Terug naar Beveiliging en compliance
SOC 2
SOC 2 is een Amerikaans auditkader, opgesteld door het AICPA, de beroepsorganisatie van accountants in de Verenigde Staten. Het onderzoekt hoe een dienstverlener de gegevens beschermt die hem zijn toevertrouwd, aan de hand van vijf vertrouwenscriteria: beveiliging, beschikbaarheid, integriteit van de verwerking, vertrouwelijkheid en bescherming van de privacy, waarvan alleen het eerste verplicht is. Angelsaksische kopers vragen erom in de vorm van een assurancerapport dat een onafhankelijke auditor heeft ondertekend. De meting hieronder vervangt dat rapport niet: ze toont de dagelijkse staat van de technische controles waarop het steunt.
100%
532 / 532 controles conform bij de automatische beoordeling
Laatste synchronisatie: · Aikido Security
Gemeten controles
De namen van beoordelingen, typen en controles zijn die van de oorspronkelijke normenkaders en staan daarom in het Engels. De teller is het aantal controles dat ons platform voor continue monitoring, Aikido Security, als voldaan rapporteert, van alle controles die het voor dit normenkader beoordeelt. Ze staan hieronder allemaal een voor een vermeld.
Configured monitoring for code repositories
| Controle | Status |
|---|---|
| Configured monitoring for all code repositories | conform |
Configured monitoring for container images
| Controle | Status |
|---|---|
| Configured monitoring for all container images | conform |
Configured monitoring for domains
| Controle | Status |
|---|---|
| Configured monitoring for domains | conform |
Does not have any severe open source dependency issues
| Controle | Status |
|---|---|
| No active critical open source dependency issues | conform |
| No active high severity open source dependency issues | conform |
Does not have any severe surface monitoring issues
| Controle | Status |
|---|---|
| No active critical surface monitoring issues | conform |
| No active high severity surface monitoring issues | conform |
Properly manages the identity of cloud users
| Controle | Status |
|---|---|
| Firewall rules restrict public ingress to port 636 | conform |
| No user has both the Service Account User and Service Account Admin role | conform |
| Service accounts have strict access permissions | conform |
| Users are logging in securely | conform |
| Users are only allowed to use corporate emails | conform |
Threat detection is enabled
| Controle | Status |
|---|---|
| Alerting policies have a notification channel configured | conform |
Applies the least privilege principle for cloud resource
| Controle | Status |
|---|---|
| Access Approval is enabled for the project | conform |
| Compute instances have OS Login enabled | conform |
| GKE clusters have the Kubernetes Dashboard disabled | conform |
| Kubernetes pods are isolated | conform |
| No instance uses the default service account | conform |
| No user has both the Service Account User and Service Account Admin role | conform |
| Project-wide SSH keys are blocked | conform |
| Service accounts have strict access permissions | conform |
| VM instances have strict access permissions | conform |
Applies the least privilege principle to cloud resources
| Controle | Status |
|---|---|
| Access to BigQuery datasets are restricted | conform |
| Cloud functions are not publicly accessible | conform |
| Cloud functions have strict access policies | conform |
| Firewall rule prevents Docker API access from anywhere | conform |
| Firewall rule prevents RDP access from anywhere | conform |
| Firewall rule prevents SSH access from anywhere | conform |
| Firewall rules do not allow unrestricted ingress to all ports and protocols | conform |
| Firewall rules restrict public ingress to port 23 | conform |
| Firewall rules restrict public ingress to port 2379 | conform |
| Firewall rules restrict public ingress to port 3000 | conform |
| Firewall rules restrict public ingress to port 5500 | conform |
| Firewall rules restrict public ingress to port 5800 | conform |
| KMS keys have strict access permissions | conform |
| Kubernetes master endpoint is not publicly available | conform |
| SQL instance root user has strict access permissions | conform |
| SQL instances do not have a public IP assigned | conform |
| SQL instances have strict access permission | conform |
| Storage Buckets have proper access rules | conform |
| Storage buckets have public access prevention enabled | conform |
Enabled security logging for cloud instances
| Controle | Status |
|---|---|
| Audit Configuration logging is enabled | conform |
| Logging and alerts are enabled for Project Ownership assignments | conform |
| Storage Permissions logging is enabled | conform |
| VPC Firewall has Rule logging enabled | conform |
Requires MFA for cloud users
| Controle | Status |
|---|---|
| Users are logging in securely | conform |
Threat detection is enabled
| Controle | Status |
|---|---|
