Check VPC peering route tables and restrict access to the minimum.
REMEDIATE EXCESSIVE SECURITY GROUP PERMISIONS
Ty Murphy2018-10-15T17:30:53-05:00
Based on assessment results, guide the user through tightening permissions.
FIND EXCESSIVE SECURITY GROUP PERMISSIONS
Ty Murphy2018-10-15T17:29:51-05:00
Look for security groups that appear to have excessive permissions, such as excessive number of /32 rules.
ENABLE VPS FLOW LOGS
Ty Murphy2018-10-15T17:28:57-05:00
Assess and recommend accounts to enable VPC flow logs.
ASSESS VPC PEERING RISK
Ty Murphy2018-12-19T19:01:48-06:00
Determine what VPCs are peered, which accounts are associated, and identify accounts that aren’t controlled by the enterprise.
REMEDIATE “FLAT” SECURITY GROUPS
Ty Murphy2018-10-15T17:27:06-05:00
Change a flat security group to remove the self referential rule.
IDENTIFY “FLAT” SECURITY GROUPS
Ty Murphy2018-10-15T17:26:14-05:00
Find security groups that allow all local traffic via a self referential rule.
MOVE WEB SERVER BEHIND LOAD BALANCER
Ty Murphy2018-10-15T17:25:23-05:00
Insert a load balancer in front of a web server.
IDENTIFY WEB SERVICES WITHOUT AN ELASTIC LOAD BALANCER
Ty Murphy2018-10-15T17:23:32-05:00
Find anything with port 80 or 443 that is internet facing but not behind an ELB.
LOCK SECURITY GROUP TO CURRENT SETTINGS
Ty Murphy2018-10-15T17:22:21-05:00
Lock a security group to prevent changes.
LOCK DOWN DEFAULT SECURITY GROUPS
Ty Murphy2018-10-15T17:20:42-05:00
Restrict all traffic in the default security group in every VPC.
RESTRICT NETWORK ACCESS TO KNOWN LOCATIONS
Ty Murphy2018-10-15T17:19:48-05:00
Adjust security group settings to only allow access to pre-defined locations.
IDENTIFY INTERNET FACING ADMINISTRATIVE USERS
Ty Murphy2019-08-30T14:21:40-05:00
Find any instances or TCP ELBs with port 22 or RDP open.
IDENTIFY INTERNET FACING ASSETS
Ty Murphy2018-10-15T17:17:27-05:00
Identify all instances and load balancers with Internet access.