CyberStrikeus/CyberStrike - Page 179

cis-aws-foundations-5-2

Ensure management console sign-in without MFA is monitored

cis-aws-foundations-5-3

Ensure usage of the 'root' account is monitored

cis-aws-foundations-5-4

Ensure IAM policy changes are monitored

cis-aws-foundations-5-5

Ensure CloudTrail configuration changes are monitored

cis-aws-foundations-5-6

Ensure AWS Management Console authentication failures are monitored

cis-aws-foundations-5-7

Ensure disabling or scheduled deletion of customer created CMKs is monitored

cis-aws-foundations-5-8

Ensure S3 bucket policy changes are monitored

cis-aws-foundations-5-9

Ensure AWS Config configuration changes are monitored

cis-aws-foundations-6-1-1

Ensure EBS volume encryption is enabled in all regions

cis-aws-foundations-6-1-2

Ensure CIFS access is restricted to trusted networks to prevent unauthorized access

cis-aws-foundations-6-2

Ensure no Network ACLs allow ingress from 0.0.0.0/0 to remote server administration ports

cis-aws-foundations-6-3

Ensure no security groups allow ingress from 0.0.0.0/0 to remote server administration ports

cis-aws-foundations-6-4

Ensure no security groups allow ingress from ::/0 to remote server administration ports

cis-aws-foundations-6-5

Ensure the default security group of every VPC restricts all traffic

cis-aws-foundations-6-6

Ensure routing tables for VPC peering are least access

cis-aws-foundations-6-7

Ensure that the EC2 Metadata Service only allows IMDSv2

cis-aws-foundations-6-8

Ensure VPC Endpoints are used for access to AWS Services

cis-aws-compute-10-1

Ensure Managed Platform updates is configured

cis-aws-compute-10-2

Ensure Persistent logs is setup and configured to S3

cis-aws-compute-10-3

Ensure access logs are enabled

cis-aws-compute-10-4

Ensure that HTTPS is enabled on load balancer

cis-aws-compute-11-1

Ensure customer-managed keys are used to encrypt AWS Fargate ephemeral storage data for Amazon ECS

cis-aws-compute-12-1

Ensure AWS Config is Enabled for Lambda and Serverless

cis-aws-compute-12-10

Ensure Lambda functions do not allow unknown cross account access via permission policies

cis-aws-compute-12-11

Ensure that the runtime environment versions used for your Lambda functions do not have end of support dates

cis-aws-compute-12-12

Ensure encryption in transit is enabled for Lambda environment variables

cis-aws-compute-12-2

Ensure Cloudwatch Lambda insights is enabled

cis-aws-compute-12-3

Ensure AWS Secrets manager is configured and being used by Lambda for databases

cis-aws-compute-12-4

Ensure least privilege is used with Lambda function access

cis-aws-compute-12-5

Ensure every Lambda function has its own IAM Role

cis-aws-compute-12-6

Ensure Lambda functions are not exposed to everyone

cis-aws-compute-12-7

Ensure Lambda functions are referencing active execution roles

cis-aws-compute-12-8

Ensure that Code Signing is enabled for Lambda functions

cis-aws-compute-12-9

Ensure there are no Lambda functions with admin privileges within your AWS account

cis-aws-compute-16-1

Ensure communications between your applications and clients is encrypted

cis-aws-compute-2-1-1

Ensure Consistent Naming Convention is used for Organizational AMI

cis-aws-compute-2-1-2

Ensure Amazon Machine Images (AMIs) are encrypted

cis-aws-compute-2-1-3

Ensure Only Approved Amazon Machine Images (AMIs) are Used

cis-aws-compute-2-1-4

Ensure Images (AMI) are not older than 90 days

cis-aws-compute-2-1-5

Ensure Images are not Publicly Available