Insecure Configuration

Fixing Insecure Configuration

About Insecure Configuration

What is Insecure Configuration?

Insecure configuration refers to the situation where a system or application is configured with settings or parameters that do not adequately protect it against security threats.

Examples of insecure configurations include using default or weak passwords, allowing open access to network ports, enabling unnecessary services or protocols, and misconfiguring access controls.

Insecure configuration can occur at any layer of the technology stack, including hardware, operating systems, applications, and network devices.

It is a common cause of security incidents and is often exploited by attackers who take advantage of misconfigured systems to gain access to sensitive information or carry out attacks.

Check out this video for a high-level explanation:

What is the impact of Insecure Configuration?

The impact of insecure configuration can lead to financial and reputational losses and potential harm to individuals or organizations.

Insecure configurations can leave systems and applications vulnerable to a variety of security threats, including unauthorized access, data breaches, and denial of service. Attackers can exploit insecure configurations to gain access to sensitive information, steal data, install malware or ransomware, or disrupt services.

In addition to the direct financial and operational costs of such attacks, insecure configurations can also result in lost business, damage to brand reputation, and legal or regulatory penalties.

Insecure configurations can also make it difficult for organizations to comply with security and privacy regulations, such as GDPR, HIPAA, and PCI DSS. Non-compliance with these regulations can result in significant fines, legal actions, and reputational damage.

How to prevent Insecure Configuration?

To prevent insecure configuration, it is important to follow security best practices and guidelines, such as those provided by industry standards like NIST or CIS, and to regularly review and update configurations to ensure they are up-to-date and properly secured.

Here are some specific steps you can take to prevent insecure configuration:

Use secure defaults: Always change the default configuration settings of software and hardware devices to more secure settings, such as changing default passwords and disabling unnecessary services.
Limit access: Implement the principle of least privilege and limit access to systems and applications only to authorized users who need it to perform their job duties.
Apply security updates: Keep systems and applications up-to-date with the latest security patches and updates to protect against known vulnerabilities.
Use security tools: Deploy security tools, such as vulnerability scanners and security information and event management (SIEM) systems, to monitor and manage system configurations.
Enforce strong passwords: Require the use of strong passwords and two-factor authentication for accessing systems and applications.
Follow security standards and frameworks: Implement security standards and frameworks, such as NIST or CIS, to ensure that your configurations adhere to industry best practices.
Regularly review and audit configurations: Regularly review and audit system configurations to ensure they are properly secured and to identify and address any vulnerabilities or misconfigurations.

By taking these steps, you can significantly reduce the risk of insecure configuration and protect your systems and applications from security threats.

References

Taxonomies

CVE Details: CWE-16

Training

ECS Task Definition Network Mode Not Recommended

Network_Mode should be "awsvpc" in NetworkMode of all AWS::ECS::TaskDefinition. AWS VPCs provide the controls to facilitate a formal process for approving and testing all network connections and changes to the firewall and router configurations.

Rule-specific references:

Option A: Consider changing the Network Mode to AWS VPC

If the NetworkMode of all AWS::ECS::TaskDefinition is not already set to "awsvpc" Consider changing it to the superior mode. AWS VPC Network Mode can simplify many things and add a lot of security.

Research what else you will need to change as well before updating the Network Mode
If you decide to go ahead with the changes you have discovered, make these changes
Locate the TaskDefinition NetworkMode and modify it's value to "awsvpc"

Change from the following pattern:

AWSTemplateFormatVersion: "2010-09-09"
Description: A sample template
Resources:
  taskdefinition:
    Type: AWS::ECS::TaskDefinition
    Properties:
      NetworkMode: none
      ContainerDefinitions:
        - Name:
            Ref: "AppName"
          MountPoints:
            - SourceVolume: "my-vol"
              ContainerPath: "/var/www/my-vol"
          Image: "amazon/amazon-ecs-sample"
          Cpu: 256
          PortMappings:
            - ContainerPort:
                Ref: "AppContainerPort"
              HostPort:
                Ref: "AppHostPort"
          EntryPoint:
            - "/usr/sbin/apache2"
            - "-D"
            - "FOREGROUND"
          Memory: 512
          Essential: true

To a configuration like the following:

AWSTemplateFormatVersion: "2010-09-09"
Description: A sample template
Resources:
  taskdefinition:
    Type: AWS::ECS::TaskDefinition
    Properties:
      NetworkMode: awsvpc
      ContainerDefinitions:
        - Name:
            Ref: "AppName"
          MountPoints:
            - SourceVolume: "my-vol"
              ContainerPath: "/var/www/my-vol"
          Image: "amazon/amazon-ecs-sample"
          Cpu: 256
          PortMappings:
            - ContainerPort:
                Ref: "AppContainerPort"
              HostPort:
                Ref: "AppHostPort"
          EntryPoint:
            - "/usr/sbin/apache2"
            - "-D"
            - "FOREGROUND"
          Memory: 512
          Essential: true

Test it
Ship it 🚢 and relax 🌴

S3 Bucket CloudTrail Logging Disabled

Server Access Logging should be enabled on S3 Buckets so that all changes are logged and auditable when the Service used is CloudTrail.

