cyberstrikeus
- 7.2k skills
- 0 followers
- 2 days ago last updated
- ▌
- ▌ Cis K8S V1111 5 3 2 · cyberstrikeusEnsure that all Namespaces have Network Policies defined (Manual)
- ▌ Cis K8S V1111 5 4 1 · cyberstrikeusPrefer using secrets as files over secrets as environment variables (Manual)
- ▌
- ▌ Cis K8S V1111 5 5 1 · cyberstrikeusConfigure Image Provenance using ImagePolicyWebhook admission controller (Manual)
- ▌ Cis K8S V1111 5 6 1 · cyberstrikeusCreate administrative boundaries between resources using namespaces (Manual)
- ▌ Cis K8S V1111 5 6 2 · cyberstrikeusEnsure that the seccomp profile is set to docker/default in your pod definitions (Manual)
- ▌
- ▌
- ▌ Cis K8S V1120 1 1 1 · cyberstrikeusEnsure that the API server pod specification file permissions are set to 600 or more restrictive (Automated)
- ▌ Cis K8S V1120 1 1 2 · cyberstrikeusEnsure that the API server pod specification file ownership is set to root:root (Automated)
- ▌ Cis K8S V1120 1 1 3 · cyberstrikeusEnsure that the controller manager pod specification file permissions are set to 600 or more restrictive (Automated)
- ▌ Cis K8S V1120 1 1 4 · cyberstrikeusEnsure that the controller manager pod specification file ownership is set to root:root (Automated)
- ▌ Cis K8S V1120 1 1 5 · cyberstrikeusEnsure that the scheduler pod specification file permissions are set to 600 or more restrictive (Automated)
- ▌ Cis K8S V1120 1 1 6 · cyberstrikeusEnsure that the scheduler pod specification file ownership is set to root:root (Automated)
- ▌ Cis K8S V1120 1 1 7 · cyberstrikeusEnsure that the etcd pod specification file permissions are set to 600 or more restrictive (Automated)
- ▌ Cis K8S V1120 1 1 8 · cyberstrikeusEnsure that the etcd pod specification file ownership is set to root:root (Automated)
- ▌ Cis K8S V1120 1 1 9 · cyberstrikeusEnsure that the Container Network Interface file permissions are set to 600 or more restrictive (Manual)
- ▌ Cis K8S V1120 1 2 1 · cyberstrikeusEnsure that the --anonymous-auth argument is set to false (Manual)
- ▌ Cis K8S V1120 1 2 2 · cyberstrikeusEnsure that the --token-auth-file parameter is not set (Automated)
- ▌
- ▌ Cis K8S V1120 1 2 4 · cyberstrikeusEnsure that the --kubelet-client-certificate and --kubelet-client-key arguments are set as appropriate (Automated)
- ▌ Cis K8S V1120 1 2 5 · cyberstrikeusEnsure that the --kubelet-certificate-authority argument is set as appropriate (Automated)
- ▌ Cis K8S V1120 1 2 6 · cyberstrikeusEnsure that the --authorization-mode argument is not set to AlwaysAllow (Automated)
- ▌ Cis K8S V1120 1 2 7 · cyberstrikeusEnsure that the --authorization-mode argument includes Node (Automated)
- ▌ Cis K8S V1120 1 2 8 · cyberstrikeusEnsure that the --authorization-mode argument includes RBAC (Automated)
- ▌ Cis K8S V1120 1 2 9 · cyberstrikeusEnsure that the admission control plugin EventRateLimit is set (Manual)
- ▌ Cis K8S V1120 1 3 1 · cyberstrikeusEnsure that the --terminated-pod-gc-threshold argument is set as appropriate (Manual)
- ▌ Cis K8S V1120 1 3 2 · cyberstrikeusEnsure that the --profiling argument is set to false (Automated)
- ▌ Cis K8S V1120 1 3 3 · cyberstrikeusEnsure that the --use-service-account-credentials argument is set to true (Automated)
- ▌ Cis K8S V1120 1 3 4 · cyberstrikeusEnsure that the --service-account-private-key-file argument is set as appropriate (Automated)
- ▌ Cis K8S V1120 1 3 5 · cyberstrikeusEnsure that the --root-ca-file argument is set as appropriate (Automated)
- ▌ Cis K8S V1120 1 3 6 · cyberstrikeusEnsure that the RotateKubeletServerCertificate argument is set to true (Automated)
- ▌ Cis K8S V1120 1 3 7 · cyberstrikeusEnsure that the --bind-address argument is set to 127.0.0.1 (Automated)
- ▌ Cis K8S V1120 1 4 1 · cyberstrikeusEnsure that the --profiling argument is set to false (Automated)
- ▌ Cis K8S V1120 1 4 2 · cyberstrikeusEnsure that the --bind-address argument is set to 127.0.0.1 (Automated)
- ▌ Cis K8S V1120 3 1 1 · cyberstrikeusClient certificate authentication should not be used for users (Manual)
- ▌ Cis K8S V1120 3 1 2 · cyberstrikeusService account token authentication should not be used for users (Manual)
- ▌ Cis K8S V1120 3 1 3 · cyberstrikeusBootstrap token authentication should not be used for users (Manual)
- ▌
- ▌ Cis K8S V1120 3 2 2 · cyberstrikeusEnsure that the audit policy covers key security concerns (Manual)
- ▌ Cis K8S V1120 4 1 1 · cyberstrikeusEnsure that the kubelet service file permissions are set to 600 or more restrictive (Automated)
