本文提供法規遵循管理工具內建雲端架構的參考內容。
Google Recommended AI Essentials - Vertex AI
支援的雲端服務供應商： Google Cloud
這個架構列出 Google 建議的 Vertex AI 工作負載安全防護最佳做法，並提供一系列必要預防和偵測政策。在 Security Command Center 中啟用 AI Protection 後，AI 安全性資訊主頁就會自動顯示針對此架構的詳細安全合規評估。
這個架構包含下列雲端控管機制：
- Block Default VPC Network for Vertex AI Workbench Instances
- Block File Downloading in JupyterLab Console
- Block Internet Access for Vertex AI Runtime Templates
- Block Public IP Address for Vertex AI Workbench Instances
- Block Root Access on Vertex AI Workbench Instances
- Enable Automatic Upgrades for Vertex AI WorkBench Instances
- Enable CMEK for Vertex AI Custom Jobs
- Enable CMEK for Vertex AI Datasets
- Enable CMEK for Vertex AI Endpoints
- Enable CMEK for Vertex AI Featurestore
- Enable CMEK for Vertex AI Hyperparameter Tuning Jobs
- Enable CMEK for Vertex AI Metadata Stores
- Enable CMEK for Vertex AI Models
- Enable CMEK for Vertex AI Notebook Runtime Templates
- Enable CMEK for Vertex AI TensorBoard
- Enable CMEK for Vertex AI Training Pipelines
- Enable CMEK for Vertex AI Workbench Instances
- Enable Delete to Trash Feature for Vertex AI Workbench Instances
- Enable Idle Shutdown for Vertex AI Runtime Templates
- Enable Integrity Monitoring for Vertex AI Workbench Instances
- Enable Secure Boot for Vertex AI Runtime Templates
- Enable Secure Boot for Vertex AI Workbench Instances
- Enable vTPM on Vertex AI Workbench Instances
- Restrict Use of Default Service Account for Vertex AI Workbench Instances
CIS GKE 1.7
支援的雲端服務供應商： Google Cloud
CIS GKE 基準是一套安全建議和最佳做法，專為 Google Kubernetes Engine (GKE) 叢集量身打造。這項基準旨在提升 GKE 環境的安全防護機制。
這個架構包含下列雲端控管機制：
- Block Legacy Authorization on GKE Clusters
- Disable Alpha Features on GKE Clusters
- Disable Client Certificate Authentication for GKE
- Disable Legacy Metadata Server Endpoints on Compute Engine
- Don't Use Kubernetes Web UI
- Enable Auto Repair for GKE Clusters
- Enable Auto Upgrade on GKE Clusters
- Enable Cloud Logging on GKE Clusters
- Enable Cloud Monitoring on GKE Clusters
- Enable CMEK on GKE Node Pool Boot Disks
- Enable Control Plane Authorized Networks on GKE Clusters
- Enable Encryption on GKE Clusters
- Enable Integrity Monitoring on GKE Clusters
- Enable Intranode Visibility for GKE Clusters
- Enable IP Alias Range for GKE Clusters
- Enable Network Policy on GKE Clusters
- Enable PodSecurityPolicies for GKE Clusters
- Enable Private Clusters for GKE
- Enable Secure Boot for Shielded GKE Nodes
- Enable Shielded GKE Nodes on a Cluster
- Enable Workload Identity Federation for GKE on clusters
- Require Binary Authorization on a Cluster
- Require Container-Optimized OS for a GKE Cluster
- Require GKE Sandbox for GKE clusters
- Require Private Nodes in GKE Clusters
- Require Workload Identity Federation for GKE and the GKE Metadata Server
- Subscribe a GKE Cluster to a Release Channel
- Use Google Groups for Kubernetes RBAC
- Use Least Privilege Service Accounts for GKE Clusters
CIS Critical Security Controls v8
支援的雲端服務供應商： Google Cloud
優先採取的防護措施，可防範常見的網路威脅。NIST CSF 提供實用的網路防禦方法，並根據機構的成熟度分為實作群組 (IG1、IG2、IG3)。
這個架構包含下列章節中的雲端控制群組和雲端控制項。
cis-controls-1-1
建立並維護所有可能儲存或處理資料的企業資產清單，確保清單內容準確、詳細且為最新狀態，包括：使用者裝置 (包括可攜式和行動裝置)、網路裝置、非運算/物聯網裝置和伺服器。請確保清單記錄每個資產的網路位址 (如為靜態)、硬體位址、機器名稱、企業資產擁有者、部門，以及資產是否已獲准連上網路。如果是行動裝置，MDM 類型的工具可視情況支援這個程序。這份清單包括實體、虛擬、遠端連線至基礎架構的資產，以及雲端環境中的資產。此外，即使資產不受企業控制，只要定期連線至企業的網路基礎架構，也屬於這類資產。每半年或更頻繁地檢查並更新所有企業資產的清單。
- Create and Manage Asymmetric Keys
- Define Set Storage Class Lifestyle Action on Bucket
- Enable Cloud Asset Inventory Service
cis-controls-10-2
為所有企業資產設定自動更新反惡意軟體簽章檔。
- Enable Object Versioning on Buckets
- Enable Subnet Flow Logs
- Enable VPC Flow Logs for Compute Engine Instances
cis-controls-10-3
停用可移除式媒體的自動執行功能。
cis-controls-10-6
集中管理防範惡意軟體軟體。
- Enable Log Locks Wait Flag for PostgreSQL instance
- Enable Subnet Flow Logs
- Enable VPC Flow Logs for Compute Engine Instances
cis-controls-11-1
建立並維護有記錄的資料復原程序，包括詳細的備份程序。在此過程中，請說明資料復原活動的範圍、復原優先順序，以及備份資料的安全性。每年或發生可能影響這項安全措施的重大企業變更時，請審查及更新說明文件。
- Enable AlloyDB Automated Backups on Cluster
- Enable AlloyDB Backups on Cluster
- Enable Auto Repair for GKE Clusters
cis-controls-11-2
自動備份範圍內的企業資產。視資料的敏感程度而定，每週或更頻繁地執行備份。
- Enable AlloyDB Automated Backups on Cluster
- Enable AlloyDB Backups on Cluster
- Enable Automatic Backups for Cloud SQL Databases
cis-controls-11-3
使用與原始資料同等的控制項保護復原資料。根據需求參照加密或資料分離。
- Enable AlloyDB Automated Backups on Cluster
- Enable AlloyDB Backups on Cluster
- Enable SSL Encryption On AlloyDB Instances
cis-controls-11-4
建立並維護獨立的復原資料執行個體。例如透過離線、雲端或異地系統/服務，控管備份目的地的版本。
cis-controls-11-5
每季或更頻繁地測試備份還原作業，以瞭解範圍內企業資產的樣本。
cis-controls-12-2
設計及維護安全的網路架構。安全的網路架構至少須解決區隔、最小權限和可用性問題。實作範例可能包括說明文件、政策和設計元件。
- Block Connections to DNS Ports from All IP Addresses
- Block Connections to Elasticsearch Ports from All IP Addresses
- Block Connections to FTP Ports from All IP Addresses
- Block Connections to LDAP Ports from All IP Addresses
- Block Connections to Memcached Ports from All IP Addresses
- Block Connections to MongoDB Ports from All IP Addresses
- Block Connections to MySQL Ports from All IP Addresses
- Block Connections to NetBIOS Ports from All IP Addresses
- Block Connections to Oracle Database Ports from All IP Addresses
- Block Connections to POP3 Server Ports from All IP Addresses
- Block Connections to PostgreSQL Server Ports from All IP Addresses
- Block Connections to Redis Server Ports from All IP Addresses
- Block Connections to SMTP Server Ports from All IP Addresses
- Block Generic Access to HTTP Ports
- Block Generic Access to Telnet Servers
- Block Overly Permissive Firewall Rules
- Configure Access Controls for the Network Boundary
- Configure the Allowed Ingress Settings for Cloud Run Organization Policy Constraint
- Configure the Allowed VPC Egress Settings for Cloud Run Organization Policy Constraint
- Configure the Disable VPC Internal IPv6 Usage Organization Policy
- Enable Control Plane Authorized Networks on GKE Clusters
- Enable IP Alias Range for GKE Clusters
- Enable Private Clusters for GKE
- Enable Private Google Access on an instance
cis-controls-12-3
安全地管理網路基礎架構。實作範例包括版本受控的基礎架構即程式碼 (IaC)，以及使用安全網路通訊協定，例如 SSH 和 HTTPS。
- Block Service Account Key Creation
- Block Service Account Key Uploads
- Configure Access Controls for the Network Boundary
- Configure the Disable VPC Internal IPv6 Usage Organization Policy
- Define a Security Policy to Mitigate for DDoS Events
- Enable Network Policy on GKE Clusters
cis-controls-12-5
集中管理網路 AAA。
- Set Log Min Error Statement Flag for AlloyDB Instances
- Set Log Min Messages Flag for AlloyDB Instances
cis-controls-12-6
採用安全的網路管理通訊協定 (例如 802.1X) 和安全通訊協定 (例如 Wi-Fi Protected Access 2 (WPA2) Enterprise 或更安全的替代方案)。
cis-controls-12-7
要求使用者先向企業管理的 VPN 和驗證服務進行驗證，才能在終端使用者裝置上存取企業資源。
- Define Secret Manager Rotation Schedule
- Set Log Min Error Statement Flag for AlloyDB Instances
- Set Log Min Messages Flag for AlloyDB Instances
cis-controls-13-1
集中管理企業資產的安全性事件快訊，以便進行記錄檔關聯和分析。如要採用最佳做法，必須使用 SIEM，包括供應商定義的事件關聯性快訊。如果記錄檔分析平台已設定與安全性相關的關聯性快訊，也符合這項安全防護措施。
cis-controls-13-2
在企業資產上部署主機入侵偵測解決方案 (視情況和/或支援而定)。
cis-controls-13-3
視情況在企業資產上部署網路入侵偵測解決方案。例如使用網路入侵偵測系統 (NIDS) 或同等雲端服務供應商 (CSP) 服務。
- Enable Intranode Visibility for GKE Clusters
- Prevent Nested Virtualization for Compute Engine VMs
- Restrict Public IP Addresses on Vertex AI Workbench Notebooks and Instances
cis-controls-13-4
視需要執行網路區隔之間的流量篩選。
- Block Connections to DNS Ports from All IP Addresses
- Block Connections to Elasticsearch Ports from All IP Addresses
- Block Connections to FTP Ports from All IP Addresses
- Block Connections to LDAP Ports from All IP Addresses
- Block Connections to Memcached Ports from All IP Addresses
- Block Connections to MongoDB Ports from All IP Addresses
- Block Connections to MySQL Ports from All IP Addresses
- Block Connections to NetBIOS Ports from All IP Addresses
- Block Connections to Oracle Database Ports from All IP Addresses
- Block Connections to POP3 Server Ports from All IP Addresses
- Block Connections to PostgreSQL Server Ports from All IP Addresses
- Block Connections to Redis Server Ports from All IP Addresses
- Block Connections to SMTP Server Ports from All IP Addresses
- Block Generic Access to HTTP Ports
- Block Generic Access to Telnet Servers
- Block Overly Permissive Firewall Rules
- Configure the Allowed Ingress Settings for Cloud Run Organization Policy Constraint
- Configure the Disable VPC Internal IPv6 Usage Organization Policy
- Define a Security Policy to Mitigate for DDoS Events
- Implement Continuous Network Traffic Monitoring
cis-controls-13-5
管理遠端連線至企業資源的資產存取權。根據下列條件決定企業資源的存取權量：安裝最新的防惡意軟體、設定符合企業安全設定程序，以及確保作業系統和應用程式為最新版本。
