Skip to content

Commit 3c112aa

Browse files
AlexanderHodickeAlexanderHodicke
authored
Merge pull request #56 from oracle-devrel/oci-security-health-check-standard-230630
OCI Security Health Check - Standard Edition, 230630
2 parents e3fc6e6 + 9f8de35 commit 3c112aa

File tree

8 files changed

+5502
-1
lines changed

8 files changed

+5502
-1
lines changed

‎.gitignore

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,7 @@
22
.DS_Store
33
.AppleDouble
44
.LSOverride
5+
.vscode
56

67
# Icon must end with two \r
78
Icon
@@ -30,4 +31,4 @@ Temporary Items
3031
.key
3132
.crt
3233
.csr
33-
.pem
34+
.pem

‎security/security-design/README.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,7 @@
3131
## Reusable Assets Overview
3232

3333
- [Bastion Session Script](bastion-session-script/README.md)
34+
- [OCI Security Health Check Standard](oci-security-health-check-standard/README.md)
3435

3536
3637
## Useful Links

‎security/security-design/oci-security-health-check-standard/LICENSE

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
Copyright (c) 2023 Oracle and/or its affiliates.
2+
3+
The Universal Permissive License (UPL), Version 1.0
4+
5+
Subject to the condition set forth below, permission is hereby granted to any
6+
person obtaining a copy of this software, associated documentation and/or data
7+
(collectively the "Software"), free of charge and under any and all copyright
8+
rights in the Software, and any and all patent rights owned or freely
9+
licensable by each licensor hereunder covering either (i) the unmodified
10+
Software as contributed to or provided by such licensor, or (ii) the Larger
11+
Works (as defined below), to deal in both
12+
13+
(a) the Software, and
14+
(b) any piece of software and/or hardware listed in the lrgrwrks.txt file if
15+
one is included with the Software (each a "Larger Work" to which the Software
16+
is contributed by such licensors),
17+
18+
without restriction, including without limitation the rights to copy, create
19+
derivative works of, display, perform, and distribute the Software and make,
20+
use, sell, offer for sale, import, export, have made, and have sold the
21+
Software and the Larger Work(s), and to sublicense the foregoing rights on
22+
either these or other terms.
23+
24+
This license is subject to the following condition:
25+
The above copyright notice and either this complete permission notice or at
26+
a minimum a reference to the UPL must be included in all copies or
27+
substantial portions of the Software.
28+
29+
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
30+
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
31+
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
32+
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
33+
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
34+
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
35+
SOFTWARE.

‎security/security-design/oci-security-health-check-standard/README.md

Lines changed: 104 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,104 @@
1+
# OCI Security Health Check - Standard Edition
2+
3+
Owner: Olaf Heimburger
4+
5+
## When to use this asset?
6+
7+
The OCI Security Health Check - Standard Edition checks an OCI tenancy for CIS OCI Foundation Benchmark compliance.
8+
9+
## Usage
10+
11+
### Prepare the OCI Tenancy
12+
13+
You can run the assessment as a member of the OCI `Administrator` group or
14+
create a group for auditing and assign the respective user to it.
15+
16+
Running the assessment script as an OCI `Administrator` is the easiest and
17+
quickest way. If you decide to use this option, please continue reading in
18+
[Run the OCI Security Health Check in Cloud Shell](#run-the-oci-security-health-check-in-cloud-shell).
19+
20+
For recurring usage, setting up a group for auditing is recommended. The
21+
steps for setting this up are described in the next chapter.
22+
23+
#### Setting up an *Auditor* group and policy
24+
25+
Using an auditor group is the recommended way to run the assessment script.
26+
To create a group for auditing do the following steps:
27+
28+
- Log into OCI Console as OCI administrator
29+
- Create a group `grp-auditors`
30+
- Create a policy `pcy-auditing` with these statements:
31+
```
32+
allow group grp-auditors to inspect all-resources in tenancy
33+
allow group grp-auditors to read instances in tenancy
34+
allow group grp-auditors to read load-balancers in tenancy
35+
allow group grp-auditors to read buckets in tenancy
36+
allow group grp-auditors to read nat-gateways in tenancy
37+
allow group grp-auditors to read public-ips in tenancy
38+
allow group grp-auditors to read file-family in tenancy
39+
allow group grp-auditors to read instance-configurations in tenancy
40+
allow group grp-auditors to read network-security-groups in tenancy
41+
allow group grp-auditors to read resource-availability in tenancy
42+
allow group grp-auditors to read audit-events in tenancy
43+
allow group grp-auditors to read users in tenancy
44+
allow group grp-auditors to read vss-family in tenancy
45+
allow group grp-auditors to read dns in tenancy
46+
allow group grp-auditors to use cloud-shell in tenancy
47+
```
48+
- Assign a user to the `grp-auditors` group
49+
- Log out of the OCI Console
50+
51+
### Run the OCI Security Health Check in OCI Cloud Shell
52+
53+
The recommended way is to run the *OCI Security Health Check - Standard* in the OCI Cloud Shell. It does not require any additional configuration on a local desktop machine.
54+
55+
#### Download and upload the release file
56+
57+
- Download the the latest distribution [oci-security-health-check-standard-\<version>.zip](releases/oci-security-health-check-standard-\<version>.zip).
58+
- Log into the OCI Console.
59+
- Select the *Developer Tools* icon (looks like a small window) in the header toolbar.
60+
- From the menu select the *Cloud Shell* item.
61+
- Wait until the Cloud Shell has been initialized.
62+
- ...
63+
- Upload the distribution file.
64+
- Extract it
65+
```
66+
$ unzip -q oci-security-health-check-standard-<version>.zip
67+
```
68+
69+
### Run the script
70+
- Change directory into `oci-security-health-check-standard-<version>`:
71+
```
72+
$ cd oci-security-health-check-standard-<version>
73+
```
74+
- In the `oci-security-health-check-standard-<version>` directory:
75+
- Enable execution of script `standard.sh`:
76+
```
77+
$ chmod +x standard.sh
78+
```
79+
- Run the script for all subscribed regions:
80+
```
81+
$ ./standard.sh
82+
```
83+
- Run the script for one subscribed region:
84+
```
85+
$ ./standard.sh -r <region_name>
86+
```
87+
- Get command line options:
88+
```
89+
$ ./standard.sh -h
90+
```
91+
92+
### Getting the results
93+
- In the directory `oci-security-health-check-standard-<version>` a directory will be created which
94+
holds all the output created by the scripts. This directory will be
95+
compressed in a single ZIP file and the resulting ZIP file will be moved to
96+
the parent directory of `oci-security-health-check-standard-<version>`.
97+
98+
# License
99+
100+
Copyright (c) 2022-2023 Oracle and/or its affiliates.
101+
102+
Licensed under the Universal Permissive License (UPL), Version 1.0.
103+
104+
See [LICENSE](https://github.com/oracle-devrel/technology-engineering/blob/folder-structure/LICENSE) for more details.

