1437 elementos encontrados

Debilidades

AWS Terraform Misconfiguration: Insufficient S3 Backup

Abstract

Una configuración establece un recurso sin configuraciones de copia de seguridad adecuadas.

Explanation

Las copias de seguridad son fundamentales para ofrecer protección contra la pérdida o corrupción de los datos. La configuración que socava las copias de seguridad incluye, entre otros:
- Deshabilitar la copia de seguridad de datos
- No realizar copias de seguridad de los datos con regularidad
- No comprobar periódicamente la integridad de las copias de seguridad
- Un período de retención de la copia de seguridad insuficiente

References

[1] Amazon Web Services, Inc. or its affiliates Backup and recovery approaches on AWS

[2] Standards Mapping - DISA Control Correlation Identifier Version 2 CCI-000366, CCI-003109

[3] Standards Mapping - FIPS200 CP

[4] Standards Mapping - NIST Special Publication 800-53 Revision 4 CP-9 Information System Backup (P1)

[5] Standards Mapping - NIST Special Publication 800-53 Revision 5 CP-9 System Backup

[6] Standards Mapping - OWASP API 2023 API8 Security Misconfiguration

[7] Standards Mapping - OWASP Application Security Verification Standard 4.0 8.1.5 General Data Protection (L3)

[8] Standards Mapping - OWASP Top 10 2017 A6 Security Misconfiguration

[9] Standards Mapping - OWASP Top 10 2021 A05 Security Misconfiguration

[10] Standards Mapping - Payment Card Industry Data Security Standard Version 3.2.1 Requirement 12.10.1

[11] Standards Mapping - Payment Card Industry Data Security Standard Version 4.0 Requirement 12.10.1

[12] Standards Mapping - Payment Card Industry Data Security Standard Version 4.0.1 Requirement 12.10.1

[13] Standards Mapping - Payment Card Industry Software Security Framework 1.0 Control Objective 2.2 - Secure Defaults

[14] Standards Mapping - Payment Card Industry Software Security Framework 1.1 Control Objective 2.2 - Secure Defaults

[15] Standards Mapping - Payment Card Industry Software Security Framework 1.2 Control Objective 2.2 - Secure Defaults

desc.structural.iac.aws.misconfiguration_insufficient_backup.base

AWS Terraform Misconfiguration: Kinesis Missing Customer-Managed Encryption Key

Abstract

Una configuración no especifica una clave de cifrado administrada por el cliente para los datos en reposo.

Explanation

Las claves administradas por el cliente no se utilizan para cifrar datos en reposo.

De forma predeterminada, AWS utiliza claves administradas por AWS para cifrar datos en reposo si el cifrado está habilitado. Las claves administradas por el cliente permiten a las organizaciones usar claves criptográficas de su elección para cifrar datos. Esto brinda a las organizaciones un mejor control y registro de los procesos de cifrado.

De este modo, las claves administradas por el cliente suelen ser parte de la solución para satisfacer requisitos que incluyen, entre otros:
- Registros de auditoría para el acceso a datos confidenciales
- Residencia de datos
- Reemplazo, deshabilitación o destrucción de claves

Tenga en cuenta que las claves con el formato aws/service-name están reservadas para las claves administradas por AWS.

References

[1] Amazon Web Services, Inc. or its affiliates AWS Key Management Service Developer Guide

[2] Standards Mapping - Common Weakness Enumeration CWE ID 311

[3] Standards Mapping - DISA Control Correlation Identifier Version 2 CCI-001350, CCI-002475

[4] Standards Mapping - FIPS200 MP

[5] Standards Mapping - General Data Protection Regulation (GDPR) Insufficient Data Protection

[6] Standards Mapping - NIST Special Publication 800-53 Revision 4 AU-9 Protection of Audit Information (P1), SC-28 Protection of Information at Rest (P1)

[7] Standards Mapping - NIST Special Publication 800-53 Revision 5 AU-9 Protection of Audit Information, SC-28 Protection of Information at Rest

[8] Standards Mapping - OWASP API 2023 API8 Security Misconfiguration

[9] Standards Mapping - OWASP Application Security Verification Standard 4.0 2.6.3 Look-up Secret Verifier Requirements (L2 L3), 6.2.1 Algorithms (L1 L2 L3), 8.1.6 General Data Protection (L3)

[10] Standards Mapping - OWASP Top 10 2017 A3 Sensitive Data Exposure

[11] Standards Mapping - OWASP Top 10 2021 A02 Cryptographic Failures

[12] Standards Mapping - Payment Card Industry Data Security Standard Version 3.2.1 Requirement 6.5.3