- Block Connections to DNS Ports from All IP Addresses
- Block Connections to Elasticsearch Ports from All IP Addresses
- Block Connections to FTP Ports from All IP Addresses
- Block Connections to LDAP Ports from All IP Addresses
- Block Connections to Memcached Ports from All IP Addresses
- Block Connections to MongoDB Ports from All IP Addresses
- Block Connections to MySQL Ports from All IP Addresses
- Block Connections to NetBIOS Ports from All IP Addresses
- Block Connections to Oracle Database Ports from All IP Addresses
- Block Connections to POP3 Server Ports from All IP Addresses
- Block Connections to PostgreSQL Server Ports from All IP Addresses
- Block Connections to Redis Server Ports from All IP Addresses
- Block Connections to SMTP Server Ports from All IP Addresses
- Block Generic Access to HTTP Ports
- Block Generic Access to Telnet Servers
- Block Overly Permissive Firewall Rules
- Define Set Storage Class Lifestyle Action on Bucket
cis-controls-13-6
從網路裝置收集網路流量記錄和/或網路流量，以供檢查及發出警報。
- Block Connections to DNS Ports from All IP Addresses
- Block Connections to Elasticsearch Ports from All IP Addresses
- Block Connections to FTP Ports from All IP Addresses
- Block Connections to LDAP Ports from All IP Addresses
- Block Connections to Memcached Ports from All IP Addresses
- Block Connections to MongoDB Ports from All IP Addresses
- Block Connections to MySQL Ports from All IP Addresses
- Block Connections to NetBIOS Ports from All IP Addresses
- Block Connections to Oracle Database Ports from All IP Addresses
- Block Connections to POP3 Server Ports from All IP Addresses
- Block Connections to PostgreSQL Server Ports from All IP Addresses
- Block Connections to Redis Server Ports from All IP Addresses
- Block Connections to SMTP Server Ports from All IP Addresses
- Block Generic Access to HTTP Ports
- Block Generic Access to Telnet Servers
- Block Overly Permissive Firewall Rules
- Configure the Allowed VPC Egress Settings for Cloud Run Organization Policy Constraint
- Enable Control Plane Authorized Networks on GKE Clusters
- Enable IP Alias Range for GKE Clusters
- Enable Private Google Access on an instance
cis-controls-13-7
在企業資產上部署主機型入侵防禦解決方案 (視情況和/或支援而定)。例如使用端點偵測與應變 (EDR) 用戶端或主機型 IPS 代理程式。
- Configure the Allowed Ingress Settings for Cloud Run Organization Policy Constraint
- Implement Continuous Network Traffic Monitoring
cis-controls-13-8
視情況部署網路入侵防護解決方案。例如使用網路入侵預防系統 (NIPS) 或同等 CSP 服務。
- Prevent Nested Virtualization for Compute Engine VMs
- Restrict Public IP Addresses on Vertex AI Workbench Notebooks and Instances
cis-controls-13-9
部署連接埠層級存取權控管。連接埠層級的存取權控管機制會使用 802.1x 或類似的網路存取權控管通訊協定 (例如憑證)，並可能納入使用者和/或裝置驗證。
- Block Connections to DNS Ports from All IP Addresses
- Block Connections to Elasticsearch Ports from All IP Addresses
- Block Connections to FTP Ports from All IP Addresses
- Block Connections to LDAP Ports from All IP Addresses
- Block Connections to Memcached Ports from All IP Addresses
- Block Connections to MongoDB Ports from All IP Addresses
- Block Connections to MySQL Ports from All IP Addresses
- Block Connections to NetBIOS Ports from All IP Addresses
- Block Connections to Oracle Database Ports from All IP Addresses
- Block Connections to POP3 Server Ports from All IP Addresses
- Block Connections to PostgreSQL Server Ports from All IP Addresses
- Block Connections to Redis Server Ports from All IP Addresses
- Block Connections to SMTP Server Ports from All IP Addresses
- Block Generic Access to HTTP Ports
- Block Generic Access to Telnet Servers
- Block Overly Permissive Firewall Rules
- Configure the Allowed VPC Egress Settings for Cloud Run Organization Policy Constraint
- Enable Control Plane Authorized Networks on GKE Clusters
- Enable IP Alias Range for GKE Clusters
- Enable Private Google Access on an instance
cis-controls-14-1
建立並維護資安意識計畫。安全意識計畫的目的是教育企業員工如何安全地與企業資產和資料互動。在聘用時和每年至少一次進行訓練。每年或發生可能影響這項安全措施的重大企業變更時，請審查及更新內容。
cis-controls-14-3
向員工說明驗證最佳做法。例如 MFA、密碼組成和憑證管理。
cis-controls-14-5
訓練員工，瞭解無意間洩漏資料的原因。例如：機密資料誤傳、遺失可攜式使用者裝置，或將資料發布給非預期對象。
cis-controls-16-1
建立並維護安全的應用程式開發程序。在此過程中，請處理下列項目：安全應用程式設計標準、安全程式設計做法、開發人員訓練、安全漏洞管理、第三方程式碼安全性，以及應用程式安全測試程序。每年或發生可能影響這項安全措施的重大企業變更時，請審查及更新說明文件。
- Enable Artifact Analysis Vulnerability Scanning
- Require Rotation of API Key
- Restrict API Keys for Required APIs Only
- Set Application Restriction on API Keys
cis-controls-16-11
針對身分管理、加密、稽核和記錄等應用程式安全元件，使用經過審查的模組或服務。在重要的安全防護功能中使用平台功能，可減少開發人員的工作量，並盡可能避免設計或實作錯誤。現代作業系統提供有效的身分識別、驗證和授權機制，並將這些機制提供給應用程式。請只使用標準化、目前可接受且經過廣泛審查的加密演算法。作業系統也提供建立及維護安全稽核記錄的機制。
- Configure the Allowed Ingress Settings for Cloud Run Organization Policy Constraint
- Enable CMEK for Cloud SQL Databases
- Enable SSL Encryption On AlloyDB Instances
- Encrypt Pub/Sub topic with CMEK
- Restrict Insecure SSL Policies for Compute Engine Instances
cis-controls-16-12
在應用程式生命週期中套用靜態和動態分析工具，確認遵循安全的程式設計做法。
cis-controls-16-13
執行應用程式滲透測試。對於重要應用程式，相較於程式碼掃描和自動化安全測試，經過驗證的滲透測試更適合找出業務邏輯安全漏洞。滲透測試需要測試人員的專業技能，以驗證和未驗證使用者的身分，手動操控應用程式。
cis-controls-16-2
建立並維護軟體安全漏洞報告的接受和處理程序，包括提供外部實體回報安全漏洞的方式。這個程序應包含以下項目：安全漏洞處理政策，其中應載明回報程序、負責處理安全漏洞報告的單位，以及安全漏洞的接收、指派、修復和修復測試程序。在過程中，請使用安全漏洞追蹤系統，其中包含嚴重程度評估和指標，用於測量安全漏洞的識別、分析和修復時間。每年或發生可能影響這項安全措施的重大企業變更時，請審查及更新文件。第三方應用程式開發人員必須將這項政策視為對外政策，協助外部利害關係人瞭解相關規定。
cis-controls-16-3
對安全漏洞執行根本原因分析。在審查安全漏洞時，根本原因分析是評估程式碼中造成安全漏洞的潛在問題，讓開發團隊不只是在發生個別安全漏洞時進行修正。
cis-controls-16-7
針對應用程式基礎架構元件，使用業界建議的標準強化設定範本。包括基礎伺服器、資料庫和網頁伺服器，適用於雲端容器、平台即服務 (PaaS) 元件和軟體即服務 (SaaS) 元件。請勿允許內部開發的軟體削弱設定強化功能。
- Set Log Min Messages Flag for AlloyDB Instances
- Turn Off Local Infile Flag for MySQL
- Turn off Log Parser Stats Flag for PostgreSQL
- Turn off Log Planner Stats Flag for PostgreSQL
cis-controls-17-2
建立並維護需要瞭解安全事件的各方聯絡資訊。聯絡人可能包括內部員工、服務供應商、執法單位、網路保險供應商、相關政府機構、資訊分享與分析中心 (ISAC) 合作夥伴或其他利害關係人。每年驗證聯絡人，確保資訊符合現況。
cis-controls-17-4
制定並維護事件應變流程文件，當中應說明角色和職責、法規遵循規定，以及通訊計畫。每年審查，或在發生可能影響這項安全措施的重大企業變更時審查。
- Define Vertex AI Access Mode
- Enable Log Locks Wait Flag for PostgreSQL instance
- Set Log Min Messages Flag for AlloyDB Instances
cis-controls-17-9
建立並維持安全事件門檻，包括至少要區分事件和事件。例如：異常活動、安全漏洞、安全弱點、資料外洩、隱私權事件等。每年或發生可能影響這項安全措施的重大企業變更時，請進行審查。
cis-controls-18-1
根據企業規模、複雜度、產業和成熟度，建立並維護適當的滲透測試計畫。滲透測試計畫的特徵包括範圍 (例如網路、網頁應用程式、應用程式開發介面 (API)、託管服務和實體場所控制項)；頻率；限制 (例如可接受的時間和排除的攻擊類型)；聯絡人資訊；補救措施 (例如調查結果的內部傳送方式)；以及回溯要求。
- Enable the Restrict Authorized Networks on Cloud SQL Instances Organization Policy Constraint
- Use Latest Image Versions on Dataproc Clusters
cis-controls-18-2
根據計畫規定，定期執行外部滲透測試，每年至少一次。外部滲透測試必須包含企業和環境偵察，以偵測可供利用的資訊。滲透測試需要專業技能和經驗，且必須由合格人員進行。測試盒可能是透明或不透明。
- Define a Security Policy to Mitigate for DDoS Events
- Enable the Restrict Authorized Networks on Cloud SQL Instances Organization Policy Constraint
- Use Latest Image Versions on Dataproc Clusters
cis-controls-18-5
根據計畫規定，定期執行內部滲透測試，每年至少一次。測試盒可能是透明或不透明。
cis-controls-2-7
使用數位簽章和版本控制等技術控管措施，確保只有授權指令碼 (例如特定 .ps1 和 .py 檔案) 能夠執行。禁止執行未經授權的指令碼。每半年或更頻繁地重新評估。
cis-controls-3-1
建立並維護有記錄的資料管理程序。在此過程中，請根據企業的敏感度和保留標準，處理資料敏感度、資料擁有者、資料處理、資料保留限制和處置要求。每年或發生可能影響這項安全措施的重大企業變更時，請審查及更新說明文件。
- Block Connections to DNS Ports from All IP Addresses
- Block Connections to Elasticsearch Ports from All IP Addresses
- Block Connections to FTP Ports from All IP Addresses
- Block Connections to LDAP Ports from All IP Addresses
- Block Connections to Memcached Ports from All IP Addresses
- Block Connections to MongoDB Ports from All IP Addresses
- Block Connections to MySQL Ports from All IP Addresses
- Block Connections to NetBIOS Ports from All IP Addresses
- Block Connections to Oracle Database Ports from All IP Addresses
- Block Connections to POP3 Server Ports from All IP Addresses
- Block Connections to PostgreSQL Server Ports from All IP Addresses
- Block Connections to Redis Server Ports from All IP Addresses
- Block Connections to SMTP Server Ports from All IP Addresses
- Block Generic Access to HTTP Ports
- Block Generic Access to Telnet Servers
- Block Overly Permissive Firewall Rules
- Block Project-Wide SSH Keys on Compute Engine Instances
- Configure the Allowed VPC Egress Settings for Cloud Run Organization Policy Constraint
- Create and Manage Asymmetric Keys
- Enable Artifact Analysis Vulnerability Scanning
- Enable Control Plane Authorized Networks on GKE Clusters
- Enable IP Alias Range for GKE Clusters
- Enable Private Google Access on an instance
- Enable SSL Encryption On AlloyDB Instances
- Encrypt Data at Rest with CMEK
- Enforce CMEK
- Enforce Public Access Prevention
- Enforce SSL for all Incoming Database Connections
cis-controls-3-11
加密伺服器、應用程式和資料庫中的靜態機密資料。儲存層加密 (又稱伺服器端加密) 符合這項安全措施的最低要求。其他加密方法可能包括應用程式層級加密(也稱為用戶端加密)，也就是說，即使能存取資料儲存裝置，也無法存取明文資料。
- Create and Manage Asymmetric Keys
