You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Access Governance is a cloud native identity governance and administration (IGA) service that provides enterprisewide visibility to govern access to cloud and on-premises environments. With an intuitive user experience, dynamic access control, and a prescriptive analytics-driven access review process, it helps customers automate access provisioning, get insights into access permission and cloud infrastructure policy reviews, identify anomalies, and remediate security risks.
Oracle Access Management provides innovative new services that complement traditional access management capabilities. It provides Web SSO with MFA, coarse-grained authorization, session management, standard SAML Federation, and OAuth capabilities to enable secure access to external cloud and mobile applications. It can be easily integrated with the Oracle Identity Cloud Service to support hybrid access management capabilities that can help customers protect on-premises and cloud applications seamlessly.
Oracle Unified Directory is part of Oracle's comprehensive directory solution offering for robust identity management deployments. Enable enterprise directory scalability with an all-in-one solution that provides the services required for high performance and massive scale.
Copy file name to clipboardExpand all lines: security/security-design/shared-assets/oci-security-health-check-standard/README.md
+31-22Lines changed: 31 additions & 22 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -2,7 +2,7 @@
2
2
3
3
Owner: Olaf Heimburger
4
4
5
-
Version: 230922
5
+
Version: 240130
6
6
7
7
Reviewed: 01.02.2024
8
8
@@ -67,28 +67,37 @@ For recurring usage, setting up a group for auditing is recommended. For setting
67
67
Using an auditor group is the recommended way to run the assessment script.
68
68
To create a group for auditing do the following steps:
69
69
70
-
- Log into OCI Console as OCI administrator
71
-
- Create a group `grp-auditors`
72
-
- Create a policy `pcy-auditing` with these statements:
70
+
- Log into OCI Console as OCI administrator.
71
+
- In your Default domain create a group `grp-auditors`
72
+
- Create a policy `pcy-auditing` with these statements (if your tenancy does not have Domains, replace `'Default'/'grp-auditors'` with `grp-auditors`):
73
73
```
74
-
allow group grp-auditors to inspect all-resources in tenancy
75
-
allow group grp-auditors to read instances in tenancy
76
-
allow group grp-auditors to read load-balancers in tenancy
77
-
allow group grp-auditors to read buckets in tenancy
78
-
allow group grp-auditors to read nat-gateways in tenancy
79
-
allow group grp-auditors to read public-ips in tenancy
80
-
allow group grp-auditors to read file-family in tenancy
81
-
allow group grp-auditors to read instance-configurations in tenancy
82
-
allow group grp-auditors to read network-security-groups in tenancy
83
-
allow group grp-auditors to read resource-availability in tenancy
84
-
allow group grp-auditors to read audit-events in tenancy
85
-
allow group grp-auditors to read users in tenancy
86
-
allow group grp-auditors to read vss-family in tenancy
87
-
allow group grp-auditors to read dns in tenancy
88
-
allow group grp-auditors to use cloud-shell in tenancy
89
-
```
90
-
- Assign a user to the `grp-auditors` group
91
-
- Log out of the OCI Console
74
+
allow group 'Default'/'grp-auditors' to inspect all-resources in tenancy
75
+
allow group 'Default'/'grp-auditors' to read instances in tenancy
76
+
allow group 'Default'/'grp-auditors' to read load-balancers in tenancy
77
+
allow group 'Default'/'grp-auditors' to read buckets in tenancy
78
+
allow group 'Default'/'grp-auditors' to read nat-gateways in tenancy
79
+
allow group 'Default'/'grp-auditors' to read public-ips in tenancy
80
+
allow group 'Default'/'grp-auditors' to read file-family in tenancy
81
+
allow group 'Default'/'grp-auditors' to read instance-configurations in tenancy
82
+
allow group 'Default'/'grp-auditors' to read network-security-groups in tenancy
83
+
allow group 'Default'/'grp-auditors' to read resource-availability in tenancy
84
+
allow group 'Default'/'grp-auditors' to read audit-events in tenancy
85
+
allow group 'Default'/'grp-auditors' to read users in tenancy
86
+
allow group 'Default'/'grp-auditors' to read vss-family in tenancy
87
+
allow group 'Default'/'grp-auditors' to read dns in tenancy
88
+
allow group 'Default'/'grp-auditors' to use cloud-shell in tenancy ```
89
+
- Assign a user to the `grp-auditors` group.
90
+
- Log out of the OCI Console.
