TMA-IBMCLOUD-9.1
Ensure the Default Network Security Group of Every Workspace Restricts All Traffic
Descripción
It is recommended that the default security group for every workspace restricts all inbound (ingress) traffic, to enforce a least-privilege security posture and reduce unintended exposure of PowerVS resources. Starting with a default security group configuration that restricts all inbound (ingress) traffic reduces the chance of exposing PowerVS resources to unintended risks.
Cómo se verifica
Método de auditoría: Revisión manual
Esta recomendación no se puede verificar automáticamente. Un escaneo la lista con estas instrucciones cuando se pasa --include-manual.
Perform the following tasks to determine if the account is configured as prescribed: Using Console: 1. Login to the IBM Cloud Portal at https://cloud.ibm.com and select Power Virtual Server user interface. 2. In the navigation panel, click Workspaces, then for each workspace that contains Network Security Groups, open the Workspace details page. 3. From the workspace details page, click view virtual servers. 4. In the left navigation panel, expand Networking and then select Network Security Groups. 5. For the default security group, perform the following: a. Ensure no rule exists that allows inbound (ingress) traffic flow to the Virtual Servers in the group.
Cómo se corrige
Método de corrección: Guía o parche de infraestructura
Using Console: 1. Login to the IBM Cloud Portal at https://cloud.ibm.com and select Power Virtual Server user interface. 2. In the navigation panel, click Workspaces, then for each workspace that contains Network Security Groups, open the Workspace details page. 3. From the workspace details page, click view virtual servers. 4. In the left navigation panel, expand Networking and then select Network Security Groups. 5. For the default security group, perform the following: a. Identify the rule that allows inbound (ingress) traffic flows. b. Remove the rule.
Propiedades
- Sistemas operativos
- Cualquiera
- Etiquetas
- cloudibmcloudnetwork
- Referencia
- CIS IBM Cloud Foundations Benchmark v2.0.0 - 9.1 Ensure the Default Network Security Group of Every Workspace Restricts All Traffic