CyberStrikeus/CyberStrike - Page 2

cis-aws-foundations-4-5

Ensure CloudTrail logs are encrypted at rest using KMS CMKs

cis-aws-foundations-4-6

Ensure rotation for customer-created symmetric CMKs is enabled

cis-aws-foundations-4-7

Ensure VPC flow logging is enabled in all VPCs

cis-aws-foundations-4-8

Ensure that object-level logging for write events is enabled for S3 buckets

cis-aws-foundations-4-9

Ensure that object-level logging for read events is enabled for S3 buckets

cis-aws-foundations-5-1

Ensure unauthorized API calls are monitored

cis-aws-foundations-5-10

Ensure security group changes are monitored

cis-aws-foundations-5-11

Ensure Network Access Control List (NACL) changes are monitored

cis-aws-foundations-5-12

Ensure changes to network gateways are monitored

cis-aws-foundations-5-13

Ensure route table changes are monitored

cis-aws-foundations-5-14

Ensure VPC changes are monitored

cis-aws-foundations-5-15

Ensure AWS Organizations changes are monitored

cis-aws-foundations-5-16

Ensure AWS Security Hub is enabled

cis-aws-foundations-5-2

Ensure management console sign-in without MFA is monitored

cis-aws-foundations-5-3

Ensure usage of the 'root' account is monitored

cis-aws-foundations-5-4

Ensure IAM policy changes are monitored

cis-aws-foundations-5-5

Ensure CloudTrail configuration changes are monitored

cis-aws-foundations-5-6

Ensure AWS Management Console authentication failures are monitored

cis-aws-foundations-5-7

Ensure disabling or scheduled deletion of customer created CMKs is monitored

cis-aws-foundations-5-8

Ensure S3 bucket policy changes are monitored

cis-aws-foundations-5-9

Ensure AWS Config configuration changes are monitored

cis-aws-foundations-6-1-1

Ensure EBS volume encryption is enabled in all regions

cis-aws-foundations-6-1-2

Ensure CIFS access is restricted to trusted networks to prevent unauthorized access

cis-aws-foundations-6-2

Ensure no Network ACLs allow ingress from 0.0.0.0/0 to remote server administration ports

cis-aws-foundations-6-3

Ensure no security groups allow ingress from 0.0.0.0/0 to remote server administration ports

cis-aws-foundations-6-4

Ensure no security groups allow ingress from ::/0 to remote server administration ports

cis-aws-foundations-6-5

Ensure the default security group of every VPC restricts all traffic

cis-aws-foundations-6-6

Ensure routing tables for VPC peering are least access

cis-aws-foundations-6-7

Ensure that the EC2 Metadata Service only allows IMDSv2

cis-aws-foundations-6-8

Ensure VPC Endpoints are used for access to AWS Services

cis-aws-compute-10-1

Ensure Managed Platform updates is configured

cis-aws-compute-10-2

Ensure Persistent logs is setup and configured to S3

cis-aws-compute-10-3

Ensure access logs are enabled

cis-aws-compute-10-4

Ensure that HTTPS is enabled on load balancer

cis-aws-compute-11-1

Ensure customer-managed keys are used to encrypt AWS Fargate ephemeral storage data for Amazon ECS

cis-aws-compute-12-1

Ensure AWS Config is Enabled for Lambda and Serverless

cis-aws-compute-12-10

Ensure Lambda functions do not allow unknown cross account access via permission policies

cis-aws-compute-12-11

Ensure that the runtime environment versions used for your Lambda functions do not have end of support dates

cis-aws-compute-12-12

Ensure encryption in transit is enabled for Lambda environment variables

cis-aws-compute-12-2

Ensure Cloudwatch Lambda insights is enabled