How do I gather evidence for CIS GCP Control: 3.9?
edited March 2022 in Compliance & Reporting
I'd like to gather evidence for the following control. How would I do that? None of my "google_compute_ssl_policy" have a profile of "CUSTOM" if that makes it easier.
Control: 3.9 Ensure no HTTPS or SSL proxy load balancers permit SSL policies with weak cipher suites
Per CIS Google Cloud Platform Foundation Benchmark v1.2.0:"Secure Sockets Layer (SSL) policies determine what port Transport Layer Security (TLS) features clients are permitted to use when connecting to load balancers. To prevent usage of insecure features, SSL policies should use (a) at least TLS 1.2 with the MODERN profile; or (b) the RESTRICTED profile, because it effectively requires clients to use TLS 1.2 regardless of the chosen minimum TLS version; or (3) a CUSTOM profile that does not support any of the following features: "
TLS_RSA_WITH_AES_128_GCM_SHA256 TLS_RSA_WITH_AES_256_GCM_SHA384 TLS_RSA_WITH_AES_128_CBC_SHA TLS_RSA_WITH_AES_256_CBC_SHA TLS_RSA_WITH_3DES_EDE_CBC_SHASince none of your ssl policies have a profile of
CUSTOMthat should make the query a bit easier to craft. The following query should find entities that fail the first 2 criteria (a and b):
FIND google_compute_ssl_policy with profile!="RESTRICTED" OR (profile!="MODERN" AND minTLsVersion!="TLS_1_2" ) THAT HAS (google_compute_target_https_proxy | google_compute_target_ssl_proxy)0
This Month's Leaders
- 336 All Categories
- Featured Categories
- 7 About the AskJ1 Community
- 11 Product Announcements
- From Mission Control
- 1 Rapid Response
- 3 How J1 Uses J1
- 131 Asset Management
- 56 Compliance & Reporting
- 65 Security Operations
- 40 Security Engineering
- 5 Open Source
- 18 News, Careers and More