CIS Benchmarks
Table of Contents
CIS Benchmarks
The CIS Benchmarks provide consensus-oriented best practices for securely configuring systems.
Prisma Cloud provides checks that validate the recommendations in the following CIS Benchmarks:
We have graded each check using a system of four possible scores: critical, high, medium, and low.
This scoring system lets you create compliance rules that take action depending on the severity of the violation.
If you want to be reasonably certain that your environment is secure, you should address all critical and high checks.
By default, all critical and high checks are set to alert, and all medium and low checks are set to ignore.
We expect customers to review, but probably never fix, medium and low checks.
There are just a handful of checks graded as critical.
Critical is reserved for things where your container environment is exposed to the Internet, and can result in a direct attack by somebody on the outside.
They should be addressed immediately.
Prisma Cloud has not implemented CIS checks marked as Not Scored.
These checks are are hard to define in a strict way.
Other checks are might not implemented because the logic is resource-heavy, results depend on user input, or files cannot be parsed reliably.
Additional details about Prisma Cloud’s implementation of the CIS benchmarks
The compliance rule dialog provides some useful information.
Compliance rules for containers can be created under
Defend > Compliance > Containers and Images
, while compliance rules for hosts can be created under Defend > Compliance > Hosts
.Benchmark versions
— To see which version of the CIS benchmark is supported in the product, click on the All types
drop-down list.
Grades
— To see Prisma Cloud’s grade for a check, see the corresponding Severity
column.
Built-in policy library
— To enable the checks for the PCI DSS, HIPAA, NIST SP 800-190, and GDPR standards, select the appropriate template.
Notes on the CIS OpenShift benchmark
When Prisma Cloud detects OpenShift Container Platform (OCP) 4, we assess the cluster against the CIS OpenShift benchmark.
Prisma Cloud supports the CIS OpenShift benchmark on OCP 4.6 and later.
The following checks from the CIS OpenShift benchmark haven’t been implemented:
- 1.2.7 - Ensure that the --authorization-mode argument is not set to AlwaysAllow.
- 1.2.10 - Ensure that the APIPriorityAndFairness feature gate is enabled.
- 1.2.11 - Ensure that the admission control plugin AlwaysAdmit is not set.
- 1.2.16 - Ensure that the admission control plugin SecurityContextConstraint is set.
- 1.2.21 - Ensure that the healthz endpoint is protected by RBAC.
- 1.2.23 - Ensure that the audit logs are forwarded off the cluster for retention.
- 1.2.33 - Ensure that the --encryption-provider-config argument is set as appropriate.
- 1.2.34 - Ensure that encryption providers are appropriately configured.
- 1.2.35 - Ensure that the API Server only makes use of Strong Cryptographic Ciphers.
- 1.3.1 - Ensure that garbage collection is configured as appropriate.
- 1.3.2 - Ensure that controller manager healthz endpoints are protected by RBAC.
- 1.4.1 - Ensure that the healthz endpoints for the scheduler are protected by RBAC.
- 1.4.2 - Verify that the scheduler API service is protected by authentication and authorization.
- 3.1.1 - Client certificate authentication should not be used for users.
- 3.2.2 - Ensure that the audit policy covers key security concerns.
- 4.2.2 - Ensure that the --authorization-mode argument is not set to AlwaysAllow.
- 4.2.7 - Ensure that the --make-iptables-util-chains argument is set to true.
- 4.2.8 - Ensure that the --hostname-override argument is not set.
- 4.2.9 - Ensure that the kubeAPIQPS [--event-qps] argument is set to 0 or a level which ensures appropriate event capture.
- 4.2.13 - Ensure that the Kubelet only makes use of Strong Cryptographic Ciphers.
- Section 5 - Policies.
Notes on the CIS Distribution Independent Linux benchmark
Prisma Cloud hasn’t implemented the following checks from the CIS Distribution Independent Linux benchmark:
- 1.7.2 - Ensure GDM login banner is configured — By default, most server distributions ship without a windows manager. A manual assessment is required.
- 2.2.1.2 - Ensure ntp (Network Time Protocol) is configured — CIS did not score this recommendation. A manual assessment is required.
- 2.2.1.3 - Ensure chrony is configured — CIS did not score this recommendation. A manual assessment is required.
- 5.3.1 - Ensure password creation requirements are configured — This recommendation cannot be implemented generically because password requirements vary from organization to organization. A manual assessment is required.