Terug naar Beveiliging en compliance
AVG
De AVG is de Europese verordening 2016/679, van toepassing sinds mei 2018. Het artikel dat deze pagina documenteert, is artikel 32: het vereist technische en organisatorische maatregelen die op het risico zijn afgestemd, waaronder versleuteling, de beschikbaarheid van de gegevens en een procedure om de doeltreffendheid ervan regelmatig te toetsen. Een platform dat opgenomen gesprekken analyseert, verwerkt van nature persoonsgegevens, zowel die van klanten als die van adviseurs.
100%
181 / 181 controles conform bij de automatische beoordeling
Laatste synchronisatie: · Aikido Security
Gemeten controles
De namen van beoordelingen, typen en controles zijn die van de oorspronkelijke normenkaders en staan daarom in het Engels. De teller is het aantal controles dat ons platform voor continue monitoring, Aikido Security, als voldaan rapporteert, van alle controles die het voor dit normenkader beoordeelt. Ze staan hieronder allemaal een voor een vermeld.
Enforces Multi-Factor Authentication (MFA)
| Controle | Status |
|---|---|
| Users are logging in securely | conform |
Proper Access Management for Resources
| Controle | Status |
|---|---|
| Access Approval is enabled for the project | conform |
| AKS local admin account is still enabled | conform |
| Compute instances have OS Login enabled | conform |
| Dangerous Impersonate permission given to ServiceAccount or node | conform |
| GKE clusters have the Kubernetes Dashboard disabled | conform |
| Kubernetes pods are isolated | conform |
| No instance uses the default service account | conform |
| No user has both the Service Account User and Service Account Admin role | conform |
| Project-wide SSH keys are blocked | conform |
| Service accounts have strict access permissions | conform |
| ServiceAccount or node can read all secrets | conform |
| VM instances have strict access permissions | conform |
Proper Access Management for Users
| Controle | Status |
|---|---|
| Users are only allowed to use corporate emails | conform |
Proper Access Management to Resources
| Controle | Status |
|---|---|
| Access to BigQuery datasets are restricted | conform |
| AKS API server does not limit access by IP ranges | conform |
| Amazon EKS Clusters public endpoints should not allow traffic from any IP | conform |
| API Gateway endpoints do not require an API key or authorization | conform |
| AWS EKS Node groups have implicit SSH access from any IP | conform |
| Azure API Management allows public network access | conform |
| Azure Cognitive Services allows unrestricted public network access | conform |
| Azure Container Registry allows public network access | conform |
| Azure Cosmos DB is publicly reachable | conform |
| Azure Event Grid topic allows public network access | conform |
| Azure Function App allows public network access | conform |
| Azure Key Vault allows public network access | conform |
| Azure SQL Server allows public network access | conform |
| Azure Storage Account allow public access | conform |
| Azure Storage blobs do not restrict public access for nested items | conform |
| BigQuery table is anonymously or publicly accessible | conform |
| Cloud functions are not publicly accessible | conform |
| Cloud functions have strict access policies | conform |
| Cloud Storage bucket does not enforce public access prevention | conform |
| Cloud Storage bucket does not enforce uniform bucket-level access | conform |
| Cloud Storage bucket is publicly accessible | conform |
| Dataproc cluster is anonymously or publicly accessible | conform |
| Default network exists in GCP project | conform |
| Firewall rule prevents Docker API access from anywhere | conform |
| Firewall rule prevents RDP access from anywhere | conform |
| Firewall rule prevents SSH access from anywhere | conform |
| Firewall rules allow RDP access from any public IP | conform |
| Firewall rules allow RDP from any public IP | conform |
| Firewall rules allow SSH from any public IP | conform |
| Firewall rules allow SSH from any public IP | conform |
| Firewall rules allow unrestricted RDP access | conform |
| Firewall rules allow unrestricted SSH access | conform |
| Firewall rules do not allow unrestricted ingress to all ports and protocols | conform |
| Firewall rules restrict public ingress to port 23 | conform |
| Firewall rules restrict public ingress to port 2379 | conform |
| Firewall rules restrict public ingress to port 3000 | conform |
| Firewall rules restrict public ingress to port 5500 | conform |
| Firewall rules restrict public ingress to port 5800 | conform |
| Key Vault is publicly accessible | conform |
| KMS cryptographic key policy allows public access | conform |
| KMS keys have strict access permissions | conform |
| Kubernetes dashboard might be deployed | conform |
| Kubernetes master endpoint is not publicly available | conform |
| Profiling endpoint automatically exposed on /debug/pprof | conform |
| Pub/Sub topic is anonymously or publicly accessible | conform |
| S3 bucket grants public access to all contents | conform |
| S3 Buckets should have block public access globally | conform |
| SQL firewall allows access from any IP | conform |
| SQL instance root user has strict access permissions | conform |
| SQL instances do not have a public IP assigned | conform |
| SQL instances have strict access permission | conform |
| Storage Buckets have proper access rules | conform |
| Storage buckets have public access prevention enabled | conform |
| Vertex AI notebook instance has a public IP address | conform |
Encryption at Rest Enabled
| Controle | Status |
|---|---|
| Amazon EKS Clusters should have secrets encryption enabled | conform |
