TMA-IBMCLOUD-9.1
Ensure the Default Network Security Group of Every Workspace Restricts All Traffic
説明
It is recommended that the default security group for every workspace restricts all inbound (ingress) traffic, to enforce a least-privilege security posture and reduce unintended exposure of PowerVS resources. Starting with a default security group configuration that restricts all inbound (ingress) traffic reduces the chance of exposing PowerVS resources to unintended risks.
チェック方法
監査方法: 手動レビュー
この推奨事項は自動ではチェックできません。--include-manual を指定すると、スキャン結果にこの手順付きで一覧表示されます。
Perform the following tasks to determine if the account is configured as prescribed: Using Console: 1. Login to the IBM Cloud Portal at https://cloud.ibm.com and select Power Virtual Server user interface. 2. In the navigation panel, click Workspaces, then for each workspace that contains Network Security Groups, open the Workspace details page. 3. From the workspace details page, click view virtual servers. 4. In the left navigation panel, expand Networking and then select Network Security Groups. 5. For the default security group, perform the following: a. Ensure no rule exists that allows inbound (ingress) traffic flow to the Virtual Servers in the group.
修正方法
修正方法: ガイダンスまたは IaC パッチ
Using Console: 1. Login to the IBM Cloud Portal at https://cloud.ibm.com and select Power Virtual Server user interface. 2. In the navigation panel, click Workspaces, then for each workspace that contains Network Security Groups, open the Workspace details page. 3. From the workspace details page, click view virtual servers. 4. In the left navigation panel, expand Networking and then select Network Security Groups. 5. For the default security group, perform the following: a. Identify the rule that allows inbound (ingress) traffic flows. b. Remove the rule.
プロパティ
- オペレーティングシステム
- すべて
- タグ
- cloudibmcloudnetwork
- 参照
- CIS IBM Cloud Foundations Benchmark v2.0.0 - 9.1 Ensure the Default Network Security Group of Every Workspace Restricts All Traffic