Skip to content

Commit ad55eb7

Browse files
oheimburgeroheimburger
committed
OCI Security Health Check - Standard Edition, version 230630
1 parent 8f4a07b commit ad55eb7

File tree

6 files changed

+5489
-0
lines changed

6 files changed

+5489
-0
lines changed

‎security/security-design/oci-security-health-check-standard/LICENSE

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
Copyright (c) 2023 Oracle and/or its affiliates.
2+
3+
The Universal Permissive License (UPL), Version 1.0
4+
5+
Subject to the condition set forth below, permission is hereby granted to any
6+
person obtaining a copy of this software, associated documentation and/or data
7+
(collectively the "Software"), free of charge and under any and all copyright
8+
rights in the Software, and any and all patent rights owned or freely
9+
licensable by each licensor hereunder covering either (i) the unmodified
10+
Software as contributed to or provided by such licensor, or (ii) the Larger
11+
Works (as defined below), to deal in both
12+
13+
(a) the Software, and
14+
(b) any piece of software and/or hardware listed in the lrgrwrks.txt file if
15+
one is included with the Software (each a "Larger Work" to which the Software
16+
is contributed by such licensors),
17+
18+
without restriction, including without limitation the rights to copy, create
19+
derivative works of, display, perform, and distribute the Software and make,
20+
use, sell, offer for sale, import, export, have made, and have sold the
21+
Software and the Larger Work(s), and to sublicense the foregoing rights on
22+
either these or other terms.
23+
24+
This license is subject to the following condition:
25+
The above copyright notice and either this complete permission notice or at
26+
a minimum a reference to the UPL must be included in all copies or
27+
substantial portions of the Software.
28+
29+
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
30+
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
31+
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
32+
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
33+
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
34+
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
35+
SOFTWARE.

‎security/security-design/oci-security-health-check-standard/README.md

Lines changed: 99 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,99 @@
1+
2+
# OCI Security Health Check - Standard Edition
3+
4+
Owner: Olaf Heimburger
5+
6+
## Prepare the OCI Tenancy
7+
8+
You can run the assessment as a member of the OCI `Administrator` group or
9+
create a group for auditing and assign the respective user to it.
10+
11+
Running the assessment script as an OCI `Administrator` is the easiest and
12+
quickest way. If you decide to use this option, please continue reading in
13+
[Run the OCI Security Health Check in Cloud Shell](#run-the-oci-security-health-check-in-cloud-shell).
14+
15+
For recurring usage, setting up a group for auditing is recommended. The
16+
steps for setting this up are described in the next chapter.
17+
18+
### Setting up an *Auditor* group and policy
19+
20+
Using an auditor group is the recommended way to run the assessment script.
21+
To create a group for auditing do the following steps:
22+
23+
- Log into OCI Console as OCI administrator
24+
- Create a group `grp-auditors`
25+
- Create a policy `pcy-auditing` with these statements:
26+
```
27+
allow group grp-auditors to inspect all-resources in tenancy
28+
allow group grp-auditors to read instances in tenancy
29+
allow group grp-auditors to read load-balancers in tenancy
30+
allow group grp-auditors to read buckets in tenancy
31+
allow group grp-auditors to read nat-gateways in tenancy
32+
allow group grp-auditors to read public-ips in tenancy
33+
allow group grp-auditors to read file-family in tenancy
34+
allow group grp-auditors to read instance-configurations in tenancy
35+
allow group grp-auditors to read network-security-groups in tenancy
36+
allow group grp-auditors to read resource-availability in tenancy
37+
allow group grp-auditors to read audit-events in tenancy
38+
allow group grp-auditors to read users in tenancy
39+
allow group grp-auditors to read vss-family in tenancy
40+
allow group grp-auditors to read dns in tenancy
41+
allow group grp-auditors to use cloud-shell in tenancy
42+
```
43+
- Assign a user to the `grp-auditors` group
44+
- Log out of the OCI Console
45+
46+
## Run the OCI Security Health Check in OCI Cloud Shell
47+
48+
The recommended way is to run the *OCI Security Healh Check - Standard* in the OCI Cloud Shell. It does not require any additional configuration on a local desktop machine.
49+
50+
### Download and upload the release file
51+
52+
- Download the the latest distribution [oci-security-health-check-standard-\<version>.zip](releases/oci-security-health-check-standard-\<version>.zip).
53+
- Log into the OCI Console.
54+
- Select the *Developer Tools* icon (looks like a small window) in the header toolbar.
55+
- From the menu select the *Cloud Shell* item.
56+
- Wait until the Cloud Shell has been initialised.
57+
- ...
58+
- Upload the distribution file.
59+
- Extract it
60+
```
61+
$ unzip -q oci-security-health-check-standard-<version>.zip
62+
```
63+
64+
### Run the script
65+
- Change directory into `oci-security-health-check-standard-<version>`:
66+
```
67+
$ cd oci-security-health-check-standard-<version>
68+
```
69+
- In the `oci-security-health-check-standard-<version>` directory:
70+
- Enable execution of script `standard.sh`:
71+
```
72+
$ chmod +x standard.sh
73+
```
74+
- Run the script for all subscribed regions:
75+
```
76+
$ ./standard.sh
77+
```
78+
- Run the script for one subscribed regions:
79+
```
80+
$ ./standard.sh -r <region_name>
81+
```
82+
- Get command line options:
83+
```
84+
$ ./standard.sh -h
85+
```
86+
87+
## Getting the results
88+
- In the directory `oci-security-health-check-standard-<version>` a directory will be created which
89+
holds all the output created by the scripts. This directory will be
90+
compressed in a single ZIP file and the resulting ZIP file will be moved to
91+
the parent directory of `oci-security-health-check-standard-<version>`.
92+
93+
# License
94+
95+
Copyright (c) 2022-2023 Oracle and/or its affiliates.
96+
97+
Licensed under the Universal Permissive License (UPL), Version 1.0.
98+
99+
See [LICENSE](https://github.com/oracle-devrel/technology-engineering/blob/folder-structure/LICENSE) for more details.

