Checks

Users with service account access at project level can impersonate any service account. Instead, they should be given access to particular service accounts as required.

RSA SHA1 is a weaker algorithm than SHA2-based algorithms such as RSA SHA256/512

DNSSEC authenticates DNS responses, preventing MITM attacks and impersonation.

Temporary files are not logged by default. To log all temporary files, a value of 0 should set in the log_temp_files flag - as all files greater in size than the number of bytes set in this flag will be logged.

In-transit data should be encrypted so that if traffic is intercepted data will not be exposed in plaintext to attackers.

Logging connections provides useful diagnostic data such as session length, which can identify performance issues in an application and potential DoS vectors.

Database instances should be configured so that they are not available over the public internet, but to internal compute resources which access them.

Setting the minimum log severity too high will cause errors not to be logged

Cross-database ownership chaining, also known as cross-database chaining, is a security feature of SQL Server that allows users of databases access to other databases besides the one they are currently using.

Lock waits are often an indication of poor performance and often an indicator of a potential denial of service vulnerability, therefore occurrences should be logged for analysis.

Logging of statements which could contain sensitive data is not advised, therefore this setting should preclude all statements from being logged.

Logging disconnections provides useful diagnostic data such as session length, which can identify performance issues in an application and potential DoS vectors.

Users with ALTER permissions on users can grant access to a contained database without the knowledge of an administrator

Automated backups are not enabled by default. Backups are an easy way to restore data in a corruption or data-loss scenario.

Logging checkpoints provides useful diagnostic data, which can identify performance issues in an application and potential DoS vectors.

Arbitrary files can be read from the system using LOAD_DATA unless this setting is disabled.

Opening up ports to allow connections from the public internet is generally to be avoided. You should restrict access to IP addresses or ranges that are explicitly required where possible.

VPC flow logs record information about all traffic, which is a vital tool in reviewing anomalous traffic.

Use of project-wide SSH keys means that a compromise of any one of these key pairs can result in all instances being compromised. It is recommended to use instance-level keys.

Instances should not be publicly exposed to the internet

When serial port access is enabled, the access is not governed by network security rules meaning the port can be exposed publicly.

Using unmanaged keys makes rotation and general management difficult.

Using unmanaged keys makes rotation and general management difficult.

Opening up ports to connect out to the public internet is generally to be avoided. You should restrict access to IP addresses or ranges that are explicitly required where possible.