Benchmark: 3.13.2 Employ architectural designs, software development techniques, and systems engineering principles that promote effective information security within organizational systems
Description
Organizations apply systems security engineering principles to new development systems or systems undergoing major upgrades. For legacy systems, organizations apply systems security engineering principles to system upgrades and modifications to the extent feasible, given the current state of hardware, software, and firmware components within those systems. The application of systems security engineering concepts and principles helps to develop trustworthy, secure, and resilient systems and system components and reduce the susceptibility of organizations to disruptions, hazards, and threats. Examples of these concepts and principles include developing layered protections; establishing security policies, architecture, and controls as the foundation for design; incorporating security requirements into the system development life cycle; delineating physical and logical security boundaries; ensuring that developers are trained on how to build secure software; and performing threat modeling to identify use cases, threat agents, attack vectors and patterns, design patterns, and compensating controls needed to mitigate risk. Organizations that apply security engineering concepts and principles can facilitate the development of trustworthy, secure systems, system components, and system services; reduce risk to acceptable levels; and make informed risk-management decisions.
Usage
Install the mod:
mkdir dashboardscd dashboardspowerpipe mod initpowerpipe mod install github.com/turbot/steampipe-mod-aws-complianceStart the Powerpipe server:
steampipe service startpowerpipe serverOpen http://localhost:9033 in your browser and select 3.13.2 Employ architectural designs, software development techniques, and systems engineering principles that promote effective information security within organizational systems.
Run this benchmark in your terminal:
powerpipe benchmark run aws_compliance.benchmark.nist_800_171_rev_2_3_13_2Snapshot and share results via Turbot Pipes:
powerpipe benchmark run aws_compliance.benchmark.nist_800_171_rev_2_3_13_2 --shareControls
- ACM certificates should not expire within 30 days
- Auto Scaling groups with a load balancer should use health checks
- Backup plan min frequency and min retention check
- Backup recovery points should be encrypted
- Backup recovery points manual deletion should be disabled
- Backup recovery points should not expire before retention period
- At least one trail should be enabled with security best practices
- DMS replication instances should not be publicly accessible
- DynamoDB table auto scaling should be enabled
- DynamoDB tables should be in a backup plan
- DynamoDB table point-in-time recovery should be enabled
- DynamoDB table should be protected by backup plan
- EBS snapshots should not be publicly restorable
- EBS volumes should be in a backup plan
- EBS volumes should be protected by a backup plan
- EC2 instance should have EBS optimization enabled
- EC2 instances should be in a VPC
- EC2 instances should not have a public IP address
- EC2 instances should be protected by backup plan
- EFS file systems should be in a backup plan
- EFS file systems should be protected by backup plan
- ELB application load balancer deletion protection should be enabled
- ELB classic load balancers should have cross-zone load balancing enabled
- EMR cluster master nodes should not have public IP addresses
- ES domains should be in a VPC
- FSx file system should be protected by backup plan
- Lambda functions concurrent execution limit configured
- Lambda functions should be in a VPC
- Lambda functions should restrict public access
- RDS Aurora clusters should be protected by backup plan
- RDS DB instance backup should be enabled
- RDS DB instances should have deletion protection enabled
- RDS DB instances should be in a backup plan
- RDS DB instance multiple az should be enabled
- RDS DB instances should prohibit public access
- RDS DB instance should be protected by backup plan
- RDS snapshots should prohibit public access
- Redshift clusters should prohibit public access
- S3 bucket cross-region replication should be enabled
- S3 buckets should prohibit public read access
- S3 buckets should prohibit public write access
- S3 public access should be blocked at account level
- SageMaker notebook instances should not have direct internet access
- VPC default security group should not allow inbound and outbound traffic
- VPC security groups should restrict ingress access on ports 20, 21, 22, 3306, 3389, 4333 from 0.0.0.0/0
- VPC security groups should restrict ingress SSH access from 0.0.0.0/0
- VPC security groups should restrict ingress TCP and UDP access from 0.0.0.0/0