@cyberstrike-io/cyberstrike 1.1.9 → 1.1.10-beta.1

package/skill/CIS_benchmarks/AWS/CIS_AWS_Compute_Services_Benchmark_v1.1.0/cis-aws-compute-16.1/SKILL.md

@@ -0,0 +1,72 @@
+---
+name: cis-aws-compute-16.1
+description: "Ensure communications between your applications and clients is encrypted"
+category: cis-compute
+version: "1.1.0"
+author: cyberstrike-official
+tags: [cis, aws, compute, simspace-weaver, encryption, tls, communication]
+cis_id: "16.1"
+cis_benchmark: "CIS AWS Compute Services Benchmark v1.1.0"
+tech_stack: [aws]
+cwe_ids: []
+chains_with: []
+prerequisites: []
+severity_boost: {}
+---
+
+# 16.1 Ensure communications between your applications and clients is encrypted (Manual)
+
+## Description
+
+SimSpace Weaver doesn't manage communications between your apps and the clients.
+
+## Rationale
+
+Be sure to implement some form of authentication and encryption for all client sessions while using SimSpace Weaver.
+
+## Impact
+
+N/A
+
+## Audit Procedure
+
+### Using AWS Console
+
+There is no setting for encryption setup for your clients and applications within SimSpace Weaver service. For this audit you have to confirm that the communication is configured in the app and the client with encryption to protect that traffic.
+
+### Using AWS CLI
+
+N/A - This control is manual. There are no AWS CLI commands specific to SimSpace Weaver encryption settings as the encryption must be configured at the application/client level.
+
+## Expected Result
+
+Communications between applications and clients running inside SimSpace Weaver are configured with encryption (e.g., TLS) to protect traffic.
+
+## Remediation
+
+### Using AWS Console
+
+Confirm that the communication you have configured between your application and clients that run inside of SimSpace Weaver are encrypted.
+
+### Using AWS CLI
+
+N/A - Remediation is application-level and not managed through AWS CLI.
+
+## Default Value
+
+SimSpace Weaver does not manage or enforce encryption between applications and clients by default. This is the responsibility of the application developer.
+
+## References
+
+1. https://docs.aws.amazon.com/simspaceweaver/latest/userguide/security_best-practices.html
+
+## CIS Controls
+
+| Controls Version | Control                                           | IG 1 | IG 2 | IG 3 |
+| ---------------- | ------------------------------------------------- | ---- | ---- | ---- |
+| v8               | 3.10 Encrypt Sensitive Data in Transit            |      | X    | X    |
+| v7               | 14.4 Encrypt All Sensitive Information in Transit |      | X    | X    |
+
+## Profile
+
+Level 1 | Manual

package/skill/CIS_benchmarks/AWS/CIS_AWS_Compute_Services_Benchmark_v1.1.0/cis-aws-compute-2.1.1/SKILL.md

