Skip to content

Commit 2bdb9bc

Browse files
tyler-dunkeltyler-dunkel
authored
Merge pull request #121 from cloudgraphdev/feature/CG-1304-GCP-CIS-130-412
Feature/cg 1304 gcp cis 130 412
2 parents 85ea563 + b718845 commit 2bdb9bc

3 files changed

Lines changed: 249 additions & 0 deletions

File tree

‎src/gcp/cis-1.3.0/README.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -106,6 +106,7 @@ Policy Pack based on the GCP Foundations 1.3.0 benchmark provided by the [Center
106106
| GCP CIS 4.9 | Ensure that Compute instances do not have public IP addresses |
107107
| GCP CIS 4.10 | In order to maintain the highest level of security all connections to an application should be secure by default |
108108
| GCP CIS 4.11 | Ensure that Compute instances have Confidential Computing enabled |
109+
| GCP CIS 4.12 | Ensure the Latest Operating System Updates Are Installed On Your Virtual Machines in All Projects |
109110
| GCP CIS 5.1 | Ensure that Cloud Storage bucket is not anonymously or publicly accessible |
110111
| GCP CIS 5.2 | Ensure that Cloud Storage buckets have uniform bucket-level access enabled |
111112
| GCP CIS 6.1.1 | Ensure that a MySQL database instance does not allow anyone to connect with administrative privileges |

