Checks

Vercel projects are assessed for production deployment protection configuration, which restricts access to the live production deployment by requiring Vercel Authentication or other access controls. When enabled, visitors must authenticate before accessing the production URL, adding a layer of defense for internal applications or projects that should not be publicly accessible.

MongoDB Atlas projects with database auditing capture database operations and administrative events. The evaluation looks for an active audit configuration and, when present, notes any configured audit_filter that scopes which events are recorded.

Vercel projects are assessed for skew protection, which ensures clients always communicate with the correct deployment version during rollouts. Without it, clients may fetch assets or call APIs against a different version than the one that served the initial page, causing hydration errors or broken functionality.

MongoDB Atlas project network access list configuration is evaluated for entries that allow access from anywhere (0.0.0.0/0, ::/0, 0.0.0.0, ::) or for missing access lists, instead of restricting connections to specific IPs or CIDRs.

Microsoft Purview tenant setting for audit log search is assessed to confirm unified audit log ingestion (UnifiedAuditLogIngestionEnabled), which records user and admin activities and makes them searchable.

Alibaba Cloud RAM access keys provide programmatic access to an account. The root account is the most privileged user and should not have access keys. All root access keys should be removed to limit compromise vectors and encourage role-based accounts following the principle of least privilege.

Alibaba Cloud RAM password policies can be used to enforce password complexity requirements. It is recommended that the password policy require at least one lowercase letter to increase the character diversity of passwords. This enhances account resiliency against brute force logon attempts and dictionary attacks.

Alibaba Cloud RAM password policies can temporarily block logon after several incorrect logon attempts within an hour. It is recommended that the password policy is set to temporarily block logon after 5 incorrect logon attempts within an hour to protect accounts against automated brute force logon attempts and credential stuffing attacks.

Alibaba Cloud RAM password policies can require passwords to expire after a given number of days. It is recommended to expire passwords after 365 days or less for periodic credential rotation. The CIS benchmark recommends an annual reset as a balanced approach that avoids overly frequent changes while ensuring compromised credentials have a limited lifespan.

Alibaba Cloud RAM password policies can be used to enforce password complexity requirements. It is recommended that the password policy require a minimum of 14 or greater characters for any password. Longer passwords provide exponentially more security against automated password cracking, as the keyspace increases dramatically with each additional character.

Alibaba Cloud RAM password policies can be used to enforce password complexity requirements. It is recommended that the password policy require at least one numeric character to increase the character diversity of passwords. This enhances account resiliency against brute force logon attempts and dictionary attacks by expanding the keyspace.

Alibaba Cloud RAM password policies can be configured to prevent the reuse of previously used passwords. It is recommended that the password policy prevent the reuse of passwords to ensure users cannot cycle back to previously compromised credentials. This increases account resiliency against brute force logon attempts and reduces the risk of credential reuse attacks.

Alibaba Cloud RAM password policies can be used to enforce password complexity requirements. It is recommended that the password policy require at least one special character (symbol) to increase the character diversity of passwords. Special characters significantly increase the keyspace that attackers must search, enhancing account resiliency against brute force logon attempts.

Alibaba Cloud RAM password policies can be used to enforce password complexity requirements. It is recommended that the password policy require at least one uppercase letter to increase the character diversity of passwords. This enhances account resiliency against brute force logon attempts and dictionary attacks by requiring mixed-case passwords.

Alibaba Cloud RAM users, groups, and roles have no access by default. RAM policies grant privileges to these principals. It is recommended to apply policies to groups and roles rather than individual users, simplifying access management and reducing unintended permissions as the number of users grows.

Alibaba Cloud RAM policies grant permissions to users, groups, or roles. Follow the principle of least privilege by granting only required permissions. Policies with "Effect": "Allow", "Action": "*", and "Resource": "*" should be avoided as they grant full administrative access to all resources.

Alibaba Cloud RAM access keys consist of an access key ID and a secret, which are used to sign programmatic requests. RAM users need their own access keys to make programmatic calls from SDKs, CLIs, or direct API calls. It is recommended that all access keys be regularly rotated every 90 days or less to reduce the window of opportunity for compromised keys to be used.

Alibaba Cloud RAM users can log on to the console by using their username and password. If a user has not logged on for 90 days or longer, it is recommended to disable the console access of the user. Disabling unused console access reduces the attack surface by removing unnecessary logon capabilities from potentially abandoned or dormant accounts.

Alibaba Cloud RAM supports MFA, adding protection on top of username and password. With MFA enabled, console logon requires an authentication code from a virtual MFA device after entering credentials. MFA should be enabled for all RAM users with console passwords to strengthen account security.

RBAC ClusterRoleBindings that bind to the cluster-admin ClusterRole are identified, showing where subjects receive super-user permissions across all namespaces.

RBAC assignments that grant update or patch on the certificatesigningrequests/approval subresource to users or groups via cluster-wide roles and bindings.

This highlights principals allowed to approve CSRs based on permissions defined in referenced ClusterRoles.

RBAC permissions to the nodes/proxy subresource are analyzed. Any user or group granted get, list, or watch via cluster-wide bindings is reported.

Kubernetes RBAC Roles and ClusterRoles that grant the create verb on pods are identified.

Rules are examined to find permissions allowing pod creation at namespace or cluster scope.

Kubernetes RBAC mapping of users or groups with the create verb on persistentvolumes through ClusterRoleBindings.

Shows which principals can provision PersistentVolumes cluster-wide.