Reino: Environment
Esta sección incluye todo lo que está fuera del código fuente pero aun así es importante para la seguridad del producto que se está creando. Dado que todas las cuestiones incluidas en esta sección no están directamente relacionadas con el código fuente, las hemos separado de las demás secciones.
AWS CloudFormation Misconfiguration: Reduced Stack Availability
Abstract
Una configuración reduce la disponibilidad del servicio.
Explanation
Los servicios en la nube suelen utilizar técnicas como el almacenamiento en caché, la replicación y el equilibrio de carga para facilitar la escalabilidad del servicio, entregar contenido más rápido y mitigar el impacto de los ataques volumétricos. Las funciones de disponibilidad deshabilitadas o mal configuradas degradan el rendimiento del servicio, pero los efectos inmediatos a menudo no son evidentes hasta que ocurren eventos extremos, como picos de tráfico y errores de hardware.
References
[1] Standards Mapping - DISA Control Correlation Identifier Version 2 CCI-001094
[2] Standards Mapping - NIST Special Publication 800-53 Revision 4 SC-5 Denial of Service Protection (P1)
[3] Standards Mapping - NIST Special Publication 800-53 Revision 5 SC-5 Denial of Service Protection
[4] Standards Mapping - OWASP API 2023 API8 Security Misconfiguration
[5] Standards Mapping - OWASP Top 10 2004 A9 Application Denial of Service
[6] Standards Mapping - OWASP Top 10 2010 A6 Security Misconfiguration
[7] Standards Mapping - OWASP Top 10 2013 A5 Security Misconfiguration
[8] Standards Mapping - OWASP Top 10 2017 A6 Security Misconfiguration
[9] Standards Mapping - OWASP Top 10 2021 A05 Security Misconfiguration
[10] Standards Mapping - Payment Card Industry Data Security Standard Version 3.2.1 Requirement 6.5.6
[11] Standards Mapping - Payment Card Industry Data Security Standard Version 4.0 Requirement 6.2.4
[12] Standards Mapping - Payment Card Industry Data Security Standard Version 4.0.1 Requirement 6.2.4
[13] Standards Mapping - Payment Card Industry Software Security Framework 1.0 Control Objective 4.2 - Critical Asset Protection
[14] Standards Mapping - Payment Card Industry Software Security Framework 1.1 Control Objective 4.2 - Critical Asset Protection
[15] Standards Mapping - Payment Card Industry Software Security Framework 1.2 Control Objective 4.2 - Critical Asset Protection, Control Objective C.3.3 - Web Software Attack Mitigation
[16] Standards Mapping - Security Technical Implementation Guide Version 4.9 APSC-DV-002400 CAT II
[17] Standards Mapping - Security Technical Implementation Guide Version 4.10 APSC-DV-002400 CAT II
[18] Standards Mapping - Security Technical Implementation Guide Version 4.11 APSC-DV-002400 CAT II
[19] Standards Mapping - Security Technical Implementation Guide Version 5.1 APSC-DV-002400 CAT II
[20] Standards Mapping - Security Technical Implementation Guide Version 5.2 APSC-DV-002400 CAT II
[21] Standards Mapping - Security Technical Implementation Guide Version 5.3 APSC-DV-002400 CAT II
[22] Standards Mapping - Security Technical Implementation Guide Version 6.1 APSC-DV-002400 CAT II
desc.structural.iac.misconfiguration_reduced_availability.base
Abstract
Una configuración reduce la disponibilidad del servicio.
Explanation
Los servicios en la nube suelen utilizar técnicas como el almacenamiento en caché, la replicación y el equilibrio de carga para facilitar la escalabilidad del servicio, entregar contenido más rápido y mitigar el impacto de los ataques volumétricos. Las funciones de disponibilidad deshabilitadas o mal configuradas degradan el rendimiento del servicio, pero los efectos inmediatos a menudo no son evidentes hasta que ocurren eventos extremos, como picos de tráfico y errores de hardware.
References
[1] Standards Mapping - DISA Control Correlation Identifier Version 2 CCI-001094
[2] Standards Mapping - NIST Special Publication 800-53 Revision 4 SC-5 Denial of Service Protection (P1)
[3] Standards Mapping - NIST Special Publication 800-53 Revision 5 SC-5 Denial of Service Protection
[4] Standards Mapping - OWASP API 2023 API8 Security Misconfiguration
[5] Standards Mapping - OWASP Top 10 2004 A9 Application Denial of Service
[6] Standards Mapping - OWASP Top 10 2010 A6 Security Misconfiguration
[7] Standards Mapping - OWASP Top 10 2013 A5 Security Misconfiguration
[8] Standards Mapping - OWASP Top 10 2017 A6 Security Misconfiguration
[9] Standards Mapping - OWASP Top 10 2021 A05 Security Misconfiguration
[10] Standards Mapping - Payment Card Industry Data Security Standard Version 3.2.1 Requirement 6.5.6
[11] Standards Mapping - Payment Card Industry Data Security Standard Version 4.0 Requirement 6.2.4
[12] Standards Mapping - Payment Card Industry Data Security Standard Version 4.0.1 Requirement 6.2.4
[13] Standards Mapping - Payment Card Industry Software Security Framework 1.0 Control Objective 4.2 - Critical Asset Protection
[14] Standards Mapping - Payment Card Industry Software Security Framework 1.1 Control Objective 4.2 - Critical Asset Protection
[15] Standards Mapping - Payment Card Industry Software Security Framework 1.2 Control Objective 4.2 - Critical Asset Protection, Control Objective C.3.3 - Web Software Attack Mitigation
[16] Standards Mapping - Security Technical Implementation Guide Version 4.9 APSC-DV-002400 CAT II
[17] Standards Mapping - Security Technical Implementation Guide Version 4.10 APSC-DV-002400 CAT II
[18] Standards Mapping - Security Technical Implementation Guide Version 4.11 APSC-DV-002400 CAT II
[19] Standards Mapping - Security Technical Implementation Guide Version 5.1 APSC-DV-002400 CAT II
[20] Standards Mapping - Security Technical Implementation Guide Version 5.2 APSC-DV-002400 CAT II
[21] Standards Mapping - Security Technical Implementation Guide Version 5.3 APSC-DV-002400 CAT II
[22] Standards Mapping - Security Technical Implementation Guide Version 6.1 APSC-DV-002400 CAT II
desc.structural.iac.misconfiguration_reduced_availability.base