Kingdom: Environment

This section includes everything that is outside of the source code but is still critical to the security of the product that is being created. Because the issues covered by this kingdom are not directly related to source code, we separated it from the rest of the kingdoms.

683 items found

Weaknesses

AWS Ansible Misconfiguration: Insufficient RDS Backup

YAML

Abstract

A configuration sets up a resource without proper backup settings.

Explanation

Backups are critical to protect against data loss or corruption. Settings that undermine backups include but are not limited to:
- Disabling data backup
- Failure to back up data regularly
- Failure to check the integrity of backups regularly
- Insufficient backup retention period

References

[1] Amazon Web Services, Inc. or its affiliates Backup and recovery approaches on AWS

[2] Standards Mapping - CIS Azure Kubernetes Service Benchmark 3

[3] Standards Mapping - CIS Microsoft Azure Foundations Benchmark partial

[4] Standards Mapping - CIS Amazon Elastic Kubernetes Service Benchmark 5

[5] Standards Mapping - CIS Amazon Web Services Foundations Benchmark 1

[6] Standards Mapping - CIS Google Cloud Computing Platform Benchmark partial

[7] Standards Mapping - CIS Google Kubernetes Engine Benchmark availability

[8] Standards Mapping - DISA Control Correlation Identifier Version 2 CCI-000366, CCI-003109

[9] Standards Mapping - FIPS200 CP

[10] Standards Mapping - NIST Special Publication 800-53 Revision 4 CP-9 Information System Backup (P1)

[11] Standards Mapping - NIST Special Publication 800-53 Revision 5 CP-9 System Backup

[12] Standards Mapping - OWASP Top 10 2017 A6 Security Misconfiguration

[13] Standards Mapping - OWASP Top 10 2021 A05 Security Misconfiguration

[14] Standards Mapping - OWASP API 2023 API8 Security Misconfiguration

[15] Standards Mapping - OWASP Application Security Verification Standard 4.0 8.1.5 General Data Protection (L3)

[16] Standards Mapping - Payment Card Industry Data Security Standard Version 3.2.1 Requirement 12.10.1

[17] Standards Mapping - Payment Card Industry Data Security Standard Version 4.0 Requirement 12.10.1

[18] Standards Mapping - Payment Card Industry Software Security Framework 1.0 Control Objective 2.2 - Secure Defaults

[19] Standards Mapping - Payment Card Industry Software Security Framework 1.1 Control Objective 2.2 - Secure Defaults

[20] Standards Mapping - Payment Card Industry Software Security Framework 1.2 Control Objective 2.2 - Secure Defaults

desc.structural.iac.aws.misconfiguration_insufficient_backup.base

AWS Ansible Misconfiguration: Insufficient S3 Backup

YAML

Abstract

A configuration sets up a resource without proper backup settings.

Explanation

Backups are critical to protect against data loss or corruption. Settings that undermine backups include but are not limited to:
- Disabling data backup
- Failure to back up data regularly
- Failure to check the integrity of backups regularly
- Insufficient backup retention period

References

[1] Amazon Web Services, Inc. or its affiliates Backup and recovery approaches on AWS

[2] Standards Mapping - CIS Azure Kubernetes Service Benchmark 3

[3] Standards Mapping - CIS Microsoft Azure Foundations Benchmark partial

[4] Standards Mapping - CIS Amazon Elastic Kubernetes Service Benchmark 5

[5] Standards Mapping - CIS Amazon Web Services Foundations Benchmark 1

[6] Standards Mapping - CIS Google Cloud Computing Platform Benchmark partial

[7] Standards Mapping - CIS Google Kubernetes Engine Benchmark availability

[8] Standards Mapping - DISA Control Correlation Identifier Version 2 CCI-000366, CCI-003109

[9] Standards Mapping - FIPS200 CP

[10] Standards Mapping - NIST Special Publication 800-53 Revision 4 CP-9 Information System Backup (P1)

[11] Standards Mapping - NIST Special Publication 800-53 Revision 5 CP-9 System Backup