- ▌ Cis K8S V1120 4 1 2 · cyberstrikeusEnsure that the kubelet service file ownership is set to root:root (Automated)
- ▌ Cis K8S V1120 4 1 3 · cyberstrikeusIf proxy kubeconfig file exists ensure permissions are set to 600 or more restrictive (Manual)
- ▌ Cis K8S V1120 4 1 4 · cyberstrikeusIf proxy kubeconfig file exists ensure ownership is set to root:root (Manual)
- ▌ Cis K8S V1120 4 1 5 · cyberstrikeusEnsure that the --kubeconfig kubelet.conf file permissions are set to 600 or more restrictive (Automated)
- ▌ Cis K8S V1120 4 1 6 · cyberstrikeusEnsure that the --kubeconfig kubelet.conf file ownership is set to root:root (Automated)
- ▌ T1055 004 Asynchronous Procedure Call · cyberstrikeusAdversaries may inject malicious code into processes via the asynchronous procedure call (APC) queue in order to evade process-based defenses as well as possibly elevate privileges.
- ▌ T1535 Unusedunsupported Cloud Regions · cyberstrikeusAdversaries may create cloud instances in unused geographic service regions in order to evade detection.
- ▌ T1599 001 Network Address Translation Traversal · cyberstrikeusAdversaries may bridge network boundaries by modifying a network device’s Network Address Translation (NAT) configuration.
- ▌ T1666 Modify Cloud Resource Hierarchy · cyberstrikeusAdversaries may attempt to modify hierarchical structures in infrastructure-as-a-service (IaaS) environments in order to evade defenses.
- ▌ T1003 005 Cached Domain Credentials · cyberstrikeusAdversaries may attempt to access cached domain credentials used to allow authentication to occur in the event a domain controller is unavailable.
- ▌ T1556 Modify Authentication Process · cyberstrikeusAdversaries may modify authentication mechanisms and processes to access user credentials or enable otherwise unwarranted access to accounts.
- ▌ T1649 Steal Or Forge Authentication Certificates · cyberstrikeusAdversaries may steal or forge certificates used for authentication to access remote systems or resources.
- ▌ T1071 002 File Transfer Protocols · cyberstrikeusAdversaries may communicate using application layer protocols associated with transferring files to avoid detection/network filtering by blending in with existing traffic.
- ▌ T1219 002 Remote Desktop Software · cyberstrikeusAn adversary may use legitimate desktop support software to establish an interactive command and control channel to target systems within networks.
- ▌ T1573 002 Asymmetric Cryptography · cyberstrikeusAdversaries may employ a known asymmetric encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol.
- ▌ T1583 003 Virtual Private Server · cyberstrikeusAdversaries may rent Virtual Private Servers (VPSs) that can be used during targeting.
- ▌ T1584 003 Virtual Private Server · cyberstrikeusAdversaries may compromise third-party Virtual Private Servers (VPSs) that can be used during targeting.
- ▌ T1591 001 Determine Physical Locations · cyberstrikeusAdversaries may gather the victim's physical location(s) that can be used during targeting.
- ▌ Media Use 03 08 07 Media Use · cyberstrikeusRestrict or prohibit the use of [organization-defined].
- ▌ Archive And Protect Each Software Release Ps 3 Archive And P · cyberstrikeusPreserve software releases in order to help identify, analyze, and eliminate vulnerabilities discovered in the software after release.
- ▌ Provide A Mechanism For Verifying Software Release Integrity · cyberstrikeusHelp software acquirers ensure that the software they acquire is legitimate and has not been tampered with.
- ▌ Ac 16 4 Association Of Attributes By Authorized Individuals · cyberstrikeusProvide the capability to associate [organization-defined] with [organization-defined] by authorized individuals (or processes acting on behalf of ind
- ▌ Ac 18 3 Disable Wireless Networking · cyberstrikeusDisable, when not intended for use, wireless networking capabilities embedded within system components prior to issuance and deployment.
- ▌ Ac 19 1 Use Of Writable And Portable Storage Devices · cyberstrikeusUse of Writable and Portable Storage Devices
- ▌ Ac 2 9 Restrictions On Use Of Shared And Group Accounts · cyberstrikeusOnly permit the use of shared and group accounts that meet [organization-defined].
- ▌
- ▌ Ac 24 2 No User Or Process Identity · cyberstrikeusEnforce access control decisions based on [organization-defined] that do not include the identity of the user or process acting on behalf of the user.