‎src/gcp/cis-1.3.0/rules/gcp-cis-1.3.0-4.12.ts‎

Lines changed: 246 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,246 @@
1+
export default {
2+
id: 'gcp-cis-1.3.0-4.12',
3+
title:
4+
'GCP CIS 4.12 Ensure the Latest Operating System Updates Are Installed On Your Virtual Machines in All Projects',
5+
description: `For the virtual machines where you manage the operating system in Infrastructure as a
6+
Service (IaaS), you are responsible for keeping these operating systems and programs up to
7+
date. There are multiple ways to manage updates yourself that would be difficult to fit into
8+
one recommendation. Check the CIS Benchmarks for each of your Operating Systems as
9+
well for potential solutions there. In this recommendation we will use a feature in Google
10+
Cloud via its VM manager API to manage updates called Operating System Patch
11+
Management (referred to OS Patch Management from here on out). This may requires
12+
installing the OS Config API if it is not already installed. Also if you install custom operating
13+
systems, they may not functionally support the local OS config agent required to gather
14+
operating system patch information and issue update commands. These update commands
15+
are the default Linux and Windows commands to install updates such as yum or apt. This
16+
feature allows for a central management to issue those commands. OS Patch management
17+
also does not host the updates itself, so your VMs will need to be public or be able to access
18+
the internet. This is not the only Patch Management solution available to your organization
19+
and you should weigh your needs before committing to using this.`,
20+
audit: `**Verifying that VM Manager and related services are installed on your Compute Operating Systems on a project by project basis
21+
22+
Determine if OS Config API is Enabled for the Project**
23+
24+
1. Navigate into a project. In the expanded hamburger menu located at the top left of the screen hover over "APIs & Services". Then in the menu right of that select "API Libraries"
25+
2. Search for "VM Manager (OS Config API) or scroll down in the left hand column and select the filter labeled "Compute" where it is the last listed. Open this API.
26+
3. Verify the blue button at the top is enabled.
27+
28+
**Determine if VM Instances have correct metadata tags for OSConfig parsing**
29+
30+
1. From the main Google Cloud console, open the hamburger menu in the top left. Mouse over Computer Engine to expand the menu next to it.
31+
2. Under the "Settings" heading, select "Metadata".
32+
3. In this view there will be a list of the project wide metadata tags for VMs. Determine if the tag "enable-osconfig" is set to "true".
33+
34+
**Determine if the Operating System of VM Instances have the local OS-Config Agent running**
35+
36+
There is no way to determine this from the Google Cloud console. The only way is to run
37+
operating specific commands locally inside the operating system via remote connection.
38+
For the sake of brevity of this recommendation please view the docs/troubleshooting/vm-manager/verify-setup
39+
reference at the bottom of the page. If you initialized your VM
40+
instance with a Google Supplied OS Image with a build date of later than v20200114 it will
41+
have the service installed. You should still determine its status for proper operation.
42+
43+
**Verify the service account you have setup for the project in Recommendation 4.1 is running**
44+
45+
1. Go to the *VM instances* page by visiting: https://console.cloud.google.com/compute/instances.
46+
2. Click on each instance name to go to its *VM instance details* page.
47+
3. Under the section *Service Account*, take note of the service account
48+
4. Run the commands locally for your operating system that are located at the docs/troubleshooting/vm-manager/verify-setup#service-account-enabled reference located at the bottom of this page. They should return the name of your service account.
49+
50+
**Determine if Instances can connect to public update hosting**
51+
52+
Linux
53+
Debian Based Operating Systems
54+
55+
sudo apt update
56+
57+
The output should have a numbered list of lines with Hit: URL of updates.
58+
Redhat Based Operating Systems
59+
60+
yum check-update
61+
62+
The output should show a list of packages that have updates available.
63+
Windows
64+
65+
ping http://windowsupdate.microsoft.com/
66+
67+
The ping should successfully be delivered and received.
68+
69+
**Determine if OS Config API is Enabled for the Project**
70+
71+
1. In each project you wish to enable run the following command
72+
73+
gcloud services list
74+
75+
2. If osconfig.googleapis.com is in the left hand column it is enabled for this project.
76+
77+
**Determine if VM Manager is Enabled for the Project**
78+
79+
1. Within the project run the following command:
80+
81+
gcloud compute instances os-inventory describe VM-NAME --zone=ZONE
82+
83+
The output will look like
84+
85+
INSTANCE_ID INSTANCE_NAME OS
86+
OSCONFIG_AGENT_VERSION UPDATE_TIME
87+
29255009728795105 centos7 CentOS Linux 7 (Core)
88+
20210217.00-g1.el7 2021-04-12T22:19:36.559Z
89+
5138980234596718741 rhel-8 Red Hat Enterprise Linux 8.3 (Ootpa)
90+
20210316.00-g1.el8 2021-09-16T17:19:24Z
91+
7127836223366142250 windows Microsoft Windows Server 2019 Datacenter
92+
20210316.00.0+win@1 2021-09-16T17:13:18Z
93+
94+
**Determine if VM Instances have correct metadata tags for OSConfig parsing**
95+
96+
1. Select the project you want to view tagging in.
97+
98+
Google Cloud Console
99+
100+
1. From the main Google Cloud console, open the hamburger menu in the top left. Mouse over Computer Engine to expand the menu next to it.
101+
2. Under the "Settings" heading, select "Metadata".
102+
3. In this view there will be a list of the project wide metadata tags for Vms. Verify a tag of ‘enable-osconfig’ is in this list and it is set to ‘true’.
103+
104+
105+
106+
**From Console:**
107+
1. Go to the *VM instances* page by visiting: https://console.cloud.google.com/compute/instances.
108+
2. Click on the instance name to see its VM instance details page.
109+
3. Ensure that *Confidential VM service* is *Enabled*.
110+
111+
**From Command Line:**
112+
113+
Run the following command to view instance data
114+
115+
gcloud compute instances list --format="table(name,status,tags.list())"
116+
117+
On each instance it should have a tag of ‘enable-osconfig’ set to ‘true’
118+
119+
**Determine if the Operating System of VM Instances have the local OS-Config Agent running**
120+
121+
There is no way to determine this from the Google Cloud CLI. The best way is to run the the
122+
commands inside the operating system located at 'Check OS-Config agent is installed and
123+
running' at the /docs/troubleshooting/vm-manager/verify-setup reference at the bottom
124+
of the page. If you initialized your VM instance with a Google Supplied OS Image with a
125+
build date of later than v20200114 it will have the service installed. You should still
126+
determine its status.
127+
128+
