aquasecurity / aquasecurity/cloudsploit

Azure plugins to cover CIS Benchmark

Open
#508 6 comments 1 reaction 0 assignees View on GitHub
Dominant language
JavaScript
Stars
3.8k
Forks
751
Avg merge
11d 9h
Merged PRs (30d)
3

Description

I noticed that there are a lot of plugins that assesses Azure environments for CIS Benchmark but they don't generate any output regarding of it. So I modified about 74 Azure plugins to ensure that there is more CIS coverage. The list of plugins is as following:

- ensureNoGuestUser.js
- noCustomOwnerRoles.js
- standardPricingEnabled.js
- autoProvisioningEnabled.js
- monitorSystemUpdates.js
- monitorEndpointProtection.js
- monitorDiskEncryption.js
- monitorNsgEnabled.js
- monitorVMVulnerability.js
- monitorBlobEncryption.js
- monitorJitNetworkAccess.js
- appWhitelistingEnabled.js
- monitorSqlAuditing.js
- monitorSqlEncryption.js
- securityContactsEnabled.js
- securityContactsEnabledPhone.js
- highSeverityAlertsEnabled.js
- adminSecurityAlertsEnabled.js
- storageAccountsHttps.js
- networkAccessDefaultAction.js
- trustedMsAccessEnabled.js
- serverAuditingEnabled.js
- auditActionGroupsEnabled.js
- auditRetentionPolicy.js
- advancedDataSecurityEnabled.js
- sendAlertsEnabled.js
- emailAccountAdminsEnabled.js
- azureADAdminEnabled.js
- tdeProtectorEncrypted.js
- enforceMySQLSSLConnection.js
- logCheckpointsEnabled.js
- enforcePostgresSSLConnection.js
- logConnectionsEnabled.js
- logDisconnectionsEnabled.js
- logDurationEnabled.js
- connectionThrottlingEnabled.js
- logRetentionDays.js
- azureADAdminEnabled.js
- logProfileRetentionPolicy.js
- logProfileArchiveData.js
- logContainerPublicAccess.js
- logStorageEncryption.js
- kvLogAnalyticsEnabled.js
- policyAssignmentLogging.js
- nsgLoggingEnabled.js
- nsgLoggingEnabled.js
- nsgRuleLoggingEnabled.js
- nsgRuleLoggingEnabled.js
- securitySolutionLogging.js
- securitySolutionLogging.js
- sqlServerFirewallRuleEnabled.js
- securityPolicyAlertsEnabled.js
- openRDP.js
- openSSH.js
- noPublicAccess.js
- networkWatcherEnabled.js
- vmDiskOSEncryption.js
- vmDiskDataEncryption.js
- vmEndpointProtection.js
- keyExpirationEnabled.js
- secretExpirationEnabled.js
- managementLockEnabled.js
- kvRecoveryEnabled.js
- rbacEnabled.js
- authEnabled.js
- httpsOnlyEnabled.js
- tlsVersionCheck.js
- clientCertEnabled.js
- identityEnabled.js
- netFrameworkVersion.js
- phpVersion.js
- pythonVersion.js
- javaVersion.js
- http20Enabled.js

There is a new one plugin called securityContactsEnabledPhone.js which is separated from securityContactsEnabled.js because both cover different CIS controls (2.16 and 2.17)
I would like to suggest those modifications as an enhancement, this is a quick look of new CIS controls added (a little bit dislodged) so please let me know how to proceed.

![image](https://user-images.githubusercontent.com/75950229/105192419-0fec2e00-5b06-11eb-996e-c730cd9d8358.png)

Contributor guide

Open the contributing guide

Research direction

Review the listed Azure plugin files, starting with securityContactsEnabled.js and the separate securityContactsEnabledPhone.js, and compare their current CIS control coverage and output. Determine the expected output for each proposed control and verify the full plugin list consistently reports the added CIS coverage; the issue does not name tests or a specific entry point.

Written by the indexing model from the issue text.

Assessment

Tech stack
azure, javascript
Domain
cloud, security
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.