|
| 1 | +# OCI Security Health Check - Standard Edition |
| 2 | + |
| 3 | +Owner: Olaf Heimburger |
| 4 | + |
| 5 | +## When to use this asset? |
| 6 | + |
| 7 | +The *OCI Security Health Check - Standard Edition* checks an OCI tenancy for CIS OCI Foundation Benchmark compliance. |
| 8 | + |
| 9 | +## Usage |
| 10 | + |
| 11 | +### Download and verify the release file |
| 12 | + |
| 13 | +Before running the *OCI Security Health Check - Standard Edition* you should download and verify it. |
| 14 | + |
| 15 | + - Download the latest distribution [oci-security-health-check-standard-230630.zip](https://github.com/oracle-devrel/technology-engineering/releases/download/oci-security-health-check-std-230630/oci-security-health-check-standard-230630.zip). |
| 16 | + - Download the respective checksum file [oci-security-health-check-standard-230630.sha512256](https://github.com/oracle-devrel/technology-engineering/releases/download/oci-security-health-check-std-230630/oci-security-health-check-standard-230630.sha512256). |
| 17 | + - Verify the integrity of the distribution. Both files must be in the same directory (for example, in your downloads directory). |
| 18 | + |
| 19 | + On MacOS: |
| 20 | + ``` |
| 21 | + $ cd <your_downloads_directory> |
| 22 | + $ shasum -a 512256 -c oci-security-health-check-standard-230630.sha512256 |
| 23 | + oci-security-health-check-standard-230630.zip: OK |
| 24 | + ``` |
| 25 | +
|
| 26 | + On Linux (including Cloud Shell): |
| 27 | + ``` |
| 28 | + $ cd <your_downloads_directory> |
| 29 | + $ sha512sum -c oci-security-health-check-standard-230630.sha512 |
| 30 | + oci-security-health-check-standard-230630.zip: OK |
| 31 | + ``` |
| 32 | +
|
| 33 | +**Reject the downloaded file if the check fails!** |
| 34 | +
|
| 35 | +### Prepare the OCI Tenancy |
| 36 | +
|
| 37 | +You can run the assessment as a member of the OCI `Administrator` group or |
| 38 | +create a group for auditing and assign the respective user to it. |
| 39 | +
|
| 40 | +Running the assessment script as an OCI `Administrator` is the easiest and |
| 41 | +quickest way. If you decide to use this option, please continue reading in |
| 42 | +[Run the OCI Security Health Check in Cloud Shell](#run-the-oci-security-health-check-in-cloud-shell). |
| 43 | +
|
| 44 | +For recurring usage, setting up a group for auditing is recommended. The |
| 45 | +steps for setting this up are described in the next chapter. |
| 46 | +
|
| 47 | +#### Setting up an *Auditor* group and policy |
| 48 | +
|
| 49 | +Using an auditor group is the recommended way to run the assessment script. |
| 50 | +To create a group for auditing do the following steps: |
| 51 | +
|
| 52 | + - Log into OCI Console as OCI administrator |
| 53 | + - Create a group `grp-auditors` |
| 54 | + - Create a policy `pcy-auditing` with these statements: |
| 55 | + ``` |
| 56 | + allow group grp-auditors to inspect all-resources in tenancy |
| 57 | + allow group grp-auditors to read instances in tenancy |
| 58 | + allow group grp-auditors to read load-balancers in tenancy |
| 59 | + allow group grp-auditors to read buckets in tenancy |
| 60 | + allow group grp-auditors to read nat-gateways in tenancy |
| 61 | + allow group grp-auditors to read public-ips in tenancy |
| 62 | + allow group grp-auditors to read file-family in tenancy |
| 63 | + allow group grp-auditors to read instance-configurations in tenancy |
| 64 | + allow group grp-auditors to read network-security-groups in tenancy |
| 65 | + allow group grp-auditors to read resource-availability in tenancy |
| 66 | + allow group grp-auditors to read audit-events in tenancy |
| 67 | + allow group grp-auditors to read users in tenancy |
| 68 | + allow group grp-auditors to read vss-family in tenancy |
| 69 | + allow group grp-auditors to read dns in tenancy |
| 70 | + allow group grp-auditors to use cloud-shell in tenancy |
