CyberStrikeus/CyberStrike - Page 83

cis-ocp-vm-v100-3-3

Ensure errorPolicy is not set to ignore (Manual)

cis-ocp-vm-v100-4-1

Use dedicated VLANs to segment network traffic (Automated)

cis-ocp-vm-v100-4-2

Enable MAC spoof filtering (Automated)

cis-ocp-vm-v100-4-3

Use multi-network policies (Manual)

cis-ocp-vm-v100-5-1

Disable Intel Trusted Execution Technology (TXT) (Manual)

cis-ocp-vm-v100-6-1

Disable nested virtualization (Manual)

cis-ocp-vm-v100-6-2

Enable vCPU metrics (Manual)

cis-ocp-vm-v100-6-3

Ensure all CPU vulnerabilities are mitigated (Manual)

cis-nginx-v300-1-1-1

Ensure NGINX is installed (Manual)

cis-nginx-v300-1-2-1

Ensure package manager repositories are properly configured (Manual)

cis-nginx-v300-1-2-2

Ensure the latest software package is installed (Manual)

cis-nginx-v300-2-1-1

Ensure only required dynamic modules are loaded (Manual)

cis-nginx-v300-2-2-1

Ensure that NGINX is run using a non-privileged, dedicated service account (Manual)

cis-nginx-v300-2-2-2

Ensure the NGINX service account is locked (Manual)

cis-nginx-v300-2-2-3

Ensure the NGINX service account has an invalid shell (Manual)

cis-nginx-v300-2-3-1

Ensure NGINX directories and files are owned by root (Manual)

cis-nginx-v300-2-3-2

Ensure access to NGINX directories and files is restricted (Manual)

cis-nginx-v300-2-3-3

Ensure the NGINX process ID (PID) file is secured (Manual)

cis-nginx-v300-2-4-1

Ensure NGINX only listens for network connections on authorized ports (Manual)

cis-nginx-v300-2-4-2

Ensure requests for unknown host names are rejected (Manual)

cis-nginx-v300-2-4-3

Ensure keepalive_timeout is 10 seconds or less, but not 0 (Manual)

cis-nginx-v300-2-4-4

Ensure send_timeout is set to 10 seconds or less, but not 0 (Manual)

cis-nginx-v300-2-5-1

Ensure server_tokens directive is set to off (Manual)

cis-nginx-v300-2-5-2

Ensure default error and index.html pages do not reference NGINX (Manual)

cis-nginx-v300-2-5-3

Ensure hidden file serving is disabled (Manual)

cis-nginx-v300-2-5-4

Ensure the NGINX reverse proxy does not enable information disclosure (Manual)

cis-nginx-v300-3-1

Ensure detailed logging is enabled (Manual)

cis-nginx-v300-3-2

Ensure access logging is enabled (Manual)

cis-nginx-v300-3-3

Ensure error logging is enabled and set to the info logging level (Manual)

cis-nginx-v300-3-4

Ensure proxies pass source IP information (Manual)

cis-nginx-v300-4-1-1

Ensure HTTP is redirected to HTTPS (Manual)

cis-nginx-v300-4-1-10

Ensure the upstream traffic server certificate is trusted (Manual)

cis-nginx-v300-4-1-11

Ensure Secure Session Resumption is Enabled (Manual)

cis-nginx-v300-4-1-12

Ensure HTTP/3.0 is used (Manual)

cis-nginx-v300-4-1-2

Ensure a trusted certificate and trust chain is installed (Manual)

cis-nginx-v300-4-1-3

Ensure private key permissions are restricted (Manual)

cis-nginx-v300-4-1-4

Ensure only modern TLS protocols are used (Manual)

cis-nginx-v300-4-1-5

Disable weak ciphers (Manual)

cis-nginx-v300-4-1-6

Ensure awareness of TLS 1.3 new Diffie-Hellman parameters (Manual)

cis-nginx-v300-4-1-7

Ensure Online Certificate Status Protocol (OCSP) stapling is enabled (Manual)