[12] Standards Mapping - OWASP Top 10 2017 A6 Security Misconfiguration

[13] Standards Mapping - OWASP Top 10 2021 A05 Security Misconfiguration

[14] Standards Mapping - OWASP API 2023 API8 Security Misconfiguration

[15] Standards Mapping - OWASP Application Security Verification Standard 4.0 8.1.5 General Data Protection (L3)

[16] Standards Mapping - Payment Card Industry Data Security Standard Version 3.2.1 Requirement 12.10.1

[17] Standards Mapping - Payment Card Industry Data Security Standard Version 4.0 Requirement 12.10.1

[18] Standards Mapping - Payment Card Industry Software Security Framework 1.0 Control Objective 2.2 - Secure Defaults

[19] Standards Mapping - Payment Card Industry Software Security Framework 1.1 Control Objective 2.2 - Secure Defaults

[20] Standards Mapping - Payment Card Industry Software Security Framework 1.2 Control Objective 2.2 - Secure Defaults

desc.structural.iac.aws.misconfiguration_insufficient_backup.base

AWS Ansible Misconfiguration: Insufficient S3 Logging

YAML

Abstract

The template defines a service with insufficient audit logging.

Explanation

A lack of audit records limits the ability to detect and respond to security-related incidents and prevents forensic investigation.

Configuration settings that undermine logging capabilities include but are not limited to:
- deliberately disabling audit logging
- exempting actions of specific users, groups, or processes from being logged
- inadequately protecting log integrity
- not enabling optional audit logging
- reducing the log sampling rate

References

[1] Open Web Application Security Project (OWASP) Logging Cheat Sheet

[2] Standards Mapping - CIS Azure Kubernetes Service Benchmark 5

[3] Standards Mapping - CIS Amazon Elastic Kubernetes Service Benchmark 3

[4] Standards Mapping - CIS Amazon Web Services Foundations Benchmark 1

[5] Standards Mapping - CIS Google Kubernetes Engine Benchmark integrity

[6] Standards Mapping - Common Weakness Enumeration CWE ID 778

[7] Standards Mapping - DISA Control Correlation Identifier Version 2 CCI-000172

[8] Standards Mapping - FIPS200 CM

[9] Standards Mapping - NIST Special Publication 800-53 Revision 4 AU-12 Audit Generation (P1)

[10] Standards Mapping - NIST Special Publication 800-53 Revision 5 AU-12 Audit Record Generation

[11] Standards Mapping - OWASP Top 10 2017 A6 Security Misconfiguration, A10 Insufficient Logging and Monitoring

[12] Standards Mapping - OWASP Top 10 2021 A09 Security Logging and Monitoring Failures

[13] Standards Mapping - OWASP API 2023 API8 Security Misconfiguration

[14] Standards Mapping - OWASP Application Security Verification Standard 4.0 7.1.3 Log Content Requirements (L2 L3), 7.1.4 Log Content Requirements (L2 L3), 7.2.1 Log Processing Requirements (L2 L3), 7.2.2 Log Processing Requirements (L2 L3)

[15] Standards Mapping - Payment Card Industry Data Security Standard Version 3.2.1 Requirement 10.2.1, Requirement 10.2.4, Requirement 10.3.4

[16] Standards Mapping - Payment Card Industry Data Security Standard Version 4.0 Requirement 10.2.1, Requirement 10.2.1.4, Requirement 10.2.2

[17] Standards Mapping - Payment Card Industry Software Security Framework 1.0 Control Objective 8.2 - Activity Tracking

[18] Standards Mapping - Payment Card Industry Software Security Framework 1.1 Control Objective 8.2 - Activity Tracking

[19] Standards Mapping - Payment Card Industry Software Security Framework 1.2 Control Objective 8.2 - Activity Tracking

[20] Standards Mapping - Security Technical Implementation Guide Version 4.11 APSC-DV-000830 CAT II

[21] Standards Mapping - Security Technical Implementation Guide Version 5.1 APSC-DV-000830 CAT II

[22] Standards Mapping - Security Technical Implementation Guide Version 5.2 APSC-DV-000830 CAT II

[23] Standards Mapping - Security Technical Implementation Guide Version 5.3 APSC-DV-000380 CAT III, APSC-DV-000390 CAT III, APSC-DV-000400 CAT III, APSC-DV-000410 CAT III, APSC-DV-000430 CAT III, APSC-DV-000590 CAT II

desc.structural.iac.misconfiguration_insufficient_logging.base

AWS Ansible Misconfiguration: Insufficient S3 Monitoring

YAML

Abstract

A configuration sets up a resource that lacks monitoring.