‎security/security-design/oci-security-health-check-standard/README.txt

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
2+
OCI Security Health Check - Standard Edition
3+
============================================
4+
5+
1 Prepare the OCI Tenancy
6+
You can run the assessment as a member of the OCI Administrator group or
7+
create a group for auditing and assign the respective user to it.
8+
9+
Running the assessment script as an OCI Administrator is the easiest and
10+
quickest way. If you decide to use this option, please continue reading in
11+
chapter 2.
12+
13+
For recurring usage, setting up a group for auditing is recommended. The
14+
steps for setting this up are described in the next chapter.
15+
16+
1.1 Setup an Auditor group and policy
17+
Using an auditor group is the recommended way to run the assessment script.
18+
To create a group for auditing do the following steps:
19+
20+
- Log into OCI Console as OCI administrator
21+
- Create a group grp-auditors
22+
- Create a policy pcy-auditing with these statements:
23+
allow group grp-auditors to inspect all-resources in tenancy
24+
allow group grp-auditors to read instances in tenancy
25+
allow group grp-auditors to read load-balancers in tenancy
26+
allow group grp-auditors to read buckets in tenancy
27+
allow group grp-auditors to read nat-gateways in tenancy
28+
allow group grp-auditors to read public-ips in tenancy
29+
allow group grp-auditors to read file-family in tenancy
30+
allow group grp-auditors to read instance-configurations in tenancy
31+
allow group grp-auditors to read network-security-groups in tenancy
32+
allow group grp-auditors to read resource-availability in tenancy
33+
allow group grp-auditors to read audit-events in tenancy
34+
allow group grp-auditors to read users in tenancy
35+
allow group grp-auditors to read vss-family in tenancy
36+
allow group grp-auditors to read dns in tenancy
37+
allow group grp-auditors to use cloud-shell in tenancy
38+
- Assign a user to the grp-auditors group
39+
- Log out of OCI Console
40+
41+
2 Using the Cloud Shell
42+
- Log into the OCI Console
43+
- Select the Developer Tools icon (looks like a small window).
44+
- From the menu select the Cloud Shell item.
45+
- When running it the first time:
46+
- Upload the provided ZIP file.
47+
- Extract it with unzip -q oci-security-health-check-standard-<version>.zip
48+
- Change directory into oci-security-health-check-standard-<version>
49+
$ cd oci-security-health-check-standard-<version>
50+
$ screen
51+
- In the oci-security-health-check-standard-<version> directory run the standard.sh
52+
script.
53+
- Run the script for all subscribed regions:
54+
$ ./standard.sh
55+
- Run the script for one subscribed regions:
56+
$ ./standard.sh -r <region_name>
57+
- Get command line options:
58+
$ ./standard.sh -h
59+
60+
3 Gathering the results
61+
- In the directory oci-security-health-check-standard-<version> a directory will be created which
62+
holds all the output created by the scripts. This directory will be
63+
compressed in a single ZIP file and the resulting ZIP file will be moved to
64+
the home directory of the account running the script.

‎security/security-design/oci-security-health-check-standard/requirements.txt

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
xlsxwriter>=3.0.3
2+
pandas>=1.5.2
3+
openpyxl>=3.0.10
4+
pyyaml>=6.0
5+
oci>=2.104

0 commit comments

Comments
 (0)