- Enable CMEK for AlloyDB Clusters
- Enable CMEK for BigQuery Datasets
- Enable CMEK for BigQuery Tables
- Enable CMEK on Compute Engine Persistent Disks
- Enable CMEK on GKE Node Pool Boot Disks
- Enable Confidential Computing for Compute Engine Instances
- Enable CSEK On Compute Engine Persistent Disks
- Enable Encryption on GKE Clusters
- Enable SSL Encryption On AlloyDB Instances
- Encrypt Data at Rest with CMEK
- Enforce CMEK
- Require CMEK on Dataproc Clusters
- Restrict Non CMEK Services
cis-controls-3-14
記錄機密資料的存取情形，包括修改和處置。
cis-controls-3-2
根據企業的資料管理程序，建立及維護資料清單。至少要清查機密資料。每年至少審查並更新一次商品目錄，優先處理機密資料。
cis-controls-3-3
根據使用者的「需要知道」原則，設定資料存取控制清單。對本機和遠端檔案系統、資料庫和應用程式套用資料存取控制清單 (又稱存取權限)。
- Block Connections to Cassandra Ports from All IP Addresses
- Block Public IP Addresses for AlloyDB Cluster Instances
- Block Public IP Addresses for Cloud SQL Instances
- Configure the Disable VM Serial Port Logging to Stackdriver Organization Policy
- Define Storage Class Lifestyle Action
- Enable Control Plane Authorized Networks on GKE Clusters
- Enable IP Alias Range for GKE Clusters
- Enable Object Versioning on Buckets
- Enable OS Login
- Enable Private Google Access on an instance
- Enable Skip Show Database Flag for MySQL
- Enable the Restrict Authorized Networks on Cloud SQL Instances Organization Policy Constraint
- Enable Uniform Bucket-Level Access on Cloud Storage Buckets
- Enforce Public Access Prevention
- Restrict Public Access to BigQuery Datasets
- Restrict Public Access to Cloud SQL Database Instances
- Restrict Public Access to Cloud Storage Buckets
- Restrict Public IP Addresses to Compute Engine Instances
- Set Uniform Bucket Level Access for Cloud Storage Buckets
- Turn Off Contained Database Authentication Flag for SQL Server
- Turn Off Cross Database Ownership Chaining Flag for SQL Server
cis-controls-3-4
根據企業記錄的資料管理程序保留資料。資料保留時間必須包含最短和最長的時間範圍。
- Define Retention Period for Cloud Storage Buckets
- Disable File Downloads on Vertex AI Workbench Instances
- Lock Storage Bucket Retention Policies
- Require Object Versioning for Cloud Storage Buckets
cis-controls-3-5
按照企業記錄的資料管理程序，安全地處置資料。確保處置程序和方法與資料機密程度相符。
- Define Retention Period for Cloud Storage Buckets
- Define Storage Class Lifestyle Action
- Require Object Versioning for Cloud Storage Buckets
cis-controls-3-6
加密含有機密資料的使用者裝置資料。例如 Windows BitLocker®、Apple FileVault®、Linux® dm-crypt。
- Don't Use Kubernetes Web UI
- Enable Object Versioning on Buckets
- Enable Secure Boot on Compute Engine Instances
- Enable SSL Encryption On AlloyDB Instances
cis-controls-3-7
為企業建立及維護整體資料分類架構。企業可能會使用「機密」、「私密」和「公開」等標籤，並根據這些標籤分類資料。每年審查並更新分類架構，或在發生可能影響這項安全措施的重大企業變更時更新。
- Define Cloud KMS Crypto Keys Protection Level
- Define Cloud KMS Crypto Keys Purpose
- Enforce CMEK for Supported Services
- Verify Cloud KMS Key Version Algorithm
cis-controls-3-8
文件資料流程。資料流程文件包括服務供應商資料流程，應以企業的資料管理程序為依據。每年或發生可能影響這項安全措施的重大企業變更時，請審查及更新說明文件。
- Block Connections to DNS Ports from All IP Addresses
- Block Connections to Elasticsearch Ports from All IP Addresses
- Block Connections to FTP Ports from All IP Addresses
- Block Connections to LDAP Ports from All IP Addresses
- Block Connections to Memcached Ports from All IP Addresses
- Block Connections to MongoDB Ports from All IP Addresses
- Block Connections to MySQL Ports from All IP Addresses
- Block Connections to NetBIOS Ports from All IP Addresses
- Block Connections to Oracle Database Ports from All IP Addresses
- Block Connections to POP3 Server Ports from All IP Addresses
- Block Connections to PostgreSQL Server Ports from All IP Addresses
- Block Connections to Redis Server Ports from All IP Addresses
- Block Connections to SMTP Server Ports from All IP Addresses
- Block Generic Access to HTTP Ports
- Block Generic Access to Telnet Servers
- Block Overly Permissive Firewall Rules
- Configure the Allowed VPC Egress Settings for Cloud Run Organization Policy Constraint
- Enable Control Plane Authorized Networks on GKE Clusters
- Enable IP Alias Range for GKE Clusters
- Enable Private Google Access on an instance
cis-controls-3-9
加密卸除式媒體上的資料。
- Create and Manage Asymmetric Keys
- Enable Encryption on GKE Clusters
- Encrypt Data at Rest with CMEK
- Enforce CMEK
- Restrict Non CMEK Services
cis-controls-4-1
為企業資產 (包括可攜式和行動裝置等使用者裝置、非運算/物聯網裝置，以及伺服器) 和軟體 (作業系統和應用程式) 建立並維護安全設定程序，並將程序記錄下來。每年或發生可能影響這項安全措施的重大企業變更時，請審查及更新說明文件。
- Configure Access Controls for the Network Boundary
- Configure the Allowed Ingress Settings for Cloud Run Organization Policy Constraint
- Configure the Disable VM Serial Port Logging to Stackdriver Organization Policy
- Configure the Disable VPC Internal IPv6 Usage Organization Policy
- Create and Manage Asymmetric Keys
- Define a Security Policy to Mitigate for DDoS Events
- Define Cloud KMS Crypto Keys Protection Level
- Define Cloud KMS Crypto Keys Purpose
- Define Retention Period for Cloud Storage Buckets
- Define Storage Class Lifestyle Action
- Don't Use Kubernetes Web UI
- Don't Use User Connections Flag for SQL Server
- Don't Use User Options Flag for SQL Server
- Enable 3625 Trace Database Flag for SQL Server
- Enable Control Plane Authorized Networks on GKE Clusters
- Enable IP Alias Range for GKE Clusters
- Enable Log Checkpoints Flag for PostgreSQL
- Enable Log Duration Flag for PostgreSQL instance
- Enable Log Temp Files Flag for PostgreSQL instance
- Enable OS Login
- Enable Private Google Access on an instance
- Enable Secure Boot on Compute Engine Instances
- Encrypt Data at Rest with CMEK
- Enforce CMEK
- Enforce CMEK for Supported Services
- Ensure Minimum TLS 1.2 Version
- Restrict Legacy TLS Versions
- Terminate Network Connections
- Turn Off Log Executor Stats Flag for PostgreSQL
- Turn off Log Hostname Flag for PostgreSQL
- Turn off Log Statement Stats Flag for PostgreSQL
- Use TLS 1.2 or Higher
- Verify Cloud KMS Key Version Algorithm
cis-controls-4-2
為網路裝置建立並維護有記錄的安全設定程序。每年或發生可能影響這項安全措施的重大企業變更時，請審查及更新說明文件。
- Avoid RSASHA1 for DNSSEC Signing
- Configure the Allowed Ingress Settings for Cloud Run Organization Policy Constraint
- Configure the Disable VM Serial Port Logging to Stackdriver Organization Policy
- Don't Use Legacy Networks
- Enable Control Plane Authorized Networks on GKE Clusters
- Enable DNSSEC for Cloud DNS
- Enable IP Alias Range for GKE Clusters
- Enable Log Checkpoints Flag for PostgreSQL
- Enable Log Duration Flag for PostgreSQL instance
- Enable Log Temp Files Flag for PostgreSQL instance
- Enable Private Google Access on an instance
- Encrypt Data at Rest with CMEK
- Ensure Minimum TLS 1.2 Version
- Restrict Legacy TLS Versions
- Terminate Network Connections
- Turn Off Log Executor Stats Flag for PostgreSQL
- Turn off Log Hostname Flag for PostgreSQL
- Turn off Log Statement Stats Flag for PostgreSQL
- Use Custom VPC Networks
cis-controls-4-3
設定企業資產在閒置一段時間後自動鎖定工作階段。如果是通用作業系統，時間不得超過 15 分鐘。如果是行動裝置，時間不得超過 2 分鐘。
cis-controls-4-4
在支援的伺服器上實作及管理防火牆。例如虛擬防火牆、作業系統防火牆或第三方防火牆代理程式。
- Block Connections to FTP Ports from All IP Addresses
- Block Connections to LDAP Ports from All IP Addresses
- Block Connections to Memcached Ports from All IP Addresses
- Block Connections to MongoDB Ports from All IP Addresses
- Block Connections to MySQL Ports from All IP Addresses
- Block Connections to NetBIOS Ports from All IP Addresses
- Block Connections to Oracle Database Ports from All IP Addresses
- Block Connections to POP3 Server Ports from All IP Addresses
- Block Connections to PostgreSQL Server Ports from All IP Addresses
- Block Connections to Redis Server Ports from All IP Addresses
- Block Connections to SMTP Server Ports from All IP Addresses
- Block Generic Access to CiscoSecure/WebSM Ports
- Block Generic Access to HTTP Ports
- Block Generic Access to RDP Ports
- Block Generic Access to SSH Ports
- Block Generic Access to Telnet Servers
- Block Legacy Authorization on GKE Clusters
- Block Overly Permissive Firewall Rules
- Disable Alpha Features on GKE Clusters
- Enable Private Google Access for VPC Subnets
- Enable Secure Boot for Shielded GKE Nodes
- Enable Shielded GKE Nodes on a Cluster
- Prevent IP Forwarding on Compute Engine Instances
- Require Container-Optimized OS for a GKE Cluster
cis-controls-4-5
在使用者裝置上實作及管理主機型防火牆或通訊埠篩選工具，並採用預設拒絕規則，捨棄所有流量，但明確允許的服務和通訊埠除外。
- Block Connections to DNS Ports from All IP Addresses
- Block Connections to Elasticsearch Ports from All IP Addresses
- Block Connections to FTP Ports from All IP Addresses
- Block Connections to LDAP Ports from All IP Addresses
- Block Connections to Memcached Ports from All IP Addresses
- Block Connections to MongoDB Ports from All IP Addresses
- Block Connections to MySQL Ports from All IP Addresses