Explanation

Any delayed response to breaches undermines an organization's ability to limit the impact of a breach.

Configuration settings that undermine monitoring capabilities include but are not limited to:
- deliberately disabling monitoring
- not enabling optional monitoring
- not specifying relevant events to export to monitoring services
- exempting actions of specific users, groups, processes, and geographical regions from monitoring

References

[1] Paul Cichonski,Tom Millar,Tim Grance,Karen Scarfone NIST Special Publication 800-61 Revision 2 - Computer Security Incident Handling Guide

[2] Standards Mapping - CIS Azure Kubernetes Service Benchmark 5

[3] Standards Mapping - CIS Amazon Elastic Kubernetes Service Benchmark 3

[4] Standards Mapping - CIS Amazon Web Services Foundations Benchmark 1

[5] Standards Mapping - CIS Google Kubernetes Engine Benchmark integrity

[6] Standards Mapping - Common Weakness Enumeration CWE ID 778

[7] Standards Mapping - DISA Control Correlation Identifier Version 2 CCI-000172

[8] Standards Mapping - FIPS200 CM

[9] Standards Mapping - General Data Protection Regulation (GDPR) Indirect Access to Sensitive Data

[10] Standards Mapping - NIST Special Publication 800-53 Revision 4 AU-12 Audit Generation (P1)

[11] Standards Mapping - NIST Special Publication 800-53 Revision 5 AU-12 Audit Record Generation

[12] Standards Mapping - OWASP Top 10 2017 A6 Security Misconfiguration, A10 Insufficient Logging and Monitoring

[13] Standards Mapping - OWASP Top 10 2021 A09 Security Logging and Monitoring Failures

[14] Standards Mapping - OWASP API 2023 API8 Security Misconfiguration

[15] Standards Mapping - OWASP Application Security Verification Standard 4.0 7.1.3 Log Content Requirements (L2 L3), 7.1.4 Log Content Requirements (L2 L3), 7.2.1 Log Processing Requirements (L2 L3), 7.2.2 Log Processing Requirements (L2 L3)

[16] Standards Mapping - Payment Card Industry Data Security Standard Version 3.2.1 Requirement 10.2.1, Requirement 10.2.4, Requirement 10.3.4

[17] Standards Mapping - Payment Card Industry Data Security Standard Version 4.0 Requirement 10.2.1, Requirement 10.2.1.4, Requirement 10.2.2

[18] Standards Mapping - Payment Card Industry Software Security Framework 1.0 Control Objective 8.2 - Activity Tracking

[19] Standards Mapping - Payment Card Industry Software Security Framework 1.1 Control Objective 8.2 - Activity Tracking

[20] Standards Mapping - Payment Card Industry Software Security Framework 1.2 Control Objective 8.2 - Activity Tracking

[21] Standards Mapping - Security Technical Implementation Guide Version 4.11 APSC-DV-000830 CAT II

[22] Standards Mapping - Security Technical Implementation Guide Version 5.1 APSC-DV-000830 CAT II

[23] Standards Mapping - Security Technical Implementation Guide Version 5.2 APSC-DV-000830 CAT II

desc.structural.iac.misconfiguration_insufficient_monitoring.base

AWS Ansible Misconfiguration: Insufficient Stack Monitoring

YAML

Abstract

A configuration sets up a resource that lacks monitoring.

Explanation

Any delayed response to breaches undermines an organization's ability to limit the impact of a breach.

