in time activation of roles and allow for periodic role attestation. Organizations should remove permanent members from privileged Office 365 roles and instead make them eligible, through a JIT activation workflow.", @@ -1436,7 +1504,8 @@ "Checks": [], "Attributes": [ { - "Section": "5.3", + "Section": "5 Microsoft Entra admin center", + "SubSection": "5.3 Identity Governance", "Profile": "E5 Level 1", "AssessmentStatus": "Manual", "Description": "Access reviews enable administrators to establish an efficient automated process for reviewing group memberships, access to enterprise applications, and role assignments. These reviews can be scheduled to recur regularly, with flexible options for delegating the task of reviewing membership to different members of the organization.Ensure `Access reviews` for Guest Users are configured to be performed no less frequently than `monthly`.", @@ -1456,7 +1525,8 @@ "Checks": [], "Attributes": [ { - "Section": "5.3", + "Section": "5 Microsoft Entra admin center", + "SubSection": "5.3 Identity Governance", "Profile": "E5 Level 1", "AssessmentStatus": "Manual", "Description": "Access reviews enable administrators to establish an efficient automated process for reviewing group memberships, access to enterprise applications, and role assignments. These reviews can be scheduled to recur regularly, with flexible options for delegating the task of reviewing membership to different members of the organization.Ensure `Access reviews` for high privileged Entra ID roles are done `monthly` or more frequently. These reviews should include **at a minimum** the roles listed below:- Global Administrator- Exchange Administrator- SharePoint Administrator- Teams Administrator- Security Administrator**Note:** An access review is created for each role selected after completing the process.", @@ -1476,7 +1546,8 @@ "Checks": [], "Attributes": [ { - "Section": "5.3", + "Section": "5 Microsoft Entra admin center", + "SubSection": "5.3 Identity Governance", "Profile": "E5 Level 1", "AssessmentStatus": "Manual", "Description": "Microsoft Entra Privileged Identity Management can be used to audit roles, allow just in time activation of roles and allow for periodic role attestation. Requiring approval before activation allows one of the selected approvers to first review and then approve the activation prior to PIM granted the role. The approver doesn't have to be a group member or owner.The recommended state is `Require approval to activate` for the Global Administrator role.", @@ -1498,7 +1569,8 @@ ], "Attributes": [ { - "Section": "6.1", + "Section": "6 Exchange admin center", + "SubSection": "6.1 Audit", "Profile": "E3 Level 1", "AssessmentStatus": "Automated", "Description": "The value False indicates that mailbox auditing on by default is turned on for the organization. Mailbox auditing on by default in the organization overrides the mailbox auditing settings on individual mailboxes. For example, if mailbox auditing is turned off for a mailbox (the AuditEnabled property on the mailbox is False), the default mailbox actions are still audited for the mailbox, because mailbox auditing on by default is turned on for the organization.Turning off mailbox auditing on by default ($true) has the following results:- Mailbox auditing is turned off for your organization.- From the time you turn off mailbox auditing on by default, no mailbox actions are audited, even if mailbox auditing is enabled on a mailbox (the AuditEnabled property on the mailbox is True).- Mailbox auditing isn't turned on for new mailboxes and setting the AuditEnabled property on a new or existing mailbox to True is ignored.- Any mailbox audit bypass association settings (configured by using the Set-MailboxAuditBypassAssociation cmdlet) are ignored.- Existing mailbox audit records are retained until the audit log age limit for the record expires.The recommended state for this setting is `False` at the organization level. This will enable auditing and enforce the default.", @@ -1520,7 +1592,8 @@ ], "Attributes": [ { - "Section": "6.1", + "Section": "6 Exchange admin center", + "SubSection": "6.1 Audit", "Profile": "E3 Level 1", "AssessmentStatus": "Automated", "Description": "Mailbox audit logging is turned on by default in all organizations. This effort started in January 2019, and means that certain actions performed by mailbox owners, delegates, and admins are automatically logged. The corresponding mailbox audit records are available for admins to search in the mailbox audit log. Mailboxes and shared mailboxes have actions assigned to them individually in order to audit the data the organization determines valuable at the mailbox level.The recommended state is `AuditEnabled` to `True` on all user mailboxes along with additional audit actions beyond the Microsoft defaults.**Note:** Due to some differences in defaults for audit actions this recommendation is specific to users assigned an E3 license only.", @@ -1542,7 +1615,8 @@ ], "Attributes": [ { - "Section": "6.1", + "Section": "6 Exchange admin center", + "SubSection": "6.1 Audit", "Profile": "E5 Level 1", "AssessmentStatus": "Automated", "Description": "Mailbox audit logging is turned on by default in all organizations. This effort started in January 2019, and means that certain actions performed by mailbox owners, delegates, and admins are automatically logged. The corresponding mailbox audit records are available for admins to search in the mailbox audit log. Mailboxes and shared mailboxes have actions assigned to them individually in order to audit the data the organization determines valuable at the mailbox level.The recommended state is `AuditEnabled` to `True` on all user mailboxes along with additional audit actions beyond the Microsoft defaults.Note: Due to some differences in defaults for audit actions this recommendation is specific to users assigned an E5 license, or auditing addon license, only.", @@ -1564,7 +1638,8 @@ ], "Attributes": [ { - "Section": "6.1", + "Section": "6 Exchange admin center", + "SubSection": "6.1 Audit", "Profile": "E3 Level 1", "AssessmentStatus": "Automated", "Description": "When configuring a user or computer account to bypass mailbox audit logging, the system will not record any access, or actions performed by the said user or computer account on any mailbox. Administratively this was introduced to reduce the volume of entries in the mailbox audit logs on trusted user or computer accounts.Ensure `AuditBypassEnabled` is not enabled on accounts without a written exception.", @@ -1587,7 +1662,8 @@ ], "Attributes": [ { - "Section": "6.2", + "Section": "6 Exchange admin center", + "SubSection": "6.2 Mail Flow", "Profile": "E3 Level 1", "AssessmentStatus": "Automated", "Description": "Exchange Online offers several methods of managing the flow of email messages. These are Remote domain, Transport Rules, and Anti-spam outbound policies. These methods work together to provide comprehensive coverage for potential automatic forwarding channels:- Outlook forwarding using inbox rules.