91
+
92
+
## Run the OCI Security Health Check in OCI Cloud Shell
93
+
94
+
For a detailed description go to [Run the OCI Security Health Check in OCI Cloud Shell](https://github.com/oracle-devrel/technology-engineering/blob/main/security/security-design/oci-security-health-check-standard/files/oci-security-health-check-standard/README.md#run-the-oci-security-health-check-in-cloud-shell)
95
+
96
+
## Sample Output
97
+
98
+
After a completed run you will find a directory with a name starting with your tenancy name followed by a timestamp in your working directory (like `tenancy_name_YYYYMMDDHHmmss_standard`). A zip archive for easier download using the same name will be created, too. Both hold data files for your review.
99
+
100
+
To start with reviewing the results, open the file named [cis_html_summary_report.html](files/resources/cis_html_summary_report.html)(sample report).
Copy file name to clipboardExpand all lines: security/security-design/shared-assets/oci-security-health-check-standard/files/oci-security-health-check-standard/README.md
+56-28Lines changed: 56 additions & 28 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -2,7 +2,7 @@
2
2
3
3
Owner: Olaf Heimburger
4
4
5
-
Version: 230922
5
+
Version: 240130
6
6
7
7
## When to use this asset?
8
8
@@ -14,25 +14,25 @@ The *OCI Security Health Check - Standard Edition* checks an OCI tenancy for CIS
14
14
15
15
Before running the *OCI Security Health Check - Standard Edition* you should download and verify it.
16
16
17
-
- Download the latest distribution [oci-security-health-check-standard-230922.zip](https://github.com/oracle-devrel/technology-engineering/releases/download/oci-security-health-check-std-230922/oci-security-health-check-standard-230922.zip).
18
-
- Download the respective checksum file [oci-security-health-check-standard-230922.sha512256](https://github.com/oracle-devrel/technology-engineering/releases/download/oci-security-health-check-std-230922/oci-security-health-check-standard-230922.sha512256).
17
+
- Download the latest distribution [oci-security-health-check-standard-240130.zip](https://github.com/oracle-devrel/technology-engineering/releases/download/oci-security-health-check-std-240130/oci-security-health-check-standard-240130.zip).
18
+
- Download the respective checksum file [oci-security-health-check-standard-240130.sha512256](https://github.com/oracle-devrel/technology-engineering/releases/download/oci-security-health-check-std-240130/oci-security-health-check-standard-240130.sha512256).
19
19
- Verify the integrity of the distribution. Both files must be in the same directory (for example, in your downloads directory).
20
20
21
21
On MacOS:
22
22
```
23
23
$ cd <your_downloads_directory>
24
-
$ shasum -a 512256 -c oci-security-health-check-standard-230922.sha512256
25
-
oci-security-health-check-standard-230922.zip: OK
24
+
$ shasum -a 512256 -c oci-security-health-check-standard-240130.sha512256
**Reject the downloaded file if the check fails!**
35
+
**Reject the downloaded file when the check fails!**
36
36
37
37
### Prepare the OCI Tenancy
38
38
@@ -51,26 +51,48 @@ steps for setting this up are described in the next chapter.
51
51
Using an auditor group is the recommended way to run the assessment script.
52
52
To create a group for auditing do the following steps:
53
53
54
-
- Log into OCI Console as OCI administrator
54
+
- Check whether your tenancy is still not migrated to Identity Domains:
55
+
- Login to OCI Console as OCI administrator
56
+
- Select "Identity & Security"
57
+
- If "Domains" are listed you are migrated to Identity Domains
55
58
- Create a group `grp-auditors`
56
59
- Create a policy `pcy-auditing` with these statements:
57
-
```
58
-
allow group grp-auditors to inspect all-resources in tenancy
59
-
allow group grp-auditors to read instances in tenancy
60
-
allow group grp-auditors to read load-balancers in tenancy
61
-
allow group grp-auditors to read buckets in tenancy
62
-
allow group grp-auditors to read nat-gateways in tenancy
63
-
allow group grp-auditors to read public-ips in tenancy
64
-
allow group grp-auditors to read file-family in tenancy
65
-
allow group grp-auditors to read instance-configurations in tenancy
66
-
allow group grp-auditors to read network-security-groups in tenancy
67
-
allow group grp-auditors to read resource-availability in tenancy
68
-
allow group grp-auditors to read audit-events in tenancy
69
-
allow group grp-auditors to read users in tenancy
70
-
allow group grp-auditors to read vss-family in tenancy