Configuration settings that undermine monitoring capabilities include but are not limited to:
- deliberately disabling monitoring
- not enabling optional monitoring
- not specifying relevant events to export to monitoring services
- exempting actions of specific users, groups, processes, and geographical regions from monitoring

References

[1] Paul Cichonski,Tom Millar,Tim Grance,Karen Scarfone NIST Special Publication 800-61 Revision 2 - Computer Security Incident Handling Guide

[2] Standards Mapping - CIS Azure Kubernetes Service Benchmark 5

[3] Standards Mapping - CIS Amazon Elastic Kubernetes Service Benchmark 3

[4] Standards Mapping - CIS Amazon Web Services Foundations Benchmark 1

[5] Standards Mapping - CIS Google Kubernetes Engine Benchmark integrity

[6] Standards Mapping - Common Weakness Enumeration CWE ID 778

[7] Standards Mapping - DISA Control Correlation Identifier Version 2 CCI-000172

[8] Standards Mapping - FIPS200 CM

[9] Standards Mapping - General Data Protection Regulation (GDPR) Indirect Access to Sensitive Data

[10] Standards Mapping - NIST Special Publication 800-53 Revision 4 AU-12 Audit Generation (P1)

[11] Standards Mapping - NIST Special Publication 800-53 Revision 5 AU-12 Audit Record Generation

[12] Standards Mapping - OWASP Top 10 2017 A6 Security Misconfiguration, A10 Insufficient Logging and Monitoring

[13] Standards Mapping - OWASP Top 10 2021 A09 Security Logging and Monitoring Failures

[14] Standards Mapping - OWASP API 2023 API8 Security Misconfiguration

[15] Standards Mapping - OWASP Application Security Verification Standard 4.0 7.1.3 Log Content Requirements (L2 L3), 7.1.4 Log Content Requirements (L2 L3), 7.2.1 Log Processing Requirements (L2 L3), 7.2.2 Log Processing Requirements (L2 L3)

[16] Standards Mapping - Payment Card Industry Data Security Standard Version 3.2.1 Requirement 10.2.1, Requirement 10.2.4, Requirement 10.3.4

[17] Standards Mapping - Payment Card Industry Data Security Standard Version 4.0 Requirement 10.2.1, Requirement 10.2.1.4, Requirement 10.2.2

[18] Standards Mapping - Payment Card Industry Software Security Framework 1.0 Control Objective 8.2 - Activity Tracking

[19] Standards Mapping - Payment Card Industry Software Security Framework 1.1 Control Objective 8.2 - Activity Tracking

[20] Standards Mapping - Payment Card Industry Software Security Framework 1.2 Control Objective 8.2 - Activity Tracking

[21] Standards Mapping - Security Technical Implementation Guide Version 4.11 APSC-DV-000830 CAT II

[22] Standards Mapping - Security Technical Implementation Guide Version 5.1 APSC-DV-000830 CAT II

[23] Standards Mapping - Security Technical Implementation Guide Version 5.2 APSC-DV-000830 CAT II

desc.structural.iac.misconfiguration_insufficient_monitoring.base

AWS Ansible Misconfiguration: Privileged Batch Container

YAML

Abstract

A configuration sets up a container with elevated permissions to run jobs.

Explanation

By default, a container cannot execute most system and network administration operations. The privileged mode removes such restrictions. This dramatically expands the attack surface of malicious jobs.

References

[1] Standards Mapping - CIS Azure Kubernetes Service Benchmark 3.5

[2] Standards Mapping - CIS Microsoft Azure Foundations Benchmark partial

[3] Standards Mapping - CIS Amazon Elastic Kubernetes Service Benchmark 5

[4] Standards Mapping - CIS Amazon Web Services Foundations Benchmark 1

[5] Standards Mapping - CIS Google Cloud Computing Platform Benchmark partial

[6] Standards Mapping - CIS Google Kubernetes Engine Benchmark confidentiality

[7] Standards Mapping - CIS Kubernetes Benchmark partial

[8] Standards Mapping - Common Weakness Enumeration CWE ID 250

[9] Standards Mapping - Common Weakness Enumeration Top 25 2019 [3] CWE ID 020

[10] Standards Mapping - Common Weakness Enumeration Top 25 2020 [3] CWE ID 020

[11] Standards Mapping - Common Weakness Enumeration Top 25 2021 [4] CWE ID 020

[12] Standards Mapping - Common Weakness Enumeration Top 25 2022 [4] CWE ID 020

[13] Standards Mapping - DISA Control Correlation Identifier Version 2 CCI-000213, CCI-001084