| Alerting policies have a notification channel configured | conform |
Applies the least privilege principle for cloud resource
| Controle | Status |
|---|---|
| Access Approval is enabled for the project | conform |
| Compute instances have OS Login enabled | conform |
| GKE clusters have the Kubernetes Dashboard disabled | conform |
| Kubernetes pods are isolated | conform |
| Load Balancers only accept HTTPS connections | conform |
| No instance uses the default service account | conform |
| No user has both the Service Account User and Service Account Admin role | conform |
| Project-wide SSH keys are blocked | conform |
| Service accounts have strict access permissions | conform |
| VM instances have strict access permissions | conform |
Does not have any severe infrastructure as code issues
| Controle | Status |
|---|---|
| No active critical infrastructure as code issues | conform |
| No active high severity infrastructure as code issues | conform |
Has deletion protection for cloud resources
| Controle | Status |
|---|---|
| Cloud SQL instances have deletion protection enabled | conform |
| VM instances have deletion protection enabled | conform |
Properly manages the identity of cloud users
| Controle | Status |
|---|---|
| Firewall rules restrict public ingress to port 636 | conform |
| Users are logging in securely | conform |
| Users are only allowed to use corporate emails | conform |
Has separate production and test environments
| Controle | Status |
|---|---|
| No cloud environment used for mixed purposes (eg production and staging) | conform |
Prevents unauthorized access via ssh
| Controle | Status |
|---|---|
| AWS EKS Node groups have implicit SSH access from any IP | conform |
| Firewall rule prevents RDP access from anywhere | conform |
| Firewall rule prevents SSH access from anywhere | conform |
| Firewall rules allow RDP access from any public IP | conform |
| Firewall rules allow SSH from any public IP | conform |
| Firewall rules allow SSH from any public IP | conform |
| Firewall rules allow unrestricted SSH access | conform |
Prevents unauthorized public access to database
| Controle | Status |
|---|---|
| BigQuery table is anonymously or publicly accessible | conform |
| Firewall rules restrict public ingress to port 1433 | conform |
| Firewall rules restrict public ingress to port 1434 | conform |
| Firewall rules restrict public ingress to port 2383 | conform |
| Firewall rules restrict public ingress to port 2484 | conform |
| Firewall rules restrict public ingress to port 27017 | conform |
| Firewall rules restrict public ingress to port 27018 | conform |
| Firewall rules restrict public ingress to port 27019 | conform |
| Firewall rules restrict public ingress to port 3306 | conform |
| Firewall rules restrict public ingress to port 61621 | conform |
| Firewall rules restrict public ingress to port 7001 | conform |
| Firewall rules restrict public ingress to port 9200 | conform |
| Firewall rules restrict public ingress to port 9300 | conform |
| No firewall rule allows MongoDB access from the internet | conform |
| SQL instance root user has strict access permissions | conform |
| SQL instances do not have a public IP assigned | conform |
| SQL instances have strict access permission | conform |
Prevents unauthorized public access to file storage
| Controle | Status |
|---|---|
| Azure Storage Account allow public access | conform |
| Azure Storage blobs do not restrict public access for nested items | conform |
| Firewall rules restrict public ingress to port 3020 | conform |
| S3 bucket grants public access to all contents | conform |
| S3 Buckets should have block public access globally | conform |
| Storage Buckets have proper access rules | conform |
| Storage buckets have public access prevention enabled | conform |
Has secured load balancer access points
| Controle | Status |
|---|---|
| Users are logging in securely | conform |
Has secured load balancer access points
| Controle | Status |
|---|---|
| AWS EKS Node groups have implicit SSH access from any IP | conform |
| Compute instances have OS Login enabled | conform |
| Firewall rule prevents RDP access from anywhere | conform |
| Firewall rule prevents SSH access from anywhere | conform |
| Firewall rules allow RDP access from any public IP | conform |
| Firewall rules allow SSH from any public IP | conform |
| Firewall rules allow SSH from any public IP | conform |
| Firewall rules allow unrestricted SSH access | conform |
| Load Balancers only accept HTTPS connections | conform |
| Project-wide SSH keys are blocked | conform |
Applies the least privilege principle to cloud resources
| Controle | Status |
|---|---|
| Access to BigQuery datasets are restricted | conform |
| Cloud functions are not publicly accessible | conform |
| Cloud functions have strict access policies | conform |
| Firewall rule prevents Docker API access from anywhere | conform |