‎security/security-design/oci-security-health-check-standard/README.txt

Lines changed: 72 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,72 @@
1+
2+
OCI Security Health Check - Standard Edition
3+
============================================
4+
Owner: Olaf Heimburger
5+
6+
When to use this asset?
7+
8+
The OCI Security Health Check - Standard Edition checks an OCI tenancy for
9+
CIS OCI Foundation Benchmark compliance.
10+
11+
Usage
12+
13+
1 Prepare the OCI Tenancy
14+
You can run the assessment as a member of the OCI Administrator group or
15+
create a group for auditing and assign the respective user to it.
16+
17+
Running the assessment script as an OCI Administrator is the easiest and
18+
quickest way. If you decide to use this option, please continue reading
19+
chapter 2.
20+
21+
For recurring usage, setting up a group for auditing is recommended. The
22+
steps for setting this up are described in the next chapter.
23+
24+
1.1 Setup an Auditor group and policy
25+
Using an auditor group is the recommended way to run the assessment script.
26+
To create a group for auditing do the following steps:
27+
28+
- Log into OCI Console as OCI administrator
29+
- Create a group grp-auditors
30+
- Create a policy pcy-auditing with these statements:
31+
allow group grp-auditors to inspect all-resources in tenancy
32+
allow group grp-auditors to read instances in tenancy
33+
allow group grp-auditors to read load-balancers in tenancy
34+
allow group grp-auditors to read buckets in tenancy
35+
allow group grp-auditors to read nat-gateways in tenancy
36+
allow group grp-auditors to read public-ips in tenancy
37+
allow group grp-auditors to read file-family in tenancy
38+
allow group grp-auditors to read instance-configurations in tenancy
39+
allow group grp-auditors to read network-security-groups in tenancy
40+
allow group grp-auditors to read resource-availability in tenancy
41+
allow group grp-auditors to read audit-events in tenancy
42+
allow group grp-auditors to read users in tenancy
43+
allow group grp-auditors to read vss-family in tenancy
44+
allow group grp-auditors to read dns in tenancy
45+
allow group grp-auditors to use cloud-shell in tenancy
46+
- Assign a user to the grp-auditors group
47+
- Log out of OCI Console
48+
49+
2 Using the Cloud Shell
50+
- Log into the OCI Console
51+
- Select the Developer Tools icon (looks like a small window).
52+
- From the menu select the Cloud Shell item.
53+
- When running it the first time:
54+
- Upload the provided ZIP file.
55+
- Extract it with unzip -q oci-security-health-check-standard-<version>.zip
56+
- Change directory into oci-security-health-check-standard-<version>
57+
$ cd oci-security-health-check-standard-<version>
58+
$ screen
59+
- In the oci-security-health-check-standard-<version> directory run the standard.sh
60+
script.
61+
- Run the script for all subscribed regions:
62+
$ ./standard.sh
63+
- Run the script for one subscribed region:
64+
$ ./standard.sh -r <region_name>
65+
- Get command line options:
66+
$ ./standard.sh -h
67+
68+
3 Gathering the results
69+
- In the directory oci-security-health-check-standard-<version> a directory will be created which
70+
holds all the output created by the scripts. This directory will be
71+
compressed in a single ZIP file and the resulting ZIP file will be moved to
72+
the home directory of the account running the script.

‎security/security-design/oci-security-health-check-standard/requirements.txt

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
xlsxwriter>=3.0.3
2+
pandas>=1.5.2
3+
openpyxl>=3.0.10
4+
pyyaml>=6.0
5+
oci>=2.104

0 commit comments

Comments
 (0)