계: Security Features

소프트웨어 보안은 보안 소프트웨어가 아닙니다. 여기서는 인증, 액세스 제어, 기밀성, 암호화, 권한 관리 등의 항목에 대해 설명합니다.

312 개 항목 찾음

취약점

Azure Ansible Misconfiguration: Insufficient AKS Monitoring

YAML

Abstract

이 Ansible 작업은 로그 이벤트를 Azure Monitor로 보내지 않는 AKS 클러스터를 정의합니다.

Explanation

기본적으로 Ansible에서 만든 Azure Kubernetes Service(AKS) 클러스터는 Azure Monitor로 로그 이벤트를 보내지 않습니다. 이로 인해 악의적인 동작이 감지되지 않고 침해 발생 시 포렌식 분석이 방해를 받을 수 있습니다.

예제 1: 다음 예제 Ansible 작업은 로그 이벤트를 Azure Monitor로 보내지 않는 AKS 클러스터를 보여줍니다.


- name: AKS Instance
  azure_rm_aks:
    name:
    resource_group: testResourceGroup
    location: eastus
    ...
    addon:
      monitoring:
        log_analytics_workspace_resource_id: logws001
        enabled: no

References

[1] Ansible Documentation azure.azcollection.azure_rm_aks – Manage a managed Azure Container Service (AKS) instance

[2] CISA Alert (AA20-245A)- Technical Approaches to Uncovering and Remediating Malicious Activity

[3] Microsoft Enable monitoring of Azure Kubernetes Service (AKS) cluster already deployed

[4] Microsoft Enable monitoring of a new Azure Kubernetes Service (AKS) cluster

[5] Microsoft Azure security baseline for Azure Kubernetes Service

[6] Standards Mapping - CIS Azure Kubernetes Service Benchmark 2

[7] Standards Mapping - CIS Microsoft Azure Foundations Benchmark Partial

[8] Standards Mapping - CIS Amazon Elastic Kubernetes Service Benchmark 5

[9] Standards Mapping - CIS Amazon Web Services Foundations Benchmark 1

[10] Standards Mapping - CIS Google Kubernetes Engine Benchmark Integrity

[11] Standards Mapping - Common Weakness Enumeration CWE ID 778

[12] Standards Mapping - DISA Control Correlation Identifier Version 2 CCI-000172

[13] Standards Mapping - FIPS200 CM

[14] Standards Mapping - General Data Protection Regulation (GDPR) Indirect Access to Sensitive Data

[15] Standards Mapping - NIST Special Publication 800-53 Revision 4 AU-12 Audit Generation (P1)

[16] Standards Mapping - NIST Special Publication 800-53 Revision 5 AU-12 Audit Record Generation

[17] Standards Mapping - OWASP Top 10 2004 A10 Insecure Configuration Management

[18] Standards Mapping - OWASP Top 10 2010 A6 Security Misconfiguration

[19] Standards Mapping - OWASP Top 10 2013 A5 Security Misconfiguration

[20] Standards Mapping - OWASP Top 10 2017 A6 Security Misconfiguration

[21] Standards Mapping - OWASP Top 10 2021 A05 Security Misconfiguration

[22] Standards Mapping - OWASP API 2023 API8 Security Misconfiguration

[23] Standards Mapping - OWASP Application Security Verification Standard 4.0 7.1.3 Log Content Requirements (L2 L3), 7.1.4 Log Content Requirements (L2 L3), 7.2.1 Log Processing Requirements (L2 L3), 7.2.2 Log Processing Requirements (L2 L3)

[24] Standards Mapping - OWASP Mobile 2014 M1 Weak Server Side Controls

[25] Standards Mapping - Payment Card Industry Data Security Standard Version 1.1 Requirement 6.5.10, Requirement 10.2.1, Requirement 10.2.4, Requirement 10.3.4

[26] Standards Mapping - Payment Card Industry Data Security Standard Version 1.2 Requirement 10.2.1, Requirement 10.2.4, Requirement 10.3.4

[27] Standards Mapping - Payment Card Industry Data Security Standard Version 2.0 Requirement 10.2.1, Requirement 10.2.4, Requirement 10.3.4

[28] Standards Mapping - Payment Card Industry Data Security Standard Version 3.0 Requirement 10.2.1, Requirement 10.2.4, Requirement 10.3.4

[29] Standards Mapping - Payment Card Industry Data Security Standard Version 3.2 Requirement 10.2.1, Requirement 10.2.4, Requirement 10.3.4

[30] Standards Mapping - Payment Card Industry Data Security Standard Version 3.2.1 Requirement 10.2.1, Requirement 10.2.4, Requirement 10.3.4

[31] Standards Mapping - Payment Card Industry Data Security Standard Version 3.1 Requirement 10.2.1, Requirement 10.2.4, Requirement 10.3.4

[32] Standards Mapping - Payment Card Industry Data Security Standard Version 4.0 Requirement 10.2.1, Requirement 10.2.1.4, Requirement 10.2.2

[33] Standards Mapping - Payment Card Industry Software Security Framework 1.0 Control Objective 8.2 - Activity Tracking

[34] Standards Mapping - Payment Card Industry Software Security Framework 1.1 Control Objective 8.2 - Activity Tracking

[35] Standards Mapping - Payment Card Industry Software Security Framework 1.2 Control Objective 8.2 - Activity Tracking

[36] Standards Mapping - Security Technical Implementation Guide Version 3.1 APP3680.4 CAT II, APP3680.5 CAT II

[37] Standards Mapping - Security Technical Implementation Guide Version 3.4 APP3680.4 CAT II, APP3680.5 CAT II

[38] Standards Mapping - Security Technical Implementation Guide Version 3.5 APP3680.4 CAT II, APP3680.5 CAT II

[39] Standards Mapping - Security Technical Implementation Guide Version 3.6 APP3680.4 CAT II, APP3680.5 CAT II