- Outlook forwarding configured using OOF rule.- OWA forwarding setting (ForwardingSmtpAddress).- Forwarding set by the admin using EAC (ForwardingAddress).- Forwarding using Power Automate / Flow.Ensure a `Transport rule` and `Anti-spam outbound policy` are used to block mail forwarding.**NOTE:** Any exclusions should be implemented based on organizational policy.", @@ -1609,7 +1685,8 @@ ], "Attributes": [ { - "Section": "6.2", + "Section": "6 Exchange admin center", + "SubSection": "6.2 Mail Flow", "Profile": "E3 Level 1", "AssessmentStatus": "Automated", "Description": "Mail flow rules (transport rules) in Exchange Online are used to identify and take action on messages that flow through the organization.", @@ -1631,7 +1708,8 @@ ], "Attributes": [ { - "Section": "6.2", + "Section": "6 Exchange admin center", + "SubSection": "6.2 Mail Flow", "Profile": "E3 Level 1", "AssessmentStatus": "Automated", "Description": "External callouts provide a native experience to identify emails from senders outside the organization. This is achieved by presenting a new tag on emails called \"External\" (the string is localized based on the client language setting) and exposing related user interface at the top of the message reading view to see and verify the real sender's email address.Once this feature is enabled via PowerShell, it might take 24-48 hours for users to start seeing the External sender tag in email messages received from external sources (outside of your organization), providing their Outlook version supports it.The recommended state is `ExternalInOutlook` set to `Enabled` `True`**Note:** Mail flow rules are often used by Exchange administrators to accomplish the External email tagging by appending a tag to the front of a subject line. There are limitations to this outlined [here.](https://techcommunity.microsoft.com/t5/exchange-team-blog/native-external-sender-callouts-on-email-in-outlook/ba-p/2250098) The preferred method in the CIS Benchmark is to use the native experience.", @@ -1653,7 +1731,8 @@ ], "Attributes": [ { - "Section": "6.3", + "Section": "6 Exchange admin center", + "SubSection": "6.3 Roles", "Profile": "E3 Level 2", "AssessmentStatus": "Automated", "Description": "Specify the administrators and users who can install and manage add-ins for Outlook in Exchange OnlineBy default, users can install add-ins in their Microsoft Outlook Desktop client, allowing data access within the client application.", @@ -1675,7 +1754,8 @@ ], "Attributes": [ { - "Section": "6.5", + "Section": "6 Exchange admin center", + "SubSection": "6.5 Settings", "Profile": "E3 Level 1", "AssessmentStatus": "Automated", "Description": "Modern authentication in Microsoft 365 enables authentication features like multifactor authentication (MFA) using smart cards, certificate-based authentication (CBA), and third-party SAML identity providers. When you enable modern authentication in Exchange Online, Outlook 2016 and Outlook 2013 use modern authentication to log in to Microsoft 365 mailboxes. When you disable modern authentication in Exchange Online, Outlook 2016 and Outlook 2013 use basic authentication to log in to Microsoft 365 mailboxes.When users initially configure certain email clients, like Outlook 2013 and Outlook 2016, they may be required to authenticate using enhanced authentication mechanisms, such as multifactor authentication. Other Outlook clients that are available in Microsoft 365 (for example, Outlook Mobile and Outlook for Mac 2016) always use modern authentication to log in to Microsoft 365 mailboxes.", @@ -1697,7 +1777,8 @@ ], "Attributes": [ { - "Section": "6.5", + "Section": "6 Exchange admin center", + "SubSection": "6.5 Settings", "Profile": "E3 Level 1", "AssessmentStatus": "Automated", "Description": "MailTips are informative messages displayed to users while they're composing a message. While a new message is open and being composed, Exchange analyzes the message (including recipients). If a potential problem is detected, the user is notified with a MailTip prior to sending the message. Using the information in the MailTip, the user can adjust the message to avoid undesirable situations or non-delivery reports (also known as NDRs or bounce messages).", @@ -1719,7 +1800,8 @@ ], "Attributes": [ { - "Section": "6.5", + "Section": "6 Exchange admin center", + "SubSection": "6.5 Settings", "Profile": "E3 Level 2", "AssessmentStatus": "Automated", "Description": "This setting allows users to open certain external files while working in Outlook on the web. If allowed, keep in mind that ", @@ -1741,7 +1823,8 @@ ], "Attributes": [ { - "Section": "6.5", + "Section": "6 Exchange admin center", + "SubSection": "6.5 Settings", "Profile": "E3 Level 1", "AssessmentStatus": "Automated", "Description": "This setting enables or disables authenticated client SMTP submission (SMTP AUTH) at an organization level in Exchange Online. The recommended state is `Turn off SMTP AUTH protocol for your organization` (checked).", @@ -1763,7 +1846,8 @@ ], "Attributes": [ { - "Section": "7.2", + "Section": "7 SharePoint admin center", + "SubSection": "7.2 Policies", "Profile": "E3 Level 1", "AssessmentStatus": "Automated", "Description": "Modern authentication in Microsoft 365 enables authentication features like multifactor authentication (MFA) using smart cards, certificate-based authentication (CBA), and third-party SAML identity providers.", @@ -1783,7 +1867,8 @@ "Checks": [], "Attributes": [ { - "Section": "7.2", + "Section": "7 SharePoint admin center", + "SubSection": "7.2 Policies", "Profile": "E3 Level 1", "AssessmentStatus": "Automated", "Description": "Entra ID B2B provides authentication and management of guests. Authentication happens via one-time passcode when they don't already have a work or school account or a Microsoft account. Integration with SharePoint and OneDrive allows for more granular control of how guest user accounts are managed in the organization's AAD, unifying a similar guest experience already deployed in other Microsoft 365 services such as Teams.