| Firewall rule prevents RDP access from anywhere | conform |
| Firewall rule prevents SSH access from anywhere | conform |
| Firewall rules do not allow unrestricted ingress to all ports and protocols | conform |
| Firewall rules restrict public ingress to port 23 | conform |
| Firewall rules restrict public ingress to port 2379 | conform |
| Firewall rules restrict public ingress to port 3000 | conform |
| Firewall rules restrict public ingress to port 5500 | conform |
| Firewall rules restrict public ingress to port 5800 | conform |
| KMS keys have strict access permissions | conform |
| Kubernetes master endpoint is not publicly available | conform |
| SQL instance root user has strict access permissions | conform |
| SQL instances do not have a public IP assigned | conform |
| SQL instances have strict access permission | conform |
| Storage Buckets have proper access rules | conform |
| Storage buckets have public access prevention enabled | conform |
Encrypts data at rest
| Controle | Status |
|---|---|
| Amazon EKS Clusters should have secrets encryption enabled | conform |
| API Gateway REST API caching is unencrypted | conform |
| AWS ElastiCache Redis cluster should have encryption at rest enabled | conform |
| ECR repository does not use AWS KMS encryption | conform |
| Elasticsearch domain is not encrypted at rest | conform |
| Ensure all data stored in the RDS is securely encrypted at rest | conform |
| KMS keys have key rotation enabled | conform |
| SNS topics are not encrypted at rest | conform |
| SQS queue data is not encrypted | conform |
| Virtual Machines have confidential computing enabled | conform |
Enforces encryption of data in transit
| Controle | Status |
|---|---|
| API Gateway stages are not using TLS 1.2 or higher | conform |
| App does not validate SSL certificates properly | conform |
| App uses an outdated TLS protocol | conform |
| App uses an outdated TLS protocol | conform |
| AWS ElastiCache Replication Group should encrypt data in transit and enable Redis AUTH | conform |
| Azure Network Security Rule allows plaintext HTTP connections | conform |
| Azure Network Security Rule allows plaintext HTTP connections | conform |
| Azure Storage Account allows plaintext HTTP connections | conform |
| Azure Storage Account allows plaintext HTTP connections | conform |
| Azure Storage Accounts does not enforce latest TLS version | conform |
| Cloud functions require HTTPS invocations | conform |
| Cloud SQL db not enforcing SSL | conform |
| Cloud SQL instance requires SSL connections | conform |
| Cookie missing HttpOnly flag | conform |
| Deprecated SSL Protocol Usage Detected | conform |
| Deprecated SSL Protocol Usage Detected | conform |
| DNSSEC is disabled | conform |
| DNSSEC is enabled for all managed zones | conform |
| Elasticsearch domain might have outdated TLS version | conform |
| Express is not emitting security headers | conform |
| Firewall rules restrict public ingress to port 2484 | conform |
| Firewall rules restrict public ingress to port 636 | conform |
| HTTP Client misconfigured with SSL validation disabled | conform |
| Insecure gRPC connection can lead to remote code execution | conform |
| Insecure gRPC connection can lead to remote code execution | conform |
| Insecure HTTP Request detected | conform |
| Insecure TLS configuration detected | conform |
| Insecure usage of `requests` sends data over cleartext | conform |
| Insecure websocket connection sends data over cleartext | conform |
| Laravel cookies can be sent unencrypted | conform |
| Load balancer allows invalid HTTP headers | conform |
| Load balancer allows unencrypted or encrypted traffic with outdated TLS policy | conform |
| Load Balancers only accept HTTPS connections | conform |
| NodeJS talks to database without encryption | conform |
| NodeJS talks to database without encryption | conform |
| Outbound Ansible connections are not encrypted | conform |
| Outbound Ansible connections are not encrypted | conform |
| Server certificates are not verified during SSL/TLS connections | conform |
| Server hostnames not verified during SSL/TLS connections | conform |
| Signature validation for dnf packages is off | conform |
| SSL certificate verification turned off during requests | conform |
| SSL certificate verification turned off during requests | conform |
| Storage account does not enforce HTTPS-only traffic | conform |
| TLS Certificate Validation Disabled | conform |
| TLS Certificate Validation Disabled | conform |
| Turning off TLS verification enables man-in-the-middle attacks | conform |
| Usage of deprecated or broken encryption detected | conform |
| Use of broken or outdated encryption | conform |
| Use of broken or outdated encryption | conform |
| Use of broken or outdated encryption | conform |
| Using potentially unsafe FTP connections to move data | conform |