[40] Standards Mapping - Security Technical Implementation Guide Version 3.7 APP3680.4 CAT II, APP3680.5 CAT II

[41] Standards Mapping - Security Technical Implementation Guide Version 3.9 APP3680.4 CAT II, APP3680.5 CAT II

[42] Standards Mapping - Security Technical Implementation Guide Version 3.10 APP3680.4 CAT II, APP3680.5 CAT II

[43] Standards Mapping - Security Technical Implementation Guide Version 4.1 APSC-DV-000830 CAT II

[44] Standards Mapping - Security Technical Implementation Guide Version 4.2 APSC-DV-000830 CAT II

[45] Standards Mapping - Security Technical Implementation Guide Version 4.3 APSC-DV-000830 CAT II

[46] Standards Mapping - Security Technical Implementation Guide Version 4.4 APSC-DV-000830 CAT II

[47] Standards Mapping - Security Technical Implementation Guide Version 4.5 APSC-DV-000830 CAT II

[48] Standards Mapping - Security Technical Implementation Guide Version 4.6 APSC-DV-000830 CAT II

[49] Standards Mapping - Security Technical Implementation Guide Version 4.7 APSC-DV-000830 CAT II

[50] Standards Mapping - Security Technical Implementation Guide Version 4.8 APSC-DV-000830 CAT II

[51] Standards Mapping - Security Technical Implementation Guide Version 4.9 APSC-DV-000830 CAT II

[52] Standards Mapping - Security Technical Implementation Guide Version 4.10 APSC-DV-000830 CAT II

[53] Standards Mapping - Security Technical Implementation Guide Version 4.11 APSC-DV-000830 CAT II

[54] Standards Mapping - Security Technical Implementation Guide Version 5.1 APSC-DV-000830 CAT II

[55] Standards Mapping - Security Technical Implementation Guide Version 5.2 APSC-DV-000830 CAT II

[56] Standards Mapping - Web Application Security Consortium Version 2.00 Application Misconfiguration (WASC-15)

desc.structural.yaml.azure_ansible_misconfiguration_insufficient_aks_monitoring.base

Azure Ansible Misconfiguration: Insufficient Azure Monitor Logging

YAML

Abstract

이 Ansible 작업은 모든 활동 로그 관리 이벤트를 수집하지 않는 Azure Monitor 로그 프로필을 정의합니다.

Explanation

감사 기록이 없으면 보안 관련 사고를 감지하고 대응하는 능력이 제한되고 포렌식 조사가 불가능해집니다.

References

[1] Standards Mapping - CIS Azure Kubernetes Service Benchmark 1

[2] Standards Mapping - CIS Microsoft Azure Foundations Benchmark complete

[3] Standards Mapping - CIS Amazon Elastic Kubernetes Service Benchmark 5

[4] Standards Mapping - CIS Amazon Web Services Foundations Benchmark 1

[5] Standards Mapping - CIS Google Kubernetes Engine Benchmark integrity

[6] Standards Mapping - CIS Kubernetes Benchmark partial

[7] Standards Mapping - Common Weakness Enumeration CWE ID 778

[8] Standards Mapping - DISA Control Correlation Identifier Version 2 CCI-000172

[9] Standards Mapping - FIPS200 CM

[10] Standards Mapping - General Data Protection Regulation (GDPR) Insufficient Data Protection

[11] Standards Mapping - NIST Special Publication 800-53 Revision 4 AU-12 Audit Generation (P1)

[12] Standards Mapping - NIST Special Publication 800-53 Revision 5 AU-12 Audit Record Generation

[13] Standards Mapping - OWASP Top 10 2004 A10 Insecure Configuration Management

[14] Standards Mapping - OWASP Top 10 2010 A6 Security Misconfiguration

[15] Standards Mapping - OWASP Top 10 2013 A5 Security Misconfiguration

[16] Standards Mapping - OWASP Top 10 2017 A10 Insufficient Logging and Monitoring

[17] Standards Mapping - OWASP Top 10 2021 A09 Security Logging and Monitoring Failures

[18] Standards Mapping - OWASP API 2023 API8 Security Misconfiguration

[19] Standards Mapping - OWASP Application Security Verification Standard 4.0 7.1.3 Log Content Requirements (L2 L3), 7.1.4 Log Content Requirements (L2 L3), 7.2.1 Log Processing Requirements (L2 L3), 7.2.2 Log Processing Requirements (L2 L3)

[20] Standards Mapping - OWASP Mobile 2014 M1 Weak Server Side Controls

[21] Standards Mapping - Payment Card Industry Data Security Standard Version 1.1 Requirement 6.5.10, Requirement 10.2.1, Requirement 10.2.4, Requirement 10.3.4

[22] Standards Mapping - Payment Card Industry Data Security Standard Version 1.2 Requirement 10.2.1, Requirement 10.2.4, Requirement 10.3.4

[23] Standards Mapping - Payment Card Industry Data Security Standard Version 2.0 Requirement 10.2.1, Requirement 10.2.4, Requirement 10.3.4

[24] Standards Mapping - Payment Card Industry Data Security Standard Version 3.0 Requirement 10.2.1, Requirement 10.2.4, Requirement 10.3.4

[25] Standards Mapping - Payment Card Industry Data Security Standard Version 3.2 Requirement 10.2.1, Requirement 10.2.4, Requirement 10.3.4

[26] Standards Mapping - Payment Card Industry Data Security Standard Version 3.2.1 Requirement 10.2.1, Requirement 10.2.4, Requirement 10.3.4

[27] Standards Mapping - Payment Card Industry Data Security Standard Version 3.1 Requirement 10.2.1, Requirement 10.2.4, Requirement 10.3.4

[28] Standards Mapping - Payment Card Industry Data Security Standard Version 4.0 Requirement 10.2.1, Requirement 10.2.1.4, Requirement 10.2.2