| API Gateway REST API caching is unencrypted | conform |
| AWS ElastiCache Redis cluster should have encryption at rest enabled | conform |
| ECR repository does not use AWS KMS encryption | conform |
| Elasticsearch domain is not encrypted at rest | conform |
| Ensure all data stored in the RDS is securely encrypted at rest | conform |
| KMS keys have key rotation enabled | conform |
| SNS topics are not encrypted at rest | conform |
| SQS queue data is not encrypted | conform |
| Virtual Machines have confidential computing enabled | conform |
Enforces HTTPS traffic to cloud instances
| Controle | Status |
|---|---|
| Cloud functions require HTTPS invocations | conform |
| Load Balancers only accept HTTPS connections | conform |
Runtimes are up to date
| Controle | Status |
|---|---|
| AWS MQBroker version is outdated | conform |
| GKE clusters use stable release channels with automatic upgrades | conform |
| GKE node pools have node auto-upgrade enabled | conform |
| No AKS cluster upgrade channel is chosen | conform |
| No Critical End-of-Life (EOL) Issues | conform |
| No High End-of-Life (EOL) Issues | conform |
Use of Cryptography Libraries
| Controle | Status |
|---|---|
| Hashes should include an unpredictable salt | conform |
| Usage of deprecated or broken encryption detected | conform |
| Use of broken or outdated encryption | conform |
| Use of broken or outdated encryption | conform |
| Use of broken or outdated encryption | conform |
| Using deprecated cryptographic library | conform |
Use of Cryptography: Enforces SSL
| Controle | Status |
|---|---|
| Cloud SQL db not enforcing SSL | conform |
| Deprecated SSL Protocol Usage Detected | conform |
| Deprecated SSL Protocol Usage Detected | conform |
| NodeJS talks to database without encryption | conform |
| SSL certificate verification turned off during requests | conform |
| SSL certificate verification turned off during requests | conform |
Use of Cryptography: Enforces TLS
| Controle | Status |
|---|---|
| API Gateway stages are not using TLS 1.2 or higher | conform |
| Azure Storage Accounts does not enforce latest TLS version | conform |
| Elasticsearch domain might have outdated TLS version | conform |
| Load balancer allows unencrypted or encrypted traffic with outdated TLS policy | conform |
| Storage account does not enforce HTTPS-only traffic | conform |
Use of Cryptography: Secure Cookies
| Controle | Status |
|---|---|
| Cookie missing HttpOnly flag | conform |
| Laravel cookies can be sent unencrypted | conform |
Backups Enabled
| Controle | Status |
|---|---|
| Databases have automated backups enabled | conform |
| DynamoDB backups are off | conform |
Logging Enabled
| Controle | Status |
|---|---|
| Amazon EKS Clusters should have control plane logging enabled | conform |
| Audit Configuration logging is enabled | conform |
| Logging and alerts are enabled for Project Ownership assignments | conform |
| Storage Permissions logging is enabled | conform |
| VPC Firewall has Rule logging enabled | conform |
Threat Detection Enabled
| Controle | Status |
|---|---|
| Alerting policies have a notification channel configured | conform |
Encryption at Rest Enabled
| Controle | Status |
|---|---|
| Amazon EKS Clusters should have secrets encryption enabled | conform |
| API Gateway REST API caching is unencrypted | conform |
| AWS ElastiCache Redis cluster should have encryption at rest enabled | conform |
| ECR repository does not use AWS KMS encryption | conform |
| Elasticsearch domain is not encrypted at rest | conform |
| Ensure all data stored in the RDS is securely encrypted at rest | conform |
| KMS keys have key rotation enabled | conform |
| SNS topics are not encrypted at rest | conform |
| SQS queue data is not encrypted | conform |
| Virtual Machines have confidential computing enabled | conform |
Enforces HTTPS traffic to cloud instances
| Controle | Status |
|---|---|
| Cloud functions require HTTPS invocations | conform |
| Load Balancers only accept HTTPS connections | conform |
Use of Cryptography Libraries
| Controle | Status |
|---|---|
| Hashes should include an unpredictable salt | conform |
| Usage of deprecated or broken encryption detected | conform |
| Use of broken or outdated encryption | conform |
| Use of broken or outdated encryption | conform |
| Use of broken or outdated encryption | conform |
| Using deprecated cryptographic library | conform |
Use of Cryptography: Enforces SSL
| Controle | Status |
|---|---|
| Cloud SQL db not enforcing SSL | conform |
| Deprecated SSL Protocol Usage Detected | conform |
| Deprecated SSL Protocol Usage Detected | conform |
| NodeJS talks to database without encryption | conform |
| SSL certificate verification turned off during requests | conform |
| SSL certificate verification turned off during requests | conform |
Use of Cryptography: Enforces TLS
| Controle | Status |
|---|---|
| API Gateway stages are not using TLS 1.2 or higher | conform |
| Azure Storage Accounts does not enforce latest TLS version | conform |
| Elasticsearch domain might have outdated TLS version | conform |
| Load balancer allows unencrypted or encrypted traffic with outdated TLS policy | conform |
| Storage account does not enforce HTTPS-only traffic | conform |
Use of Cryptography: Secure Cookies
| Controle | Status |
|---|---|
| Cookie missing HttpOnly flag | conform |
| Laravel cookies can be sent unencrypted | conform |
Upload een gesprek. Lees de analyse. Vijf minuten.
Registratie in enkele seconden, zonder creditcard en zonder cookies. Een welcome tour laat u de belangrijkste principes zien, daarna voegt u uw eerste gesprek toe.
Early access · Uw feedback bouwt mee aan het product