| Using potentially unsafe FTP connections to move data | conform |
| Weak SSL/TLS protocols used | conform |
Has measures against SQL injection attacks
| Controle | Status |
|---|---|
| NoSQL injection attack possible | conform |
| NoSQL injection attack possible | conform |
| NoSQL injection attack possible | conform |
| Potential NoSQL injection via string-based query concatenation | conform |
| Potential NoSQL injection via string-based query concatenation | conform |
| Potential NoSQL injection via string-based query concatenation | conform |
| Potential NoSQL injection via string-based query concatenation | conform |
| Potential SQL injection in Doctrine's QueryBuilder | conform |
| Potential SQL injection in sqlite3 via string-based query concatenation | conform |
| Potential SQL injection through JDBC via string-based query concatenation | conform |
| Potential SQL injection using sqflite execute sink | conform |
| Potential SQL injection via Drupal database functionality | conform |
| Potential SQL injection via dynamic raw query construction | conform |
| Potential SQL injection via dynamic raw query construction | conform |
| Potential SQL injection via dynamic raw query construction | conform |
| Potential SQL injection via Laravel function | conform |
| Potential SQL injection via string-based query concatenation | conform |
| Potential SQL injection via string-based query concatenation | conform |
| Potential SQL injection via string-based query concatenation | conform |
| Potential SQL injection via string-based query concatenation | conform |
| Potential SQL injection via string-based query concatenation | conform |
| Potential SQL injection via string-based query concatenation | conform |
| Potential SQL injection via string-based query concatenation | conform |
| Potential SQL injection via string-based query concatenation | conform |
| Potential SQL injection via string-based query concatenation | conform |
| Potential SQL injection via string-based query concatenation | conform |
| Potential SQL injection via string-based query concatenation | conform |
| Potential SQL injection via string-based query concatenation | conform |
| Potential SQL injection via string-based query concatenation | conform |
| Potential SQL injection via string-based query concatenation | conform |
| Potential SQL injection via string-based query concatenation | conform |
| Potential SQL injection via string-based query concatenation | conform |
| Potential SQL injection via string-based query concatenation | conform |
| Potential SQL injection via string-based query concatenation using AuraSQL framework functions | conform |
| Potential SQL injection via Yii function | conform |
| Potential SQL injection when bypassing Django ORM with extra() | conform |
| Potential SQL injection when bypassing Django ORM with RawSQL() | conform |
| Potential SQL injection when bypassing Doctrine ORM with raw query | conform |
Is protected against command injections attacks
| Controle | Status |
|---|---|
| A potential Swift command injection vulnerability has been identified due to the construction of an operating system command with user-controlled input. | conform |
| Possible command injection via Process.Start | conform |
| Possible command injection via Process.Start | conform |
| Possible command injection via shell script | conform |
| Possible command injection via user-controlled input to clojure.java.shell/sh | conform |
| Potential command injection via Command API | conform |
| Potential command injection via Process.run | conform |
| Use of vulnerable ingress-nginx controller | conform |
| Xpath injection attack could lead to information extraction | conform |
| Xpath injection attack could lead to information extraction | conform |
Is protected against SSRF attacks
| Controle | Status |
|---|---|
| A timing attack might allow hackers to bruteforce passwords | conform |
| EC2 IAM roles vulnerable to SSRF attacks | conform |
| GCP Kubernetes engine clusters vulnerable to SSRF attacks | conform |
| HTTP request might enable SSRF attack | conform |
| HTTP request might enable SSRF attack | conform |
| HTTP request might enable SSRF attack | conform |
| HTTP request might enable SSRF attack | conform |
| HTTP request might enable SSRF attack | conform |
| HTTP request might enable SSRF attack | conform |
| HTTP request might enable SSRF attack | conform |
| HTTP request might enable SSRF attack | conform |
| Potential file inclusion attack via reading file | conform |
| Potential file inclusion attack via reading file | conform |
| Potential file inclusion attack via reading file | conform |
| Potential user input in HTTP request may allow SSRF attack | conform |
| Potential user input in HTTP request may allow SSRF attack | conform |
| Simple DOS attack possible due to http.server misconfiguration | conform |