**Note:** Global Reader role currently can't access SharePoint using PowerShell.", @@ -1805,7 +1890,8 @@ ], "Attributes": [ { - "Section": "7.2", + "Section": "7 SharePoint admin center", + "SubSection": "7.2 Policies", "Profile": "E3 Level 1", "AssessmentStatus": "Automated", "Description": "The external sharing settings govern sharing for the organization overall. Each site has its own sharing setting that can be set independently, though it must be at the same or more restrictive setting as the organization. The new and existing guests option requires people who have received invitations to sign in with their work or school account (if their organization uses Microsoft 365) or a Microsoft account, or to provide a code to verify their identity. Users can share with guests already in your organization's directory, and they can send invitations to people who will be added to the directory if they sign in.The recommended state is `New and existing guests` or less permissive.", @@ -1825,7 +1911,8 @@ "Checks": [], "Attributes": [ { - "Section": "7.2", + "Section": "7 SharePoint admin center", + "SubSection": "7.2 Policies", "Profile": "E3 Level 2", "AssessmentStatus": "Automated", "Description": "This setting governs the global permissiveness of OneDrive content sharing in the organization. OneDrive content sharing can be restricted independent of SharePoint but can never be more permissive than the level established with SharePoint.The recommended state is `Only people in your organization`.", @@ -1847,7 +1934,8 @@ ], "Attributes": [ { - "Section": "7.2", + "Section": "7 SharePoint admin center", + "SubSection": "7.2 Policies", "Profile": "E3 Level 2", "AssessmentStatus": "Automated", "Description": "SharePoint gives users the ability to share files, folders, and site collections. Internal users can share with external collaborators, and with the right permissions could share to other external parties.", @@ -1869,7 +1957,8 @@ ], "Attributes": [ { - "Section": "7.2", + "Section": "7 SharePoint admin center", + "SubSection": "7.2 Policies", "Profile": "E3 Level 2", "AssessmentStatus": "Automated", "Description": "Control sharing of documents to external domains by either blocking domains or only allowing sharing with specific named domains.", @@ -1889,7 +1978,8 @@ "Checks": [], "Attributes": [ { - "Section": "7.2", + "Section": "7 SharePoint admin center", + "SubSection": "7.2 Policies", "Profile": "E3 Level 1", "AssessmentStatus": "Automated", "Description": "This setting sets the default link type that a user will see when sharing content in OneDrive or SharePoint. It does not restrict or exclude any other options.The recommended state is `Specific people (only the people the user specifies)`", @@ -1909,7 +1999,8 @@ "Checks": [], "Attributes": [ { - "Section": "7.2", + "Section": "7 SharePoint admin center", + "SubSection": "7.2 Policies", "Profile": "E3 Level 2", "AssessmentStatus": "Manual", "Description": "External sharing of content can be restricted to specific security groups. This setting is global, applies to sharing in both SharePoint and OneDrive and cannot be set at the site level in SharePoint.The recommended state is `Enabled` or `Checked`.**Note:** Users in these security groups must be allowed to invite guests in the guest invite settings in Microsoft Entra. Identity > External Identities > External collaboration settings", @@ -1929,7 +2020,8 @@ "Checks": [], "Attributes": [ { - "Section": "7.2", + "Section": "7 SharePoint admin center", + "SubSection": "7.2 Policies", "Profile": "E3 Level 1", "AssessmentStatus": "Automated", "Description": "This policy setting configures the expiration time for each guest that is invited to the SharePoint site or with whom users share individual files and folders with.The recommended state is `30` or less.", @@ -1949,7 +2041,8 @@ "Checks": [], "Attributes": [ { - "Section": "7.2", + "Section": "7 SharePoint admin center", + "SubSection": "7.2 Policies", "Profile": "E3 Level 1", "AssessmentStatus": "Automated", "Description": "This setting configures if guests who use a verification code to access the site or links are required to reauthenticate after a set number of days.The recommended state is `15` or less.", @@ -1969,7 +2062,8 @@ "Checks": [], "Attributes": [ { - "Section": "7.2", + "Section": "7 SharePoint admin center", + "SubSection": "7.2 Policies", "Profile": "E3 Level 1", "AssessmentStatus": "Automated", "Description": "This setting configures the permission that is selected by default for sharing link from a SharePoint site.The recommended state is `View`.", @@ -1989,7 +2083,8 @@ "Checks": [], "Attributes": [ { - "Section": "7.3", + "Section": "7 SharePoint admin center", + "SubSection": "7.3 Settings", "Profile": "E5 Level 2", "AssessmentStatus": "Automated", "Description": "By default, SharePoint online allows files that Defender for Office 365 has detected as infected to be downloaded.", @@ -2011,7 +2106,8 @@ ], "Attributes": [ { - "Section": "7.3", + "Section": "7 SharePoint admin center", + "SubSection": "7.3 Settings", "Profile": "E3 Level 2", "AssessmentStatus": "Automated", "Description": "Microsoft OneDrive allows users to sign in their cloud tenant account and begin syncing select folders or the entire contents of OneDrive to a local computer. By default, this includes any computer with OneDrive already installed, whether it is Entra Joined , Entra Hybrid Joined or Active Directory Domain joined.The recommended state for this setting is `Allow syncing only on computers joined to specific domains` `Enabled: Specify the AD domain GUID(s)`", @@ -2031,7 +2127,8 @@ "Checks": [], "Attributes": [ { - "Section": "7.3", + "Section": "7 SharePoint admin center", + "SubSection": "7.3 Settings", "Profile": "E3 Level 1", "AssessmentStatus": "Manual", "Description": "This setting controls custom script execution on self-service created sites.Custom scripts can allow users to change the look, feel and behavior of sites and pages. Every script that runs in a SharePoint page (whether it's an HTML page in a document library or a JavaScript in a Script Editor Web Part) always runs in the context of the user visiting the page and the SharePoint application. This means:- Scripts have access to everything the user has access to.- Scripts can access content across several Microsoft 365 services and even beyond with Microsoft Graph integration.The recommended state is `Prevent users from running custom script on self-service created sites`.", @@ -2051,7 +2148,8 @@ "Checks": [], "Attributes": [ { - "Section": "7.3", + "Section": "7 SharePoint admin center", + "SubSection": "7.3 Settings", "Profile": "E3 Level 1", "AssessmentStatus": "Automated", "Description": "This setting controls custom script execution on a particular site (previously called \"site collection\").Custom scripts can allow users to change the look, feel and behavior of sites and pages. Every script that runs in a SharePoint page (whether it's an HTML page in a document library or a JavaScript in a Script Editor Web Part) always runs in the context of the user visiting the page and the SharePoint application. This means:- Scripts have access to everything the user has access to.