71
-
allow group grp-auditors to read dns in tenancy
72
-
allow group grp-auditors to use cloud-shell in tenancy
73
-
```
60
+
- For tenancies **without** Identity Domains use
61
+
```
62
+
allow group grp-auditors to inspect all-resources in tenancy
63
+
allow group grp-auditors to read instances in tenancy
64
+
allow group grp-auditors to read load-balancers in tenancy
65
+
allow group grp-auditors to read buckets in tenancy
66
+
allow group grp-auditors to read nat-gateways in tenancy
67
+
allow group grp-auditors to read public-ips in tenancy
68
+
allow group grp-auditors to read file-family in tenancy
69
+
allow group grp-auditors to read instance-configurations in tenancy
70
+
allow group grp-auditors to read network-security-groups in tenancy
71
+
allow group grp-auditors to read resource-availability in tenancy
72
+
allow group grp-auditors to read audit-events in tenancy
73
+
allow group grp-auditors to read users in tenancy
74
+
allow group grp-auditors to read vss-family in tenancy
75
+
allow group grp-auditors to read dns in tenancy
76
+
allow group grp-auditors to use cloud-shell in tenancy
77
+
```
78
+
- For tenancies **with** Identity Domains use
79
+
```
80
+
allow group 'Default'/'grp-auditors' to inspect all-resources in tenancy
81
+
allow group 'Default'/'grp-auditors' to read instances in tenancy
82
+
allow group 'Default'/'grp-auditors' to read load-balancers in tenancy
83
+
allow group 'Default'/'grp-auditors' to read buckets in tenancy
84
+
allow group 'Default'/'grp-auditors' to read nat-gateways in tenancy
85
+
allow group 'Default'/'grp-auditors' to read public-ips in tenancy
86
+
allow group 'Default'/'grp-auditors' to read file-family in tenancy
87
+
allow group 'Default'/'grp-auditors' to read instance-configurations in tenancy
88
+
allow group 'Default'/'grp-auditors' to read network-security-groups in tenancy
89
+
allow group 'Default'/'grp-auditors' to read resource-availability in tenancy
90
+
allow group 'Default'/'grp-auditors' to read audit-events in tenancy
91
+
allow group 'Default'/'grp-auditors' to read users in tenancy
92
+
allow group 'Default'/'grp-auditors' to read vss-family in tenancy
93
+
allow group 'Default'/'grp-auditors' to read dns in tenancy
94
+
allow group 'Default'/'grp-auditors' to use cloud-shell in tenancy
95
+
```
74
96
- Assign a user to the `grp-auditors` group
75
97
- Log out of the OCI Console
76
98
@@ -128,6 +150,12 @@ The report results are summarized in two files:
128
150
- *cis_html_summary_report.html* – The report in HTML that displays the all recommendations and their compliance status, respectively.
129
151
- *Consolidated_Report.xslx* – An XSLX workbook with a summary and sheets for the non-compliant recommendations.
130
152
153
+
### Known Issues
154
+
155
+
#### Wrong urllib3 version
156
+
157
+
There is a known dependency between Python urllib3 version 2 and the OS installed version of OpenSSL. The script tries to handle this automatically using a working version of urllib3. If the handling does not work let us know.
158
+
131
159
## Credits
132
160
133
161
The *OCI Security Health Check - Standard Edition* streamlines the usage of the bundled [Compliance Checking Script](https://github.com/oracle-quickstart/oci-cis-landingzone-quickstart/blob/main/compliance-script.md) provided by the [CIS OCI Landing Zone Quick Start Template](https://github.com/oracle-quickstart/oci-cis-landingzone-quickstart).
@@ -140,8 +168,8 @@ The Compliance Checking Script is certified by the [CIS Center of Internet Secur
140
168
141
169
# License
142
170
143
-
Copyright (c) 2022-2023 Oracle and/or its affiliates.
171
+
Copyright (c) 2022-2024 Oracle and/or its affiliates.
144
172
145
173
Licensed under the Universal Permissive License (UPL), Version 1.0.
146
174
147
-
See [LICENSE](https://github.com/oracle-devrel/technology-engineering/blob/folder-structure/LICENSE) for more details.
175
+
See [LICENSE](https://github.com/oracle-devrel/technology-engineering/blob/main/LICENSE) for more details.
Copy file name to clipboardExpand all lines: security/security-design/shared-assets/oci-security-health-check-standard/files/oci-security-health-check-standard/README.txt
+31-9Lines changed: 31 additions & 9 deletions
Original file line number
Diff line number
Diff line change
@@ -2,7 +2,7 @@
2
2
OCI Security Health Check - Standard Edition
3
3
============================================
4
4
Owner: Olaf Heimburger
5
-
Version: 230922
5
+
Version: 240130
6
6
7
7
When to use this asset?