- Block Connections to NetBIOS Ports from All IP Addresses
- Block Connections to Oracle Database Ports from All IP Addresses
- Block Connections to POP3 Server Ports from All IP Addresses
- Block Connections to PostgreSQL Server Ports from All IP Addresses
- Block Connections to Redis Server Ports from All IP Addresses
- Block Connections to SMTP Server Ports from All IP Addresses
- Block Generic Access to CiscoSecure/WebSM Ports
- Block Generic Access to HTTP Ports
- Block Generic Access to RDP Ports
- Block Generic Access to SSH Ports
- Block Generic Access to Telnet Servers
- Block Overly Permissive Firewall Rules
- Enforce Deny All Egress Firewall Rule
- Prevent IP Forwarding on Compute Engine Instances
cis-controls-4-6
安全地管理企業資產和軟體。例如，透過版本控制的基礎架構即程式碼 (IaC) 管理設定，以及透過安全網路通訊協定 (例如安全殼層 (SSH) 和超文字傳輸安全通訊協定 (HTTPS)) 存取管理介面。除非作業上必須使用，否則請勿使用不安全的管理通訊協定，例如 Telnet (電傳打字網路) 和 HTTP。
- Block Public IP Addresses for AlloyDB Cluster Instances
- Block Public IP Addresses for Cloud SQL Instances
- Don't Use Kubernetes Web UI
cis-controls-4-7
管理企業資產和軟體上的預設帳戶，例如根帳戶、管理員帳戶和其他預先設定的供應商帳戶。例如停用預設帳戶或使其無法使用。
- Restrict API Access to Google Cloud APIs for Compute Engine Instances
- Use Custom Service Accounts for Compute Engine Instances
cis-controls-4-8
在企業資產和軟體上解除安裝或停用不必要的服務，例如未使用的檔案共用服務、網頁應用程式模組或服務功能。
- Block Serial Ports for Compute Engine Instances
- Configure Access Controls for the Network Boundary
- Configure the Disable VPC Internal IPv6 Usage Organization Policy
- Disable Legacy Metadata Server Endpoints on Compute Engine
- Set Application Restriction on API Keys
- Turn Off Remote Access Flag for SQL Server
cis-controls-5-1
建立並維護企業管理的所有帳戶清單。清查結果至少須包含使用者、管理員和服務帳戶。清單至少應包含人員姓名、使用者名稱、開始/停止日期和部門。確認所有有效帳戶都已授權，且至少每季或更頻繁地定期排定驗證時間。
- Block External IP Address Access on Compute Engine VM Instances
- Create GKE Clusters with Limited Privileges
- Define VPC Connector Egress For Cloud Run Functions
- Enable Artifact Analysis Vulnerability Scanning
- Enable OS Login
- Enable Private Google Access for VPC Subnets
cis-controls-5-2
為所有企業資產設定不重複的密碼。最佳做法至少包括：使用多重驗證 (MFA) 的帳戶密碼長度至少為 8 個字元，未使用 MFA 的帳戶密碼長度至少為 14 個字元。
- Block Project-Wide SSH Keys on Compute Engine Instances
- Don't Use Kubernetes Web UI
- Enable Private Google Access for VPC Subnets
cis-controls-5-4
限制企業資產專用管理員帳戶的管理員權限。透過使用者主要的一般帳戶 (而非具備特殊權限的帳戶)，執行一般運算活動，例如瀏覽網際網路、收發電子郵件，以及使用效率提升套件。
- Block Automatic IAM Grants to Default Service Accounts
- Use Least Privilege Service Accounts for GKE Clusters
cis-controls-5-5
建立及維護服務帳戶清單。商品目錄至少須包含部門擁有者、審查日期和目的。定期 (至少每季一次，或更頻繁) 檢查服務帳戶，確認所有有效帳戶都已獲得授權。
- Block External IP Address Access on Compute Engine VM Instances
- Configure Remote Access Inactivity Timeout
- Enable Workload Identity Federation for GKE on clusters
cis-controls-5-6
透過目錄或身分服務集中管理帳戶。
- Don't Use Kubernetes Web UI
- Enable OS Login for All Instances at Project Level
- Require OS Login on Compute Engine Instances
cis-controls-6-1
建立並遵循有記錄的程序 (最好是自動化程序)，在新進員工到職或使用者角色變更時，授予企業資產的存取權。
- Block Generic Access to Directory Service Ports
- Block Legacy Authorization on GKE Clusters
- Configure Access Controls for the Network Boundary
- Enable Private Google Access for VPC Subnets
- Enable the Confidential VM Organization Policy Constraint
- Enable Workload Identity Federation for GKE on clusters
- Restrict Default Network Creation for Compute Engine Instances
cis-controls-6-2
建立並遵循相關程序 (最好是自動化程序)，在使用者終止服務、權利遭撤銷或角色變更時，立即停用帳戶，撤銷對企業資產的存取權。如要保留稽核追蹤記錄，可能需要停用帳戶，而不是刪除帳戶。
- Disable File Downloads on Vertex AI Workbench Instances
- Enable Private Google Access for VPC Subnets
- Enable the Confidential VM Organization Policy Constraint
- Restrict Default Network Creation for Compute Engine Instances
cis-controls-6-3
要求所有對外公開的企業或第三方應用程式強制執行 MFA (如支援)。透過目錄服務或單一登入 (SSO) 供應商強制執行多重驗證，即為妥善實施這項安全措施。
- Set Log Min Error Statement Flag for AlloyDB Instances
- Set Log Min Messages Flag for AlloyDB Instances
cis-controls-6-5
在所有企業資產上，為所有管理存取權帳戶啟用 MFA (如支援)，無論這些資產是在現場管理，還是透過服務供應商管理。
- Create GKE Clusters with Limited Privileges
- Set Log Min Error Statement Flag for AlloyDB Instances
- Set Log Min Messages Flag for AlloyDB Instances
cis-controls-6-6
建立並維護企業的驗證和授權系統清單，包括在現場或遠端服務供應商託管的系統。至少每年檢查並更新一次商品目錄，頻率越高越好。
- Enable Cloud Asset Inventory Service
- Enable Private Google Access for VPC Subnets
- Enable the Confidential VM Organization Policy Constraint
- Restrict Default Network Creation for Compute Engine Instances
cis-controls-6-7
透過目錄服務或單一登入 (SSO) 供應商 (如支援)，集中管理所有企業資產的存取權。
- Configure Access Controls for the Network Boundary
- Enable OS Login for All Instances at Project Level
- Ensure Minimum TLS 1.2 Version
- Require OS Login on Compute Engine Instances
- Set Application Restriction on API Keys
cis-controls-6-8
定義並維護以角色為基礎的存取權控管機制，方法是判斷並記錄企業內各角色執行指派職務時所需的存取權。定期 (至少每年一次，或更頻繁) 審查企業資產的存取權控管，確認所有權限都已獲得授權。
- Block Automatic IAM Grants to Default Service Accounts
- Configure the Allowed VPC Egress Settings for Cloud Run Organization Policy Constraint
- Create GKE Clusters with Limited Privileges
- Set Application Restriction on API Keys
- Use Least Privilege Service Accounts for GKE Clusters
cis-controls-7-2
建立並維護以風險為基礎的補救策略，記錄在補救程序中，並每月或更頻繁地進行審查。
cis-controls-7-7
根據修復程序，每月或更頻繁地透過程序和工具，修復軟體中偵測到的安全漏洞。
- Disable Legacy Metadata Server Endpoints on Compute Engine
- Use Latest Image Versions on Dataproc Clusters
cis-controls-8-1
建立並維護記錄在案的稽核記錄管理程序，定義企業的記錄需求。至少要處理企業資產的稽核記錄收集、審查和保留作業。每年或發生可能影響這項安全措施的重大企業變更時，請審查及更新說明文件。
- Allocate Audit Log Storage Capacity
- Block Automatic IAM Grants to Default Service Accounts
- Block Service Account Key Creation
- Block Service Account Key Uploads
- Enable Audit Logs for Google Cloud Services
- Enable Firewall Rule Logging
- Enable Log Checkpoints Flag for PostgreSQL
- Enable Log Duration Flag for PostgreSQL instance
- Require Cloud Storage Bucket Logging
- Require Object Versioning for Cloud Storage Buckets
- Retain Audit Records
- Set Log Error Verbosity Flag for AlloyDB Instances
- Set Log Min Error Statement Flag for AlloyDB Instances
- Set Log Min Messages Flag for AlloyDB Instances
- Turn Off Log Executor Stats Flag for PostgreSQL
- Turn off Log Hostname Flag for PostgreSQL
cis-controls-8-11
稽核記錄可協助您偵測異常或不尋常的事件，這些事件可能代表潛在威脅。每週或更頻繁地進行審查。
- Configure Security Logging Policies for Google Cloud Services
- Enable Cloud DNS Logs Monitoring
- Enable Log Temp Files Flag for PostgreSQL instance
- Implement Event Logging for Google Cloud Services
- Set Log Error Verbosity Flag for AlloyDB Instances
- Set Log Min Error Statement Flag for AlloyDB Instances
- Set Log Min Messages Flag for AlloyDB Instances
- Turn Off Log Executor Stats Flag for PostgreSQL
- Turn off Log Parser Stats Flag for PostgreSQL
- Turn off Log Planner Stats Flag for PostgreSQL
- Turn off Log Statement Stats Flag for PostgreSQL
cis-controls-8-2
收集稽核記錄。確保已根據企業的稽核記錄管理程序，在企業資產中啟用記錄功能。
- Allocate Audit Log Storage Capacity
- Configure Log Metrics and Alerts for Audit Logging Changes
- Configure Log Metrics and Alerts for Cloud SQL Configuration Changes
- Configure Log Metrics and Alerts for Cloud Storage IAM Policy Changes
- Configure Log Metrics and Alerts for Custom Role Changes
- Configure Log Metrics and Alerts for VPC Network Changes
- Configure Log Metrics and Alerts for VPC Network Firewall Changes
- Configure Log Metrics and Alerts for VPC Route Changes
- Configure Log Sinks
- Configure Security Logging Policies for Google Cloud Services
- Don't Use Kubernetes Web UI
- Enable Audit Logs for Google Cloud Services
- Enable Cloud DNS Logs Monitoring
- Enable Cloud Logging on GKE Clusters
- Enable Firewall Rule Logging
- Enable Load Balancer Logging
- Enable Log Locks Wait Flag for PostgreSQL instance
- Implement Event Logging for Google Cloud Services
- Turn off Log Parser Stats Flag for PostgreSQL
cis-controls-8-3
請確保記錄目的地有足夠的儲存空間，以符合企業的稽核記錄管理程序。
cis-controls-8-4
標準化時間同步。在支援的企業資產中，設定至少兩個同步時間來源。
- Block Automatic IAM Grants to Default Service Accounts
- Define Cloud KMS Crypto Keys Purpose
- Don't Use Kubernetes Web UI
- Set Uniform Bucket Level Access for Cloud Storage Buckets
cis-controls-8-5
為含有機密資料的企業資產設定詳細的稽核記錄。包括事件來源、日期、使用者名稱、時間戳記、來源地址、目的地地址，以及其他有助於鑑識調查的實用元素。
- Allocate Audit Log Storage Capacity
- Block Service Account Key Creation
- Block Service Account Key Uploads
- Configure Log Metrics and Alerts for Audit Logging Changes
- Configure Log Metrics and Alerts for Cloud SQL Configuration Changes
- Configure Log Metrics and Alerts for Cloud Storage IAM Policy Changes
- Configure Log Metrics and Alerts for Custom Role Changes
- Configure Log Metrics and Alerts for VPC Network Changes
- Configure Log Metrics and Alerts for VPC Network Firewall Changes