[14] Standards Mapping - FIPS200 CM

[15] Standards Mapping - General Data Protection Regulation (GDPR) Indirect Access to Sensitive Data

[16] Standards Mapping - NIST Special Publication 800-53 Revision 4 AC-6 Least Privilege (P1)

[17] Standards Mapping - NIST Special Publication 800-53 Revision 5 AC-6 Least Privilege

[18] Standards Mapping - OWASP Top 10 2004 A10 Insecure Configuration Management

[19] Standards Mapping - OWASP Top 10 2010 A6 Security Misconfiguration

[20] Standards Mapping - OWASP Top 10 2013 A5 Security Misconfiguration

[21] Standards Mapping - OWASP Top 10 2017 A6 Security Misconfiguration

[22] Standards Mapping - OWASP Top 10 2021 A05 Security Misconfiguration

[23] Standards Mapping - OWASP API 2023 API8 Security Misconfiguration

[24] Standards Mapping - OWASP Application Security Verification Standard 4.0 5.1.3 Input Validation Requirements (L1 L2 L3), 5.1.4 Input Validation Requirements (L1 L2 L3)

[25] Standards Mapping - OWASP Mobile 2014 M1 Weak Server Side Controls

[26] Standards Mapping - Payment Card Industry Data Security Standard Version 1.1 Requirement 6.5.10

[27] Standards Mapping - Payment Card Industry Data Security Standard Version 3.0 Requirement 6.5.6

[28] Standards Mapping - Payment Card Industry Data Security Standard Version 3.2 Requirement 6.5.6

[29] Standards Mapping - Payment Card Industry Data Security Standard Version 3.2.1 Requirement 6.5.6

[30] Standards Mapping - Payment Card Industry Data Security Standard Version 3.1 Requirement 6.5.6

[31] Standards Mapping - Payment Card Industry Data Security Standard Version 4.0 Requirement 6.2.4

[32] Standards Mapping - Payment Card Industry Software Security Framework 1.0 Control Objective 4.2 - Critical Asset Protection

[33] Standards Mapping - Payment Card Industry Software Security Framework 1.1 Control Objective 4.2 - Critical Asset Protection

[34] Standards Mapping - Payment Card Industry Software Security Framework 1.2 Control Objective 4.2 - Critical Asset Protection

[35] Standards Mapping - SANS Top 25 2009 Insecure Interaction - CWE ID 020

[36] Standards Mapping - SANS Top 25 2011 Porous Defenses - CWE ID 250

[37] Standards Mapping - Security Technical Implementation Guide Version 3.1 APP3500 CAT II

[38] Standards Mapping - Security Technical Implementation Guide Version 3.4 APP3500 CAT II

[39] Standards Mapping - Security Technical Implementation Guide Version 3.5 APP3500 CAT II

[40] Standards Mapping - Security Technical Implementation Guide Version 3.6 APP3500 CAT II

[41] Standards Mapping - Security Technical Implementation Guide Version 3.7 APP3500 CAT II

[42] Standards Mapping - Security Technical Implementation Guide Version 3.9 APP3500 CAT II

[43] Standards Mapping - Security Technical Implementation Guide Version 3.10 APP3500 CAT II

[44] Standards Mapping - Security Technical Implementation Guide Version 4.1 APSC-DV-000460 CAT I, APSC-DV-002360 CAT II

[45] Standards Mapping - Security Technical Implementation Guide Version 4.2 APSC-DV-000460 CAT I, APSC-DV-002360 CAT II

[46] Standards Mapping - Security Technical Implementation Guide Version 4.3 APSC-DV-000460 CAT I, APSC-DV-002360 CAT II