| User data used in Puppeteer methods can result in SSRF | conform |
| User data used in Puppeteer methods can result in SSRF | conform |
Prevents the exposure of sensitive data
| Controle | Status |
|---|---|
| Currently there are no exposed secrets | conform |
Prevents XSS attacks
| Controle | Status |
|---|---|
| Apex Visualforce misconfigurations may lead to Cross-Site Scripting (XSS) Vulnerabilities | conform |
| Directly writing unsanitized input to http.ResponseWriter can lead to XSS | conform |
| Disabling JSON HTML Escaping in ActiveSupport may lead to XSS | conform |
| DOM Cross-Site Scripting (XSS) via Insecure jQuery Execution Sinks | conform |
| HttpServletResponse output can be used for XSS attacks | conform |
| Improper sanitization in dynamic attribute bindings can lead to XSS attacks | conform |
| Input validation disabled in controller | conform |
| Jinja2 template config can lead to XSS attacks | conform |
| Potential Cross Site Scripting (XSS) via window.location.href | conform |
| Potential XSS due to enabling bypassSecurityTrustUrl | conform |
| Potential XSS via MarkupStr(...) in Razor template may lead to XSS | conform |
| Rendering unescaped input can lead to XSS attacks | conform |
| Rendering unescaped input can lead to XSS attacks | conform |
| Rendering unescaped input can lead to XSS attacks | conform |
| Rendering unescaped input can lead to XSS attacks | conform |
| Rendering unescaped input can lead to XSS attacks | conform |
| Rendering unescaped input can lead to XSS attacks | conform |
| Rendering unescaped input in EJS template can lead to XSS attacks | conform |
| Rendering unescaped input in handlebar/mustache template can lead to XSS attacks | conform |
| Rendering unescaped input in HTML template can lead to XSS attacks | conform |
| Unsanitized user input in jQuery DOM handling methods detected | conform |
| Unsanitized user input leads to cross-site scripting (XSS) | conform |
| Using dangerouslySetInnerHTML in React can lead to XSS attacks | conform |
| Using document write methods can lead to XSS attacks | conform |
| Using document write methods can lead to XSS attacks | conform |
| Using document write methods can lead to XSS attacks | conform |
| Using document write methods in .ejs files can lead to XSS attacks | conform |
| Using raw on potential user input can leads to XSS | conform |
| Using v-html in Vue templates can lead to XSS attacks | conform |
Requires MFA for cloud users
| Controle | Status |
|---|---|
| Users are logging in securely | conform |
Threat detection is enabled
| Controle | Status |
|---|---|
| Alerting policies have a notification channel configured | conform |
Encrypts data at rest
| Controle | Status |
|---|---|
| Amazon EKS Clusters should have secrets encryption enabled | conform |
| API Gateway REST API caching is unencrypted | conform |
| AWS ElastiCache Redis cluster should have encryption at rest enabled | conform |
| ECR repository does not use AWS KMS encryption | conform |
| Elasticsearch domain is not encrypted at rest | conform |
| Ensure all data stored in the RDS is securely encrypted at rest | conform |
| KMS keys have key rotation enabled | conform |
| SNS topics are not encrypted at rest | conform |
| Virtual Machines have confidential computing enabled | conform |
Enforces encryption of data in transit
| Controle | Status |
|---|---|
| API Gateway stages are not using TLS 1.2 or higher | conform |
| App does not validate SSL certificates properly | conform |
| App uses an outdated TLS protocol | conform |
| App uses an outdated TLS protocol | conform |
| AWS ElastiCache Replication Group should encrypt data in transit and enable Redis AUTH | conform |
| Azure Network Security Rule allows plaintext HTTP connections | conform |
| Azure Network Security Rule allows plaintext HTTP connections | conform |
| Azure Storage Account allows plaintext HTTP connections | conform |
| Azure Storage Account allows plaintext HTTP connections | conform |
| Azure Storage Accounts does not enforce latest TLS version | conform |
| Cloud functions require HTTPS invocations | conform |
| Cloud SQL db not enforcing SSL | conform |
| Cloud SQL instance requires SSL connections | conform |
| Cookie missing HttpOnly flag | conform |
| Deprecated SSL Protocol Usage Detected | conform |
| Deprecated SSL Protocol Usage Detected | conform |
| DNSSEC is disabled | conform |
| DNSSEC is enabled for all managed zones | conform |
| Elasticsearch domain might have outdated TLS version | conform |
| Express is not emitting security headers | conform |
| Firewall rules restrict public ingress to port 2484 | conform |
| Firewall rules restrict public ingress to port 636 | conform |
| HTTP Client misconfigured with SSL validation disabled | conform |
| Insecure gRPC connection can lead to remote code execution | conform |
| Insecure gRPC connection can lead to remote code execution | conform |