[29] Standards Mapping - Payment Card Industry Software Security Framework 1.0 Control Objective 8.2 - Activity Tracking

[30] Standards Mapping - Payment Card Industry Software Security Framework 1.1 Control Objective 8.2 - Activity Tracking

[31] Standards Mapping - Payment Card Industry Software Security Framework 1.2 Control Objective 8.2 - Activity Tracking

[32] Standards Mapping - Security Technical Implementation Guide Version 3.1 APP3680.4 CAT II, APP3680.5 CAT II

[33] Standards Mapping - Security Technical Implementation Guide Version 3.4 APP3680.4 CAT II, APP3680.5 CAT II

[34] Standards Mapping - Security Technical Implementation Guide Version 3.5 APP3680.4 CAT II, APP3680.5 CAT II

[35] Standards Mapping - Security Technical Implementation Guide Version 3.6 APP3680.4 CAT II, APP3680.5 CAT II

[36] Standards Mapping - Security Technical Implementation Guide Version 3.7 APP3680.4 CAT II, APP3680.5 CAT II

[37] Standards Mapping - Security Technical Implementation Guide Version 3.9 APP3680.4 CAT II, APP3680.5 CAT II

[38] Standards Mapping - Security Technical Implementation Guide Version 3.10 APP3680.4 CAT II, APP3680.5 CAT II

[39] Standards Mapping - Security Technical Implementation Guide Version 4.1 APSC-DV-000830 CAT II

[40] Standards Mapping - Security Technical Implementation Guide Version 4.2 APSC-DV-000830 CAT II

[41] Standards Mapping - Security Technical Implementation Guide Version 4.3 APSC-DV-000830 CAT II

[42] Standards Mapping - Security Technical Implementation Guide Version 4.4 APSC-DV-000830 CAT II

[43] Standards Mapping - Security Technical Implementation Guide Version 4.5 APSC-DV-000830 CAT II

[44] Standards Mapping - Security Technical Implementation Guide Version 4.6 APSC-DV-000830 CAT II

[45] Standards Mapping - Security Technical Implementation Guide Version 4.7 APSC-DV-000830 CAT II

[46] Standards Mapping - Security Technical Implementation Guide Version 4.8 APSC-DV-000830 CAT II

[47] Standards Mapping - Security Technical Implementation Guide Version 4.9 APSC-DV-000830 CAT II

[48] Standards Mapping - Security Technical Implementation Guide Version 4.10 APSC-DV-000830 CAT II

[49] Standards Mapping - Security Technical Implementation Guide Version 4.11 APSC-DV-000830 CAT II

[50] Standards Mapping - Security Technical Implementation Guide Version 5.1 APSC-DV-000830 CAT II

[51] Standards Mapping - Security Technical Implementation Guide Version 5.2 APSC-DV-000830 CAT II

[52] Standards Mapping - Web Application Security Consortium 24 + 2 Application Misconfiguration

desc.structural.yaml.azure_ansible_misconfiguration_insufficient_azure_monitor_logging

Azure ARM Misconfiguration: Hardcoded Secret

JSON

Abstract

이 템플릿은 보안 유형을 사용하여 매개 변수의 기본값을 정의합니다.

Explanation

암호와 같은 민감한 Azure ARM 템플릿 매개 변수는 일반적으로 securestring 또는 secureobject 유형을 사용합니다.

보안 유형을 사용하는 매개 변수의 경우 매개 변수 값이 배포 기록에 기록되거나 저장되지 않습니다.

그러나 보안 유형에 대해 하드코드된 기본값이 구성된 경우 템플릿 또는 배포 기록에 액세스할 수 있는 모든 사람이 이 기본값을 읽을 수 있습니다.

하드코드된 기밀의 보안은 쉽게 해결할 수 없는 방식으로 침해될 수 있습니다. 소프트웨어가 운영 단계에 들어간 후 손상된 기밀을 변경하려면 업데이트가 필요합니다.

데이터를 암호화하는 데 사용되는 기밀의 경우 키 순환 단계를 관리하여 손상된 키로 보호되는 모든 데이터를 해독하고 다시 암호화해야 합니다.

예제 1: 다음 템플릿은 하드코드된 기본값이 있는 기밀 유형의 매개 변수를 보여줍니다.


{
    ...
    "parameters": {
        "rootPassword": {
            "defaultValue": "HardcodedPassword",
            "type": "secureString"
        },
        "adminLogin": {
            "type": "string"
        },
        "sqlServerName": {
            "type": "string"
        }
    },
    ...
}

References

[1] CISA Alert (TA13-175A) - Risks of Default Passwords on the Internet

[2] Microsoft Use Azure Key Vault to pass secure parameter value during deployment

[3] Microsoft ARM template best practices - Security recommendations for parameters

[4] Microsoft String functions for ARM templates - newGuid

[5] Microsoft Test cases for ARM templates - Secure parameters can't have hardcoded default

[6] Microsoft Data types in ARM templates - Secure strings and objects

[7] Standards Mapping - CIS Azure Kubernetes Service Benchmark 3

[8] Standards Mapping - CIS Microsoft Azure Foundations Benchmark complete

[9] Standards Mapping - CIS Amazon Elastic Kubernetes Service Benchmark 5

[10] Standards Mapping - CIS Amazon Web Services Foundations Benchmark 1

[11] Standards Mapping - CIS Google Kubernetes Engine Benchmark confidentiality

[12] Standards Mapping - CIS Kubernetes Benchmark complete

[13] Standards Mapping - Common Weakness Enumeration CWE ID 321

[14] Standards Mapping - Common Weakness Enumeration Top 25 2019 [13] CWE ID 287, [19] CWE ID 798

[15] Standards Mapping - Common Weakness Enumeration Top 25 2020 [14] CWE ID 287, [20] CWE ID 798