@@ -0,0 +1,104 @@
+---
+name: cis-aws-compute-2.1.1
+description: "Ensure Consistent Naming Convention is used for Organizational AMI"
+category: cis-compute
+version: "1.1.0"
+author: cyberstrike-official
+tags: [cis, aws, compute, ec2, ami, naming-convention, inventory]
+cis_id: "2.1.1"
+cis_benchmark: "CIS AWS Compute Services Benchmark v1.1.0"
+tech_stack: [aws]
+cwe_ids: []
+chains_with: [cis-aws-compute-2.1.2, cis-aws-compute-2.1.3]
+prerequisites: []
+severity_boost: {}
+---
+
+# Ensure Consistent Naming Convention is used for Organizational AMI
+
+## Description
+
+The naming convention for AMI (Amazon Machine Images) should be documented and followed for any AMI's created.
+
+## Rationale
+
+The majority of AWS resources can be named and tagged. Most organizations have already created standardize naming conventions, and have existing rules in effect. They simply need to extend that for all AWS cloud resources to include Amazon Machine Images (AMI).
+
+## Impact
+
+No significant operational impact. This is an organizational best practice that improves manageability and consistency of AMI resources.
+
+## Audit Procedure
+
+### Using AWS CLI
+
+1. Run aws ec2 describe-images.
+
+```bash
+aws ec2 describe-images --owner self --region us-west-2
+```
+
+2. Review the list of AMIs.
+3. Confirm that the AMI Name matches the organizational image naming policy.
+
+If any of the AMI Name's do not match the Organization policy refer to the remediation below.
+
+### Using AWS Console
+
+1. Login to the EC2 console at https://console.aws.amazon.com/ec2/.
+2. In the left pane, under `Images`, click `AMIs`.
+3. Review the list of AMIs.
+4. Confirm that the AMI Name matches the organizational image naming policy.
+
+## Expected Result
+
+All AMI names should follow the organization's documented naming convention. The output of describe-images should show AMIs with consistent, policy-compliant names.
+
+## Remediation
+
+### Using AWS CLI
+
+No specific CLI remediation command is provided. Use the console method to copy and rename AMIs that do not comply with the naming policy.
+
+### Using AWS Console
+
+1. Login to the EC2 console at https://console.aws.amazon.com/ec2/.
+2. In the left pane click `Images`, click `AMIs`.
+3. Select the AMI that does not comply to the naming policy.
+4. Click on `Actions`.
+5. Click on `Copy AMI`.
+
+```
+Destination region - Select the region the AMI is in.
+Name - `Enter the new Name`
+Description - `Enter the new description`
+Encryption - `Select` if it matches your image policy
+```
+
+6. Click on Copy AMI
+
+Once the AMI has finished copying:
+
+7. Select the AMI that does not comply to the naming policy.
+8. Click on `Actions`.
+9. Click on `Deregister`.
+
+## Default Value
+
+AWS does not enforce any default naming convention for AMIs.
+
+## References
+
+1. https://awscli.amazonaws.com/v2/documentation/api/latest/reference/ec2/describe-images.html
+2. https://docs.aws.amazon.com/AWSEC2/latest/WindowsGuide/AMIs.html
+
+## CIS Controls
+
+| Controls Version | Control                                                        | IG 1 | IG 2 | IG 3 |
+| ---------------- | -------------------------------------------------------------- | ---- | ---- | ---- |
+| v8               | 1.1 Establish and Maintain Detailed Enterprise Asset Inventory | x    | x    | x    |
+| v7               | 1.4 Maintain Detailed Asset Inventory                          | x    | x    | x    |
+
+## Profile
+
+Level 1 | Manual

package/skill/CIS_benchmarks/AWS/CIS_AWS_Compute_Services_Benchmark_v1.1.0/cis-aws-compute-2.1.2/SKILL.md

@@ -0,0 +1,118 @@
+---
+name: cis-aws-compute-2.1.2
+description: "Ensure Amazon Machine Images (AMIs) are encrypted"
+category: cis-compute
+version: "1.1.0"
+author: cyberstrike-official
+tags: [cis, aws, compute, ec2, ami, encryption, ebs]
+cis_id: "2.1.2"
+cis_benchmark: "CIS AWS Compute Services Benchmark v1.1.0"
+tech_stack: [aws]
+cwe_ids: []
+chains_with: [cis-aws-compute-2.1.1, cis-aws-compute-2.2.1, cis-aws-compute-2.2.3]
+prerequisites: []
+severity_boost: {}
+---
+
+# Ensure Amazon Machine Images (AMIs) are encrypted
+
+## Description
+
+Amazon Machine Images should utilize EBS Encrypted snapshots.
+
+## Rationale
+
+AMIs backed by EBS snapshots should use EBS encryption. Snapshot volumes can be encrypted and attached to an AMI.
+
+## Impact
+
+Encrypting AMIs may add slight overhead to instance launch times and requires KMS key management. Existing unencrypted AMIs must be copied with encryption enabled and old ones deregistered.
+
+## Audit Procedure
+
+### Using AWS CLI
+
+1. Run the aws ec2 describe-images command to find unencrypted AMIs:
+
+```bash
+aws ec2 describe-images --region us-east-1 --owner self --filter "Name=block-device-mapping.encrypted,Values=false" --query "Images[*].[ImageId]"
+```
+
+2. If this produces a list of AMI's make note as these are not encrypted, then refer to the remediation below.
+
+### Using AWS Console
+
+1. Login to the IAM console at https://console.aws.amazon.com/ec2/.
+2. In the left pane click `Instances`, click `AMIs`.
+3. In the `Details` tab.
+4. Review the 'Block Devices'.
+5. Confirm that it ends with `encrypted`.
+
+If it doesn't end with encrypted, refer to the remediation below.
+
+## Expected Result
+
+The CLI command should return an empty list, indicating all AMIs use encrypted EBS snapshots. In the console, all AMI block devices should show as `encrypted`.
+
+## Remediation
+
+### Using AWS CLI
+
+1. Run the aws ec2 copy-image command to copy AMI with encrypted block device:
+
+```bash
+aws ec2 copy-image --name <New_AMI_Name> --source-image-id <Image-ID> --source-region <region> --encrypted
+```
+
+2. Run aws ec2 deregister-image to deregister older AMIs:
+
+```bash
+aws ec2 deregister-image --image-id <Image-ID>
+```
+
+### Using AWS Console
+
+1. Login to the EC2 console at https://console.aws.amazon.com/ec2/.
+2. In the left pane click on `AMIs`.
+3. Select the AMI that does not comply to the encryption policy.
+4. Click on `Actions`.
+5. Click on `Copy AMI`.
+
+```
+Destination region - `Select the region the AMI is in`.
+Name - `Enter the new Name`
+Description - `Enter the new description`
+Encryption - `Select` Encrypt target EBS snapshots
+```
+
+6. Click on Copy AMI.
+
+Once the AMI has finished copying:
+
+7. Select the AMI that does not have encrypted EBS snapshots.
+8. Click on `Actions`.
+9. Click on `Deregister`.
+
+## Default Value
+
+By default, AMIs are not encrypted. EBS encryption must be explicitly enabled when creating or copying AMIs.
+
+## References
+
+1. https://aws.amazon.com/premiumsupport/knowledge-center/view-ami-snapshot-encryption-details/
+2. https://docs.aws.amazon.com/AWSEC2/latest/WindowsGuide/AMIEncryption.html
+3. https://docs.aws.amazon.com/cli/latest/reference/ec2/copy-image.html
+4. https://docs.aws.amazon.com/cli/latest/reference/ec2/deregister-image.html
+5. https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DeregisterImage.html
+6. https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CopyImage.html
+
+## CIS Controls
+
+| Controls Version | Control                                    | IG 1 | IG 2 | IG 3 |
+| ---------------- | ------------------------------------------ | ---- | ---- | ---- |
+| v8               | 3.11 Encrypt Sensitive Data at Rest        |      | x    | x    |
+| v7               | 14.8 Encrypt Sensitive Information at Rest |      |      | x    |
+
+## Profile
+
+Level 1 | Automated

