1.2.0 • Published 12 months ago

@cloudgraph/policy-pack-gcp-nist-800-53-rev4 v1.2.0

Weekly downloads
-
License
MPL-2.0
Repository
github
Last release
12 months ago

NIST 800-53 Rev. 4 for Google Cloud Services

Policy Pack based on the 800-53 Rev. 4 benchmark provided by the The National Institute of Standards and Technology (NIST)

First Steps

  1. Install Cloud Graph CLI.
  2. Set up the GCP Provider for CG with the cg init gcp command.
  3. Add Policy Pack NIST 800-53 Rev. 4 for Google Cloud Services benchmark using cg policy add gcp-nist-800-53-rev4 command.
  4. Execute the ruleset using the scan command cg scan gcp.
  5. Query the findings using the different options:

    5a. Querying findings by provider:

    query {
      querygcpFindings {
        NISTFindings {
          id
          resourceId
          result
        }
      }
    }

    5b. Querying findings by specific benchmark:

    query {
      querygcpNISTFindings {
        id
        resourceId
        result
      }
    }

    5c. Querying findings by resource:

    query {
      querygcpIamPolicy {
        id
        NISTFindings {
          id
          resourceId
          result
        }
      }
    }

Available Ruleset

RuleDescription
GCP NIST 1.1Compute instances should not use the default service account
GCP NIST 1.2Compute instances should not use the default service account with full access to all Cloud APIs
GCP NIST 1.3Compute instance "block-project-ssh-keys should be enabled
GCP NIST 1.4Compute instances should not have public IP addresses
GCP NIST 1.5Compute instances "Enable connecting to serial ports" should not be enabled
GCP NIST 1.6SQL database instances should not permit access from 0.0.0.0/0
GCP NIST 1.7SQL database instances should not have public IPs
GCP NIST 2.1DNS managed zone DNSSEC should be enabled
GCP NIST 2.2DNS managed zone DNSSEC key-signing keys should not use RSASHA1
GCP NIST 2.3DNS managed zone DNSSEC zone-signing keys should not use RSASHA1
GCP NIST 3.1IAM default audit log config should not exempt any users
GCP NIST 3.2PostgreSQL database instance 'log_checkpoints' database flag should be set to 'on'
GCP NIST 3.3PostgreSQL database instance 'log_connections' database flag should be set to 'on'
GCP NIST 3.4PostgreSQL database instance 'log_disconnections' database flag should be set to 'on'
GCP NIST 3.5PostgreSQL database instance 'log_lock_waits' database flag should be set to 'on'
GCP NIST 3.6PostgreSQL database instance 'log_min_error_statement' database flag should be set appropriately
GCP NIST 3.7PostgreSQL database instance 'log_temp_files' database flag should be set to '0' (on)
GCP NIST 3.8PostgreSQL database instance 'log_min_duration_statement' database flag should be set to '-1' (disabled)
GCP NIST 3.9At least one project-level logging sink should be configured with an empty filter
GCP NIST 3.10Network subnet flow logs should be enabled
GCP NIST 3.11IAM default audit log config should include 'DATA_READ' and 'DATA_WRITE' log types
GCP NIST 4.1Compute instance disks should be encrypted with customer-supplied encryption keys (CSEKs)
GCP NIST 4.2SQL database instances should require incoming connections to use SSL
GCP NIST 5.1Logging metric filter and alert for project ownership assignments/changes should be configured
GCP NIST 5.2Logging metric filter and alert for audit configuration changes should be configured
GCP NIST 5.3Logging metric filter and alert for Custom Role changes should be configured
GCP NIST 5.4Logging metric filter and alert for network firewall rule changes should be configured
GCP NIST 5.5Logging metric filter and alert for network route changes should be configured
GCP NIST 5.6Logging metric filter and alert for network changes should be configured
GCP NIST 5.7Logging metric filter and alert for SQL instance configuration changes should be configured
GCP NIST 5.8Logging storage bucket retention policies and Bucket Lock should be configured
GCP NIST 6.1The default network for a project should be deleted
GCP NIST 6.2Network firewall rules should not permit ingress from 0.0.0.0/0 to port 22 (SSH)
GCP NIST 6.3Network firewall rules should not permit ingress from 0.0.0.0/0 to port 3389 (RDP)
GCP NIST 6.4Load balancer HTTPS or SSL proxy SSL policies should not have weak cipher suites
GCP NIST 6.5Compute instances "IP forwarding" should not be enabled
1.2.1-alpha.2

12 months ago

1.2.1-alpha.1

12 months ago

1.2.0

1 year ago

1.2.0-alpha.1

1 year ago

1.1.1

2 years ago

1.1.0

2 years ago

1.0.0

2 years ago