[16] Standards Mapping - Common Weakness Enumeration Top 25 2021 [14] CWE ID 287, [16] CWE ID 798

[17] Standards Mapping - DISA Control Correlation Identifier Version 2 CCI-002450

[18] Standards Mapping - FIPS200 IA

[19] Standards Mapping - General Data Protection Regulation (GDPR) Insufficient Data Protection

[20] Standards Mapping - NIST Special Publication 800-53 Revision 4 SC-12 Cryptographic Key Establishment and Management (P1)

[21] Standards Mapping - NIST Special Publication 800-53 Revision 5 SC-12 Cryptographic Key Establishment and Management

[22] Standards Mapping - OWASP Top 10 2004 A8 Insecure Storage

[23] Standards Mapping - OWASP Top 10 2007 A8 Insecure Cryptographic Storage

[24] Standards Mapping - OWASP Top 10 2010 A7 Insecure Cryptographic Storage

[25] Standards Mapping - OWASP Top 10 2013 A6 Sensitive Data Exposure

[26] Standards Mapping - OWASP Top 10 2017 A3 Sensitive Data Exposure

[27] Standards Mapping - OWASP Top 10 2021 A02 Cryptographic Failures

[28] Standards Mapping - OWASP API 2023 API8 Security Misconfiguration

[29] Standards Mapping - OWASP Application Security Verification Standard 4.0 2.6.3 Look-up Secret Verifier Requirements (L2 L3), 2.7.1 Out of Band Verifier Requirements (L1 L2 L3), 2.7.2 Out of Band Verifier Requirements (L1 L2 L3), 2.7.3 Out of Band Verifier Requirements (L1 L2 L3), 2.8.4 Single or Multi Factor One Time Verifier Requirements (L2 L3), 2.8.5 Single or Multi Factor One Time Verifier Requirements (L2 L3), 2.9.1 Cryptographic Software and Devices Verifier Requirements (L2 L3), 2.10.2 Service Authentication Requirements (L2 L3), 2.10.4 Service Authentication Requirements (L2 L3), 3.5.2 Token-based Session Management (L2 L3), 3.7.1 Defenses Against Session Management Exploits (L1 L2 L3), 6.2.1 Algorithms (L1 L2 L3), 6.4.1 Secret Management (L2 L3), 6.4.2 Secret Management (L2 L3), 9.2.3 Server Communications Security Requirements (L2 L3), 10.2.3 Malicious Code Search (L3)

[30] Standards Mapping - OWASP Mobile 2014 M6 Broken Cryptography

[31] Standards Mapping - Payment Card Industry Data Security Standard Version 1.1 Requirement 6.5.8, Requirement 8.4

[32] Standards Mapping - Payment Card Industry Data Security Standard Version 1.2 Requirement 6.3.1.3, Requirement 6.5.8, Requirement 8.4

[33] Standards Mapping - Payment Card Industry Data Security Standard Version 2.0 Requirement 6.3.1, Requirement 6.5.3, Requirement 8.4

[34] Standards Mapping - Payment Card Industry Data Security Standard Version 3.0 Requirement 6.3.1, Requirement 6.5.3, Requirement 8.2.1

[35] Standards Mapping - Payment Card Industry Data Security Standard Version 3.2 Requirement 6.3.1, Requirement 6.5.3, Requirement 8.2.1

[36] Standards Mapping - Payment Card Industry Data Security Standard Version 3.2.1 Requirement 6.3.1, Requirement 6.5.3, Requirement 8.2.1

[37] Standards Mapping - Payment Card Industry Data Security Standard Version 3.1 Requirement 6.3.1, Requirement 6.5.3, Requirement 8.2.1

[38] Standards Mapping - Payment Card Industry Data Security Standard Version 4.0 Requirement 6.2.4, Requirement 6.5.3, Requirement 6.5.6, Requirement 8.3.2

[39] Standards Mapping - Payment Card Industry Software Security Framework 1.0 Control Objective 7.2 - Use of Cryptography

[40] Standards Mapping - Payment Card Industry Software Security Framework 1.1 Control Objective 7.2 - Use of Cryptography, Control Objective B.2.3 - Terminal Software Design

[41] Standards Mapping - Payment Card Industry Software Security Framework 1.2 Control Objective 7.2 - Use of Cryptography, Control Objective B.2.3 - Terminal Software Design

[42] Standards Mapping - SANS Top 25 2009 Porous Defenses - CWE ID 259

[43] Standards Mapping - SANS Top 25 2010 Porous Defenses - CWE ID 798

[44] Standards Mapping - SANS Top 25 2011 Porous Defenses - CWE ID 798

[45] Standards Mapping - Security Technical Implementation Guide Version 3.1 APP3210.1 CAT II, APP3350 CAT I

[46] Standards Mapping - Security Technical Implementation Guide Version 3.4 APP3210.1 CAT II, APP3350 CAT I

[47] Standards Mapping - Security Technical Implementation Guide Version 3.5 APP3210.1 CAT II, APP3350 CAT I

[48] Standards Mapping - Security Technical Implementation Guide Version 3.6 APP3210.1 CAT II, APP3350 CAT I

[49] Standards Mapping - Security Technical Implementation Guide Version 3.7 APP3210.1 CAT II, APP3350 CAT I

[50] Standards Mapping - Security Technical Implementation Guide Version 3.9 APP3210.1 CAT II, APP3350 CAT I

[51] Standards Mapping - Security Technical Implementation Guide Version 3.10 APP3210.1 CAT II, APP3350 CAT I

[52] Standards Mapping - Security Technical Implementation Guide Version 4.1 APSC-DV-002010 CAT II

[53] Standards Mapping - Security Technical Implementation Guide Version 4.2 APSC-DV-002010 CAT II