- Scripts can access content across several Microsoft 365 services and even beyond with Microsoft Graph integration.The recommended state is `DenyAddAndCustomizePages` set to `$true`.", @@ -2073,7 +2171,8 @@ ], "Attributes": [ { - "Section": "8.1", + "Section": "8 Microsoft Teams admin center", + "SubSection": "8.1 Teams", "Profile": "E3 Level 2", "AssessmentStatus": "Automated", "Description": "Microsoft Teams enables collaboration via file sharing. This file sharing is conducted within Teams, using SharePoint Online, by default; however, third-party cloud services are allowed as well.**Note:** Skype for business is deprecated as of July 31, 2021 although these settings may still be valid for a period of time. See the link in the references section for more information.", @@ -2095,7 +2194,8 @@ ], "Attributes": [ { - "Section": "8.1", + "Section": "8 Microsoft Teams admin center", + "SubSection": "8.1 Teams", "Profile": "E3 Level 1", "AssessmentStatus": "Automated", "Description": "Teams channel email addresses are an optional feature that allows users to email the Teams channel directly.", @@ -2117,7 +2217,8 @@ ], "Attributes": [ { - "Section": "8.2", + "Section": "8 Microsoft Teams admin center", + "SubSection": "8.2 Users", "Profile": "E3 Level 2", "AssessmentStatus": "Automated", "Description": "This policy controls whether external domains are allowed, blocked or permitted based on an allowlist or denylist. When external domains are allowed, users in your organization can chat, add users to meetings, and use audio video conferencing with users in external organizations.The recommended state is `Allow only specific external domains` or `Block all external domains`.", @@ -2139,7 +2240,8 @@ ], "Attributes": [ { - "Section": "8.2", + "Section": "8 Microsoft Teams admin center", + "SubSection": "8.2 Users", "Profile": "E3 Level 1", "AssessmentStatus": "Automated", "Description": "This policy setting controls chats and meetings with external unmanaged Teams users (those not managed by an organization, such as Microsoft Teams (free)). The recommended state is: `People in my organization can communicate with Teams users whose accounts aren't managed by an organization` set to `Off`.", @@ -2161,7 +2263,8 @@ ], "Attributes": [ { - "Section": "8.2", + "Section": "8 Microsoft Teams admin center", + "SubSection": "8.2 Users", "Profile": "E3 Level 1", "AssessmentStatus": "Automated", "Description": "This setting prevents external users who are not managed by an organization from initiating contact with users in the protected organization.The recommended state is to uncheck `External users with Teams accounts not managed by an organization can contact users in my organization`.**Note:** Disabling this setting is used as an additional stop gap for the previous setting which disables communication with unmanaged Teams users entirely. If an organization chooses to have an exception to **(L1) Ensure communication with unmanaged Teams users is disabled** they can do so while also disabling the ability for the same group of users to initiate contact. Disabling communication entirely will also disable the ability for unmanaged users to initiate contact.", @@ -2181,7 +2284,8 @@ "Checks": [], "Attributes": [ { - "Section": "8.2", + "Section": "8 Microsoft Teams admin center", + "SubSection": "8.2 Users", "Profile": "E3 Level 1", "AssessmentStatus": "Automated", "Description": "This policy setting controls chat with external unmanaged Skype users.**Note:** Skype for business is deprecated as of July 31, 2021, although these settings may still be valid for a period of time. See the link in the reference section for more information.", @@ -2201,7 +2305,8 @@ "Checks": [], "Attributes": [ { - "Section": "8.4", + "Section": "8 Microsoft Teams admin center", + "SubSection": "8.4 Teams apps", "Profile": "E3 Level 1", "AssessmentStatus": "Manual", "Description": "This policy setting controls which class of apps are available for users to install.", @@ -2223,7 +2328,8 @@ ], "Attributes": [ { - "Section": "8.5", + "Section": "8 Microsoft Teams admin center", + "SubSection": "8.5 Meetings", "Profile": "E3 Level 2", "AssessmentStatus": "Automated", "Description": "This policy setting can prevent anyone other than invited attendees (people directly invited by the organizer, or to whom an invitation was forwarded) from bypassing the lobby and entering the meeting.For more information on how to setup a sensitive meeting, please visit **Configure Teams meetings with protection for sensitive data - Microsoft Teams:** https://learn.microsoft.com/en-us/MicrosoftTeams/configure-meetings-sensitive-protection", @@ -2245,7 +2351,8 @@ ], "Attributes": [ { - "Section": "8.5", + "Section": "8 Microsoft Teams admin center", + "SubSection": "8.5 Meetings", "Profile": "E3 Level 1", "AssessmentStatus": "Automated", "Description": "This policy setting controls if an anonymous participant can start a Microsoft Teams meeting without someone in attendance. Anonymous users and dial-in callers must wait in the lobby until the meeting is started by someone in the organization or an external user from a trusted organization.Anonymous participants are classified as:- Participants who are not logged in to Teams with a work or school account.- Participants from non-trusted organizations (as configured in external access).- Participants from organizations where there is not mutual trust.**Note:** This setting only applies when `Who can bypass the lobby` is set to `Everyone`. If the `anonymous users can join a meeting` organization-level setting or meeting policy is `Off`, this setting only applies to dial-in callers.", @@ -2267,7 +2374,8 @@ ], "Attributes": [ { - "Section": "8.5", + "Section": "8 Microsoft Teams admin center", + "SubSection": "8.5 Meetings", "Profile": "E3 Level 1", "AssessmentStatus": "Automated", "Description": "This policy setting controls who can join a meeting directly and who must wait in the lobby until they're admitted by an organizer, co-organizer, or presenter of the meeting.", @@ -2289,7 +2397,8 @@ ], "Attributes": [ { - "Section": "8.5", + "Section": "8 Microsoft Teams admin center", + "SubSection": "8.5 Meetings", "Profile": "E3 Level 1", "AssessmentStatus": "Automated", "Description": "This policy setting controls if users who dial in by phone can join the meeting directly or must wait in the lobby. Admittance to the meeting from the lobby is authorized by the meeting organizer, co-organizer, or presenter of the meeting.", @@ -2311,7 +2420,8 @@ ], "Attributes": [ { - "Section": "8.5", + "Section": "8 Microsoft Teams admin center", + "SubSection": "8.5 Meetings", "Profile": "E3 Level 