cis-aws-database-3-8

name	cis-aws-database-3.8
description	Ensure to Regularly Patch Systems
category	cis-database
version	2.0.0
author	cyberstrike-official
tags	["cis","aws","database","rds","patching","maintenance","updates"]
cis_id	3.8
cis_benchmark	CIS AWS Database Services Benchmark v2.0.0
tech_stack	["aws"]
cwe_ids	[]
chains_with	["cis-aws-database-3.1","cis-aws-database-3.11"]
prerequisites	[]
severity_boost	{}

3.8 Ensure to Regularly Patch Systems (Manual)

Description

This control ensures that RDS database instances and their database engines are regularly updated and patched to address security vulnerabilities and maintain system integrity.

Rationale

Regular patching addresses known security vulnerabilities, bug fixes, and performance improvements, reducing the attack surface and maintaining compliance.

Impact

Helps the organization reduce their security risk by regularly updating and patching their database and database engine. Regularly updating and scanning for any weaknesses in the company can bring up possible vulnerabilities that could have led to potential cyber-attack.

Audit Procedure

Using AWS Console

1. Stay Informed about Database Engine Updates

   • Stay up-to-date with the latest information regarding database engine updates and patches provided by the respective database engine vendors (e.g., MySQL, PostgreSQL, Oracle, SQL Server).
   • Subscribe to release announcements, security bulletins, and updates from the database engine vendor or AWS.

2. Review the Database Engine Documentation

   • Refer to the documentation provided by the database engine vendor to understand the recommended patching and update processes specific to the database engine you use on Amazon RDS.
   • Review the vendor's guidelines and best practices for applying updates and patches.

3. Plan for Maintenance Windows

   • Determine regular maintenance windows during which you can schedule updates and patches for your RDS instances.
   • Coordinate with your team to ensure minimal disruption to your applications and users during the maintenance window.

4. Enable Automated Minor Version Upgrades

   • In the Amazon RDS console, select the RDS instance you want to enable automated upgrades.
   • Under the Maintenance & backups or Maintenance section.
   • Enable the Auto minor version upgrade option.
   • This allows Amazon RDS to automatically apply eligible minor version upgrades to your RDS instances during the maintenance window.

5. Monitor Available Updates

   • Regularly monitor the Pending Maintenance section in the Amazon RDS console for any updates or patches for your RDS instances.
   • Pay attention to notifications and alerts from AWS about pending updates.

6. Schedule Updates and Patches

   • Review the available updates and patches and their associated release notes and security advisories.