[54] Standards Mapping - Security Technical Implementation Guide Version 4.3 APSC-DV-002010 CAT II

[55] Standards Mapping - Security Technical Implementation Guide Version 4.4 APSC-DV-002010 CAT II

[56] Standards Mapping - Security Technical Implementation Guide Version 4.5 APSC-DV-002010 CAT II

[57] Standards Mapping - Security Technical Implementation Guide Version 4.6 APSC-DV-002010 CAT II

[58] Standards Mapping - Security Technical Implementation Guide Version 4.7 APSC-DV-002010 CAT II

[59] Standards Mapping - Security Technical Implementation Guide Version 4.8 APSC-DV-002010 CAT II

[60] Standards Mapping - Security Technical Implementation Guide Version 4.9 APSC-DV-002010 CAT II

[61] Standards Mapping - Security Technical Implementation Guide Version 4.10 APSC-DV-002010 CAT II

[62] Standards Mapping - Security Technical Implementation Guide Version 4.11 APSC-DV-002010 CAT II

[63] Standards Mapping - Security Technical Implementation Guide Version 5.1 APSC-DV-002010 CAT II

[64] Standards Mapping - Security Technical Implementation Guide Version 5.2 APSC-DV-002010 CAT II

[65] Standards Mapping - Web Application Security Consortium Version 2.00 Information Leakage (WASC-13)

desc.structural.json.azure_arm_misconfiguration_hardcoded_secret

Azure ARM Misconfiguration: HTTPS Not Required

JSON

Abstract

HTTP 트래픽이 명시적으로 활성화되어 있습니다.

Explanation

HTTP를 통해 전송되는 모든 데이터는 볼 수 있으며 손상될 수 있습니다.
예제 1:


"supportsHttpsTrafficOnly": "false"

References

[1] Microsoft.Storage storageAccounts template reference

[2] Require secure transfer to ensure secure connections

[3] Standards Mapping - CIS Azure Kubernetes Service Benchmark 4

[4] Standards Mapping - CIS Amazon Elastic Kubernetes Service Benchmark 4

[5] Standards Mapping - CIS Amazon Web Services Foundations Benchmark 1

[6] Standards Mapping - CIS Google Kubernetes Engine Benchmark confidentiality

[7] Standards Mapping - CIS Kubernetes Benchmark complete

[8] Standards Mapping - Common Weakness Enumeration CWE ID 319

[9] Standards Mapping - DISA Control Correlation Identifier Version 2 CCI-000068, CCI-001453, CCI-002418, CCI-002420, CCI-002421, CCI-002422, CCI-002890, CCI-003123

[10] Standards Mapping - FIPS200 SC

[11] Standards Mapping - General Data Protection Regulation (GDPR) Insufficient Data Protection

[12] Standards Mapping - NIST Special Publication 800-53 Revision 4 SC-8 Transmission Confidentiality and Integrity (P1)

[13] Standards Mapping - NIST Special Publication 800-53 Revision 5 SC-8 Transmission Confidentiality and Integrity

[14] Standards Mapping - OWASP Top 10 2004 A10 Insecure Configuration Management

[15] Standards Mapping - OWASP Top 10 2007 A9 Insecure Communications

[16] Standards Mapping - OWASP Top 10 2010 A9 Insufficient Transport Layer Protection

[17] Standards Mapping - OWASP Top 10 2013 A6 Sensitive Data Exposure

[18] Standards Mapping - OWASP Top 10 2017 A3 Sensitive Data Exposure

[19] Standards Mapping - OWASP Top 10 2021 A05 Security Misconfiguration

[20] Standards Mapping - OWASP API 2023 API8 Security Misconfiguration

[21] Standards Mapping - OWASP Application Security Verification Standard 4.0 1.9.1 Communications Architectural Requirements (L2 L3), 1.14.1 Configuration Architectural Requirements (L2 L3), 2.2.5 General Authenticator Requirements (L3), 2.6.3 Look-up Secret Verifier Requirements (L2 L3), 2.8.3 Single or Multi Factor One Time Verifier Requirements (L2 L3), 2.7.1 Out of Band Verifier Requirements (L1 L2 L3), 2.7.2 Out of Band Verifier Requirements (L1 L2 L3), 2.7.3 Out of Band Verifier Requirements (L1 L2 L3), 2.8.4 Single or Multi Factor One Time Verifier Requirements (L2 L3), 2.8.5 Single or Multi Factor One Time Verifier Requirements (L2 L3), 2.9.3 Cryptographic Software and Devices Verifier Requirements (L2 L3), 3.7.1 Defenses Against Session Management Exploits (L1 L2 L3), 6.2.1 Algorithms (L1 L2 L3), 6.2.2 Algorithms (L2 L3), 6.2.3 Algorithms (L2 L3), 6.2.4 Algorithms (L2 L3), 6.2.5 Algorithms (L2 L3), 6.2.6 Algorithms (L2 L3), 6.2.7 Algorithms (L3), 8.1.6 General Data Protection (L3), 8.3.1 Sensitive Private Data (L1 L2 L3), 8.3.4 Sensitive Private Data (L1 L2 L3), 8.3.7 Sensitive Private Data (L2 L3), 9.1.1 Communications Security Requirements (L1 L2 L3), 9.1.2 Communications Security Requirements (L1 L2 L3), 9.1.3 Communications Security Requirements (L1 L2 L3), 9.2.1 Server Communications Security Requirements (L2 L3), 9.2.2 Server Communications Security Requirements (L2 L3), 9.2.3 Server Communications Security Requirements (L2 L3), 14.1.3 Build (L2 L3), 14.4.5 HTTP Security Headers Requirements (L1 L2 L3)

[22] Standards Mapping - OWASP Mobile 2014 M3 Insufficient Transport Layer Protection

[23] Standards Mapping - Payment Card Industry Data Security Standard Version 1.1 Requirement 4.1, Requirement 6.5.10