2", "AssessmentStatus": "Automated", "Description": "This policy setting controls who has access to read and write chat messages during a meeting.", @@ -2333,7 +2443,8 @@ ], "Attributes": [ { - "Section": "8.5", + "Section": "8 Microsoft Teams admin center", + "SubSection": "8.5 Meetings", "Profile": "E3 Level 2", "AssessmentStatus": "Automated", "Description": "This policy setting controls who can present in a Teams meeting. **Note:** Organizers and co-organizers can change this setting when the meeting is set up.", @@ -2355,7 +2466,8 @@ ], "Attributes": [ { - "Section": "8.5", + "Section": "8 Microsoft Teams admin center", + "SubSection": "8.5 Meetings", "Profile": "E3 Level 1", "AssessmentStatus": "Automated", "Description": "This policy setting allows control of who can present in meetings and who can request control of the presentation while a meeting is underway.", @@ -2377,7 +2489,8 @@ ], "Attributes": [ { - "Section": "8.5", + "Section": "8 Microsoft Teams admin center", + "SubSection": "8.5 Meetings", "Profile": "E3 Level 2", "AssessmentStatus": "Automated", "Description": "This meeting policy setting controls whether users can read or write messages in external meeting chats with untrusted organizations. If an external organization is on the list of trusted organizations this setting will be ignored.", @@ -2399,7 +2512,8 @@ ], "Attributes": [ { - "Section": "8.5", + "Section": "8 Microsoft Teams admin center", + "SubSection": "8.5 Meetings", "Profile": "E3 Level 2", "AssessmentStatus": "Automated", "Description": "This setting controls the ability for a user to initiate a recording of a meeting in progress.The recommended state is `Off` for the `Global (Org-wide default)` meeting policy.", @@ -2422,7 +2536,8 @@ ], "Attributes": [ { - "Section": "8.6", + "Section": "8 Microsoft Teams admin center", + "SubSection": "8.6 Messaging", "Profile": "E3 Level 1", "AssessmentStatus": "Automated", "Description": "User reporting settings allow a user to report a message as malicious for further analysis. This recommendation is composed of 3 different settings and all be configured to pass:- **In the Teams admin center:** On by default and controls whether users are able to report messages from Teams. When this setting is turned off, users can't report messages within Teams, so the corresponding setting in the Microsoft 365 Defender portal is irrelevant.- **In the Microsoft 365 Defender portal:** On by default for new tenants. Existing tenants need to enable it. If user reporting of messages is turned on in the Teams admin center, it also needs to be turned on the Defender portal for user reported messages to show up correctly on the User reported tab on the Submissions page.- **Defender - Report message destinations:** This applies to more than just Microsoft Teams and allows for an organization to keep their reports contained. Due to how the parameters are configured on the backend it is included in this assessment as a requirement.", @@ -2442,7 +2557,8 @@ "Checks": [], "Attributes": [ { - "Section": "9.1", + "Section": "9 Microsoft Fabric", + "SubSection": "9.1 Teams settings", "Profile": "E3 Level 1", "AssessmentStatus": "Manual", "Description": "This setting allows business-to-business (B2B) guests access to Microsoft Fabric, and contents that they have permissions to. With the setting turned off, B2B guest users receive an error when trying to access Power BI.The recommended state is `Enabled for a subset of the organization` or `Disabled`.", @@ -2462,7 +2578,8 @@ "Checks": [], "Attributes": [ { - "Section": "9.1", + "Section": "9 Microsoft Fabric", + "SubSection": "9.1 Teams settings", "Profile": "E3 Level 1", "AssessmentStatus": "Manual", "Description": "This setting helps organizations choose whether new external users can be invited to the organization through Power BI sharing, permissions, and subscription experiences. This setting only controls the ability to invite through Power BI.The recommended state is `Enabled for a subset of the organization` or `Disabled`.**Note:** To invite external users to the organization, the user must also have the Microsoft Entra Guest Inviter role.", @@ -2482,7 +2599,8 @@ "Checks": [], "Attributes": [ { - "Section": "9.1", + "Section": "9 Microsoft Fabric", + "SubSection": "9.1 Teams settings", "Profile": "E3 Level 1", "AssessmentStatus": "Manual", "Description": "This setting allows Microsoft Entra B2B guest users to have full access to the browsing experience using the left-hand navigation pane in the organization. Guest users who have been assigned workspace roles or specific item permissions will continue to have those roles and/or permissions, even if this setting is disabled.The recommended state is `Enabled for a subset of the organization` or `Disabled`.", @@ -2502,7 +2620,8 @@ "Checks": [], "Attributes": [ { - "Section": "9.1", + "Section": "9 Microsoft Fabric", + "SubSection": "9.1 Teams settings", "Profile": "E3 Level 1", "AssessmentStatus": "Manual", "Description": "Power BI enables users to share reports and materials directly on the internet from both the application's desktop version and its web user interface. This functionality generates a publicly reachable web link that doesn't necessitate authentication or the need to be an Entra ID user in order to access and view it.The recommended state is `Enabled for a subset of the organization` or `Disabled`.", @@ -2522,7 +2641,8 @@ "Checks": [], "Attributes": [ { - "Section": "9.1", + "Section": "9 Microsoft Fabric", + "SubSection": "9.1 Teams settings", "Profile": "E3 Level 2", "AssessmentStatus": "Manual", "Description": "Power BI allows the integration of R and Python scripts directly into visuals. This feature allows data visualizations by incorporating custom calculations, statistical analyses, machine learning models, and more using R or Python scripts. Custom visuals can be created by embedding them directly into Power BI reports. Users can then interact with these visuals and see the results of the custom code within the Power BI interface.", @@ -2542,7 +2662,8 @@ "Checks": [], "Attributes": [ { - "Section": "9.1", + "Section": "9 Microsoft Fabric", + "SubSection": "9.1 Teams settings", "Profile": "E3 Level 1", "AssessmentStatus": "Manual", "Description": "Information protection tenant settings help to protect sensitive information in the Power BI tenant. Allowing and applying sensitivity labels to content ensures that information is only seen and accessed by the appropriate users.The recommended state is `Enabled` or `Enabled for a subset of the organization`.