[13] Standards Mapping - Payment Card Industry Data Security Standard Version 4.0 Requirement 6.2.4, Requirement 3.5.1

[14] Standards Mapping - Payment Card Industry Data Security Standard Version 4.0.1 Requirement 3.3.2, Requirement 3.3.3, Requirement 3.5.1, Requirement 6.2.4

[15] Standards Mapping - Payment Card Industry Software Security Framework 1.0 Control Objective 7.1 - Use of Cryptography

[16] Standards Mapping - Payment Card Industry Software Security Framework 1.1 Control Objective 7.1 - Use of Cryptography

[17] Standards Mapping - Payment Card Industry Software Security Framework 1.2 Control Objective 7.2 - Use of Cryptography

[18] Standards Mapping - Security Technical Implementation Guide Version 4.11 APSC-DV-001350 CAT II, APSC-DV-002340 CAT II

[19] Standards Mapping - Security Technical Implementation Guide Version 5.1 APSC-DV-001350 CAT II, APSC-DV-002340 CAT II

[20] Standards Mapping - Security Technical Implementation Guide Version 5.2 APSC-DV-001350 CAT II, APSC-DV-002340 CAT II

[21] Standards Mapping - Security Technical Implementation Guide Version 5.3 APSC-DV-001350 CAT II, APSC-DV-002340 CAT II

[22] Standards Mapping - Security Technical Implementation Guide Version 6.1 APSC-DV-001350 CAT II, APSC-DV-002340 CAT II

desc.structural.iac.aws.misconfiguration_missing_customer_managed_encryption_key.base

AWS Terraform Misconfiguration: Lightsail Publicly Accessible

Abstract

Una configuración no aplica controles de acceso adecuados.

Explanation

Los recursos de acceso público son susceptibles a un ataque de Denial of Service (DDoS) distribuido y exponen los datos a accesos no autorizados, manipulaciones y posibles robos.

References

[1] Standards Mapping - Common Weakness Enumeration CWE ID 749

[2] Standards Mapping - Common Weakness Enumeration Top 25 2020 [25] CWE ID 862

[3] Standards Mapping - Common Weakness Enumeration Top 25 2021 [18] CWE ID 862

[4] Standards Mapping - Common Weakness Enumeration Top 25 2022 [16] CWE ID 862

[5] Standards Mapping - DISA Control Correlation Identifier Version 2 CCI-000213, CCI-001084, CCI-002165

[6] Standards Mapping - FIPS200 AC

[7] Standards Mapping - General Data Protection Regulation (GDPR) Access Violation

[8] Standards Mapping - NIST Special Publication 800-53 Revision 4 AC-3 Access Enforcement (P1), AC-6 Least Privilege (P1), SC-3 Security Function Isolation (P1)

[9] Standards Mapping - NIST Special Publication 800-53 Revision 5 AC-3 Access Enforcement, AC-6 Least Privilege, SC-3 Security Function Isolation

[10] Standards Mapping - OWASP API 2023 API8 Security Misconfiguration

[11] Standards Mapping - OWASP Application Security Verification Standard 4.0 4.1.3 General Access Control Design (L1 L2 L3)

[12] Standards Mapping - OWASP Top 10 2004 A2 Broken Access Control

[13] Standards Mapping - OWASP Top 10 2007 A4 Insecure Direct Object Reference

[14] Standards Mapping - OWASP Top 10 2010 A4 Insecure Direct Object References

[15] Standards Mapping - OWASP Top 10 2013 A4 Insecure Direct Object References

[16] Standards Mapping - OWASP Top 10 2017 A5 Broken Access Control

[17] Standards Mapping - OWASP Top 10 2021 A01 Broken Access Control

[18] Standards Mapping - Payment Card Industry Data Security Standard Version 1.1 Requirement 6.5.2

[19] Standards Mapping - Payment Card Industry Data Security Standard Version 1.2 Requirement 6.5.4

[20] Standards Mapping - Payment Card Industry Data Security Standard Version 2.0 Requirement 6.5.8

[21] Standards Mapping - Payment Card Industry Data Security Standard Version 3.0 Requirement 6.5.8

[22] Standards Mapping - Payment Card Industry Data Security Standard Version 3.1 Requirement 6.5.8

[23] Standards Mapping - Payment Card Industry Data Security Standard Version 3.2 Requirement 6.5.8

[24] Standards Mapping - Payment Card Industry Data Security Standard Version 3.2.1 Requirement 6.5.8

[25] Standards Mapping - Payment Card Industry Data Security Standard Version 4.0 Requirement 6.2.4, Requirement 1.4.2