package/skill/CIS_benchmarks/AWS/CIS_AWS_Compute_Services_Benchmark_v1.1.0/cis-aws-compute-2.1.3/SKILL.md

@@ -0,0 +1,119 @@
+---
+name: cis-aws-compute-2.1.3
+description: "Ensure Only Approved Amazon Machine Images (AMIs) are Used"
+category: cis-compute
+version: "1.1.0"
+author: cyberstrike-official
+tags: [cis, aws, compute, ec2, ami, approved-images, inventory]
+cis_id: "2.1.3"
+cis_benchmark: "CIS AWS Compute Services Benchmark v1.1.0"
+tech_stack: [aws]
+cwe_ids: []
+chains_with: [cis-aws-compute-2.1.1, cis-aws-compute-2.1.4, cis-aws-compute-2.1.5]
+prerequisites: []
+severity_boost: {}
+---
+
+# Ensure Only Approved Amazon Machine Images (AMIs) are Used
+
+## Description
+
+Ensure that all base AMIs utilized are approved for use by your organization.
+
+## Rationale
+
+An approved AMI is a base EC2 machine image that is a pre-configured OS configured to run your application. Using approved AMIs helps enforce consistency and security.
+
+## Impact
+
+Instances running on unapproved AMIs may need to be replaced with instances built from approved AMIs, which could cause temporary service disruption.
+
+## Audit Procedure
+
+### Using AWS CLI
+
+No specific CLI audit command is provided for this control. Use the console method to manually verify AMI approval status.
+
+### Using AWS Console
+
+1. Login to the EC2 console at https://console.aws.amazon.com/ec2/.
+2. In the left pane click on `Images`.
+3. Then choose `AMIs`.
+4. Confirm that `Owned by me` is selected.
+5. Review the list of AMIs.
+6. Confirm that the AMIs listed are all approved for use.
+7. In the left pane click on `Instances`.
+8. Then choose `Instances`.
+9. Select the EC2 instance for review.
+10. In the Details tab review:
+
+```
+AMI Name
+AMI location
+```
+
+11. Confirm that the AMI name matches an approved AMI and the AMI location is within your account.
+12. Repeat steps 9 - 11 to verify the AMI is approved.
+
+Repeat the process for all other regions.
+If any of the AMIs are not approved refer to the remediation below.
+
+## Expected Result
+
+All EC2 instances should be running on organization-approved AMIs. The AMI Name and AMI location should match entries in the organization's approved AMI list.
+
+## Remediation
+
+### Using AWS CLI
+
+No specific CLI remediation command is provided. Use the console method below.
+
+### Using AWS Console
+
+**Remove unauthorized AMIs:**
+
+1. Login to the EC2 console at https://console.aws.amazon.com/ec2/.
+2. In the left pane click on `Images`.
+3. Then choose `AMIs`.
+4. Confirm that `Owned by me` is selected.
+5. Review the list of AMIs.
+6. Confirm that the AMIs listed are all approved for use.
+7. If an AMI is listed that is not approved select it.
+8. Click on `Actions` and choose `Deregister`.
+
+**After all unauthorized AMIs have been De-registered review all EC2 instances:**
+
+1. Click on `Instances`.
+2. Then choose `Instances`.
+3. Select the `EC2 instance` for review.
+4. In the `Details` tab review:
+
+```
+AMI Name
+AMI location
+```
+
+5. If this information is listed as not available this instance was built with an unauthorized AMI.
+6. Follow organization steps to secure this instance and replace it with an instance built from an approved AMI if applicable.
+7. Repeat steps 3 - 6 to verify all instance have been created with approved AMIs.
+
+Repeat the process for all other regions.
+
+## Default Value
+
+AWS does not enforce any default AMI approval process. Any AMI can be used to launch instances.
+
+## References
+
+No specific references provided in the benchmark for this control.
+
+## CIS Controls
+
+| Controls Version | Control                                                        | IG 1 | IG 2 | IG 3 |
+| ---------------- | -------------------------------------------------------------- | ---- | ---- | ---- |
+| v8               | 1.1 Establish and Maintain Detailed Enterprise Asset Inventory | x    | x    | x    |
+| v7               | 1.4 Maintain Detailed Asset Inventory                          | x    | x    | x    |
+
+## Profile
+
+Level 1 | Manual