**Note:** Sensitivity labels and protection are only applied to files exported to Excel, PowerPoint, or PDF files, that are controlled by \"Export to Excel\" and \"Export reports as PowerPoint presentation or PDF documents\" settings. All other export and sharing options do not support the application of sensitivity labels and protection.**Note 2:** There are some prerequisite steps that need to be completed in order to fully utilize labeling. See [here](https://learn.microsoft.com/en-us/power-bi/enterprise/service-security-enable-data-sensitivity-labels#licensing-and-requirements).", @@ -2562,7 +2683,8 @@ "Checks": [], "Attributes": [ { - "Section": "9.1", + "Section": "9 Microsoft Fabric", + "SubSection": "9.1 Teams settings", "Profile": "E3 Level 1", "AssessmentStatus": "Manual", "Description": "Creating a shareable link allows a user to create a link to a report or dashboard, then add that link to an email or another messaging application. There are 3 options that can be selected when creating a shareable link:- People in your organization- People with existing access- Specific peopleThis setting solely deals with restrictions to `People in the organization`. External users by default are not included in any of these categories, and therefore cannot use any of these links regardless of the state of this setting.The recommended state is `Enabled for a subset of the organization` or `Disabled`.", @@ -2582,7 +2704,8 @@ "Checks": [], "Attributes": [ { - "Section": "9.1", + "Section": "9 Microsoft Fabric", + "SubSection": "9.1 Teams settings", "Profile": "E3 Level 1", "AssessmentStatus": "Manual", "Description": "Power BI admins can specify which users or user groups can share datasets externally with guests from a different tenant through the in-place mechanism. Disabling this setting prevents any user from sharing datasets externally by restricting the ability of users to turn on external sharing for datasets they own or manage.The recommended state is `Enabled for a subset of the organization` or `Disabled`.", @@ -2602,7 +2725,8 @@ "Checks": [], "Attributes": [ { - "Section": "9.1", + "Section": "9 Microsoft Fabric", + "SubSection": "9.1 Teams settings", "Profile": "E3 Level 1", "AssessmentStatus": "Manual", "Description": "This setting blocks the use of resource key based authentication. The Block ResourceKey Authentication setting applies to streaming and PUSH datasets. If blocked users will not be allowed send data to streaming and PUSH datasets using the API with a resource key.The recommended state is `Enabled`.", @@ -2622,7 +2746,8 @@ "Checks": [], "Attributes": [ { - "Section": "9.1", + "Section": "9 Microsoft Fabric", + "SubSection": "9.1 Teams settings", "Profile": "E3 Level 1", "AssessmentStatus": "Manual", "Description": "Web apps registered in Microsoft Entra ID use an assigned service principal to access Power BI APIs without a signed-in user. This setting allows an app to use service principal authentication.The recommended state is `Enabled for a subset of the organization` or `Disabled`.", @@ -2642,7 +2767,8 @@ "Checks": [], "Attributes": [ { - "Section": "9.1", + "Section": "9 Microsoft Fabric", + "SubSection": "9.1 Teams settings", "Profile": "E3 Level 1", "AssessmentStatus": "Manual", "Description": "Service principal profiles provide a flexible solution for apps used in a multitenancy deployment. The profiles enable customer data isolation and tighter security boundaries between customers that are utilizing the app.The recommended state is `Enabled for a subset of the organization` or `Disabled`.", diff --git a/prowler/lib/outputs/compliance/cis/cis_m365.py b/prowler/lib/outputs/compliance/cis/cis_m365.py index a587d98214..addc78a104 100644 --- a/prowler/lib/outputs/compliance/cis/cis_m365.py +++ b/prowler/lib/outputs/compliance/cis/cis_m365.py @@ -48,6 +48,7 @@ class M365CIS(ComplianceOutput): Requirements_Id=requirement.Id, Requirements_Description=requirement.Description, Requirements_Attributes_Section=attribute.Section, + Requirements_Attributes_SubSection=attribute.SubSection, Requirements_Attributes_Profile=attribute.Profile, Requirements_Attributes_AssessmentStatus=attribute.AssessmentStatus, Requirements_Attributes_Description=attribute.Description, @@ -79,6 +80,7 @@ class M365CIS(ComplianceOutput): Requirements_Id=requirement.Id, Requirements_Description=requirement.Description, Requirements_Attributes_Section=attribute.Section, + Requirements_Attributes_SubSection=attribute.SubSection, Requirements_Attributes_Profile=attribute.Profile, Requirements_Attributes_AssessmentStatus=attribute.AssessmentStatus, Requirements_Attributes_Description=attribute.Description, diff --git a/prowler/lib/outputs/compliance/cis/models.py b/prowler/lib/outputs/compliance/cis/models.py index 8ddbc3f1de..1a4764c294 100644 --- a/prowler/lib/outputs/compliance/cis/models.py +++ b/prowler/lib/outputs/compliance/cis/models.py @@ -82,6 +82,7 @@ class M365CISModel(BaseModel): Requirements_Id: str Requirements_Description: str Requirements_Attributes_Section: str + Requirements_Attributes_SubSection: Optional[str] Requirements_Attributes_Profile: str Requirements_Attributes_AssessmentStatus: str Requirements_Attributes_Description: str diff --git a/tests/lib/outputs/compliance/cis/cis_m365_test.py b/tests/lib/outputs/compliance/cis/cis_m365_test.py new file mode 100644 index 0000000000..1c8232d73a --- /dev/null +++ b/tests/lib/outputs/compliance/cis/cis_m365_test.py @@ -0,0 +1,182 @@ +from datetime import datetime +from io import StringIO + +from freezegun import freeze_time +from mock import patch + +from prowler.lib.outputs.compliance.cis.cis_m365 import M365CIS +from prowler.lib.outputs.compliance.cis.models import M365CISModel +from tests.lib.outputs.compliance.fixtures import CIS_4_0_M365 +from tests.lib.outputs.fixtures.fixtures import generate_finding_output +from tests.providers.m365.m365_fixtures import DOMAIN, LOCATION, TENANT_ID + + +class TestM365CIS: + def test_output_transform(self): + findings = [ + generate_finding_output( + provider="m365", + compliance={"CIS-4.0": "2.1.3"}, + account_name=DOMAIN, + account_uid=TENANT_ID, + region=LOCATION, + ) + ] + # Clear the data from CSV class + output = M365CIS(findings, CIS_4_0_M365) + output_data = output.data[0] + assert isinstance(output_data, M365CISModel) + assert output_data.Provider == "m365" + assert output_data.TenantId == TENANT_ID + assert output_data.Location == LOCATION + assert output_data.Description == CIS_4_0_M365.Description + assert output_data.Requirements_Id == CIS_4_0_M365.Requirements[0].Id + assert ( + output_data.Requirements_Description + == CIS_4_0_M365.Requirements[0].Description + ) + assert ( + output_data.Requirements_Attributes_Section + == CIS_4_0_M365.Requirements[0].Attributes[0].Section + ) + assert ( + output_data.Requirements_Attributes_SubSection + == CIS_4_0_M365.Requirements[0].Attributes[0].SubSection + ) + assert ( + output_data.Requirements_Attributes_Profile + == CIS_4_0_M365.Requirements[0].Attributes[0].Profile + ) + assert ( + output_data.Requirements_Attributes_AssessmentStatus + == CIS_4_0_M365.Requirements[0].Attributes[0].AssessmentStatus + ) + assert ( + output_data.Requirements_Attributes_Description + == CIS_4_0_M365.Requirements[0].Attributes[0].Description + ) + assert ( + output_data.Requirements_Attributes_RationaleStatement + == CIS_4_0_M365.Requirements[0].Attributes[0].RationaleStatement + ) + assert ( + output_data.Requirements_Attributes_ImpactStatement + == CIS_4_0_M365.Requirements[0].Attributes[0].ImpactStatement + ) + assert ( + output_data.Requirements_Attributes_RemediationProcedure + == CIS_4_0_M365.Requirements[0].Attributes[0].RemediationProcedure + ) + assert ( + output_data.Requirements_Attributes_AuditProcedure + == CIS_4_0_M365.Requirements[0].Attributes[0].AuditProcedure + ) + assert ( + output_data.Requirements_Attributes_AdditionalInformation + == CIS_4_0_M365.Requirements[0].Attributes[0].AdditionalInformation + ) + assert ( + output_data.Requirements_Attributes_References + == CIS_4_0_M365.Requirements[0].Attributes[0].References + ) + assert ( + output_data.Requirements_Attributes_DefaultValue + == CIS_4_0_M365.Requirements[0].Attributes[0].DefaultValue + ) + assert output_data.Status == "PASS" + assert output_data.StatusExtended == "" + assert output_data.ResourceId == "" + assert output_data.ResourceName == "" + assert output_data.CheckId == "test-check-id" + assert output_data.Muted is False + # Test manual check + output_data_manual = output.data[1] + assert output_data_manual.Provider == "m365" + assert output_data_manual.TenantId == TENANT_ID + assert output_data_manual.Location == LOCATION + assert output_data_manual.Description == CIS_4_0_M365.Description + assert output_data_manual.Requirements_Id == CIS_4_0_M365.Requirements[1].Id + assert ( + output_data_manual.Requirements_Description + == CIS_4_0_M365.Requirements[1].Description + ) + assert ( + output_data_manual.Requirements_Attributes_Section + == CIS_4_0_M365.Requirements[1].Attributes[0].Section + ) + assert ( + output_data.Requirements_Attributes_SubSection + == CIS_4_0_M365.Requirements[0].Attributes[0].SubSection + ) + assert ( + output_data_manual.Requirements_Attributes_Profile + == CIS_4_0_M365.Requirements[1].Attributes[0].Profile + ) + assert ( + output_data_manual.Requirements_Attributes_AssessmentStatus + == CIS_4_0_M365.Requirements[1].Attributes[0].AssessmentStatus + ) + assert ( + output_data_manual.Requirements_Attributes_Description + == CIS_4_0_M365.Requirements[1].Attributes[0].Description + ) + assert ( + output_data_manual.Requirements_Attributes_RationaleStatement + == CIS_4_0_M365.Requirements[1].Attributes[0].RationaleStatement + ) + assert ( + output_data_manual.Requirements_Attributes_ImpactStatement + == CIS_4_0_M365.Requirements[1].Attributes[0].ImpactStatement + ) + assert ( + output_data_manual.Requirements_Attributes_RemediationProcedure + == CIS_4_0_M365.Requirements[1].Attributes[0].RemediationProcedure + ) + assert ( + output_data_manual.Requirements_Attributes_AuditProcedure + == CIS_4_0_M365.Requirements[1].Attributes[0].AuditProcedure + ) + assert ( + output_data_manual.Requirements_Attributes_AdditionalInformation + == CIS_4_0_M365.Requirements[1].Attributes[0].AdditionalInformation + ) + assert ( + output_data_manual.Requirements_Attributes_References + == CIS_4_0_M365.Requirements[1].Attributes[0].References + ) + assert ( + output_data_manual.Requirements_Attributes_DefaultValue + == CIS_4_0_M365.Requirements[1].Attributes[0].DefaultValue + ) + assert output_data_manual.Status == "MANUAL" + assert output_data_manual.StatusExtended == "Manual check" + assert output_data_manual.ResourceId == "manual_check" + assert output_data_manual.ResourceName == "Manual check" + assert output_data_manual.CheckId == "manual" + assert output_data_manual.Muted is False + + @freeze_time(datetime.now()) + def test_batch_write_data_to_file(self): + mock_file = StringIO() + findings = [ + generate_finding_output( + provider="m365", + compliance={"CIS-4.0": "2.1.3"}, + account_name=DOMAIN, + account_uid=TENANT_ID, + region=LOCATION, + ) + ] + # Clear the data from CSV class + output = M365CIS(findings, CIS_4_0_M365) + output._file_descriptor = mock_file + + with patch.object(mock_file, "close", return_value=None): + output.batch_write_data_to_file() + + mock_file.seek(0) + content = mock_file.read() + + expected_csv = f"PROVIDER;DESCRIPTION;TENANTID;LOCATION;ASSESSMENTDATE;REQUIREMENTS_ID;REQUIREMENTS_DESCRIPTION;REQUIREMENTS_ATTRIBUTES_SECTION;REQUIREMENTS_ATTRIBUTES_SUBSECTION;REQUIREMENTS_ATTRIBUTES_PROFILE;REQUIREMENTS_ATTRIBUTES_ASSESSMENTSTATUS;REQUIREMENTS_ATTRIBUTES_DESCRIPTION;REQUIREMENTS_ATTRIBUTES_RATIONALESTATEMENT;REQUIREMENTS_ATTRIBUTES_IMPACTSTATEMENT;REQUIREMENTS_ATTRIBUTES_REMEDIATIONPROCEDURE;REQUIREMENTS_ATTRIBUTES_AUDITPROCEDURE;REQUIREMENTS_ATTRIBUTES_ADDITIONALINFORMATION;REQUIREMENTS_ATTRIBUTES_DEFAULTVALUE;REQUIREMENTS_ATTRIBUTES_REFERENCES;STATUS;STATUSEXTENDED;RESOURCEID;RESOURCENAME;CHECKID;MUTED\r\nm365;The CIS Microsoft 365 Foundations Benchmark provides prescriptive guidance for configuring security options for Microsoft 365 with an emphasis on foundational, testable, and architecture agnostic settings.;00000000-0000-0000-0000-000000000000;global;{datetime.now()};2.1.3;Ensure MFA Delete is enabled on S3 buckets;2.1. Simple Storage Service (S3);;Level 1;Automated;Once MFA Delete is enabled on your sensitive and classified S3 bucket it requires the user to have two forms of authentication.;Adding MFA delete to an S3 bucket, requires additional authentication when you change the version state of your bucket or you delete and object version adding another layer of security in the event your security credentials are compromised or unauthorized access is granted.;;Perform the steps below to enable MFA delete on an S3 bucket.Note:-You cannot enable MFA Delete using the AWS Management Console. You must use the AWS CLI or API.-You must use your 'root' account to enable MFA Delete on S3 buckets.