[26] Standards Mapping - Payment Card Industry Data Security Standard Version 4.0.1 Requirement 6.2.4, Requirement 1.4.2

[27] Standards Mapping - Payment Card Industry Software Security Framework 1.0 Control Objective 5.4 - Authentication and Access Control

[28] Standards Mapping - Payment Card Industry Software Security Framework 1.1 Control Objective 5.4 - Authentication and Access Control

[29] Standards Mapping - Payment Card Industry Software Security Framework 1.2 Control Objective 5.4 - Authentication and Access Control, Control Objective C.2.3 - Web Software Access Controls

[30] Standards Mapping - SANS Top 25 2009 Porous Defenses - CWE ID 285

[31] Standards Mapping - Security Technical Implementation Guide Version 3.1 APP3480.1 CAT II

[32] Standards Mapping - Security Technical Implementation Guide Version 3.4 APP3480.1 CAT I

[33] Standards Mapping - Security Technical Implementation Guide Version 3.5 APP3480.1 CAT I

[34] Standards Mapping - Security Technical Implementation Guide Version 3.6 APP3480.1 CAT I

[35] Standards Mapping - Security Technical Implementation Guide Version 3.7 APP3480.1 CAT I

[36] Standards Mapping - Security Technical Implementation Guide Version 3.9 APP3480.1 CAT I

[37] Standards Mapping - Security Technical Implementation Guide Version 3.10 APP3480.1 CAT I

[38] Standards Mapping - Security Technical Implementation Guide Version 4.2 APSC-DV-000460 CAT I, APSC-DV-000470 CAT II, APSC-DV-002360 CAT II

[39] Standards Mapping - Security Technical Implementation Guide Version 4.3 APSC-DV-000460 CAT I, APSC-DV-000470 CAT II, APSC-DV-002360 CAT II

[40] Standards Mapping - Security Technical Implementation Guide Version 4.4 APSC-DV-000460 CAT I, APSC-DV-000470 CAT II, APSC-DV-002360 CAT II

[41] Standards Mapping - Security Technical Implementation Guide Version 4.5 APSC-DV-000460 CAT I, APSC-DV-000470 CAT II, APSC-DV-002360 CAT II

[42] Standards Mapping - Security Technical Implementation Guide Version 4.6 APSC-DV-000460 CAT I, APSC-DV-000470 CAT II, APSC-DV-002360 CAT II

[43] Standards Mapping - Security Technical Implementation Guide Version 4.7 APSC-DV-000460 CAT I, APSC-DV-000470 CAT II, APSC-DV-002360 CAT II

[44] Standards Mapping - Security Technical Implementation Guide Version 4.8 APSC-DV-000460 CAT I, APSC-DV-000470 CAT II, APSC-DV-002360 CAT II

[45] Standards Mapping - Security Technical Implementation Guide Version 4.9 APSC-DV-000460 CAT I, APSC-DV-000470 CAT II, APSC-DV-002360 CAT II

[46] Standards Mapping - Security Technical Implementation Guide Version 4.10 APSC-DV-000460 CAT I, APSC-DV-000470 CAT II, APSC-DV-002360 CAT II

[47] Standards Mapping - Security Technical Implementation Guide Version 4.11 APSC-DV-000460 CAT I, APSC-DV-000470 CAT II, APSC-DV-002360 CAT II

[48] Standards Mapping - Security Technical Implementation Guide Version 4.1 APSC-DV-000460 CAT I, APSC-DV-000470 CAT II, APSC-DV-002360 CAT II

[49] Standards Mapping - Security Technical Implementation Guide Version 5.1 APSC-DV-000460 CAT I, APSC-DV-000470 CAT II, APSC-DV-002360 CAT II

[50] Standards Mapping - Security Technical Implementation Guide Version 5.2 APSC-DV-000460 CAT I, APSC-DV-000470 CAT II, APSC-DV-002360 CAT II

[51] Standards Mapping - Security Technical Implementation Guide Version 5.3 APSC-DV-000460 CAT I, APSC-DV-000470 CAT II, APSC-DV-002360 CAT II

[52] Standards Mapping - Security Technical Implementation Guide Version 6.1 APSC-DV-000460 CAT I, APSC-DV-000470 CAT II, APSC-DV-002360 CAT II

[53] Standards Mapping - Web Application Security Consortium Version 2.00 Insufficient Authorization (WASC-02)

[54] Standards Mapping - Web Application Security Consortium 24 + 2 Insufficient Authorization

desc.structural.iac.aws.misconfiguration_publicly_accessible.base

AWS Terraform Misconfiguration: Location Service Missing Customer-Managed Encryption Key