package/skill/CIS_benchmarks/AWS/CIS_AWS_Compute_Services_Benchmark_v1.1.0/cis-aws-compute-2.1.4/SKILL.md

@@ -0,0 +1,104 @@
+---
+name: cis-aws-compute-2.1.4
+description: "Ensure Images (AMI) are not older than 90 days"
+category: cis-compute
+version: "1.1.0"
+author: cyberstrike-official
+tags: [cis, aws, compute, ec2, ami, age, patching, lifecycle]
+cis_id: "2.1.4"
+cis_benchmark: "CIS AWS Compute Services Benchmark v1.1.0"
+tech_stack: [aws]
+cwe_ids: []
+chains_with: [cis-aws-compute-2.1.3, cis-aws-compute-2.5]
+prerequisites: []
+severity_boost: {}
+---
+
+# Ensure Images (AMI) are not older than 90 days
+
+## Description
+
+Ensure that your AMIs are not older than 90 days.
+
+## Rationale
+
+Using up-to-date AMIs will provide many benefits from OS updates and security patches helping to ensure reliability, security and compliance.
+
+## Impact
+
+Outdated AMIs must be replaced by creating new images from updated instances. This requires a refresh cycle that involves launching instances, applying updates, creating new AMIs, and deregistering old ones.
+
+## Audit Procedure
+
+### Using AWS CLI
+
+Run the aws ec2 describe-images command:
+
+```bash
+aws ec2 describe-images \
+    --region <region> \
+    --image-ids <image-ID>
+```
+
+Look for CreationDate in response.
+If the age of the selected AMI is greater than 90 days, the AMI is considered outdated and it should be updated.
+
+### Using AWS Console
+
+1. Login to the EC2 console at https://console.aws.amazon.com/ec2/.
+2. In the left pane, under `Images`, click `AMIs`.
+3. Select the AMI for review.
+4. Under the `Details` tab.
+5. Review the `Creation date`.
+
+If the age of the selected AMI is greater than 90 days, the AMI is considered outdated and it should be updated.
+
+6. Repeat steps no. 3 - 5 to verify the date of the other approved AMIs available.
+
+Repeat all steps for the other regions.
+
+## Expected Result
+
+All AMIs should have a CreationDate within the last 90 days. Any AMI older than 90 days is considered non-compliant and should be updated.
+
+## Remediation
+
+### Using AWS CLI
+
+No specific CLI remediation command is provided. Follow the console steps below to update AMIs.
+
+### Using AWS Console
+
+1. Login to the EC2 console at https://console.aws.amazon.com/ec2/.
+2. In the left pane, under `Images`, click `AMIs`.
+3. Select the AMI to be updated.
+4. Click on Launch.
+5. Go through the EC2 Instance creation process.
+6. Apply all system, security and application updates that are applicable to the EC2 instance.
+7. Once completed click on `Instance state`, Stop instance.
+8. Click on `Actions, Image and templates, Create image`.
+9. Once the image process has complete return to the AMI list but clicking on `Images, AMIs`.
+10. Select the AMI that is older than 90 days.
+11. Click on `Actions, Deregister`.
+
+Repeat these steps for any other AMIs older than 90 days.
+
+## Default Value
+
+AWS does not enforce any default age limit on AMIs.
+
+## References
+
+1. https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-images.html
+2. https://docs.aws.amazon.com/cli/latest/reference/ec2/deregister-image.html
+
+## CIS Controls
+
+| Controls Version | Control                                               | IG 1 | IG 2 | IG 3 |
+| ---------------- | ----------------------------------------------------- | ---- | ---- | ---- |
+| v8               | 2.2 Ensure Authorized Software is Currently Supported | x    | x    | x    |
+| v7               | 2.2 Ensure Software is Supported by Vendor            | x    | x    | x    |
+
+## Profile
+
+Level 1 | Automated

