القائمة
Ensure That BigQuery Datasets Are Not Anonymously or Publicly Accessible
يُحدَّد Prompt الذي يراجع المصدر أولًا بشكل افتراضي. يمكنك التبديل إلى أمر مباشر أو تنزيل نسخة محلية.
اقرأ SKILL.md وأي ملفات مرافقة يعرضها SkillsMP قبل أن تقرر التثبيت.
التثبيت باستخدام Codex أو Claude انسخ هذا Prompt والصقه في Codex أو Claude أو مساعد آخر ليراجع صفحة Skill ويثبّتها لك.
يتجاوز الأمر المباشر Prompt المخصّص للمراجعة. افحص المصدر قبل تشغيله.
npx skills add https://github.com/CyberStrikeus/CyberStrike --skill cis-gcp-foundations-7-1يبقى الأمر في سطر واحد. مرّر أفقيًا لمراجعته كاملًا قبل النسخ.
تفضّل نسخة محلية؟ نزّل الملفات المتاحة حاليًا لدى SkillsMP.
macOS post-exploitation for credential harvesting, DTrace monitoring, TCC bypass, and stealth operations via native tools
Windows userland post-exploitation for credential harvesting, monitoring, AMSI/ETW bypass, and stealth operations
Kubernetes post-exploitation for container escape, secret extraction, RBAC abuse, and cluster persistence
عرض SKILL.md
استنادا إلى تصنيف SOC المهني
| name | cis-gcp-foundations-7.1 |
| description | Ensure That BigQuery Datasets Are Not Anonymously or Publicly Accessible |
| category | cis-gcp-foundations |
| version | 4.0.0 |
| author | cyberstrike-official |
| tags | ["cis","gcp","bigquery","encryption","cmek"] |
| cis_id | 7.1 |
| cis_benchmark | CIS Google Cloud Platform Foundation Benchmark v4.0.0 |
| tech_stack | ["gcp"] |
| cwe_ids | [] |
| chains_with | [] |
| prerequisites | [] |
| severity_boost | {} |
It is recommended that the IAM policy on BigQuery datasets does not allow anonymous and/or public access.
Granting permissions to allUsers or allAuthenticatedUsers allows anyone to access the dataset. Such access might not be desirable if sensitive data is being stored in the dataset. Therefore, ensure that anonymous and/or public access to a dataset is not allowed.
The dataset is not publicly accessible. Explicit modification of IAM privileges would be necessary to make them publicly accessible.
BigQuery by visiting: https://console.cloud.google.com/bigquery.Resources.SHARING near the right side of the window and select Permissions.allUsers or allAuthenticatedUsers.List the name of all datasets.
bq ls
Retrieve each dataset details using the following command:
bq show PROJECT_ID:DATASET_NAME
Ensure that allUsers and allAuthenticatedUsers have not been granted access to the dataset.
BigQuery by visiting: https://console.cloud.google.com/bigquery.SHARING near the right side of the window and select Permissions.allUsers or allAuthenticatedUsers. On the popup click Remove.List the name of all datasets.
bq ls
Retrieve the data set details:
bq show --format=prettyjson PROJECT_ID:DATASET_NAME > PATH_TO_FILE
In the access section of the JSON file, update the dataset information to remove all roles containing allUsers or allAuthenticatedUsers.
Update the dataset:
bq update --source PATH_TO_FILE PROJECT_ID:DATASET_NAME
You can prevent Bigquery dataset from becoming publicly accessible by setting up the Domain restricted sharing organization policy at: https://console.cloud.google.com/iam-admin/orgpolicies/iam-allowedPolicyMemberDomains.
By default, BigQuery datasets are not publicly accessible.
| Controls Version | Control | IG 1 | IG 2 | IG 3 |
|---|---|---|---|---|
| v8 | 3.3 Configure Data Access Control Lists | X | X | X |
| v7 | 14.6 Protect Information through Access Control Lists | X | X | X |