| Insecure HTTP Request detected | conform |
| Insecure TLS configuration detected | conform |
| Insecure usage of `requests` sends data over cleartext | conform |
| Insecure websocket connection sends data over cleartext | conform |
| Laravel cookies can be sent unencrypted | conform |
| Load balancer allows invalid HTTP headers | conform |
| Load balancer allows unencrypted or encrypted traffic with outdated TLS policy | conform |
| Load Balancers only accept HTTPS connections | conform |
| NodeJS talks to database without encryption | conform |
| NodeJS talks to database without encryption | conform |
| Outbound Ansible connections are not encrypted | conform |
| Outbound Ansible connections are not encrypted | conform |
| Server certificates are not verified during SSL/TLS connections | conform |
| Server hostnames not verified during SSL/TLS connections | conform |
| Signature validation for dnf packages is off | conform |
| SQS queue data is not encrypted | conform |
| SSL certificate verification turned off during requests | conform |
| SSL certificate verification turned off during requests | conform |
| Storage account does not enforce HTTPS-only traffic | conform |
| TLS Certificate Validation Disabled | conform |
| TLS Certificate Validation Disabled | conform |
| Turning off TLS verification enables man-in-the-middle attacks | conform |
| Using potentially unsafe FTP connections to move data | conform |
| Using potentially unsafe FTP connections to move data | conform |
| Weak SSL/TLS protocols used | conform |
Uses up to date cryptography libraries
| Controle | Status |
|---|---|
| Hashes should include an unpredictable salt | conform |
| Usage of deprecated or broken encryption detected | conform |
| Use of broken or outdated encryption | conform |
| Use of broken or outdated encryption | conform |
| Use of broken or outdated encryption | conform |
| Using deprecated cryptographic library | conform |
Applies the least privilege principle for cloud resource
| Controle | Status |
|---|---|
| Access Approval is enabled for the project | conform |
| Access to BigQuery datasets are restricted | conform |
| API key restricts usage to certain APIs | conform |
| API key restricts usage to certain clients | conform |
| Cloud functions are not publicly accessible | conform |
| Cloud functions have strict access policies | conform |
| Compute instances have IP forwarding disabled | conform |
| Compute instances have OS Login enabled | conform |
| Compute instances have serial port access disabled | conform |
| Firewall rule prevents Docker API access from anywhere | conform |
| Firewall rule prevents RDP access from anywhere | conform |
| Firewall rule prevents SSH access from anywhere | conform |
| Firewall rules do not allow unrestricted ingress to all ports and protocols | conform |
| Firewall rules restrict public ingress to port 23 | conform |
| Firewall rules restrict public ingress to port 2379 | conform |
| Firewall rules restrict public ingress to port 3000 | conform |
| Firewall rules restrict public ingress to port 5500 | conform |
| Firewall rules restrict public ingress to port 5800 | conform |
| GKE clusters have the GKE Metadata Server enabled | conform |
| GKE clusters have the Kubernetes Dashboard disabled | conform |
| GKE node pools use dedicated service accounts | conform |
| KMS keys have strict access permissions | conform |
| Kubernetes master endpoint is not publicly available | conform |
| Kubernetes pods are isolated | conform |
| No instance uses the default service account | conform |
| No user has both the Service Account User and Service Account Admin role | conform |
| Project-wide SSH keys are blocked | conform |
| Service accounts have strict access permissions | conform |
| SQL instance root user has strict access permissions | conform |
| SQL instances do not have a public IP assigned | conform |
| SQL instances have strict access permission | conform |
| Storage Buckets have proper access rules | conform |
| Storage buckets have public access prevention enabled | conform |
| Storage buckets have uniform bucket-level access enabled | conform |
| Users are logging in securely | conform |
| VM instances have strict access permissions | conform |
MFA is enforced for cloud users
| Controle | Status |
|---|---|
| Users are logging in securely | conform |
Prevents public access to cloud resources
| Controle | Status |
|---|---|
| Access to BigQuery datasets are restricted | conform |
| AKS API server does not limit access by IP ranges | conform |
| Amazon EKS Clusters public endpoints should not allow traffic from any IP | conform |
| API Gateway endpoints do not require an API key or authorization | conform |
| AWS EKS Node groups have implicit SSH access from any IP | conform |
| Azure API Management allows public network access | conform |
| Azure Cognitive Services allows unrestricted public network access | conform |