- Configure Log Metrics and Alerts for VPC Route Changes
- Configure Security Logging Policies for Google Cloud Services
- Enable Audit Logs for Google Cloud Services
- Enable Log Checkpoints Flag for PostgreSQL
- Enable Log Connections Flag for PostgreSQL
- Enable Log Disconnections Flag for PostgreSQL
- Enable Log Error Verbosity Flag for PostgreSQL
- Enable Log Min Error Statement Flag for PostgreSQL
- Enable Log Min Messages Flag for PostgreSQL
- Enable Log Statement Flag for PostgreSQL
- Enforce Compute Session Inactive Policy
- Require Cloud Storage Bucket Logging
- Set Log Error Verbosity Flag for AlloyDB Instances
- Turn Off Log Executor Stats Flag for PostgreSQL
- Turn Off Log Min Duration Statement Flag for PostgreSQL
cis-controls-8-6
在適當且支援的情況下，收集企業資產的 DNS 查詢稽核記錄。
- Enable Cloud DNS Logs Monitoring
- Enable Integrity Monitoring on GKE Clusters
- Enforce Public Access Prevention
- Ensure Minimum TLS 1.2 Version
- Implement Continuous Network Traffic Monitoring
cis-controls-8-7
在適當且支援的情況下，收集企業資產的網址要求稽核記錄。
- Block Service Account Key Creation
- Block Service Account Key Uploads
- Define Secret Manager Rotation Schedule
- Restrict Legacy TLS Versions
cis-controls-8-8
收集指令列稽核記錄。例如，從 PowerShell®、BASH™ 和遠端管理終端機收集稽核記錄。
- Enable Log Temp Files Flag for PostgreSQL instance
- Set Log Error Verbosity Flag for AlloyDB Instances
- Set Log Min Error Statement Flag for AlloyDB Instances
- Set Log Min Messages Flag for AlloyDB Instances
- Turn Off Log Executor Stats Flag for PostgreSQL
- Turn off Log Parser Stats Flag for PostgreSQL
- Turn off Log Planner Stats Flag for PostgreSQL
- Turn off Log Statement Stats Flag for PostgreSQL
cis-controls-8-9
盡可能集中收集及保留企業資產的稽核記錄，並遵守記錄的稽核記錄管理程序。實作範例主要包括運用 SIEM 工具集中管理多個記錄來源。
- Configure Security Logging Policies for Google Cloud Services
- Enable Audit Logs for Google Cloud Services
- Enable Log Checkpoints Flag for PostgreSQL
- Enable Log Duration Flag for PostgreSQL instance
- Require Cloud Storage Bucket Logging
- Require Object Versioning for Cloud Storage Buckets
- Set Log Error Verbosity Flag for AlloyDB Instances
- Turn Off Log Executor Stats Flag for PostgreSQL
- Turn off Log Hostname Flag for PostgreSQL
cis-controls-9-1
確保企業只能執行完全支援的瀏覽器和電子郵件用戶端，且只能使用供應商提供的最新版瀏覽器和電子郵件用戶端。
cis-controls-9-2
在所有使用者裝置 (包括遠端和內部部署資產) 上使用 DNS 篩選服務，封鎖對已知惡意網域的存取權。
- Block External IP Address Access on Compute Engine VM Instances
- Create and Manage Asymmetric Keys
- Define VPC Connector Egress For Cloud Run Functions
cis-controls-9-3
強制執行並更新以網路為準的網址篩選器，限制企業資產連線至可能有害或未經核准的網站。例如依類別或信譽篩選，或是使用封鎖清單。對所有企業資產強制執行篩選器。
cis-controls-9-4
透過解除安裝或停用，限制任何未經授權或不必要的瀏覽器或電子郵件用戶端外掛程式、擴充功能和外掛應用程式。
CSA Cloud Controls Matrix v4.0.11
支援的雲端服務供應商： Google Cloud
專為雲端運算環境設計的網路安全控管架構。這項服務提供主要領域的完整控管機制，可協助您評估雲端服務的安全防護機制。
這個架構包含下列章節中的雲端控制群組和雲端控制項。
ccm-aa-01
建立、記錄、核准、傳達、套用、評估及維護稽核和保證政策、程序和標準。至少每年檢查並更新政策和程序。
- Enable Log Duration Flag for PostgreSQL instance
- Enable Object Versioning on Buckets
- Enable Subnet Flow Logs
- Enable VPC Flow Logs for Compute Engine Instances
ccm-aa-02
每年至少根據相關標準進行一次獨立稽核和保證評估。
- Allocate Audit Log Storage Capacity
- Create and Manage Asymmetric Keys
- Disable Alpha Features on GKE Clusters
- Enable Cloud Monitoring on GKE Clusters
- Ensure Minimum TLS 1.2 Version
- Terminate Network Connections
ccm-ais-01
制定、記錄、核准、傳達、套用、評估及維護應用程式安全政策和程序，為組織應用程式安全功能的適當規劃、交付及支援提供指引。至少每年檢查並更新政策和程序。
ccm-ais-02
為保護不同應用程式建立、記錄及維護基本需求。
- Enable Artifact Analysis Vulnerability Scanning
- Enable CMEK for Cloud SQL Databases
- Turn off Log Parser Stats Flag for PostgreSQL
- Turn off Log Planner Stats Flag for PostgreSQL
ccm-ais-03
根據業務目標、安全需求和法規遵循義務，定義及導入技術和作業指標。
ccm-ais-04
根據機構定義的安全性需求，為應用程式設計、開發、部署及運作定義並實作 SDLC 程序。
- Enable CMEK on Compute Engine Persistent Disks
- Require Container-Optimized OS for a GKE Cluster
- Set Application Restriction on API Keys
ccm-ais-05
實施測試策略，包括新資訊系統、升級和新版本的驗收標準，確保應用程式安全無虞並維持法規遵循狀態，同時達成組織的交付速度目標。盡可能自動化。
- Define VPC Connector Egress For Cloud Run Functions
- Restrict Insecure SSL Policies for Compute Engine Instances
ccm-bcr-03
制定策略，在風險承受範圍內減少業務中斷的影響、抵禦中斷，並從中恢復。
ccm-bcr-07
在業務持續性和復原程序期間，與利害關係人和參與者建立溝通管道。
ccm-bcr-08
定期備份儲存在雲端的資料。確保備份資料的機密性、完整性和可用性，並驗證備份資料的復原作業，以確保復原能力。
ccm-bcr-09
制定、記錄、核准、傳達、套用、評估及維護災害應變計畫，以便在發生天災和人為災害時進行復原。每年至少更新一次，或在發生重大變更時更新。
ccm-bcr-10
每年或發生重大變更時，請演練災難應變計畫，包括盡可能與當地緊急應變機構合作。
ccm-bcr-11
根據適用的產業標準，在合理的最短距離內，以獨立位置的備援設備補充業務關鍵設備。
ccm-ccc-01
制定、記錄、核准、傳達、套用、評估及維護相關政策和程序，以管理將變更套用至機構資產 (包括應用程式、系統、基礎架構、設定等) 的相關風險。無論資產是由內部或外部管理，都必須遵循這些政策和程序。至少每年檢查並更新政策和程序。
- Block Automatic IAM Grants to Default Service Accounts
- Don't Use User Connections Flag for SQL Server
- Don't Use User Options Flag for SQL Server
- Enable 3625 Trace Database Flag for SQL Server
- Enable OS Login
- Enable Shielded GKE Nodes on a Cluster
- Restrict Service Usage
ccm-ccc-02
遵循已定義的品質變更控制、核准和測試程序，並建立基準、測試和發布標準。
ccm-ccc-07
實施偵測措施，在變更偏離既定基準時主動發出通知。
ccm-cek-01
建立、記錄、核准、傳達、套用、評估及維護密碼編譯、加密和金鑰管理政策與程序。至少每年檢查並更新政策和程序。
- Enable CMEK for Cloud SQL Databases
- Enable CMEK for Cloud Storage Buckets
- Enable SSL Encryption On AlloyDB Instances
- Encrypt Pub/Sub topic with CMEK
ccm-cek-02
定義及實作密碼編譯、加密和金鑰管理角色與職責。
ccm-cek-03
使用通過核准標準認證的密碼編譯程式庫，為靜態和傳輸中的資料提供密碼編譯保護。
- Block Project-Wide SSH Keys on Compute Engine Instances
- Enable CMEK for AlloyDB Clusters
- Enable CMEK for BigQuery Datasets
- Enable CMEK for BigQuery Tables
- Enable CSEK On Compute Engine Persistent Disks
- Enable SSL Encryption On AlloyDB Instances
- Require Binary Authorization on a Cluster
- Require CMEK on Dataproc Clusters
- Restrict Non CMEK Services
- Use Least Privilege Service Accounts for GKE Clusters
ccm-cek-04
根據資料分類、相關風險和加密技術的可用性，使用適合資料保護的加密演算法。
ccm-cek-05
建立標準變更管理程序，以因應內部和外部來源的變更，並審查、核准、實作及傳達加密、加密和金鑰管理技術變更。
ccm-cek-08
CSP 必須提供功能，讓 CSC 管理自己的資料加密金鑰。
ccm-cek-10
使用業界認可的加密編譯程式庫產生加密編譯金鑰，並指定演算法強度和使用的隨機號碼產生器。
- Enable CMEK for Cloud SQL Databases
- Encrypt Pub/Sub topic with CMEK
- Restrict Insecure SSL Policies for Compute Engine Instances
ccm-cek-11
管理為特定用途佈建的加密密碼和私密金鑰。
ccm-cek-18
定義、實作及評估相關程序和技術措施，在需要最低權限存取的安全存放區中管理封存金鑰，包括法律和法規要求。
ccm-cek-21
定義、實作及評估程序、步驟和技術措施，確保金鑰管理系統能追蹤及回報所有加密編譯資料和狀態變更，包括法律和法規要求。
ccm-dcs-07
實施實體安全防護措施，保護人員、資料和資訊系統。在行政和業務區域與資料儲存和處理設施區域之間，建立實體安全範圍。
- Enable Secure Boot for Shielded GKE Nodes
- Enforce Deny All Egress Firewall Rule
- Subscribe a GKE Cluster to a Release Channel
ccm-dcs-09
只允許授權人員進入安全區域，並透過實體存取權控管機制，限制、記錄及監控所有出入口。視貴機構需求，定期保留存取權控管記錄。
ccm-dsp-01
根據所有適用法律、法規、標準和風險等級，制定、記錄、核准、傳達、套用、評估及維護資料分類、保護和處理政策與程序，確保資料在整個生命週期內受到妥善管理。至少每年檢查並更新政策和程序。
ccm-dsp-02
採用業界認可的方法，安全地從儲存媒體中處置資料，確保資料無法透過任何鑑識方式復原。
ccm-dsp-07
根據設計安全原則和業界最佳做法，開發系統、產品和業務實務。
- Define Retention Period for Cloud Storage Buckets
- Require Rotation of API Key
- Restrict API Keys for Required APIs Only
ccm-dsp-08
根據「隱私權設計原則」和業界最佳做法，開發系統、產品和業務實務。確保系統的隱私權設定預設會根據所有適用法律和法規進行設定。
ccm-dsp-10
定義、實作及評估程序、流程和技術措施，確保任何個人或私密資料的移轉行為受到保護，不會遭到未經授權的存取，且只會在相關法律和法規允許的範圍內處理。
- Create and Manage Asymmetric Keys
- Encrypt Data at Rest with CMEK
- Enforce CMEK
- Lock Storage Bucket Retention Policies
ccm-dsp-16
資料保留、封存和刪除作業會依據業務需求和適用的法律與法規進行管理。
ccm-dsp-17
定義及實施程序、流程和技術措施，在整個生命週期中保護私密資料。
- Block Public IP Addresses for AlloyDB Cluster Instances
- Enable Log Connections Flag for PostgreSQL
- Enable Log Disconnections Flag for PostgreSQL
- Enable Log Error Verbosity Flag for PostgreSQL
- Enable Log Min Error Statement Flag for PostgreSQL
- Enable Log Min Messages Flag for PostgreSQL
- Enable Log Statement Flag for PostgreSQL
- Enable Skip Show Database Flag for MySQL
- Enable Uniform Bucket-Level Access on Cloud Storage Buckets
- Require Binary Authorization on a Cluster
- Restrict Non CMEK Services
- Restrict Public IP Addresses to Compute Engine Instances
- Set Log Error Verbosity Flag for AlloyDB Instances
- Set Log Min Error Statement Flag for AlloyDB Instances
- Set Log Min Messages Flag for AlloyDB Instances
- Turn Off Contained Database Authentication Flag for SQL Server
- Turn Off Cross Database Ownership Chaining Flag for SQL Server
- Turn Off Log Min Duration Statement Flag for PostgreSQL
- Use Least Privilege Service Accounts for GKE Clusters
ccm-grc-01
建立、記錄、核准、傳達、套用、評估及維護資訊治理計畫的政策和程序，並由組織領導階層贊助。至少每年檢查並更新政策和程序。
ccm-grc-03
至少每年一次，或是在機構發生重大變更時，檢閱所有相關機構政策和相關程序。
ccm-grc-07
找出並記錄貴機構適用的所有相關標準、法規、法律、合約和法定要求。
ccm-iam-01
建立、記錄、核准、傳達、實施、套用、評估及維護身分與存取權管理政策和程序。至少每年檢查並更新政策和程序。
- Block External IP Address Access on Compute Engine VM Instances
- Don't Use Kubernetes Web UI
- Enable CMEK for Cloud SQL Databases
- Enable OS Login for All Instances at Project Level
- Enable Private Clusters for GKE
- Enable Private Google Access for VPC Subnets
- Enable the Confidential VM Organization Policy Constraint
- Require OS Login on Compute Engine Instances
- Restrict Default Network Creation for Compute Engine Instances