| 71 | + ``` |
| 72 | + - Assign a user to the `grp-auditors` group |
| 73 | + - Log out of the OCI Console |
| 74 | +
|
| 75 | +### Run the OCI Security Health Check in OCI Cloud Shell |
| 76 | +
|
| 77 | +The recommended way is to run the *OCI Security Health Check - Standard* in the OCI Cloud Shell. It does not require any additional configuration on a local desktop machine. |
| 78 | +
|
| 79 | +#### Upload the release file |
| 80 | +
|
| 81 | + - Log into the OCI Console. |
| 82 | + - Select the *Developer Tools* icon (looks like a small window) in the header toolbar. |
| 83 | + - From the menu select the *Cloud Shell* item. |
| 84 | + - Wait until the Cloud Shell has been initialized. |
| 85 | + - On the green tool bar click on the *Settings* icon and select the *Upload ...* menu item. |
| 86 | + - Upload the distribution file. |
| 87 | + - Extract it |
| 88 | + ``` |
| 89 | + $ unzip -q oci-security-health-check-standard-230630.zip |
| 90 | + ``` |
| 91 | +
|
| 92 | +### Run the script |
| 93 | + - Change directory into `oci-security-health-check-standard`: |
| 94 | + ``` |
| 95 | + $ cd oci-security-health-check-standard |
| 96 | + ``` |
| 97 | + - In the `oci-security-health-check-standard` directory: |
| 98 | + - Enable execution of script `standard.sh`: |
| 99 | + ``` |
| 100 | + $ chmod +x standard.sh |
| 101 | + ``` |
| 102 | + - Run the script for all subscribed regions: |
| 103 | + ``` |
| 104 | + $ ./standard.sh |
| 105 | + ``` |
| 106 | + - Run the script for one subscribed region: |
| 107 | + ``` |
| 108 | + $ ./standard.sh -r <region_name> |
| 109 | + ``` |
| 110 | + - Get command line options: |
| 111 | + ``` |
| 112 | + $ ./standard.sh -h |
| 113 | + ``` |
| 114 | +
|
| 115 | +### Getting the results |
| 116 | + - In the directory `oci-security-health-check-standard` a directory will be created which |
| 117 | + holds all the output created by the scripts. This directory will be |
| 118 | + compressed in a single ZIP file and the resulting ZIP file will be moved to |
| 119 | + the parent directory of `oci-security-health-check-standard`. |
| 120 | +
|
| 121 | +### Checking the results |
| 122 | +
|
| 123 | +The report results are showing the compliance status of the related [CIS OCI Foundation Benchmark, version 1.2](https://www.cisecurity.org/benchmark/Oracle_Cloud) recommendations. Please download this benchmark before reading the report. (For license reasons, we cannot distribute the benchmark.) |
| 124 | +
|
| 125 | +The report results are summarized in two files: |
| 126 | +- *cis_html_summary_report.html* – The report in HTML that displays the all recommendations and their compliance status, respectively. |
| 127 | +- *Consolidated_Report.xslx* – An XSLX workbook with a summary and sheets for the non-compliant recommendations. |
| 128 | +
|
| 129 | +## Credits |
| 130 | +
|
| 131 | +The *OCI Security Health Check - Standard Edition* streamlines the usage of the bundled [Compliance Checking Script](https://github.com/oracle-quickstart/oci-cis-landingzone-quickstart/blob/main/compliance-script.md) provided by the [CIS OCI Landing Zone Quick Start Template](https://github.com/oracle-quickstart/oci-cis-landingzone-quickstart). |
| 132 | +
|
| 133 | +The *OCI Security Health Check - Standard Edition* would not be possible without the great work of the [CIS OCI Landing Zone Quick Start Template Team](https://github.com/oracle-quickstart/oci-cis-landingzone-quickstart/graphs/contributors). |
| 134 | +# License |
| 135 | +
|
| 136 | +Copyright (c) 2022-2023 Oracle and/or its affiliates. |
| 137 | +
|
| 138 | +Licensed under the Universal Permissive License (UPL), Version 1.0. |
| 139 | +
|
| 140 | +See [LICENSE](https://github.com/oracle-devrel/technology-engineering/blob/folder-structure/LICENSE) for more details. |
0 commit comments