Checks

When handling sensitive data between servers, please consider using a private LAN to isolate the private side network from the shared network.

Removing expired SSL/TLS certificates eliminates the risk that an invalid certificate will be

deployed accidentally to a resource such as NIFCLOUD Load Balancer(L4LB), which candamage the

credibility of the application/website behind the L4LB. As a best practice, it is

recommended to delete expired certificates.

Removing verified record of TXT auth the risk that

If the authentication record remains, anyone can register the zone

Database resources should not publicly available. You should limit all access to the minimum that is required for your application to function.

Backup retention periods should be set to a period that is a balance on cost and limiting risk.

When handling sensitive data between servers, please consider using a private LAN to isolate the private side network from the shared network.

Opening up ports to allow connections from the public internet is generally to be avoided. You should restrict access to IP addresses or ranges that are explicitly required where possible.

DB security groups should include a description for auditing purposes.

Simplifies auditing, debugging, and managing db security groups.

When handling sensitive data between servers, please consider using a private LAN to isolate the private side network from the shared network.

Opening up ports to allow connections from the public internet is generally to be avoided. You should restrict access to IP addresses or ranges that are explicitly required where possible.

NAS security groups should include a description for auditing purposes.

Simplifies auditing, debugging, and managing nas security groups.

Need to add a security group to your router.

When handling sensitive data between servers, please consider using a private LAN to isolate the private side network from the shared network.

Need to add a security group to your vpnGateway.

When handling sensitive data between servers, please consider using a private LAN to isolate the private side network from the shared network.

You should not use outdated/insecure TLS versions for encryption. You should be using TLS v1.2+.

Plain HTTP is unencrypted and human-readable. This means that if a malicious actor was to eavesdrop on your connection, they would be able to see all of your data flowing back and forth.

You should use HTTPS, which is HTTP over an encrypted (TLS) connection, meaning eavesdroppers cannot read your traffic.

E2E Networks nodes should have accidental protection enabled to guard against unintended deletion or modification of compute instances.

E2E Networks nodes should run with compliance mode enabled so required security controls are enforced and workload activity remains auditable.

E2E Networks nodes should have disk encryption enabled so data stored on node volumes and snapshots is protected at rest.

E2E Networks nodes should not be assigned a public IP address, keeping compute instances off the public internet unless inbound access is explicitly required.

E2E Networks nodes should not be running in rescue mode, which grants elevated filesystem access and can bypass normal operating controls.

E2E Networks nodes should be attached to a VPC so their traffic benefits from network isolation and segmentation controls.

ObjectStorage access keys should have an explicit expiration date. Long-lived credentials increase the blast radius of a credential compromise because they cannot expire on their own. Setting an expiration date enforces periodic rotation and limits the exposure window if a key is leaked.