[24] Standards Mapping - Payment Card Industry Data Security Standard Version 1.2 Requirement 4.1, Requirement 6.3.1.4, Requirement 6.5.9

[25] Standards Mapping - Payment Card Industry Data Security Standard Version 2.0 Requirement 4.1, Requirement 6.5.4

[26] Standards Mapping - Payment Card Industry Data Security Standard Version 3.0 Requirement 4.1, Requirement 6.5.4

[27] Standards Mapping - Payment Card Industry Data Security Standard Version 3.2 Requirement 4.1, Requirement 6.5.4

[28] Standards Mapping - Payment Card Industry Data Security Standard Version 3.2.1 Requirement 4.1, Requirement 6.5.4

[29] Standards Mapping - Payment Card Industry Data Security Standard Version 3.1 Requirement 4.1, Requirement 6.5.4

[30] Standards Mapping - Payment Card Industry Data Security Standard Version 4.0 Requirement 4.2.1, Requirement 6.2.4

[31] Standards Mapping - Payment Card Industry Software Security Framework 1.0 Control Objective 6.2 - Sensitive Data Protection, Control Objective 7 - Use of Cryptography

[32] Standards Mapping - Payment Card Industry Software Security Framework 1.1 Control Objective 6.2 - Sensitive Data Protection, Control Objective 7 - Use of Cryptography

[33] Standards Mapping - Payment Card Industry Software Security Framework 1.2 Control Objective 6.2 - Sensitive Data Protection, Control Objective 7 - Use of Cryptography, Control Objective C.4.1 - Web Software Communications

[34] Standards Mapping - SANS Top 25 2009 Insecure Interaction - CWE ID 319

[35] Standards Mapping - SANS Top 25 2010 Porous Defenses - CWE ID 311

[36] Standards Mapping - SANS Top 25 2011 Porous Defenses - CWE ID 311

[37] Standards Mapping - Security Technical Implementation Guide Version 3.1 APP3250.1 CAT I, APP3250.2 CAT I, APP3250.3 CAT II, APP3250.4 CAT II, APP3260.1 CAT II

[38] Standards Mapping - Security Technical Implementation Guide Version 3.4 APP3250.1 CAT I, APP3250.2 CAT I, APP3250.3 CAT II, APP3250.4 CAT II, APP3260 CAT II

[39] Standards Mapping - Security Technical Implementation Guide Version 3.5 APP3250.1 CAT I, APP3250.2 CAT I, APP3250.3 CAT II, APP3250.4 CAT II, APP3260 CAT II

[40] Standards Mapping - Security Technical Implementation Guide Version 3.6 APP3250.1 CAT I, APP3250.2 CAT I, APP3250.3 CAT II, APP3250.4 CAT II, APP3260 CAT II

[41] Standards Mapping - Security Technical Implementation Guide Version 3.7 APP3250.1 CAT I, APP3250.2 CAT I, APP3250.3 CAT II, APP3250.4 CAT II, APP3260 CAT II

[42] Standards Mapping - Security Technical Implementation Guide Version 3.9 APP3250.1 CAT I, APP3250.2 CAT I, APP3250.3 CAT II, APP3250.4 CAT II, APP3260 CAT II

[43] Standards Mapping - Security Technical Implementation Guide Version 3.10 APP3250.1 CAT I, APP3250.2 CAT I, APP3250.3 CAT II, APP3250.4 CAT II, APP3260 CAT II

[44] Standards Mapping - Security Technical Implementation Guide Version 4.1 APSC-DV-000160 CAT II, APSC-DV-000170 CAT II, APSC-DV-001940 CAT II, APSC-DV-001950 CAT II, APSC-DV-002440 CAT I, APSC-DV-002450 CAT II, APSC-DV-002460 CAT II, APSC-DV-002470 CAT II

[45] Standards Mapping - Security Technical Implementation Guide Version 4.2 APSC-DV-000160 CAT II, APSC-DV-000170 CAT II, APSC-DV-001940 CAT II, APSC-DV-001950 CAT II, APSC-DV-002440 CAT I, APSC-DV-002450 CAT II, APSC-DV-002460 CAT II, APSC-DV-002470 CAT II

[46] Standards Mapping - Security Technical Implementation Guide Version 4.3 APSC-DV-000160 CAT II, APSC-DV-000170 CAT II, APSC-DV-001940 CAT II, APSC-DV-001950 CAT II, APSC-DV-002440 CAT I, APSC-DV-002450 CAT II, APSC-DV-002460 CAT II, APSC-DV-002470 CAT II

[47] Standards Mapping - Security Technical Implementation Guide Version 4.4 APSC-DV-000160 CAT II, APSC-DV-000170 CAT II, APSC-DV-001940 CAT II, APSC-DV-001950 CAT II, APSC-DV-002440 CAT I, APSC-DV-002450 CAT II, APSC-DV-002460 CAT II, APSC-DV-002470 CAT II

[48] Standards Mapping - Security Technical Implementation Guide Version 4.5 APSC-DV-000160 CAT II, APSC-DV-000170 CAT II, APSC-DV-001940 CAT II, APSC-DV-001950 CAT II, APSC-DV-002440 CAT I, APSC-DV-002450 CAT II, APSC-DV-002460 CAT II, APSC-DV-002470 CAT II

[49] Standards Mapping - Security Technical Implementation Guide Version 4.6 APSC-DV-000160 CAT II, APSC-DV-000170 CAT II, APSC-DV-001940 CAT II, APSC-DV-001950 CAT II, APSC-DV-002440 CAT I, APSC-DV-002450 CAT II, APSC-DV-002460 CAT II, APSC-DV-002470 CAT II