package/skill/CIS_benchmarks/AWS/CIS_AWS_Compute_Services_Benchmark_v1.1.0/cis-aws-compute-2.1.5/SKILL.md

@@ -0,0 +1,85 @@
+---
+name: cis-aws-compute-2.1.5
+description: "Ensure Images are not Publicly Available"
+category: cis-compute
+version: "1.1.0"
+author: cyberstrike-official
+tags: [cis, aws, compute, ec2, ami, public-access, permissions]
+cis_id: "2.1.5"
+cis_benchmark: "CIS AWS Compute Services Benchmark v1.1.0"
+tech_stack: [aws]
+cwe_ids: []
+chains_with: [cis-aws-compute-2.1.3, cis-aws-compute-2.2.2]
+prerequisites: []
+severity_boost: {}
+---
+
+# Ensure Images are not Publicly Available
+
+## Description
+
+EC2 allows you to make an AMI public, sharing it with all AWS accounts.
+
+## Rationale
+
+Publicly sharing an AMI with all AWS accounts could expose organizational data and configuration information.
+
+## Impact
+
+Making an AMI private may affect other AWS accounts that depend on it. Ensure shared accounts are explicitly added if needed.
+
+## Audit Procedure
+
+### Using AWS CLI
+
+No specific CLI audit command is provided for this control. Use the console method below.
+
+### Using AWS Console
+
+1. Login to the EC2 console at https://console.aws.amazon.com/ec2/.
+2. In the left pane, under `Images`, click `AMIs`.
+3. Confirm the `Owned by me` is set.
+4. Select the AMI from the list.
+5. Click on the `Permissions` Tab.
+6. If this reads `This image is currently Public`, please refer to the remediation below.
+
+## Expected Result
+
+All AMIs should have their permissions set to Private. No AMI should display "This image is currently Public" in the Permissions tab.
+
+## Remediation
+
+### Using AWS CLI
+
+No specific CLI remediation command is provided for this control. Use the console method below.
+
+### Using AWS Console
+
+1. Login to the EC2 console at https://console.aws.amazon.com/ec2/.
+2. In the left pane, under `Images`, click `AMIs`.
+3. Confirm the `Owned by me` is set.
+4. Select the AMI from the list.
+5. Click on the `Permissions` Tab.
+6. Click on `Edit`.
+7. Click on the radio button `Private`.
+
+Add AWS Account Number if you have a need to share with other Internal AWS accounts that your Organization owns.
+
+## Default Value
+
+By default, AMIs are private when created. They must be explicitly made public.
+
+## References
+
+1. https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/sharing-amis.html
+
+## CIS Controls
+
+| Controls Version | Control                          | IG 1 | IG 2 | IG 3 |
+| ---------------- | -------------------------------- | ---- | ---- | ---- |
+| v8               | 11.3 Protect Recovery Data       | x    | x    | x    |
+| v7               | 5.3 Securely Store Master Images |      | x    | x    |
+
+## Profile
+
+Level 1 | Manual