cis-aws-database-7-7

name	cis-aws-database-7.7
description	Ensure Regular Updates and Patches
category	cis-database
version	2.0.0
author	cyberstrike-official
tags	["cis","aws","database","documentdb","patching","updates","maintenance"]
cis_id	7.7
cis_benchmark	CIS AWS Database Services Benchmark v2.0.0
tech_stack	["aws"]
cwe_ids	[]
chains_with	["cis-aws-database-7.11"]
prerequisites	[]
severity_boost	{}

7.7 Ensure Regular Updates and Patches (Manual)

Description

Stay informed about the latest security updates and patches released by Amazon for DocumentDB. Regularly apply updates and patches to your DocumentDB instances to protect against known vulnerabilities.

Rationale

Regular patching and updates are essential to protect DocumentDB instances from known security vulnerabilities and ensure the database engine is running with the latest security fixes.

Impact

Helps the organization reduce their security risk by regularly updating and patching their database and database engine. Regularly updating and scanning for any weaknesses in the company can bring up possible vulnerabilities that could have led to potential cyber-attack.

Audit Procedure

Using AWS Console

1. Stay Informed

   • Stay updated with Amazon DocumentDB announcements, release notes, and security bulletins.
   • Subscribe to AWS newsletters, forums, and notifications to receive timely updates regarding updates and patches.

2. Plan for Maintenance Windows

   • Determine a suitable maintenance window to apply updates and patches to your DocumentDB cluster.
   • Consider the impact on your applications and users when scheduling the maintenance window.

3. Monitor the AWS Management Console

   • Regularly check the AWS Management Console for notifications related to available updates and patches for your DocumentDB cluster.
   • The console will provide information on new versions and available patches.

4. Review the Release Notes and Changelog

   • Before applying any updates or patches, review the release notes and changelog for the new version or patch.
   • Pay attention to any compatibility or breaking changes that may require application adjustments.

5. Create a Test Environment (Optional)

   • If feasible, create a separate test environment that closely resembles your production environment.
   • Deploy a copy of your DocumentDB cluster in the test environment to test the updates and patches before applying them to production.

6. Apply Updates and Patches

   • During the scheduled maintenance window, initiate the process to apply updates and patches to your DocumentDB cluster.
   • Follow the recommended procedure provided by AWS, which may involve a few simple clicks in the AWS Management Console.
   • Ensure that you select the appropriate version or patch to apply.

7. Monitor the Update Process