- ▌ Ac 3 6 Protection Of User And System Information · cyberstrikeusProtection of User and System Information
- ▌ Ac 3 4 Discretionary Access Control · cyberstrikeusEnforce [organization-defined] over the set of covered subjects and objects specified in the policy, and where the policy specifies that a subject tha
- ▌ Ac 4 11 Configuration Of Security Or Privacy Policy Filters · cyberstrikeusProvide the capability for privileged administrators to configure [organization-defined] to support different security or privacy policies.
- ▌ Ac 9 4 Additional Logon Information · cyberstrikeusNotify the user, upon successful logon, of the following additional information: [organization-defined].
- ▌ At 3 5 Processing Personally Identifiable Information · cyberstrikeusProvide [organization-defined] with initial and [organization-defined] training in the employment and operation of personally identifiable information
- ▌ Au 1 Policy And Procedures · cyberstrikeusDevelop, document, and disseminate to [organization-defined]: [organization-defined] audit and accountability policy that: Procedures to facilitate th
- ▌ Au 9 5 Dual Authorization · cyberstrikeusEnforce dual authorization for [organization-defined] of [organization-defined].
- ▌ Ca 7 3 Trend Analyses · cyberstrikeusEmploy trend analyses to determine if control implementations, the frequency of continuous monitoring activities, and the types of activities used in
- ▌ Cm 1 Policy And Procedures · cyberstrikeusDevelop, document, and disseminate to [organization-defined]: [organization-defined] configuration management policy that: Procedures to facilitate th
- ▌ Cm 12 Information Location · cyberstrikeusIdentify and document the location of [organization-defined] and the specific system components on which the information is processed and stored;
- ▌ Cm 3 8 Prevent Or Restrict Configuration Changes · cyberstrikeusPrevent or restrict changes to the configuration of the system under the following circumstances: [organization-defined].
- ▌ Cm 5 4 Dual Authorization · cyberstrikeusEnforce dual authorization for implementing changes to [organization-defined].
- ▌ Cp 7 Alternate Processing Site · cyberstrikeusEstablish an alternate processing site, including necessary agreements to permit the transfer and resumption of [organization-defined] for essentia...
- ▌ Ir 6 2 Vulnerabilities Related To Incidents · cyberstrikeusReport system vulnerabilities associated with reported incidents to [organization-defined].
- ▌ Ir 6 3 Supply Chain Coordination · cyberstrikeusProvide incident information to the provider of the product or service and other organizations involved in the supply chain or supply chain governance
- ▌ Ir 7 Incident Response Assistance · cyberstrikeusProvide an incident response support resource, integral to the organizational incident response capability, that offers advice and assistance to users
- ▌ Ir 7 2 Coordination With External Providers · cyberstrikeusEstablish a direct, cooperative relationship between its incident response capability and external providers of system protection capability;
- ▌ Ma 4 4 Authentication And Separation Of Maintenance Sessions · cyberstrikeusProtect nonlocal maintenance sessions by: Employing [organization-defined] ; and Separating the maintenance sessions from other network sessions with
- ▌ Ma 6 3 Automated Support For Predictive Maintenance · cyberstrikeusTransfer predictive maintenance data to a maintenance management system using [organization-defined].
- ▌ Mp 6 8 Remote Purging Or Wiping Of Information · cyberstrikeusProvide the capability to purge or wipe information from [organization-defined] [organization-defined].
- ▌
- ▌ Pm 25 Minimization Of Personally Identifiable Information Us · cyberstrikeusDevelop, document, and implement policies and procedures that address the use of personally identifiable information for internal testing, training...
- ▌ Pm 30 1 Suppliers Of Critical Or Mission Essential Items · cyberstrikeusIdentify, prioritize, and assess suppliers of critical or mission-essential technologies, products, and services.
- ▌ Ps 3 4 Citizenship Requirements · cyberstrikeusVerify that individuals accessing a system processing, storing, or transmitting [organization-defined] meet [organization-defined].
- ▌ Ps 7 External Personnel Security · cyberstrikeusEstablish personnel security requirements, including security roles and responsibilities for external providers;
- ▌ Ra 2 1 Impact Level Prioritization · cyberstrikeusConduct an impact-level prioritization of organizational systems to obtain additional granularity on system impact levels.
- ▌ Ra 5 2 Update Vulnerabilities To Be Scanned · cyberstrikeusUpdate the system vulnerabilities to be scanned [organization-defined].
- ▌
- ▌ Si 18 2 Data Tags · cyberstrikeusEmploy data tags to automate the correction or deletion of personally identifiable information across the information life cycle within organizational
- ▌ Si 19 2 Archiving · cyberstrikeusProhibit archiving of personally identifiable information elements if those elements in a dataset will not be needed after the dataset is archived.
- ▌ T0847 Replication Through Removable Media · cyberstrikeusAdversaries may move onto systems, such as those separated from the enterprise network, by copying malware to removable media which is inserted into the control systems environment.