cis-aws-database-9-1

name	cis-aws-database-9.1
description	Ensure Network Security is Enabled
category	cis-database
version	2.0.0
author	cyberstrike-official
tags	["cis","aws","database","neptune","graph-database","network-security","vpc"]
cis_id	9.1
cis_benchmark	CIS AWS Database Services Benchmark v2.0.0
tech_stack	["aws"]
cwe_ids	[]
chains_with	["cis-aws-database-9.2","cis-aws-database-9.3","cis-aws-database-9.4","cis-aws-database-9.5"]
prerequisites	[]
severity_boost	{}

9.1 Ensure Network Security is Enabled (Manual)

Description

This helps ensure that all the necessary security measurements are taken to prevent a cyber-attack. Such as utilizing VPC, creating certain inbound and outbound rules, and ACLs.

Rationale

Network security is fundamental to protecting Neptune database clusters from unauthorized access and network-based attacks.

Impact

Provides privacy and lets the user customize their security preferences. Prevents private network from interfering with public networks.

Audit Procedure

Using AWS Console

1. Sign in to the AWS Management Console at https://console.aws.amazon.com/ with your AWS account credentials.
2. Open the Amazon Neptune Console - Navigate to the service using the Find Services search bar or by directly accessing the console at https://console.aws.amazon.com/neptune/.
3. Select the Neptune Cluster:
   • Choose the Amazon Neptune cluster for which you want to configure network security.
   • Click on the cluster name to access its details page.
4. Configure Security Groups:
   • In the cluster details page, navigate to the Connectivity & Security or Network & Security section.
   • Under Security Groups, click on Manage security groups.
   • Click on Create new security group or select an existing security group associated with your Neptune cluster.
   • Configure inbound and outbound rules within the security group to control network traffic.
     • For inbound rules, specify the allowed source IP addresses or security groups and the necessary ports for accessing the Neptune cluster.
     • For outbound rules, define the allowed destination IP addresses or security groups and the required ports for outbound connections from the Neptune cluster.
   • Save the security group settings.
5. Configure Network Access Control Lists (ACLs):
   • In the cluster details page, navigate to the Connectivity & Security or Network & Security section.
   • Under Network Access Control Lists (ACLs), click on Manage network ACLs.
   • Create a new network ACL or select an existing one associated with your Amazon Neptune cluster.
   • Configure inbound and outbound rules within the network ACL to control network traffic at the subnet level.