**From Command line:**1. Run the s3api put-bucket-versioning command aws s3api put-bucket-versioning --profile my-root-profile --bucket Bucket_Name --versioning-configuration Status=Enabled,MFADelete=Enabled --mfa arn:aws:iam::aws_account_id:mfa/root-account-mfa-device passcode;Perform the steps below to confirm MFA delete is configured on an S3 Bucket**From Console:**1. Login to the S3 console at `https://console.aws.amazon.com/s3/`2. Click the `Check` box next to the Bucket name you want to confirm3. In the window under `Properties`4. Confirm that Versioning is `Enabled`5. Confirm that MFA Delete is `Enabled`**From Command Line:**1. Run the `get-bucket-versioning aws s3api get-bucket-versioning --bucket my-bucket Output example: Enabled Enabled\ If the Console or the CLI output does not show Versioning and MFA Delete `enabled` refer to the remediation below.;;By default, MFA Delete is not enabled on S3 buckets.;https://docs.aws.amazon.com/AmazonS3/latest/dev/Versioning.html#MultiFactorAuthenticationDelete:https://docs.aws.amazon.com/AmazonS3/latest/dev/UsingMFADelete.html:https://aws.amazon.com/blogs/security/securing-access-to-aws-using-mfa-part-3/:https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_mfa_lost-or-broken.html;PASS;;;;test-check-id;False\r\nm365;The CIS Microsoft 365 Foundations Benchmark provides prescriptive guidance for configuring security options for Microsoft 365 with an emphasis on foundational, testable, and architecture agnostic settings.;00000000-0000-0000-0000-000000000000;global;{datetime.now()};2.1.4;Ensure that the controller manager pod specification file permissions are set to 600 or more restrictive;1.1 Control Plane Node Configuration Files;;Level 1 - Master Node;Automated;Ensure that the controller manager pod specification file has permissions of `600` or more restrictive.;The controller manager pod specification file controls various parameters that set the behavior of the Controller Manager on the master node. You should restrict its file permissions to maintain the integrity of the file. The file should be writable by only the administrators on the system.;;Run the below command (based on the file location on your system) on the Control Plane node. For example, ``` chmod 600 /etc/kubernetes/manifests/kube-controller-manager.yaml ```;Run the below command (based on the file location on your system) on the Control Plane node. For example, ``` stat -c %a /etc/kubernetes/manifests/kube-controller-manager.yaml ``` Verify that the permissions are `600` or more restrictive.;;By default, the `kube-controller-manager.yaml` file has permissions of `640`.;https://kubernetes.io/docs/admin/kube-apiserver/;MANUAL;Manual check;manual_check;Manual check;manual;False\r\n" + + assert content == expected_csv diff --git a/tests/lib/outputs/compliance/fixtures.py b/tests/lib/outputs/compliance/fixtures.py index 3c8b71e3cd..94c9604cf3 100644 --- a/tests/lib/outputs/compliance/fixtures.py +++ b/tests/lib/outputs/compliance/fixtures.py @@ -243,6 +243,58 @@ CIS_1_5_AWS = Compliance( ], ) +CIS_4_0_M365_NAME = "cis_4.0_m365" +CIS_4_0_M365 = Compliance( + Framework="CIS", + Provider="M365", + Version="4.0", + Description="The CIS Microsoft 365 Foundations Benchmark provides prescriptive guidance for configuring security options for Microsoft 365 with an emphasis on foundational, testable, and architecture agnostic settings.", + Requirements=[ + Compliance_Requirement( + Checks=[ + "mfa_delete_enabled", + ], + Id="2.1.3", + Description="Ensure MFA Delete is enabled on S3 buckets", + Attributes=[ + CIS_Requirement_Attribute( + Section="2.1. Simple Storage Service (S3)", + Profile="Level 1", + AssessmentStatus="Automated", + Description="Once MFA Delete is enabled on your sensitive and classified S3 bucket it requires the user to have two forms of authentication.", + RationaleStatement="Adding MFA delete to an S3 bucket, requires additional authentication when you change the version state of your bucket or you delete and object version adding another layer of security in the event your security credentials are compromised or unauthorized access is granted.", + ImpactStatement="", + RemediationProcedure="Perform the steps below to enable MFA delete on an S3 bucket.Note:-You cannot enable MFA Delete using the AWS Management Console. You must use the AWS CLI or API.-You must use your 'root' account to enable MFA Delete on S3 buckets.**From Command line:**1. Run the s3api put-bucket-versioning command aws s3api put-bucket-versioning --profile my-root-profile --bucket Bucket_Name --versioning-configuration Status=Enabled,MFADelete=Enabled --mfa arn:aws:iam::aws_account_id:mfa/root-account-mfa-device passcode", + AuditProcedure="Perform the steps below to confirm MFA delete is configured on an S3 Bucket**From Console:**1. Login to the S3 console at `https://console.aws.amazon.com/s3/`2. Click the `Check` box next to the Bucket name you want to confirm3. In the window under `Properties`4. Confirm that Versioning is `Enabled`5. Confirm that MFA Delete is `Enabled`**From Command Line:**1. Run the `get-bucket-versioning aws s3api get-bucket-versioning --bucket my-bucket Output example: Enabled Enabled\ If the Console or the CLI output does not show Versioning and MFA Delete `enabled` refer to the remediation below.", + AdditionalInformation="", + References="https://docs.aws.amazon.com/AmazonS3/latest/dev/Versioning.html#MultiFactorAuthenticationDelete:https://docs.aws.amazon.com/AmazonS3/latest/dev/UsingMFADelete.html:https://aws.amazon.com/blogs/security/securing-access-to-aws-using-mfa-part-3/:https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_mfa_lost-or-broken.html", + DefaultValue="By default, MFA Delete is not enabled on S3 buckets.", + ) + ], + ), + Compliance_Requirement( + Checks=[], + Id="2.1.4", + Description="Ensure that the controller manager pod specification file permissions are set to 600 or more restrictive", + Attributes=[ + CIS_Requirement_Attribute( + Section="1.1 Control Plane Node Configuration Files", + Profile="Level 1 - Master Node", + AssessmentStatus="Automated", + Description="Ensure that the controller manager pod specification file has permissions of `600` or more restrictive.", + RationaleStatement="The controller manager pod specification file controls various parameters that set the behavior of the Controller Manager on the master node. You should restrict its file permissions to maintain the integrity of the file. The file should be writable by only the administrators on the system.", + ImpactStatement="", + RemediationProcedure="Run the below command (based on the file location on your system) on the Control Plane node. For example, ``` chmod 600 /etc/kubernetes/manifests/kube-controller-manager.yaml ```", + AuditProcedure="Run the below command (based on the file location on your system) on the Control Plane node. For example, ``` stat -c %a /etc/kubernetes/manifests/kube-controller-manager.yaml ``` Verify that the permissions are `600` or more restrictive.", + AdditionalInformation="", + References="https://kubernetes.io/docs/admin/kube-apiserver/", + DefaultValue="By default, the `kube-controller-manager.yaml` file has permissions of `640`.", + ) + ], + ), + ], +) + MITRE_ATTACK_AWS_NAME = "mitre_attack_aws" MITRE_ATTACK_AWS = Compliance( Framework="MITRE-ATTACK",