Ensure the Default Network Security Group of Every Workspace Restricts All Traffic

高级别 1人工审核ibmcloud

说明

It is recommended that the default security group for every workspace restricts all inbound (ingress) traffic, to enforce a least-privilege security posture and reduce unintended exposure of PowerVS resources. Starting with a default security group configuration that restricts all inbound (ingress) traffic reduces the chance of exposing PowerVS resources to unintended risks.

检查方式

审计方法: 人工审核

此项建议无法自动检查。当您传入 --include-manual 时，扫描结果会列出该项并附带这些说明。

Perform the following tasks to determine if the account is configured as prescribed: Using Console: 1. Login to the IBM Cloud Portal at https://cloud.ibm.com and select Power Virtual Server user interface. 2. In the navigation panel, click Workspaces, then for each workspace that contains Network Security Groups, open the Workspace details page. 3. From the workspace details page, click view virtual servers. 4. In the left navigation panel, expand Networking and then select Network Security Groups. 5. For the default security group, perform the following: a. Ensure no rule exists that allows inbound (ingress) traffic flow to the Virtual Servers in the group.

修复方式

修复方法: 操作指南或基础设施补丁

Using Console: 1. Login to the IBM Cloud Portal at https://cloud.ibm.com and select Power Virtual Server user interface. 2. In the navigation panel, click Workspaces, then for each workspace that contains Network Security Groups, open the Workspace details page. 3. From the workspace details page, click view virtual servers. 4. In the left navigation panel, expand Networking and then select Network Security Groups. 5. For the default security group, perform the following: a. Identify the rule that allows inbound (ingress) traffic flows. b. Remove the rule.

属性

操作系统: 任意
标签: cloudibmcloudnetwork
参考: CIS IBM Cloud Foundations Benchmark v2.0.0 - 9.1 Ensure the Default Network Security Group of Every Workspace Restricts All Traffic