Ensure the Default Network Security Group of Every Workspace Restricts All Traffic

AltaNível 1Revisão manualibmcloud

Descrição

It is recommended that the default security group for every workspace restricts all inbound (ingress) traffic, to enforce a least-privilege security posture and reduce unintended exposure of PowerVS resources. Starting with a default security group configuration that restricts all inbound (ingress) traffic reduces the chance of exposing PowerVS resources to unintended risks.

Como é verificado

Método de auditoria: Revisão manual

Esta recomendação não pode ser verificada automaticamente. Uma varredura a lista com estas instruções quando você passa --include-manual.

Perform the following tasks to determine if the account is configured as prescribed: Using Console: 1. Login to the IBM Cloud Portal at https://cloud.ibm.com and select Power Virtual Server user interface. 2. In the navigation panel, click Workspaces, then for each workspace that contains Network Security Groups, open the Workspace details page. 3. From the workspace details page, click view virtual servers. 4. In the left navigation panel, expand Networking and then select Network Security Groups. 5. For the default security group, perform the following: a. Ensure no rule exists that allows inbound (ingress) traffic flow to the Virtual Servers in the group.

Como é corrigido

Método de correção: Orientação ou patch de infraestrutura

Using Console: 1. Login to the IBM Cloud Portal at https://cloud.ibm.com and select Power Virtual Server user interface. 2. In the navigation panel, click Workspaces, then for each workspace that contains Network Security Groups, open the Workspace details page. 3. From the workspace details page, click view virtual servers. 4. In the left navigation panel, expand Networking and then select Network Security Groups. 5. For the default security group, perform the following: a. Identify the rule that allows inbound (ingress) traffic flows. b. Remove the rule.

Propriedades

Sistemas operacionais: Qualquer
Tags: cloudibmcloudnetwork
Referência: CIS IBM Cloud Foundations Benchmark v2.0.0 - 9.1 Ensure the Default Network Security Group of Every Workspace Restricts All Traffic