| Azure Container Registry allows public network access | conform |
| Azure Cosmos DB is publicly reachable | conform |
| Azure Event Grid topic allows public network access | conform |
| Azure Function App allows public network access | conform |
| Azure Key Vault allows public network access | conform |
| Azure SQL Server allows public network access | conform |
| Azure Storage Account allow public access | conform |
| Azure Storage blobs do not restrict public access for nested items | conform |
| BigQuery table is anonymously or publicly accessible | conform |
| Cloud functions are not publicly accessible | conform |
| Cloud functions have strict access policies | conform |
| Cloud Storage bucket does not enforce public access prevention | conform |
| Cloud Storage bucket does not enforce uniform bucket-level access | conform |
| Cloud Storage bucket is publicly accessible | conform |
| Compute instances do not have public IP addresses | conform |
| Dataproc cluster is anonymously or publicly accessible | conform |
| Default network exists in GCP project | conform |
| Firewall rule prevents Docker API access from anywhere | conform |
| Firewall rule prevents RDP access from anywhere | conform |
| Firewall rule prevents SSH access from anywhere | conform |
| Firewall rules allow RDP access from any public IP | conform |
| Firewall rules allow RDP from any public IP | conform |
| Firewall rules allow SSH from any public IP | conform |
| Firewall rules allow SSH from any public IP | conform |
| Firewall rules allow unrestricted RDP access | conform |
| Firewall rules allow unrestricted SSH access | conform |
| Firewall rules do not allow unrestricted ingress to all ports and protocols | conform |
| Firewall rules restrict public ingress to port 11214 | conform |
| Firewall rules restrict public ingress to port 11215 | conform |
| Firewall rules restrict public ingress to port 135 | conform |
| Firewall rules restrict public ingress to port 137 | conform |
| Firewall rules restrict public ingress to port 138 | conform |
| Firewall rules restrict public ingress to port 139 | conform |
| Firewall rules restrict public ingress to port 1433 | conform |
| Firewall rules restrict public ingress to port 1434 | conform |
| Firewall rules restrict public ingress to port 23 | conform |
| Firewall rules restrict public ingress to port 2379 | conform |
| Firewall rules restrict public ingress to port 2383 | conform |
| Firewall rules restrict public ingress to port 2484 | conform |
| Firewall rules restrict public ingress to port 27017 | conform |
| Firewall rules restrict public ingress to port 27018 | conform |
| Firewall rules restrict public ingress to port 27019 | conform |
| Firewall rules restrict public ingress to port 3000 | conform |
| Firewall rules restrict public ingress to port 3020 | conform |
| Firewall rules restrict public ingress to port 3306 | conform |
| Firewall rules restrict public ingress to port 389 | conform |
| Firewall rules restrict public ingress to port 4505 | conform |
| Firewall rules restrict public ingress to port 4506 | conform |
| Firewall rules restrict public ingress to port 5500 | conform |
| Firewall rules restrict public ingress to port 5800 | conform |
| Firewall rules restrict public ingress to port 61621 | conform |
| Firewall rules restrict public ingress to port 636 | conform |
| Firewall rules restrict public ingress to port 7001 | conform |
| Firewall rules restrict public ingress to port 8000 | conform |
| Firewall rules restrict public ingress to port 9200 | conform |
| Firewall rules restrict public ingress to port 9300 | conform |
| Key Vault is publicly accessible | conform |
| KMS cryptographic key policy allows public access | conform |
| KMS keys have strict access permissions | conform |
| Kubernetes dashboard might be deployed | conform |
| Kubernetes master endpoint is not publicly available | conform |
| No firewall rule allows access to Open Telemtry metrics endpoint from the internet | conform |
| No firewall rule allows access to port 1720 from the internet | conform |
| No firewall rule allows cPanel access from the internet | conform |
| No firewall rule allows etcd access from the internet | conform |
| No firewall rule allows MongoDB access from the internet | conform |
| No firewall rule allows NFS access from the internet | conform |
| No firewall rule allows Telnet access from the internet | conform |
| No firewall rule allows Tomcat Cluster Receiver access from the internet | conform |
| Profiling endpoint automatically exposed on /debug/pprof | conform |
| Pub/Sub topic is anonymously or publicly accessible | conform |
| S3 bucket grants public access to all contents | conform |
| S3 Buckets should have block public access globally | conform |
| SQL firewall allows access from any IP | conform |
| SQL instance root user has strict access permissions | conform |