- Restrict Legacy TLS Versions
ccm-iam-03
管理、儲存及查看系統身分和存取層級的資訊。
- Block Automatic IAM Grants to Default Service Accounts
- Enable OS Login for All Instances at Project Level
- Require OS Login on Compute Engine Instances
ccm-iam-04
實作資訊系統存取權時，請採用職責分離原則。
- Enable Cloud Logging on GKE Clusters
- Enable Private Clusters for GKE
- Restrict Public Access to Cloud Storage Buckets
ccm-iam-05
實作資訊系統存取權時，請採用最低權限原則。
- Block External IP Address Access on Compute Engine VM Instances
- Configure the Allowed VPC Egress Settings for Cloud Run Organization Policy Constraint
- Create GKE Clusters with Limited Privileges
- Define Cloud KMS Crypto Keys Purpose
- Don't Use Kubernetes Web UI
- Enable Private Clusters for GKE
- Enforce Deny All Egress Firewall Rule
- Enforce SSL for all Incoming Database Connections
- Require OS Login on Compute Engine Instances
- Restrict Public Access to BigQuery Datasets
- Restrict Public Access to Cloud SQL Database Instances
- Restrict Public Access to Cloud Storage Buckets
- Set Application Restriction on API Keys
- Subscribe a GKE Cluster to a Release Channel
ccm-iam-07
及時取消或修改異動人員、離職人員或系統身分識別的存取權，以便有效採用並傳達身分與存取權管理政策。
- Block Service Account Key Creation
- Block Service Account Key Uploads
- Define Secret Manager Rotation Schedule
ccm-iam-09
定義、實作及評估特權存取角色區隔的程序、程序和技術措施，確保資料、加密和金鑰管理功能以及記錄功能的管理存取權彼此不同且分開。
- Block Automatic IAM Grants to Default Service Accounts
- Configure Remote Access Inactivity Timeout
- Don't Use Kubernetes Web UI
- Enable Secure Boot on Compute Engine Instances
- Enable SSL Encryption On AlloyDB Instances
- Enforce HTTPS Traffic Only
- Set Application Restriction on API Keys
ccm-iam-10
定義及實作存取程序，確保特權存取角色和權限僅在有限時間內授予，並實作相關程序，防止多個特權存取權限累積。
- Block Service Account Key Creation
- Block Service Account Key Uploads
- Configure Remote Access Inactivity Timeout
- Create GKE Clusters with Limited Privileges
- Restrict Public Access to BigQuery Datasets
ccm-iam-11
定義、實作及評估相關程序和流程，讓客戶參與授予存取權的作業，以取得機構風險評估所定義的同意高風險特殊存取角色。
ccm-iam-12
定義、實作及評估程序、流程和技術措施，確保所有具備寫入權限 (包括具備特殊權限的角色) 的使用者只能讀取記錄基礎架構，且停用記錄基礎架構的權限受到程序控管，確保職責分離和緊急情況程序。
- Block Connections to Cassandra Ports from All IP Addresses
- Block Public IP Addresses for Cloud SQL Instances
- Configure the Allowed Ingress Settings for Cloud Run Organization Policy Constraint
- Configure the Disable VM Serial Port Logging to Stackdriver Organization Policy
- Configure the Disable VPC External IPv6 Usage Organization Policy
- Enable Control Plane Authorized Networks on GKE Clusters
- Enable IP Alias Range for GKE Clusters
- Enable OS Login
- Enable Private Google Access on an instance
- Enable the Restrict Authorized Networks on Cloud SQL Instances Organization Policy Constraint
- Restrict Public Access to BigQuery Datasets
- Restrict Public Access to Cloud SQL Database Instances
- Restrict Public Access to Cloud Storage Buckets
ccm-iam-13
定義、導入及評估相關程序、措施和技術，確保可透過專屬 ID 識別使用者，或將個人與 User ID 的使用情形建立關聯。
ccm-iam-14
定義、導入及評估驗證系統、應用程式和資料資產存取權的程序、程序和技術措施，包括至少針對具備特殊權限的使用者和私密資料存取權，採用多重驗證。採用數位憑證或替代方案，為系統身分提供同等程度的安全防護。
ccm-iam-16
定義、實作及評估程序、流程和技術措施，以驗證資料和系統功能的存取權是否經過授權。
- Enable OS Login
- Enforce SSL for all Incoming Database Connections
- Set Application Restriction on API Keys
ccm-ivs-01
制定、記錄、核准、傳達、套用、評估及維護基礎架構和虛擬化安全政策與程序。至少每年檢查並更新政策和程序。
- Define a Security Policy to Mitigate for DDoS Events
- Enable Auto Upgrade on GKE Clusters
- Enable Intranode Visibility for GKE Clusters
- Terminate Network Connections
ccm-ivs-03
監控、加密及限制環境之間的通訊，只允許經過驗證和授權的連線，並說明理由。請至少每年檢查一次這些設定，並記錄所有允許的服務、通訊協定、通訊埠和補償控制措施，做為支援這些設定的依據。
- Block Connections to DNS Ports from All IP Addresses
- Block Connections to Elasticsearch Ports from All IP Addresses
- Block Connections to FTP Ports from All IP Addresses
- Block Connections to LDAP Ports from All IP Addresses
- Block Connections to Memcached Ports from All IP Addresses
- Block Connections to MongoDB Ports from All IP Addresses
- Block Connections to MySQL Ports from All IP Addresses
- Block Connections to NetBIOS Ports from All IP Addresses
- Block Connections to Oracle Database Ports from All IP Addresses
- Block Connections to POP3 Server Ports from All IP Addresses
- Block Connections to PostgreSQL Server Ports from All IP Addresses
- Block Connections to Redis Server Ports from All IP Addresses
- Block Connections to SMTP Server Ports from All IP Addresses
- Block Generic Access to HTTP Ports
- Block Generic Access to Telnet Servers
- Block Legacy Authorization on GKE Clusters
- Block Overly Permissive Firewall Rules
- Block Public IP Addresses for Cloud SQL Instances
- Configure the Allowed Ingress Settings for Cloud Run Organization Policy Constraint
- Configure the Allowed VPC Egress Settings for Cloud Run Organization Policy Constraint
- Configure the Disable VPC External IPv6 Usage Organization Policy
- Configure the Disable VPC Internal IPv6 Usage Organization Policy
- Define a Security Policy to Mitigate for DDoS Events
- Enable Control Plane Authorized Networks on GKE Clusters
- Enable IP Alias Range for GKE Clusters
- Enable Private Google Access on an instance
- Enable Secure Boot for Shielded GKE Nodes
- Enforce Deny All Egress Firewall Rule
- Ensure Minimum TLS 1.2 Version
- Implement Continuous Network Traffic Monitoring
- Restrict Public Access to Cloud SQL Database Instances
- Subscribe a GKE Cluster to a Release Channel
- Terminate Network Connections
ccm-ivs-04
根據各自的最佳做法，強化主機和客體 OS、管理程序或基礎架構控制平面，並透過技術控管機制支援，做為安全基準的一部分。
- Avoid RSASHA1 for DNSSEC Signing
- Configure the Disable VM Serial Port Logging to Stackdriver Organization Policy
- Disable Legacy Metadata Server Endpoints on Compute Engine
- Don't Use Legacy Networks
- Enable Control Plane Authorized Networks on GKE Clusters
- Enable Integrity Monitoring on GKE Clusters
- Enable IP Alias Range for GKE Clusters
- Enable Log Checkpoints Flag for PostgreSQL
- Enable Log Duration Flag for PostgreSQL instance
- Enable Log Locks Wait Flag for PostgreSQL instance
- Enable Log Temp Files Flag for PostgreSQL instance
- Enable Private Google Access on an instance
- Enable Workload Identity Federation for GKE on clusters
- Turn Off Log Executor Stats Flag for PostgreSQL
- Turn off Log Hostname Flag for PostgreSQL
- Turn off Log Statement Stats Flag for PostgreSQL
- Use Custom VPC Networks
ccm-ivs-06
設計、開發、部署及設定應用程式和基礎架構，確保 CSP 和 CSC (租戶) 使用者存取權和租戶內存取權適當區隔和隔離，並監控及限制其他租戶的存取權。
- Block Connections to Cassandra Ports from All IP Addresses
- Block Legacy Authorization on GKE Clusters
- Configure Access Controls for the Network Boundary
- Enable Secure Boot for Shielded GKE Nodes
ccm-ivs-07
將伺服器、服務、應用程式或資料遷移至雲端環境時，請使用安全且經過加密的通訊管道。這類管道只能包含最新且已核准的通訊協定。
- Configure Access Controls for the Network Boundary
- Define a Security Policy to Mitigate for DDoS Events
ccm-ivs-09
定義、實作及評估相關程序、流程和縱深防禦技術，以保護網路、偵測網路攻擊，並及時做出回應。
ccm-log-01
建立、記錄、核准、傳達、套用、評估及維護記錄和監控政策與程序。至少每年檢查並更新政策和程序。
- Allocate Audit Log Storage Capacity
- Configure Security Logging Policies for Google Cloud Services
- Don't Use Kubernetes Web UI
- Enable Audit Logs for Google Cloud Services
- Enable Firewall Rule Logging
- Retain Audit Records
ccm-log-02
定義、導入及評估程序、流程和技術措施，確保稽核記錄的安全和保留。
- Configure Security Logging Policies for Google Cloud Services
- Disable Alpha Features on GKE Clusters
- Enable Cloud Monitoring on GKE Clusters
- Enable Firewall Rule Logging
- Enable Log Checkpoints Flag for PostgreSQL
- Enable Log Duration Flag for PostgreSQL instance
- Enable Log Locks Wait Flag for PostgreSQL instance
- Enable Network Policy on GKE Clusters
- Require Cloud Storage Bucket Logging
- Require Object Versioning for Cloud Storage Buckets
- Retain Audit Records
- Turn Off Log Executor Stats Flag for PostgreSQL
- Turn off Log Hostname Flag for PostgreSQL
ccm-log-03
找出並監控應用程式和基礎架構中的安全性相關事件。定義及實作系統，根據這類事件和對應指標，向負責的利害關係人產生快訊。
- Allocate Audit Log Storage Capacity
- Configure Security Logging Policies for Google Cloud Services
- Enable Audit Logs for Google Cloud Services
- Enable Firewall Rule Logging
- Enable Log Checkpoints Flag for PostgreSQL
- Enforce Compute Session Inactive Policy
- Require Cloud Storage Bucket Logging
- Turn Off Log Executor Stats Flag for PostgreSQL
ccm-log-04
限制授權人員存取稽核記錄，並維護可提供專屬存取權問責制的記錄。
- Disable Alpha Features on GKE Clusters
- Enable Auto Repair for GKE Clusters
- Enable Cloud Monitoring on GKE Clusters
- Enable Log Temp Files Flag for PostgreSQL instance
- Enable Network Policy on GKE Clusters
ccm-log-05
監控安全稽核記錄，偵測超出一般或預期模式的活動。建立並遵循明確的流程，審查偵測到的異常情形，並及時採取適當行動。
- Don't Use Kubernetes Web UI
- Enable Cloud DNS Logs Monitoring
- Enable Firewall Rule Logging
- Enable Log Temp Files Flag for PostgreSQL instance
