계: Security Features

소프트웨어 보안은 보안 소프트웨어가 아닙니다. 여기서는 인증, 액세스 제어, 기밀성, 암호화, 권한 관리 등의 항목에 대해 설명합니다.

Azure Ansible Misconfiguration: Insufficient AKS Monitoring

YAML

Abstract

이 Ansible 작업은 로그 이벤트를 Azure Monitor로 보내지 않는 AKS 클러스터를 정의합니다.

Explanation

기본적으로 Ansible에서 만든 Azure Kubernetes Service(AKS) 클러스터는 Azure Monitor로 로그 이벤트를 보내지 않습니다. 이로 인해 악의적인 동작이 감지되지 않고 침해 발생 시 포렌식 분석이 방해를 받을 수 있습니다.

예제 1: 다음 예제 Ansible 작업은 로그 이벤트를 Azure Monitor로 보내지 않는 AKS 클러스터를 보여줍니다.


- name: AKS Instance
  azure_rm_aks:
    name:
    resource_group: testResourceGroup
    location: eastus
    ...
    addon:
      monitoring:
        log_analytics_workspace_resource_id: logws001
        enabled: no

References

[1] Ansible Documentation azure.azcollection.azure_rm_aks – Manage a managed Azure Container Service (AKS) instance

[2] CISA Alert (AA20-245A)- Technical Approaches to Uncovering and Remediating Malicious Activity

[3] Microsoft Enable monitoring of Azure Kubernetes Service (AKS) cluster already deployed

[4] Microsoft Enable monitoring of a new Azure Kubernetes Service (AKS) cluster

[5] Microsoft Azure security baseline for Azure Kubernetes Service

[6] Standards Mapping - Common Weakness Enumeration CWE ID 778

[7] Standards Mapping - DISA Control Correlation Identifier Version 2 CCI-000172

[8] Standards Mapping - FIPS200 CM

[9] Standards Mapping - General Data Protection Regulation (GDPR) Indirect Access to Sensitive Data

[10] Standards Mapping - NIST Special Publication 800-53 Revision 4 AU-12 Audit Generation (P1)

[11] Standards Mapping - NIST Special Publication 800-53 Revision 5 AU-12 Audit Record Generation

[12] Standards Mapping - OWASP API 2023 API8 Security Misconfiguration

[13] Standards Mapping - OWASP Application Security Verification Standard 4.0 7.1.3 Log Content Requirements (L2 L3), 7.1.4 Log Content Requirements (L2 L3), 7.2.1 Log Processing Requirements (L2 L3), 7.2.2 Log Processing Requirements (L2 L3)

[14] Standards Mapping - OWASP Mobile 2014 M1 Weak Server Side Controls

[15] Standards Mapping - OWASP Top 10 2004 A10 Insecure Configuration Management

[16] Standards Mapping - OWASP Top 10 2010 A6 Security Misconfiguration

[17] Standards Mapping - OWASP Top 10 2013 A5 Security Misconfiguration

[18] Standards Mapping - OWASP Top 10 2017 A6 Security Misconfiguration

[19] Standards Mapping - OWASP Top 10 2021 A05 Security Misconfiguration

[20] Standards Mapping - Payment Card Industry Data Security Standard Version 1.1 Requirement 6.5.10, Requirement 10.2.1, Requirement 10.2.4, Requirement 10.3.4

[21] Standards Mapping - Payment Card Industry Data Security Standard Version 1.2 Requirement 10.2.1, Requirement 10.2.4, Requirement 10.3.4

[22] Standards Mapping - Payment Card Industry Data Security Standard Version 2.0 Requirement 10.2.1, Requirement 10.2.4, Requirement 10.3.4

[23] Standards Mapping - Payment Card Industry Data Security Standard Version 3.0 Requirement 10.2.1, Requirement 10.2.4, Requirement 10.3.4

[24] Standards Mapping - Payment Card Industry Data Security Standard Version 3.1 Requirement 10.2.1, Requirement 10.2.4, Requirement 10.3.4