[50] Standards Mapping - Security Technical Implementation Guide Version 4.7 APSC-DV-000160 CAT II, APSC-DV-000170 CAT II, APSC-DV-001940 CAT II, APSC-DV-001950 CAT II, APSC-DV-002440 CAT I, APSC-DV-002450 CAT II, APSC-DV-002460 CAT II, APSC-DV-002470 CAT II

[51] Standards Mapping - Security Technical Implementation Guide Version 4.8 APSC-DV-000160 CAT II, APSC-DV-000170 CAT II, APSC-DV-001940 CAT II, APSC-DV-001950 CAT II, APSC-DV-002440 CAT I, APSC-DV-002450 CAT II, APSC-DV-002460 CAT II, APSC-DV-002470 CAT II

[52] Standards Mapping - Security Technical Implementation Guide Version 4.9 APSC-DV-000160 CAT II, APSC-DV-000170 CAT II, APSC-DV-001940 CAT II, APSC-DV-001950 CAT II, APSC-DV-002440 CAT I, APSC-DV-002450 CAT II, APSC-DV-002460 CAT II, APSC-DV-002470 CAT II

[53] Standards Mapping - Security Technical Implementation Guide Version 4.10 APSC-DV-000160 CAT II, APSC-DV-000170 CAT II, APSC-DV-001940 CAT II, APSC-DV-001950 CAT II, APSC-DV-002440 CAT I, APSC-DV-002450 CAT II, APSC-DV-002460 CAT II, APSC-DV-002470 CAT II

[54] Standards Mapping - Security Technical Implementation Guide Version 4.11 APSC-DV-000160 CAT II, APSC-DV-000170 CAT II, APSC-DV-001940 CAT II, APSC-DV-001950 CAT II, APSC-DV-002440 CAT I, APSC-DV-002450 CAT II, APSC-DV-002460 CAT II, APSC-DV-002470 CAT II

[55] Standards Mapping - Security Technical Implementation Guide Version 5.1 APSC-DV-000160 CAT II, APSC-DV-000170 CAT II, APSC-DV-001940 CAT II, APSC-DV-001950 CAT II, APSC-DV-002440 CAT I, APSC-DV-002450 CAT II, APSC-DV-002460 CAT II, APSC-DV-002470 CAT II

[56] Standards Mapping - Security Technical Implementation Guide Version 5.2 APSC-DV-000160 CAT II, APSC-DV-000170 CAT II, APSC-DV-001940 CAT II, APSC-DV-001950 CAT II, APSC-DV-002440 CAT I, APSC-DV-002450 CAT II, APSC-DV-002460 CAT II, APSC-DV-002470 CAT II

[57] Standards Mapping - Security Technical Implementation Guide Version 5.3 APSC-DV-000160 CAT II, APSC-DV-000170 CAT II, APSC-DV-001940 CAT II, APSC-DV-001950 CAT II, APSC-DV-002440 CAT I, APSC-DV-002450 CAT II, APSC-DV-002460 CAT II, APSC-DV-002470 CAT II

[58] Standards Mapping - Web Application Security Consortium Version 2.00 Insufficient Transport Layer Protection (WASC-04)

[59] Standards Mapping - Web Application Security Consortium 24 + 2 Information Leakage

desc.config.json.azure_arm_misconfiguration_https_not_required

Azure ARM Misconfiguration: Improper AKS Network Access Control

Bicep
JSON

Abstract

이 템플릿은 Kubernetes API 서버에 대한 액세스를 제한하지 못합니다.

Explanation

공개적으로 액세스 가능한 Kubernetes API 서버는 조직을 공격에 노출시킬 수 있습니다.

예제 1: 다음 예제는 API 서버에 연결할 수 있는 IP 주소 범위를 제한하지 않는 Kubernetes 서비스 클러스터를 정의하는 템플릿을 보여줍니다.


param location string = resourceGroup().location

resource example 'Microsoft.ContainerService/managedClusters@2020-02-01' = {
    name: 'TestCluster'
    location: location
    properties: {
        ...
        servicePrincipalProfile: {
            clientId: '422313d8-123a-41ea-8f8e-90821ff61c05'
            secret: 'xxxxxxxxxxxxxxxxx'
        }
    }
}

References

[1] microsoft Secure access to the API server using authorized IP address ranges in Azure Kubernetes Service (AKS)

[2] Standards Mapping - CIS Azure Kubernetes Service Benchmark 4

[3] Standards Mapping - CIS Amazon Elastic Kubernetes Service Benchmark 3

[4] Standards Mapping - CIS Amazon Web Services Foundations Benchmark 1

[5] Standards Mapping - CIS Google Kubernetes Engine Benchmark confidentiality

[6] Standards Mapping - Common Weakness Enumeration CWE ID 749

[7] Standards Mapping - Common Weakness Enumeration Top 25 2020 [25] CWE ID 862

[8] Standards Mapping - Common Weakness Enumeration Top 25 2021 [18] CWE ID 862

[9] Standards Mapping - DISA Control Correlation Identifier Version 2 CCI-000213, CCI-001084, CCI-002165

[10] Standards Mapping - General Data Protection Regulation (GDPR) Access Violation

[11] Standards Mapping - NIST Special Publication 800-53 Revision 4 AC-6 Least Privilege (P1)

[12] Standards Mapping - NIST Special Publication 800-53 Revision 5 AC-6 Least Privilege

[13] Standards Mapping - OWASP Top 10 2004 A2 Broken Access Control

[14] Standards Mapping - OWASP Top 10 2007 A4 Insecure Direct Object Reference

[15] Standards Mapping - OWASP Top 10 2010 A4 Insecure Direct Object References

[16] Standards Mapping - OWASP Top 10 2013 A4 Insecure Direct Object References

[17] Standards Mapping - OWASP Top 10 2017 A5 Broken Access Control

[18] Standards Mapping - OWASP Top 10 2021 A01 Broken Access Control

[19] Standards Mapping - OWASP API 2023 API8 Security Misconfiguration

[20] Standards Mapping - OWASP Application Security Verification Standard 4.0 4.1.3 General Access Control Design (L1 L2 L3)