| SQL instances do not have a public IP assigned | conform |
| SQL instances have strict access permission | conform |
| Storage Buckets have proper access rules | conform |
| Storage buckets have public access prevention enabled | conform |
| Vertex AI notebook instance has a public IP address | conform |
Enforces latest TLS version
| Controle | Status |
|---|---|
| API Gateway stages are not using TLS 1.2 or higher | conform |
| Azure Storage Accounts does not enforce latest TLS version | conform |
| Elasticsearch domain might have outdated TLS version | conform |
| Load balancer allows unencrypted or encrypted traffic with outdated TLS policy | conform |
| Storage account does not enforce HTTPS-only traffic | conform |
Uses up to date cryptography libraries
| Controle | Status |
|---|---|
| Hashes should include an unpredictable salt | conform |
| Usage of deprecated or broken encryption detected | conform |
| Use of broken or outdated encryption | conform |
| Use of broken or outdated encryption | conform |
| Use of broken or outdated encryption | conform |
| Using deprecated cryptographic library | conform |
Prevents container orchestration takeover
| Controle | Status |
|---|---|
| AKS local admin account is still enabled | conform |
| Dangerous Impersonate permission given to ServiceAccount or node | conform |
Protects unauthorized runtime access
| Controle | Status |
|---|---|
| Container processes can gain more privileges than its parent | conform |
| Container running as root can allow attacker to escalate attacks | conform |
| Default Kubernetes settings allow containers to eavesdrop on traffic. | conform |
| Default security context allows pods to access host system. | conform |
| Docker container configured to run as user with root privileges | conform |
| Docker container runs as default root user | conform |
| Filesystem for docker container should not be writeable | conform |
| Privileged container can allow attackers to escalate attacks | conform |
Aikido Malware Scanner is enabled
| Controle | Status |
|---|---|
| Aikido Malware Scanner is enabled | conform |
Threat detection is enabled
| Controle | Status |
|---|---|
| Alerting policies have a notification channel configured | conform |
Connected code repositories
| Controle | Status |
|---|---|
| Connect code repositories | conform |
Connected public facing domain
| Controle | Status |
|---|---|
| Connect public facing domain | conform |
Does not have any issues outside of their SLA
| Controle | Status |
|---|---|
| No issues outside of sla | conform |
Uses Lockfiles to pin code dependencies
| Controle | Status |
|---|---|
| Use lockfiles in repos | conform |
Connected code repositories
| Controle | Status |
|---|---|
| Connect code repositories | conform |
Threat detection is enabled
| Controle | Status |
|---|---|
| Alerting policies have a notification channel configured | conform |
Configured SLAs to resolve issues
| Controle | Status |
|---|---|
| Configure SLAs | conform |
Connected cloud environment
| Controle | Status |
|---|---|
| Connect a cloud environment | conform |
Connected code repositories
| Controle | Status |
|---|---|
| Connect code repositories | conform |
Connected public facing domain
| Controle | Status |
|---|---|
| Connect public facing domain | conform |
Enabled security logging for cloud instances
| Controle | Status |
|---|---|
| Alerting policies have a notification channel configured | conform |
| Amazon EKS Clusters should have control plane logging enabled | conform |
| Audit Configuration logging is enabled | conform |
| Logging and alerts are enabled for Project Ownership assignments | conform |
| Storage Permissions logging is enabled | conform |
| VPC Firewall has Rule logging enabled | conform |
Has no critical open source dependency issues
| Controle | Status |
|---|---|
| There are critical open source dependency issues | conform |
Runtimes are up to date
| Controle | Status |
|---|---|
| AWS MQBroker version is outdated | conform |
| GKE clusters use stable release channels with automatic upgrades | conform |
| GKE node pools have node auto-upgrade enabled | conform |
| No AKS cluster upgrade channel is chosen | conform |
Prevents the exposure of sensitive data
| Controle | Status |
|---|---|
| Currently there are no exposed secrets | conform |
Tracks progress via an issue tracker
| Controle | Status |
|---|---|
| Integration with issue tracker enabled | conform |
Has backups for stateful cloud resources
| Controle | Status |
|---|---|
| Databases have automated backups enabled | conform |
| DynamoDB backups are off | conform |
Upload een gesprek. Lees de analyse. Vijf minuten.
Registratie in enkele seconden, zonder creditcard en zonder cookies. Een welcome tour laat u de belangrijkste principes zien, daarna voegt u uw eerste gesprek toe.
Early access · Uw feedback bouwt mee aan het product