AWS, Google and Microsoft Azure Security Checklist


Overview of Security

This report presents suggested best practices and techniques that an organization should acknowledge when building a full-fledged cloud strategy. This article covers leading cloud providers Security Checklist.

AWS Security Checklist

  • Permit CloudTrail logging across all Amazon Web Services.
  • Set on CloudTrail log file validation.
  • Permit CloudTrail multi-region logging.
  • Combine CloudTrail with CloudWatch.
  • Permit access logging for CloudTrail S3 buckets.
  • Permit access logging for Elastic Load Balancer (ELB).
  • Permit Redshift audit logging.
  • Permit Virtual Private Cloud (VPC) flow logging.
  • Multifactor authentication (MFA) is required to delete CloudTrail buckets.
  • Set on multifactor authentication for the “root” account.
  • Set on multifactor authentication for IAM users.
  • Permit IAM users for multi-mode access.
  • Link IAM policies to groups or roles.
  • Regularly rotate IAM access keys, and standardize on the selected number of days.
  • strict password policy must be set up
  • Set the password termination session to 90 days
  • Expired SSL/TLS certificates should not be used
  • User HTTPS for CloudFront distributions.
  • Limit access to CloudTrail bucket.
  • Encrypt the CloudTrail log files at rest.
  • Elastic Block Store (EBS) database must be encrypted
  • Provision access to resources using IAM roles.
  • Using root user accounts should be avoided
  • SSL secure ciphers must be applied while connecting between the client and ELB.
  • SSL secure versions must be used while connecting between ELB and Client.
  • Use a standard naming (tagging) convention for EC2.
  • Encrypt Amazon’s Relational Database Service (RDS).
  • Access keys should not be used with root accounts.
  • Use secure CloudFront SSL versions.
  • Permit the require_ssl parameter in all Redshift clusters.
  • Periodically rotate SSH keys
  • Number of discrete security groups should be minimized
  • Reduce the number of IAM groups.
  • Terminate available access keys.
  • Disable access for unused or inactive IAM users.
  • Remove unused IAM access keys.
  • Delete unused SSH Public Keys.
  • Limit access to Amazon Machine Images (AMIs).
  • Limit access to EC2 security groups.
  • Limit access to RDS instances.
  • Limit access to Redshift clusters.
  • Limit access to outbound access.
  • Disallow unrestricted ingress access on different ports.
  • Limit access to well-known ports such as CIFS, FTP, ICMP, SMTP, SSH, Remote desktop.
  • Involve IT security throughout the development process.
  • Limited privileges should be granted as possible for application users.
  • Encrypt highly sensitive data such as personally identifiable information (PII) or protected health information (PHI)

Azure Security Checklist

  • Ensure that multi factor authentication is enabled for all users
  • Ensure that there are no guest users.
  • Use Role-Based Access Control to manage access to resources.
  • Ensure that ‘enable users to memorize multi factor authentication on devices they trust’ is disabled.
  • Ensure that ‘number of processes required to reset’ is set to 2.
  • Assure that ‘number of days before users are asked to re-confirm their authentication report’ is not set to 0.
  • Assure that ‘caution users on password resets’ is set to yes.
  • Ensure that ‘notify all admins when other admins reset their password?’ is set to yes
  • Ensure that ‘users can comply with apps obtaining company data on their account’ is set to none.
  • Guarantee that ‘users can add gallery apps to their Entrance Panel’ is set to no.
  • Ensure that ‘users can disclose applications’ is fixed to no.
  • Guarantee that ‘guest users agreements are limited’ is set to yes.
  • Ensure that ‘members can request’ is set to no.
  • Guarantee that ‘guests can invite’ is set to no.
  • Ensure that entrance to the Azure AD administration portal should be limited
  • Ensure that ‘users can create security associations’ is set to none.
  • Ensure that ‘self-service group administration enabled’ is established to no.
  • Ensure that ‘users who can handle security groups’ is set to none.
  • Ensure that ‘users can create Office 365 groups’ is set to no.
  • Ensure that ‘users who can manage Office 365 groups’ is set to none.
  • Ensure that ‘require multifactor auth to join devices’ is set to yes
  • Ensure that ‘secure transfer required’ is arranged to enable.
  • Ensure that ‘storage service encryption’ is set to enabled
  • On SQL servers, ensure that ‘auditing’ is set to on.
  • On SQL servers, ensure that ‘auditing type’ is set to blob
  • On SQL servers, ensure that ‘threat detection’ is set to on.
  • On SQL servers, ensure that ‘threat detection types’ is set to all.
  • On SQL servers, ensure that ‘send alerts to’ is set.
  • On SQL servers, ensure that ’email service and co-administrators’ is enabled.
  • On SQL servers, ensure that firewall rules are set as appropriate.
  • Disable RDP access on network security groups from the internet
  • Disable SSH access on network security groups from the internet.

Google Security Checklist

  • Require 2-Step Verification for admin accounts
  • Enforce 2-Step Verification for users
  • Don’t use a super admin account for daily activities
  • Don’t remain signed in to an idle super admin account
  • Set up admin email alerts
  • Review the admin audit log
  • Add recovery options to admin accounts
  • Enroll a spare security key
  • Save the backup codes
  • Use unique passwords
  • Prevent password reuse with password alert
  • Regularly review activity reports and alerts
  • Know and approve which third-party can access G Suite core services
  • Create a Whitelist of trusted apps
  • Limit external calendar sharing
  • Set up underlying Chrome OS and Chrome Browser policy
  • Warn the users when chatting outside their domain
  • Don’t automatically share the contact information
  • Validate email with SPF, DKIM, and DMARC
  • Disable the “Do not require sender authentication” setting for spam policies.
  • Prevent automatic forwarding the incoming mail
  • Enable comprehensive mail storage
  • Enable additional attachment protection
  • Enable enhanced pre-delivery message scanning
  • Enable additional attachment protection
  • Limit group creation to admins
  • Set up the private access to groups
  • Enforce mobile password requirements (reduce risk if the device is lost)
  • Encrypt data on mobile devices
  • Enable mobile inactivity reports
  • Disable location history
  • Disable access to offline docs
  • Do not permit users to establish add-ons for Docs from the add-on store

360 Degree Approach to Security

We offer Managed Cloud Solutions for AWS – Amazon Web Services, Microsoft Azure and Google Cloud Platform. To know more about Cloud Migration, Cloud Consulting Solutions Contact Us.

Also, check out the above content repurposed to a video using InVideo on our youtube channel @ XenonStack

Leave a Comment

Name required.
Enter a Valid Email Address.
Comment required.(Min 30 Char)