Checks

Microsoft Defender for Office 365 Safe Attachments provides an additional layer of protection by scanning email attachments in a secure environment before delivering them to recipients.

The Built-In Protection Policy should have Enable=True, Action=Block, and QuarantineTag=AdminOnlyAccessPolicy to ensure malicious attachments are blocked and quarantined with admin-only access.

Microsoft Defender for Office 365 Safe Links is a feature that provides URL scanning and rewriting of inbound email messages, as well as time-of-click verification of URLs and links in email messages, Teams, and Office apps.

This check verifies that the Safe Links policy is properly configured with all recommended settings enabled.

The Strict Preset Security Policy applies Microsoft's recommended strict protection settings and should be enabled for both Exchange Online Protection (anti-phishing, anti-spam, anti-malware) and Defender for Office 365 (Safe Attachments, Safe Links). The rules are exposed via Get-EOPProtectionPolicyRule and Get-ATPProtectionPolicyRule.

Microsoft Defender XDR critical asset management classifications with a lower classification confidence score must be approved by a security administrator.

Asset classifications that have not yet been reviewed and approved may result in incomplete critical asset visibility.

Microsoft Defender XDR's Security Exposure Management detects when credentials from users with Entra ID privileged roles are present on vulnerable devices. Privileged users may have authentication artifacts (CLI secrets, cookies, tokens) exposed on endpoints with high risk scores.

Microsoft Defender for Office 365 Zero-hour auto purge (ZAP) is a protection feature that retroactively detects and neutralizes malware and high confidence phishing in Teams messages.

When ZAP blocks a message, it is blocked for everyone in the chat. The initial block happens right after delivery, but ZAP can occur up to 48 hours after delivery.

Vercel production deployments are assessed for source branch stability by verifying they are sourced from a stable branch (main or master). Deploying to production from feature branches bypasses standard CI/CD review processes and may introduce untested or incomplete code into the production environment.

Opening up ports to allow connections from the public internet is generally to be avoided. You should restrict access to IP addresses or ranges that are explicitly required where possible.

Plain HTTP is unencrypted and human-readable. This means that if a malicious actor was to eavesdrop on your connection, they would be able to see all of your data flowing back and forth. You should use HTTPS, which is HTTP over an encrypted (TLS) connection, meaning eavesdroppers cannot read your traffic.

Opening up ports to connect out to the public internet is generally to be avoided. You should restrict access to IP addresses or ranges that are explicitly required where possible.

When working with a server, you’ll likely spend most of your time in a terminal session connected to your server through SSH. A more secure alternative to password-based logins, SSH keys use encryption to provide a secure way of logging into your server and are recommended for all users.

While upgrading your cluster, workloads will temporarily be moved to new nodes. A small cost will follow, but as a bonus, you won't experience downtime.

Space bucket and bucket object permissions should be set to deny public access unless explicitly required.

Versioning is a means of keeping multiple variants of an object in the same bucket. You can use the Spaces (S3) Versioning feature to preserve, retrieve, and restore every version of every object stored in your buckets. With versioning you can recover more easily from both unintended user actions and application failures.

Enabling force destroy on a Spaces bucket means that the bucket can be deleted without the additional check that it is empty. This risks important data being accidentally deleted by a bucket removal process.

AWS Direct Connect connectivity is provisioned with connection and location redundancy-multiple connections spread across at least two distinct Direct Connect locations in each Region.

Direct Connect gateways and virtual private gateways are assessed for interface redundancy: multiple virtual interfaces (VIFs) distributed across more than one Direct Connect connection.

Gateways with only one VIF or with all VIFs on a single connection are identified.

AWS Directory Service directories are configured to forward domain controller security event logs to CloudWatch Logs using log subscriptions.

Evaluation identifies directories with or without this forwarding in place.

AWS Directory Service directories are associated with Amazon SNS topics to send status change notifications (e.g., Active Impaired).

The evaluation looks for directories that have SNS event topics configured for monitoring alerts.

AWS Directory Service directories with manual snapshot capacity fully consumed or nearly exhausted, based on current snapshot count relative to the directory's maximum allowed.

AWS Directory Service Secure LDAP (LDAPS) certificates are assessed for upcoming expiration by comparing each directory's certificate expiration to the current time and identifying those with <= 90 days remaining.

AWS Directory Service RADIUS configuration uses the authentication protocol defined for MFA integration. The finding evaluates whether directories with RADIUS enabled are set to MS-CHAPv2 instead of weaker options like PAP, CHAP, or MS-CHAPv1.

AWS Directory Service directories are evaluated for RADIUS-backed multi-factor authentication, confirming that MFA is configured and the RADIUS integration is active.