DESCRIPTION

Identifies Azure MySQL Database Servers which are using the insecure TLS version. As a best practice, use the newer TLS version as the minimum TLS version.

Identifies Azure Storage Accounts which are using the insecure TLS version. As a best practice, use the newer TLS version as the minimum TLS version for Azure Storage Accounts.

Identifies GCP VM instances where the OS Login configuration is overriding the project OS Login configuration. Enabling OS Login ensures that the SSH keys used to connect to instances are mapped with IAM users. Revoking access to an IAM user will revoke all the SSH keys associated with that user—it facilitates centralized and automated SSH key pair management which is useful in handling cases like a response to compromised SSH key pairs.

There are 16 new UEBA anomaly policies to detect user activity from the TOR anonymity network. TOR is often used by hackers to hide their identity so that their suspicious operations like creating copies of VM images won’t be traced back to them. Each policy corresponds to one of the different service groups available in AWS, Azure, and GCP—for example—analytics, containers, compute, security, storage, and web. All the policies are classified as high severity and identify defense evasion and impact attack tactics listed in the MITRE ATT&CK framework. The policies are disabled by default, but customers can manually enable them according to their security needs and the cloud services used in their environments. Here’s the list of UEBA policies:

The following anomaly policies have a reduction from high to medium:

The following anomaly policies have a reduction from high to low:

AWS Redshift managed ENI reachable from any untrust internet source

Identifies Network interfaces attached to the Redshift cluster that are exposed to inbound traffic from any untrusted Internet source. Redshift clusters exposed to the Internet are prone to external security threats. As a best practice, restrict network interfaces that are attached to the Redshift cluster to known hosts or services only.

AWS RDS managed ENI reachable from any untrust internet source

Identifies Network interfaces attached to RDS instances that are exposed to inbound traffic from any untrusted Internet source. RDS instances exposed to the Internet are prone to external security threats. As a best practice, restrict network interfaces that are attached to the RDS instance to known hosts or services only.

AWS EC2 instance allows outbound unrestricted access (0.0.0.0/0) to the internet

Identifies EC2 instances that allow unrestricted outbound traffic to the Internet. As a best practice, restrict outbound traffic and limit the access to known hosts or services.

AWS EC2 instance that is internet reachable with unrestricted access (0.0.0.0/0) other than HTTP/HTTPS port

Identifies AWS EC2 instances that are reachable from the Internet with unrestricted access (0.0.0.0/0) other than HTTP/HTTPS port. EC2 instances with unrestricted access to the Internet enable bad actors to use brute force on a system to gain unauthorized access to the entire network. As a best practice, restrict traffic from unknown IP addresses and limit the access to known hosts, services, or specific entities.

Changes–

The following

config

policies are deleted because Cloud Network Analyzer provides you alerts for resources which are truly exposed to the Internet. You can create custom policies to alert on specific ports:

Impact–

Previously generated alerts will be resolved as Policy_Deleted. The compliance reports for the following are impacted: APRA (CPS 234) Information Security, AWS Foundational Security Best Practices standard, CIS Amazon Web Services Foundations Benchmark v 1.4.0, Cybersecurity Maturity Model Certification (CMMC) v.1.02, Cloud Security Alliance Cloud Controls Matrix (CCM) Version 4.0.1, HITRUST v.9.4.2, ISO/IEC 27002:2013, ISO/IEC 27017:2015, ISO/IEC 27018:2019, Brazilian Data Protection Law (LGPD), MAS TRM 2021, MLPS 2.0, MPAA Content Protection Best Practices, NIST SP 800-171 Revision 2, NIST SP 800-172, NIST 800-53 Rev4, NIST 800-53 Rev 5, NIST CSF, New Zealand Information Security Manual (NZISM v3.4), PCI DSS v3.2.1, Risk Management in Technology (RMiT), CCPA 2018, CSA CCM v3.0.1, GDPR, HITRUST CSF v9.3, MITRE ATT

The following policies are deleted to reduce the number of alerts you receive:

Impact–

All open alerts will be resolved as Policy_Deleted. In addition, the reports for the following standards are impacted: APRA (CPS 234) Information Security, AWS Foundational Security Best Practices standard, Cybersecurity Maturity Model Certification (CMMC) v.1.02, Cloud Security Alliance Cloud Controls Matrix (CCM) Version 4.0.1, HITRUST v.9.4.2, ISO/IEC 27002:2013, ISO/IEC 27017:2015, ISO/IEC 27018:2019, Brazilian Data Protection Law (LGPD), MAS TRM 2021, MLPS 2.0, NIST SP 800-171 Revision 2, NIST SP 800-172, NIST 800-53 Rev4, NIST 800-53 Rev 5, NIST CSF, New Zealand Information Security Manual (NZISM v3.4), PCI DSS v3.2.1, Risk Management in Technology (RMiT), CCPA 2018, CSA CCM v3.0.1, HITRUST CSF v9.3, MITRE ATT&CK version 6.3, MITRE ATT&CK v8.2, PIPEDA, SOC 2, and MITRE ATT&CK v10.0.

GCP sink not configured to export all log entries

This policy is deleted as GCP started supporting two cloud logging buckets named _Default and _Required. These two buckets can’t be modified and when combined, store all the logs specific to a GCP project.

Impact—

Previously generated alerts will be resolved as Policy_Deleted.

Changes—

Cloud Network Analyzer replaces the following

config

policies to alert for resources that are truly exposed to the Internet; the severity of these policies are changed from high to low:

Impact–

No impact on existing alerts.

DESCRIPTION

The

Azure Storage Account using insecure TLS version

policy has been mapped to Azure CIS v1.4.0, section 3.12.

Impact—

No impact on existing alerts. The compliance score may be impacted because a new mapping has been added.

Anomaly policies are no longer mapped to any compliance standard supported on Prisma Cloud, except for the MITRE ATT&CK framework.

DESCRIPTION

A new Adoption Advisor API enables you to explore data about the security capabilities you’ve adopted. It also uncovers unused capabilities that might optimize your security hygiene.