[47] Standards Mapping - Security Technical Implementation Guide Version 4.4 APSC-DV-000460 CAT I, APSC-DV-002360 CAT II

[48] Standards Mapping - Security Technical Implementation Guide Version 4.5 APSC-DV-000460 CAT I, APSC-DV-002360 CAT II

[49] Standards Mapping - Security Technical Implementation Guide Version 4.6 APSC-DV-000460 CAT I, APSC-DV-002360 CAT II

[50] Standards Mapping - Security Technical Implementation Guide Version 4.7 APSC-DV-000460 CAT I, APSC-DV-002360 CAT II

[51] Standards Mapping - Security Technical Implementation Guide Version 4.8 APSC-DV-000460 CAT I, APSC-DV-002360 CAT II

[52] Standards Mapping - Security Technical Implementation Guide Version 4.9 APSC-DV-000460 CAT I, APSC-DV-002360 CAT II

[53] Standards Mapping - Security Technical Implementation Guide Version 4.10 APSC-DV-000460 CAT I, APSC-DV-002360 CAT II

[54] Standards Mapping - Security Technical Implementation Guide Version 4.11 APSC-DV-000460 CAT I, APSC-DV-002360 CAT II

[55] Standards Mapping - Security Technical Implementation Guide Version 5.1 APSC-DV-000460 CAT I, APSC-DV-002360 CAT II

[56] Standards Mapping - Security Technical Implementation Guide Version 5.2 APSC-DV-000460 CAT I, APSC-DV-002360 CAT II

[57] Standards Mapping - Web Application Security Consortium Version 2.00 Application Misconfiguration (WASC-15)

desc.structural.iac.misconfiguration_privileged_container.base

AWS Ansible Misconfiguration: RDS Auto-Upgrade Disabled

YAML

Abstract

A configuration turns off automatic software upgrades.

Explanation

Automatic software upgrades, which ensure timely patching of known software vulnerabilities, are disabled.

References

[1] Standards Mapping - CIS Azure Kubernetes Service Benchmark 2

[2] Standards Mapping - CIS Microsoft Azure Foundations Benchmark complete

[3] Standards Mapping - CIS Amazon Elastic Kubernetes Service Benchmark 5

[4] Standards Mapping - CIS Amazon Web Services Foundations Benchmark 1

[5] Standards Mapping - CIS Google Cloud Computing Platform Benchmark complete

[6] Standards Mapping - CIS Google Kubernetes Engine Benchmark confidentiality

[7] Standards Mapping - CIS Kubernetes Benchmark complete

[8] Standards Mapping - FIPS200 CM

[9] Standards Mapping - General Data Protection Regulation (GDPR) Insufficient Data Protection

[10] Standards Mapping - NIST Special Publication 800-53 Revision 4 SI-2 Flaw Remediation (P1)

[11] Standards Mapping - NIST Special Publication 800-53 Revision 5 SI-2 Flaw Remediation

[12] Standards Mapping - OWASP Top 10 2017 A9 Using Components with Known Vulnerabilities

[13] Standards Mapping - OWASP Top 10 2021 A06 Vulnerable and Outdated Components

[14] Standards Mapping - OWASP API 2023 API8 Security Misconfiguration

[15] Standards Mapping - Payment Card Industry Data Security Standard Version 3.2.1 Requirement 6.2

[16] Standards Mapping - Payment Card Industry Data Security Standard Version 4.0 Requirement 6.3.3

[17] Standards Mapping - Payment Card Industry Software Security Framework 1.0 Control Objective 10.2 - Threat and Vulnerability Management

[18] Standards Mapping - Payment Card Industry Software Security Framework 1.1 Control Objective 10.2 - Threat and Vulnerability Management

[19] Standards Mapping - Payment Card Industry Software Security Framework 1.2 Control Objective 10.2 - Threat and Vulnerability Management, Control Objective C.1.6 - Web Software Components & Services

desc.structural.iac.misconfiguration_auto_upgrade_disabled.base

<
1
2
3
4
5
6
7
8
9
10
11
>