Rule-specific references:

AWS S3 Bucket Logging Configuration

Option A: Make sure S3 Bucket has Logging Configuration block defined

An S3 Bucket Policy (Type: "AWS::S3::BucketPolicy") should reference an S3 Bucket (Type: "AWS::S3::Bucket") that has a LoggingConfiguration block defined.

Locate the following vulnerable pattern:

AWSTemplateFormatVersion: "2010-09-09"
Description: A sample template
Resources:
  mybucketVulnerable:
    Type: "AWS::S3::Bucket"
    DeletionPolicy: Retain
    Properties:
      ReplicationConfiguration:
        Role:
          Fn::GetAtt:
            - WorkItemBucketBackupRole
            - Arn
        Rules:
          - Destination:
              Bucket:
                Fn::Join:
                  - ""
                  - - "arn:aws:s3:::"
                    - "Fn::Join":
                        - "-"
                        - - Ref: "AWS::Region"
                          - Ref: "AWS::StackName"
                          - replicationbucket
              StorageClass: STANDARD
            Id: Backup
            Prefix: ""
            Status: Enabled
      VersioningConfiguration:
        Status: Enabled
  WorkItemBucketBackupRole:
    Type: "AWS::IAM::Role"
    Properties:
      AssumeRolePolicyDocument:
        Statement:
          - Action:
              - "sts:AssumeRole"
            Effect: Allow
            Principal:
              Service:
                - s3.amazonaws.com
  SampleBucketPolicy:
    Type: 'AWS::S3::BucketPolicy'
    Properties:
      Bucket:
        Ref: mybucketVulnerable
      PolicyDocument:
        Statement:
          - Action:
              - 's3:GetObject'
            Effect: Allow
            Resource:
              'Fn::Join':
                - ''
                - - 'arn:aws:s3:::'
                  - Ref: DOC-EXAMPLE-BUCKET
                  - /*
            Principal:
              Service: 'cloudtrail.amazonaws.com'
            Condition:
              StringLike:
                'aws:Referer':
                  - 'http://www.example.com/*'
                  - 'http://example.net/*'

Modify the config to something like the following that includes a LoggingConfiguration block:

AWSTemplateFormatVersion: "2010-09-09"
Description: A sample template
Resources:
  mybucket:
    Type: "AWS::S3::Bucket"
    DeletionPolicy: Retain
    Properties:
      ReplicationConfiguration:
        Role:
          Fn::GetAtt:
            - WorkItemBucketBackupRole
            - Arn
        Rules:
          - Destination:
              Bucket:
                Fn::Join:
                  - ""
                  - - "arn:aws:s3:::"
                    - "Fn::Join":
                        - "-"
                        - - Ref: "AWS::Region"
                          - Ref: "AWS::StackName"
                          - replicationbucket
              StorageClass: STANDARD
            Id: Backup
            Prefix: ""
            Status: Enabled
      VersioningConfiguration:
        Status: Enabled
      LoggingConfiguration:
        DestinationBucketName: LoggingBucket
        LogFilePrefix: loga/
  WorkItemBucketBackupRole:
    Type: "AWS::IAM::Role"
    Properties:
      AssumeRolePolicyDocument:
        Statement:
          - Action:
              - "sts:AssumeRole"
            Effect: Allow
            Principal:
              Service:
                - s3.amazonaws.com
  SampleBucketPolicy:
    Type: 'AWS::S3::BucketPolicy'
    Properties:
      Bucket:
        Ref: mybucket
      PolicyDocument:
        Statement:
          - Action:
              - 's3:GetObject'
            Effect: Allow
            Resource:
              'Fn::Join':
                - ''
                - - 'arn:aws:s3:::'
                  - Ref: DOC-EXAMPLE-BUCKET
                  - /*
            Principal:
              Service: 'cloudtrail.amazonaws.com'
            Condition:
              StringLike:
                'aws:Referer':
                  - 'http://www.example.com/*'
                  - 'http://example.net/*'

Test it
Ship it 🚢 and relax 🌴

Fixing Insecure Configuration​

What is Insecure Configuration?​

What is the impact of Insecure Configuration?​

How to prevent Insecure Configuration?​

References​

Taxonomies​

Related CVEs​

Training​

ECS Task Definition Network Mode Not Recommended​

Option A: Consider changing the Network Mode to AWS VPC​

S3 Bucket CloudTrail Logging Disabled​

Option A: Make sure S3 Bucket has Logging Configuration block defined​