8
8
@@ -23,12 +23,13 @@ Usage
23
23
steps for setting this up are described in the next chapter.
24
24
25
25
1.1 Setup an Auditor group and policy
26
-
Using an auditor group is the recommended way to run the assessment script.
27
-
To create a group for auditing do the following steps:
28
-
29
-
- Log into OCI Console as OCI administrator
26
+
- Check whether your tenancy is still not migrated to Identity Domains:
27
+
- Login to OCI Console as OCI Administrator
28
+
- Select "Identity & Security"
29
+
- If "Domains" are listed you are migrated to Identity Domains
30
30
- Create a group grp-auditors
31
31
- Create a policy pcy-auditing with these statements:
32
+
- For tenancies without Identity Domains use
32
33
allow group grp-auditors to inspect all-resources in tenancy
33
34
allow group grp-auditors to read instances in tenancy
34
35
allow group grp-auditors to read load-balancers in tenancy
@@ -44,6 +45,22 @@ Usage
44
45
allow group grp-auditors to read vss-family in tenancy
45
46
allow group grp-auditors to read dns in tenancy
46
47
allow group grp-auditors to use cloud-shell in tenancy
48
+
- For tenancies *with* Identity Domains use
49
+
allow group 'Default'/'grp-auditors' to inspect all-resources in tenancy
50
+
allow group 'Default'/'grp-auditors' to read instances in tenancy
51
+
allow group 'Default'/'grp-auditors' to read load-balancers in tenancy
52
+
allow group 'Default'/'grp-auditors' to read buckets in tenancy
53
+
allow group 'Default'/'grp-auditors' to read nat-gateways in tenancy
54
+
allow group 'Default'/'grp-auditors' to read public-ips in tenancy
55
+
allow group 'Default'/'grp-auditors' to read file-family in tenancy
56
+
allow group 'Default'/'grp-auditors' to read instance-configurations in tenancy
57
+
allow group 'Default'/'grp-auditors' to read network-security-groups in tenancy
58
+
allow group 'Default'/'grp-auditors' to read resource-availability in tenancy
59
+
allow group 'Default'/'grp-auditors' to read audit-events in tenancy
60
+
allow group 'Default'/'grp-auditors' to read users in tenancy
61
+
allow group 'Default'/'grp-auditors' to read vss-family in tenancy
62
+
allow group 'Default'/'grp-auditors' to read dns in tenancy
63
+
allow group 'Default'/'grp-auditors' to use cloud-shell in tenancy
47
64
- Assign a user to the grp-auditors group
48
65
- Log out of OCI Console
49
66
@@ -72,20 +89,25 @@ Usage
72
89
compressed in a single ZIP file and the resulting ZIP file will be moved to
73
90
the home directory of the account running the script.
74
91
92
+
4 Known Issues
93
+
94
+
4.1 Wrong urllib3 version
95
+
96
+
There is a known dependency between Python urllib3 version 2 and the OS installed version of OpenSSL. The script tries to handle this automatically using a working version of urllib3. If the handling does not work let us know.
75
97
76
-
4 Credits
98
+
5 Credits
77
99
78
100
The OCI Security Health Check - Standard Edition streamlines the usage of the bundled Compliance Checking Script (https://github.com/oracle-quickstart/oci-cis-landingzone-quickstart/blob/main/compliance-script.md) provided by the CIS OCI Landing Zone Quick Start Template (https://github.com/oracle-quickstart/oci-cis-landingzone-quickstart).
79
101
80
102
The OCI Security Health Check - Standard Edition would not be possible without the great work of the CIS OCI Landing Zone Quick Start Template Team (https://github.com/oracle-quickstart/oci-cis-landingzone-quickstart/graphs/contributors).
81
103
82
-
5 Certification
104
+
6 Certification
83
105
84
106
The Compliance Checking Script is certified by the CIS Center of Internet Security for the OCI Oracle Cloud Foundation Benchmark v1.2.O, Level 1 and 2 (https://www.cisecurity.org/partner/oracle).
85
107
86
-
6 License
108
+
7 License
87
109
88
-
Copyright (c) 2022-2023 Oracle and/or its affiliates.
110
+
Copyright (c) 2022-2024 Oracle and/or its affiliates.
89
111
90
112
Licensed under the Universal Permissive License (UPL), Version 1.0.
0 commit comments