[21] Standards Mapping - Payment Card Industry Data Security Standard Version 1.1 Requirement 6.5.2

[22] Standards Mapping - Payment Card Industry Data Security Standard Version 1.2 Requirement 6.5.4

[23] Standards Mapping - Payment Card Industry Data Security Standard Version 2.0 Requirement 6.5.8

[24] Standards Mapping - Payment Card Industry Data Security Standard Version 3.0 Requirement 6.5.8

[25] Standards Mapping - Payment Card Industry Data Security Standard Version 3.2 Requirement 6.5.8

[26] Standards Mapping - Payment Card Industry Data Security Standard Version 3.2.1 Requirement 6.5.8

[27] Standards Mapping - Payment Card Industry Data Security Standard Version 3.1 Requirement 6.5.8

[28] Standards Mapping - Payment Card Industry Data Security Standard Version 4.0 Requirement 6.2.4, Requirement 1.4.2

[29] Standards Mapping - Payment Card Industry Software Security Framework 1.0 Control Objective 5.4 - Authentication and Access Control

[30] Standards Mapping - Payment Card Industry Software Security Framework 1.1 Control Objective 5.4 - Authentication and Access Control

[31] Standards Mapping - Payment Card Industry Software Security Framework 1.2 Control Objective 5.4 - Authentication and Access Control, Control Objective C.2.3 - Web Software Access Controls

[32] Standards Mapping - SANS Top 25 2009 Porous Defenses - CWE ID 285

[33] Standards Mapping - SANS Top 25 2010 Porous Defenses - CWE ID 863

[34] Standards Mapping - SANS Top 25 2011 Porous Defenses - CWE ID 863

[35] Standards Mapping - Security Technical Implementation Guide Version 3.1 APP3480.1 CAT II

[36] Standards Mapping - Security Technical Implementation Guide Version 3.4 APP3480.1 CAT I

[37] Standards Mapping - Security Technical Implementation Guide Version 3.5 APP3480.1 CAT I

[38] Standards Mapping - Security Technical Implementation Guide Version 3.6 APP3480.1 CAT I

[39] Standards Mapping - Security Technical Implementation Guide Version 3.7 APP3480.1 CAT I

[40] Standards Mapping - Security Technical Implementation Guide Version 3.9 APP3480.1 CAT I

[41] Standards Mapping - Security Technical Implementation Guide Version 3.10 APP3480.1 CAT I

[42] Standards Mapping - Security Technical Implementation Guide Version 4.1 APSC-DV-000460 CAT I, APSC-DV-000470 CAT II, APSC-DV-002360 CAT II

[43] Standards Mapping - Security Technical Implementation Guide Version 4.2 APSC-DV-000460 CAT I, APSC-DV-000470 CAT II, APSC-DV-002360 CAT II

[44] Standards Mapping - Security Technical Implementation Guide Version 4.3 APSC-DV-000460 CAT I, APSC-DV-000470 CAT II, APSC-DV-002360 CAT II

[45] Standards Mapping - Security Technical Implementation Guide Version 4.4 APSC-DV-000460 CAT I, APSC-DV-000470 CAT II, APSC-DV-002360 CAT II

[46] Standards Mapping - Security Technical Implementation Guide Version 4.5 APSC-DV-000460 CAT I, APSC-DV-000470 CAT II, APSC-DV-002360 CAT II

[47] Standards Mapping - Security Technical Implementation Guide Version 4.6 APSC-DV-000460 CAT I, APSC-DV-000470 CAT II, APSC-DV-002360 CAT II

[48] Standards Mapping - Security Technical Implementation Guide Version 4.7 APSC-DV-000460 CAT I, APSC-DV-000470 CAT II, APSC-DV-002360 CAT II

[49] Standards Mapping - Security Technical Implementation Guide Version 4.8 APSC-DV-000460 CAT I, APSC-DV-000470 CAT II, APSC-DV-002360 CAT II

[50] Standards Mapping - Security Technical Implementation Guide Version 4.9 APSC-DV-000460 CAT I, APSC-DV-000470 CAT II, APSC-DV-002360 CAT II

[51] Standards Mapping - Security Technical Implementation Guide Version 4.10 APSC-DV-000460 CAT I, APSC-DV-000470 CAT II, APSC-DV-002360 CAT II

[52] Standards Mapping - Security Technical Implementation Guide Version 4.11 APSC-DV-000460 CAT I, APSC-DV-000470 CAT II, APSC-DV-002360 CAT II

[53] Standards Mapping - Security Technical Implementation Guide Version 5.1 APSC-DV-000460 CAT I, APSC-DV-000470 CAT II, APSC-DV-002360 CAT II

[54] Standards Mapping - Security Technical Implementation Guide Version 5.2 APSC-DV-000460 CAT I, APSC-DV-000470 CAT II, APSC-DV-002360 CAT II

[55] Standards Mapping - Web Application Security Consortium Version 2.00 Insufficient Authorization (WASC-02)

[56] Standards Mapping - Web Application Security Consortium 24 + 2 Insufficient Authorization

desc.structural.bicep.azure_arm_misconfiguration_improper_aks_network_access_control

Abstract

이 템플릿은 Kubernetes API 서버에 대한 액세스를 제한하지 못합니다.

Explanation


{
    "name": "TestCluster",
    "type": "Microsoft.ContainerService/managedClusters",
    "apiVersion": "2020-02-01",
    "location": "[resourceGroup().location]",
    "properties": {
    ...
    "servicePrincipalProfile": {
        "clientId": "422313d8-123a-41ea-8f8e-90821ff61c05",
        "secret": "xxxxxxxxxxxxxxxxx"
    },
    }
}