- Implement Continuous Network Traffic Monitoring
- Implement Event Logging for Google Cloud Services
- Turn Off Log Executor Stats Flag for PostgreSQL
- Turn off Log Parser Stats Flag for PostgreSQL
- Turn off Log Planner Stats Flag for PostgreSQL
- Turn off Log Statement Stats Flag for PostgreSQL
ccm-log-07
建立、記錄及實作應記錄哪些資訊中繼資料和資料系統事件。每年至少檢查一次範圍，或在威脅環境發生變化時檢查。
- Allocate Audit Log Storage Capacity
- Configure Security Logging Policies for Google Cloud Services
- Enable Audit Logs for Google Cloud Services
- Retain Audit Records
ccm-log-08
產生包含相關安全資訊的稽核記錄。
- Allocate Audit Log Storage Capacity
- Configure Log Metrics and Alerts for Audit Logging Changes
- Configure Log Metrics and Alerts for Cloud SQL Configuration Changes
- Configure Log Metrics and Alerts for Cloud Storage IAM Policy Changes
- Configure Log Metrics and Alerts for Custom Role Changes
- Configure Log Metrics and Alerts for VPC Network Changes
- Configure Log Metrics and Alerts for VPC Network Firewall Changes
- Configure Log Metrics and Alerts for VPC Route Changes
- Configure Log Sinks
- Enable Load Balancer Logging
- Turn off Log Parser Stats Flag for PostgreSQL
ccm-log-12
使用可稽核的門禁系統監控及記錄實體存取權。
ccm-sef-01
制定、記錄、核准、傳達、套用、評估及維護安全事件管理、電子探索和雲端鑑識的政策和程序。至少每年檢查並更新政策和程序。
ccm-sef-02
制定、記錄、核准、傳達、套用、評估及維護政策和程序，以便及時管理安全事件。至少每年檢查並更新政策和程序。
ccm-sef-08
與適用的法規主管機關、國家和地方執法機關，以及其他法律管轄機關保持聯絡。
ccm-sta-04
根據雲端服務供應項目的 SSRM，劃分所有 CSA CCM 控制項的共同擁有權和適用性。
ccm-sta-08
雲端服務供應商會定期審查供應鏈中所有機構的相關風險因素。
ccm-sta-09
雲端服務供應商與雲端服務客戶 (租戶) 之間的服務協議，至少須納入雙方同意的條款，包括業務關係和所提供服務的範圍、特性和位置、資訊安全要求 (包括 SSRM)、變更管理程序、記錄和監控功能、事件管理和通訊程序、稽核和第三方評估權、服務終止、互通性和可攜性要求，以及資料隱私權。
ccm-tvm-01
制定、記錄、核准、傳達、套用、評估及維護相關政策和程序，以識別、回報安全漏洞並排定修復優先順序，保護系統免於安全漏洞遭人利用。至少每年檢查並更新政策和程序。
- Define a Security Policy to Mitigate for DDoS Events
- Disable Legacy Metadata Server Endpoints on Compute Engine
- Require Container-Optimized OS for a GKE Cluster
ccm-tvm-02
建立、記錄、核准、傳達、套用、評估及維護政策和程序，以防受管理資產遭到惡意軟體入侵。至少每年檢查並更新政策和程序。
- Enable Auto Repair for GKE Clusters
- Enable Auto Upgrade on GKE Clusters
- Enable Cloud Logging on GKE Clusters
- Enable CMEK on GKE Node Pool Boot Disks
- Enable Encryption on GKE Clusters
- Enable Intranode Visibility for GKE Clusters
- Enable Shielded GKE Nodes on a Cluster
- Enable Workload Identity Federation for GKE on clusters
ccm-tvm-03
根據已識別的風險，定義、實作及評估相關程序、流程和技術措施，以便針對安全漏洞識別結果，排定時間或緊急採取因應措施。
ccm-tvm-06
定義、導入及評估相關程序和技術措施，以便由獨立第三方定期執行滲透測試。
- Configure the Allowed Ingress Settings for Cloud Run Organization Policy Constraint
- Enable the Restrict Authorized Networks on Cloud SQL Instances Organization Policy Constraint
- Use Latest Image Versions on Dataproc Clusters
ccm-uem-04
維護用於儲存及存取公司資料的所有端點清單。
ccm-uem-07
透過公司的變更管理程序，管理端點作業系統、修補程式層級和應用程式的變更。
- Enable CMEK on GKE Node Pool Boot Disks
- Enable Encryption on GKE Clusters
- Enable Integrity Monitoring on GKE Clusters
- Enable Workload Identity Federation for GKE on clusters
ccm-uem-10
設定軟體防火牆，確保受管理端點的設定正確無誤。
- Block Connections to FTP Ports from All IP Addresses
- Block Connections to LDAP Ports from All IP Addresses
- Block Connections to Memcached Ports from All IP Addresses
- Block Connections to MongoDB Ports from All IP Addresses
- Block Connections to MySQL Ports from All IP Addresses
- Block Connections to NetBIOS Ports from All IP Addresses
- Block Connections to Oracle Database Ports from All IP Addresses
- Block Connections to POP3 Server Ports from All IP Addresses
- Block Connections to PostgreSQL Server Ports from All IP Addresses
- Block Connections to Redis Server Ports from All IP Addresses
- Block Connections to SMTP Server Ports from All IP Addresses
- Block Generic Access to CiscoSecure/WebSM Ports
- Block Generic Access to Directory Service Ports
- Block Generic Access to HTTP Ports
- Block Generic Access to Telnet Servers
- Block Overly Permissive Firewall Rules
ccm-uem-11
根據風險評估結果，使用資料遺失防護 (DLP) 技術和規則設定受管理端點。
Data Security and Privacy Essentials
支援的雲端服務供應商： Google Cloud
Google 建議的雲端控制措施，可確保資料安全和隱私權
這個架構包含下列雲端控管機制：
- Block Public Access to BigQuery Datasets with Sensitive Data
- Block Public Access to Cloud SQL Instances with Sensitive Data
- Require CMEK for BigQuery Datasets with Sensitive Data
- Require CMEK for BigQuery Tables with Sensitive Data
- Require CMEK for Cloud SQL Instances with Sensitive Data
Data Security Framework Template
支援的雲端服務供應商： Google Cloud
Google 內建架構，可部署進階 DSPM Cloud 控管機制。
這個架構包含下列雲端控管機制：
- Enable CMEK for BigQuery Tables
- Enable CMEK for Vertex AI Datasets
- Enable CMEK for Vertex AI Featurestore
- Enable CMEK for Vertex AI Metadata Stores
- Enable CMEK for Vertex AI Models
- Govern the Maximum Retention Period for Sensitive Data
- Restrict Access to Sensitive Data to Permitted Users
- Restrict Flow of Sensitive Data Across Geographic Jurisdictions
FedRAMP Low 20x
支援的雲端服務供應商： Google Cloud
這項計畫適用於整個政府機構，針對機關用來處理未分類資訊的雲端運算產品和服務，提供標準化且可重複使用的安全性評估與授權方法。如果機密性、完整性和可用性損失對機構作業、資產或個人造成的負面影響有限，則最適合使用 FedRAMP 低影響程度 CSO。
這個架構包含下列章節中的雲端控制群組和雲端控制項。
ksi-cmt-1
記錄及監控系統修改內容。確保所有系統變更都已記錄，且設定基準已更新。
- Configure Log Metrics and Alerts for Audit Logging Changes
- Configure Log Metrics and Alerts for Cloud SQL Configuration Changes
- Configure Log Metrics and Alerts for Cloud Storage IAM Policy Changes
- Configure Log Metrics and Alerts for Custom Role Changes
- Configure Log Metrics and Alerts for VPC Network Firewall Changes
- Configure Log Metrics and Alerts for VPC Route Changes
ksi-cna-1
設定所有資訊資源，限制傳入和傳出流量。
- Configure the Allowed Ingress Settings for Cloud Run Organization Policy Constraint
- Configure the Allowed VPC Egress Settings for Cloud Run Organization Policy Constraint
- Define VPC Connector Egress For Cloud Run Functions
- Enable Network Policy on GKE Clusters
- Enable Private Clusters for GKE
- Enforce Deny All Egress Firewall Rule
ksi-cna-2
設計系統，協助縮小受攻擊面，並在遭到入侵時盡量減少橫向移動。
- Block Connections to DNS Ports from All IP Addresses
- Block Connections to Elasticsearch Ports from All IP Addresses
- Block Connections to FTP Ports from All IP Addresses
- Block Connections to LDAP Ports from All IP Addresses
- Block Connections to Memcached Ports from All IP Addresses
- Block Connections to MongoDB Ports from All IP Addresses
- Block Connections to MySQL Ports from All IP Addresses
- Block Connections to NetBIOS Ports from All IP Addresses
- Block Connections to Oracle Database Ports from All IP Addresses
- Block Connections to POP3 Server Ports from All IP Addresses
- Block Connections to PostgreSQL Server Ports from All IP Addresses
- Block Connections to Redis Server Ports from All IP Addresses
- Block Connections to SMTP Server Ports from All IP Addresses
- Block Generic Access to CiscoSecure/WebSM Ports
- Block Generic Access to Directory Service Ports
- Block Generic Access to HTTP Ports
- Block Generic Access to RDP Ports
- Block Generic Access to SSH Ports
- Block Generic Access to Telnet Servers
- Block Overly Permissive Firewall Rules
- Block Public IP Addresses for AlloyDB Cluster Instances
- Block Public IP Addresses for Cloud SQL Instances
- Don't Use Kubernetes Web UI
- Restrict Public Access to BigQuery Datasets
- Restrict Public Access to Cloud Storage Buckets
- Restrict Public IP Addresses on Vertex AI Workbench Notebooks and Instances
- Restrict Public IP Addresses to Compute Engine Instances
ksi-cna-4
使用不可變基礎架構，並嚴格定義功能和權限。
ksi-cna-6
設計具備高可用性和快速復原功能的資訊系統，防止資料遺失。
ksi-cna-7
根據主機供應商的最佳做法和記錄的指引，實作雲端優先的資訊資源。
- Block Connections to Cassandra Ports from All IP Addresses
- Define Retention Period for Cloud Storage Buckets
- Define Storage Class Lifestyle Action
- Lock Storage Bucket Retention Policies
- Require CMEK on Dataproc Clusters
ksi-iam-3
為 Google Cloud 中的所有非使用者帳戶和服務強制執行安全驗證方法，協助保護資料和資源免於未經授權的存取。
- Block Service Account Key Creation
- Block Service Account Key Uploads
- Enable Workload Identity Federation for GKE on clusters
- Restrict User Managed Service Account Keys
ksi-iam-4
實作最低權限、以角色和屬性為基礎，以及即時的安全授權模型。請為所有使用者和非使用者帳戶與服務採用這個模型，以降低未經授權存取或濫用的風險。
- Block Automatic IAM Grants to Default Service Accounts
- Use Least Privilege Service Accounts for GKE Clusters
ksi-mla-2
定期查看應用程式和服務的稽核記錄。
- Enable Cloud DNS Logs Monitoring
- Enable Cloud Logging on GKE Clusters
- Enable Cloud Monitoring on GKE Clusters
- Enable Firewall Rule Logging
- Enable Flow Logs for VPC Subnet
- Enable Intranode Visibility for GKE Clusters
- Enable Load Balancer Logging
- Require Cloud Storage Bucket Logging
ksi-mla-3
偵測安全漏洞，並及時修正或緩解，以協助降低應用程式和服務的風險影響。
ksi-piy-1
維護最新資訊資源清單或程式碼，定義所有已部署的資產、軟體和服務。
ksi-piy-4
將安全考量納入軟體開發生命週期 (SDLC)，並遵守美國網路安全暨基礎設施安全局 (CISA) 的「安全設計」原則。
ksi-svc-1
定期檢查並強化網路和系統設定，確保安全無虞。
- Block Serial Ports for Compute Engine Instances
- Don't Use Legacy Networks
- Don't Use User Connections Flag for SQL Server