[25] Standards Mapping - Payment Card Industry Data Security Standard Version 3.2 Requirement 10.2.1, Requirement 10.2.4, Requirement 10.3.4

[26] Standards Mapping - Payment Card Industry Data Security Standard Version 3.2.1 Requirement 10.2.1, Requirement 10.2.4, Requirement 10.3.4

[27] Standards Mapping - Payment Card Industry Data Security Standard Version 4.0 Requirement 10.2.1, Requirement 10.2.1.4, Requirement 10.2.2

[28] Standards Mapping - Payment Card Industry Data Security Standard Version 4.0.1 Requirement 10.2.1, Requirement 10.2.1.4, Requirement 10.2.2

[29] Standards Mapping - Payment Card Industry Software Security Framework 1.0 Control Objective 8.2 - Activity Tracking

[30] Standards Mapping - Payment Card Industry Software Security Framework 1.1 Control Objective 8.2 - Activity Tracking

[31] Standards Mapping - Payment Card Industry Software Security Framework 1.2 Control Objective 8.2 - Activity Tracking

[32] Standards Mapping - Security Technical Implementation Guide Version 3.1 APP3680.4 CAT II, APP3680.5 CAT II

[33] Standards Mapping - Security Technical Implementation Guide Version 3.4 APP3680.4 CAT II, APP3680.5 CAT II

[34] Standards Mapping - Security Technical Implementation Guide Version 3.5 APP3680.4 CAT II, APP3680.5 CAT II

[35] Standards Mapping - Security Technical Implementation Guide Version 3.6 APP3680.4 CAT II, APP3680.5 CAT II

[36] Standards Mapping - Security Technical Implementation Guide Version 3.7 APP3680.4 CAT II, APP3680.5 CAT II

[37] Standards Mapping - Security Technical Implementation Guide Version 3.9 APP3680.4 CAT II, APP3680.5 CAT II

[38] Standards Mapping - Security Technical Implementation Guide Version 3.10 APP3680.4 CAT II, APP3680.5 CAT II

[39] Standards Mapping - Security Technical Implementation Guide Version 4.2 APSC-DV-000830 CAT II

[40] Standards Mapping - Security Technical Implementation Guide Version 4.3 APSC-DV-000830 CAT II

[41] Standards Mapping - Security Technical Implementation Guide Version 4.4 APSC-DV-000830 CAT II

[42] Standards Mapping - Security Technical Implementation Guide Version 4.5 APSC-DV-000830 CAT II

[43] Standards Mapping - Security Technical Implementation Guide Version 4.6 APSC-DV-000830 CAT II

[44] Standards Mapping - Security Technical Implementation Guide Version 4.7 APSC-DV-000830 CAT II

[45] Standards Mapping - Security Technical Implementation Guide Version 4.8 APSC-DV-000830 CAT II

[46] Standards Mapping - Security Technical Implementation Guide Version 4.9 APSC-DV-000830 CAT II

[47] Standards Mapping - Security Technical Implementation Guide Version 4.10 APSC-DV-000830 CAT II

[48] Standards Mapping - Security Technical Implementation Guide Version 4.11 APSC-DV-000830 CAT II

[49] Standards Mapping - Security Technical Implementation Guide Version 4.1 APSC-DV-000830 CAT II

[50] Standards Mapping - Security Technical Implementation Guide Version 5.1 APSC-DV-000830 CAT II

[51] Standards Mapping - Security Technical Implementation Guide Version 5.2 APSC-DV-000830 CAT II

[52] Standards Mapping - Security Technical Implementation Guide Version 5.3 APSC-DV-000830 CAT II

[53] Standards Mapping - Security Technical Implementation Guide Version 6.1 APSC-DV-000830 CAT II

[54] Standards Mapping - Web Application Security Consortium Version 2.00 Application Misconfiguration (WASC-15)

desc.structural.yaml.azure_ansible_misconfiguration_insufficient_aks_monitoring.base