cis-gcp-foundations-4-12

name	cis-gcp-foundations-4.12
description	Ensure the Latest Operating System Updates Are Installed On Your Virtual Machines in All Projects
category	cis-gcp-foundations
version	4.0.0
author	cyberstrike-official
tags	["cis","gcp","compute","virtual-machines","service-accounts"]
cis_id	4.12
cis_benchmark	CIS Google Cloud Platform Foundation Benchmark v4.0.0
tech_stack	["gcp"]
cwe_ids	[]
chains_with	[]
prerequisites	[]
severity_boost	{}

4.12 Ensure the Latest Operating System Updates Are Installed On Your Virtual Machines in All Projects (Manual)

Profile Applicability

• Level 2

Description

Google Cloud Virtual Machines have the ability via an OS Config agent API to periodically (about every 10 minutes) report OS inventory data. A patch compliance API periodically reads this data, and cross references metadata to determine if the latest updates are installed.

This is not the only Patch Management solution available to your organization and you should weigh your needs before committing to using this method.

Rationale

Keeping virtual machine operating systems up to date is a security best practice. Using this service will simplify this process.

Impact

Most Operating Systems require a restart or changing critical resources to apply the updates. Using the Google Cloud VM manager for its OS Patch management will incur additional costs for each VM managed by it. Please view the VM manager pricing reference for further information.

Audit

From Google Cloud Console

Determine if OS Config API is Enabled for the Project

1. Navigate into a project. In the expanded navigation menu located at the top left of the screen hover over APIs & Services. Then in the menu right of that select API Libraries.
2. Search for "VM Manager (OS Config API)" or scroll down in the left hand column and select the filter labeled "Compute" where it is the last listed. Open this API.
3. Verify the blue button at the top is enabled.

Determine if the Operating System of VM Instances have the local OS-Config Agent running

There is no way to determine this from the Google Cloud console. The only way is to run operating specific commands locally inside the operating system via remote connection. For the sake of brevity of this recommendation please view the docs/troubleshooting/vm-manager/verify-setup reference at the bottom of the page. If you initialized your VM instance with a Google Supplied OS Image with a build date of later than v20200114 it will have the service installed. You should still determine its status for proper operation.

Verify the service account you have setup for the project in Recommendation 4.1 is running

1. Go to the VM instances page by visiting: https://console.cloud.google.com/compute/instances.
2. Click on each instance name to go to its VM instance details page.
3. Under the section Service Account, take note of the service account.