**Verify the service account you have setup for the project in Recommendation 4.1 is running**
129+
130+
1. Go to the *VM instances* page by visiting: https://console.cloud.google.com/compute/instances.
131+
2. Click on each instance name to go to its VM *instance details* page.
132+
3. Under the section *Service Account*, take note of the service account
133+
4. View the compute/docs/troubleshooting/vm-manager/verify-setup#service-account-enabled resource at the bottom of the page for operating system specific commands to run locally.
134+
135+
**Determine if Instances can connect to public update hosting**
136+
137+
Linux
138+
Debian Based Operating Systems
139+
140+
sudo apt update
141+
142+
The output should have a numbered list of lines with Hit: URL of updates.
143+
Redhat Based Operating Systems
144+
145+
yum check-update
146+
147+
The output should show a list of packages that have updates available.
148+
Windows
149+
150+
ping http://windowsupdate.microsoft.com/
151+
152+
The ping should successfully be delivered and received.
153+
`,
154+
rationale: 'Keeping an operating system up to date is the best way to secure against ever evolving known vulnerabilities and bugs in programs that can be used in cyber attacks by bad actors.',
155+
remediation: `**Enabling OS Patch Management on a Project by Project Basis
156+
157+
Install OS Config API for the Project**
158+
159+
1. Navigate into a project. In the expanded hamburger menu located at the top left of the screen hover over "APIs & Services". Then in the menu right of that select "API Libraries"
160+
2. Search for "VM Manager (OS Config API) or scroll down in the left hand column and select the filter labeled "Compute" where it is the last listed. Open this API.
161+
3. Click the blue 'Enable' button.
162+
163+
**Add MetaData Tags for OSConfig Parsing**
164+
165+
1. From the main Google Cloud console, open the hamburger menu in the top left. Mouse over Computer Engine to expand the menu next to it.
166+
2. Under the "Settings" heading, select "Metadata".
167+
3. In this view there will be a list of the project wide metadata tags for VMs. Click edit and 'add item' in the key column type 'enable-osconfig' and in the value column set it to 'true'.
168+
169+
**From Command Line:**
170+
171+
1. For project wide tagging, run the following command
172+
173+
gcloud compute project-info add-metadata \
174+
--project <PROJECT_ID>\
175+
--metadata=enable-osconfig=TRUE
176+
177+
Please see the reference /compute/docs/troubleshooting/vm-manager/verify- setup#metadata-enabled at the bottom for more options like instance specific tagging. Note: Adding a new tag via commandline may overwrite existing tags. You will need to do this at a time of low usage for the least impact.
178+
179+
**Install and Start the Local OSConfig for Data Parsing**
180+
181+
There is no way to centrally manage or start the Local OSConfig agent. Please view the reference of manage-os#agent-install to view specific operating system commands.
182+
183+
**Setup a project wide Service Account**
184+
185+
Please view Recommendation 4.1 to view how to setup a service account. Rerun the audit procedure to test if it has taken effect.
186+
187+
**Enable NAT or Configure Private Google Access to allow Access to Public Update Hosting**
188+
189+
For the sake of brevity, please see the attached resources to enable NAT or Private Google Access. Rerun the audit procedure to test if it has taken effect.
190+
191+
**Install OS Config API for the Project**
192+
193+
1. In each project you wish to audit run gcloud services enable osconfig.googleapis.com
194+
195+
**Install and Start the Local OSConfig for Data Parsing**
196+
197+
Please view the reference of manage-os#agent-install to view specific operating system commands.
198+
199+
**Setup a project wide Service Account**
200+
201+
Please view Recommendation 4.1 to view how to setup a service account. Rerun the audit procedure to test if it has taken effect.
202+
203+
**Enable NAT or Configure Private Google Access to allow Access to Public Update Hosting**
204+
205+
For the sake of brevity, please see the attached resources to enable NAT or Private Google Access. Rerun the audit procedure to test if it has taken effect.
206+
Determine if Instances can connect to public update hosting
207+
Linux
208+
Debian Based Operating Systems
209+
210+
sudo apt update
211+
212+
The output should have a numbered list of lines with Hit: URL of updates.
213+
Redhat Based Operating Systems
214+
215+
yum check-update
216+
217+
The output should show a list of packages that have updates available.
218+
Windows
219+
220+
ping http://windowsupdate.microsoft.com/
221+
222+
The ping should successfully be delivered and received.
223+
224+
**Default Value:**
225+
226+
By default most operating systems and programs do not update themselves. The Google Cloud VM Manager which is a dependency of the OS Patch management feature is installed on Google Built OS images with a build date of v20200114 or later. The VM manager is not enabled in a project by default and will need to be setup.
227+
`,
228+
references: [
229+
'https://cloud.google.com/compute/docs/manage-os',
230+
'https://cloud.google.com/compute/docs/os-patch-management',
231+
'https://cloud.google.com/compute/docs/vm-manager',
232+
'https://cloud.google.com/compute/docs/images/os-details#vm-manager',
233+
'https://cloud.google.com/compute/docs/vm-manager#pricing',
234+
'https://cloud.google.com/compute/docs/troubleshooting/vm-manager/verify-setup',
235+
'https://cloud.google.com/compute/docs/instances/view-os-details#view-data-tools',
236+
'https://cloud.google.com/compute/docs/os-patch-management/create-patch-job',
237+
'https://cloud.google.com/nat/docs/set-up-network-address-translation',
238+
'https://cloud.google.com/vpc/docs/configure-private-google-access',
239+
'https://workbench.cisecurity.org/sections/811638/recommendations/1334335',
240+
'https://cloud.google.com/compute/docs/manage-os#agent-install',
241+
'https://cloud.google.com/compute/docs/troubleshooting/vm-manager/verify- setup#service-account-enabled',
242+
'https://cloud.google.com/compute/docs/os-patch-management#use-dashboard',
243+
'https://cloud.google.com/compute/docs/troubleshooting/vm-manager/verify-setup#metadata-enabled',
244+
],
245+
severity: 'unknown',
246+
}

‎src/gcp/cis-1.3.0/rules/index.ts‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -49,6 +49,7 @@ import Gcp_CIS_130_48 from './gcp-cis-1.3.0-4.8'
4949
import Gcp_CIS_130_49 from './gcp-cis-1.3.0-4.9'
5050
import Gcp_CIS_130_410 from './gcp-cis-1.3.0-4.10'
5151
import Gcp_CIS_130_411 from './gcp-cis-1.3.0-4.11'
52+
import Gcp_CIS_130_412 from './gcp-cis-1.3.0-4.12'
5253
import Gcp_CIS_130_611 from './gcp-cis-1.3.0-6.1.1'
5354
import Gcp_CIS_130_612 from './gcp-cis-1.3.0-6.1.2'
5455
import Gcp_CIS_130_613 from './gcp-cis-1.3.0-6.1.3'
@@ -129,6 +130,7 @@ export default [
129130
Gcp_CIS_130_49,
130131
Gcp_CIS_130_410,
131132
Gcp_CIS_130_411,
133+
Gcp_CIS_130_412,
132134
Gcp_CIS_130_611,
133135
Gcp_CIS_130_612,
134136
Gcp_CIS_130_613,

0 commit comments

Comments
 (0)