- Don't Use User Options Flag for SQL Server
- Enable 3625 Trace Database Flag for SQL Server
- Enable Cloud Asset Inventory Service
- Enable DNSSEC for Cloud DNS
ksi-svc-2
加密連線至 Google Cloud 的機器之間交換的所有核心內容資料，或保護所有網路流量，以協助保護資料。
ksi-svc-6
使用自動化金鑰管理系統，協助保護、管理及定期輪替數位金鑰和憑證。
- Enable OS Login for All Instances at Project Level
- Enable Workload Identity Federation for GKE on clusters
ksi-svc-7
針對應用程式和服務套用安全性修補程式，並採取一致的風險評估方法。
- Enable Auto Upgrade on GKE Clusters
- Require Auto Upgrade Schedule Set for Vertex AI Workbench
- Subscribe a GKE Cluster to a Release Channel
ISO 27001:2022
支援的雲端服務供應商： Google Cloud
資訊安全管理系統 (ISMS) 的國際標準。這項標準提供以風險為依據的系統化方法，藉由指定建立及改善安全控管措施的規定，協助管理機密資訊。
這個架構包含下列章節中的雲端控制群組和雲端控制項。
iso-27001-2022-a-5-1
應定義資訊安全政策和特定主題政策，並由管理階層核准、發布，向相關人員和利害關係人傳達並取得確認，以及在預定間隔和發生重大變更時進行審查。
iso-27001-2022-a-5-10
應找出可接受的使用規則，以及處理資訊和其他相關資產的程序，並記錄及實施這些規則和程序。
- Block Public IP Addresses for AlloyDB Cluster Instances
- Block Public IP Addresses for Cloud SQL Instances
- Enable Skip Show Database Flag for MySQL
- Enable Uniform Bucket-Level Access on Cloud Storage Buckets
- Restrict Public Access to BigQuery Datasets
- Restrict Public Access to Cloud SQL Database Instances
- Restrict Public Access to Cloud Storage Buckets
- Restrict Public IP Addresses to Compute Engine Instances
- Turn Off Contained Database Authentication Flag for SQL Server
- Turn Off Cross Database Ownership Chaining Flag for SQL Server
iso-27001-2022-a-5-12
根據機密性、完整性、可用性和相關利害關係人需求，按照機構的資訊安全需求分類資訊。
iso-27001-2022-a-5-14
組織內及組織與其他各方之間的所有類型傳輸設施，都應制定資訊傳輸規則、程序或協議。
iso-27001-2022-a-5-15
根據業務和資訊安全需求，制定並實施相關規則，控管資訊和其他相關資產的實體和邏輯存取權。
- Block Public IP Addresses for AlloyDB Cluster Instances
- Block Public IP Addresses for Cloud SQL Instances
- Block Root Access on Vertex AI Workbench Instances
- Block Terminal Access on Vertex AI Workbench Instances
- Define Vertex AI Access Mode
- Enable OS Login for All Instances at Project Level
- Enable Skip Show Database Flag for MySQL
- Enable Uniform Bucket-Level Access on Cloud Storage Buckets
- Enforce Public Access Prevention
- Require OS Login on Compute Engine Instances
- Restrict Public Access to BigQuery Datasets
- Restrict Public Access to Cloud SQL Database Instances
- Restrict Public Access to Cloud Storage Buckets
- Restrict Public IP Addresses to Compute Engine Instances
- Restrict Service Usage
- Set Application Restriction on API Keys
- Set Uniform Bucket Level Access for Cloud Storage Buckets
- Turn Off Contained Database Authentication Flag for SQL Server
- Turn Off Cross Database Ownership Chaining Flag for SQL Server
iso-27001-2022-a-5-17
驗證資訊的分配和管理應由管理程序控管，包括向人員提供驗證資訊的適當處理方式。
iso-27001-2022-a-5-18
資訊和其他相關資產的存取權，應根據機構的特定主題政策和存取權控管規則，進行佈建、審查、修改和移除。
- Block Automatic IAM Grants to Default Service Accounts
- Retain Audit Records
- Set Application Restriction on API Keys
iso-27001-2022-a-5-19
應定義及實作程序，以管理使用供應商產品或服務時的資訊安全風險。
iso-27001-2022-a-5-20
根據供應商關係類型，與各供應商建立並同意相關資訊安全要求。
iso-27001-2022-a-5-23
應根據機構的資訊安全需求，建立雲端服務的取得、使用、管理和退出程序。
- Block Root Access on Vertex AI Workbench Instances
- Block Terminal Access on Vertex AI Workbench Instances
- Define Vertex AI Access Mode
- Disable File Downloads on Vertex AI Workbench Instances
- Enforce CMEK for Supported Services
- Require Auto Upgrade Schedule Set for Vertex AI Workbench
- Restrict Non CMEK Services
- Restrict Public IP Addresses on Vertex AI Workbench Notebooks and Instances
- Restrict Service Usage
iso-27001-2022-a-5-24
機構應規劃及準備管理資訊安全事件，方法是定義、建立及傳達資訊安全事件管理程序、角色和責任。
iso-27001-2022-a-5-25
組織應評估資訊安全事件，並決定是否將其歸類為資訊安全事件。
iso-27001-2022-a-5-28
組織應建立並實施相關程序，以識別、蒐集、取得及保存與資訊安全事件相關的證據。
- Enable Log Connections Flag for PostgreSQL
- Enable Log Disconnections Flag for PostgreSQL
- Enable Log Error Verbosity Flag for PostgreSQL
- Enable Log Min Error Statement Flag for PostgreSQL
- Enable Log Min Messages Flag for PostgreSQL
- Enable Log Statement Flag for PostgreSQL
- Set Log Error Verbosity Flag for AlloyDB Instances
- Set Log Min Error Statement Flag for AlloyDB Instances
- Set Log Min Messages Flag for AlloyDB Instances
- Turn Off Log Min Duration Statement Flag for PostgreSQL
iso-27001-2022-a-5-30
應根據業務持續性目標和 ICT 持續性需求，規劃、實施、維護及測試 ICT 準備情況。
iso-27001-2022-a-5-33
記錄應受到保護，避免遺失、毀損、偽造、未經授權存取和未經授權發布。
- Define Retention Period for Cloud Storage Buckets
- Enable CMEK for AlloyDB Clusters
- Enable CMEK for BigQuery Datasets
- Enable CMEK for BigQuery Tables
- Enable Object Versioning on Buckets
- Lock Storage Bucket Retention Policies
- Require CMEK on Dataproc Clusters
iso-27001-2022-a-5-5
機構應與相關主管機關建立並維持聯繫。
iso-27001-2022-a-5-6
機構應與特殊利益團體或其他專業安全論壇和專業協會建立並維持聯繫。
iso-27001-2022-a-5-9
應開發及維護資訊和其他相關資產的清單，包括擁有者。
- Define Set Storage Class Lifestyle Action on Bucket
- Define Storage Class Lifestyle Action
- Enable Cloud Asset Inventory Service
iso-27001-2022-a-6-7
員工遠端工作時，應採取安全措施，保護在機構外部存取、處理或儲存的資訊。
iso-27001-2022-a-8-1
儲存於、處理或存取使用者端點裝置的資訊應受到保護。
- Don't Use User Connections Flag for SQL Server
- Don't Use User Options Flag for SQL Server
- Enable 3625 Trace Database Flag for SQL Server
iso-27001-2022-a-8-10
資訊系統、裝置或其他儲存媒體中儲存的資訊，在不再需要時應刪除。
- Define Retention Period for Cloud Storage Buckets
- Lock Storage Bucket Retention Policies
- Turn Off External Scripts Flag for SQL Server
iso-27001-2022-a-8-13
應根據備份相關的特定主題政策，維護並定期測試資訊、軟體和系統的備份副本。
- Enable AlloyDB Automated Backups on Cluster
- Enable AlloyDB Backups on Cluster
- Enable Automatic Backups for Cloud SQL Databases
- Enable Object Versioning on Buckets
- Require Object Versioning for Cloud Storage Buckets
iso-27001-2022-a-8-14
資訊處理設施應實作足夠的備援機制，以符合可用性需求。
iso-27001-2022-a-8-15
系統應產生、儲存、保護及分析記錄活動、例外狀況、錯誤和其他相關事件的記錄。
- Allocate Audit Log Storage Capacity
- Configure Log Metrics and Alerts for Audit Logging Changes
- Configure Log Metrics and Alerts for Cloud SQL Configuration Changes
- Configure Log Metrics and Alerts for Cloud Storage IAM Policy Changes
- Configure Log Metrics and Alerts for Custom Role Changes
- Configure Log Metrics and Alerts for VPC Network Changes
- Configure Log Metrics and Alerts for VPC Network Firewall Changes
- Configure Log Metrics and Alerts for VPC Route Changes
- Configure Log Sinks
- Configure Network Traffic Monitoring
- Configure Security Logging Policies for Google Cloud Services
- Configure the Disable VM Serial Port Logging to Stackdriver Organization Policy
- Enable Audit Logs for Google Cloud Services
- Enable Cloud Logging on GKE Clusters
- Enable Firewall Rule Logging
- Enable Flow Logs for VPC Subnet
- Enable Load Balancer Logging
- Enable Log Checkpoints Flag for PostgreSQL
- Enable Log Connections Flag for PostgreSQL
- Enable Log Disconnections Flag for PostgreSQL
- Enable Log Duration Flag for PostgreSQL instance
- Enable Log Error Verbosity Flag for PostgreSQL
- Enable Log Locks Wait Flag for PostgreSQL instance
- Enable Log Min Error Statement Flag for PostgreSQL
- Enable Log Min Messages Flag for PostgreSQL
- Enable Log Statement Flag for PostgreSQL
- Enable Log Temp Files Flag for PostgreSQL instance
- Enable VPC Flow Logs for Compute Engine Instances
- Require Cloud Storage Bucket Logging
- Set Log Error Verbosity Flag for AlloyDB Instances
- Set Log Min Error Statement Flag for AlloyDB Instances
- Set Log Min Messages Flag for AlloyDB Instances
- Turn Off Log Min Duration Statement Flag for PostgreSQL
iso-27001-2022-a-8-16
應監控網路、系統和應用程式的異常行為，並採取適當行動來評估潛在的資訊安全事件。
- Allocate Audit Log Storage Capacity
- Configure Network Traffic Monitoring
- Enable Audit Logs for Google Cloud Services
- Enable Cloud Monitoring on GKE Clusters
- Enable Firewall Rule Logging
- Enable Flow Logs for VPC Subnet
- Enable Integrity Monitoring on GKE Clusters
- Enable Log Duration Flag for PostgreSQL instance
- Enable Log Locks Wait Flag for PostgreSQL instance
- Enable OS Login
- Enable VPC Flow Logs for Compute Engine Instances
- Enable Workload Identity Federation for GKE on clusters
- Implement Continuous Network Traffic Monitoring
- Restrict User Managed Service Account Keys
- Terminate Network Connections
iso-27001-2022-a-8-17
機構使用的資訊處理系統時鐘應與核准的時間來源同步。
iso-27001-2022-a-8-2
應限制及管理高權限存取權的分配和使用。
- Block Automatic IAM Grants to Default Service Accounts
- Block Legacy Authorization on GKE Clusters
- Block Root Access on Vertex AI Workbench Instances
- Create GKE Clusters with Limited Privileges
- Restrict API Access to Google Cloud APIs for Compute Engine Instances
- Set Application Restriction on API Keys
- Use Custom Service Accounts for Compute Engine Instances
- Use Least Privilege Service Accounts for GKE Clusters
iso-27001-2022-a-8-20
網路和網路裝置應受到保護、管理及控管，以保護系統和應用程式中的資訊。
- Block Connections to Cassandra Ports from All IP Addresses
- Block Connections to DNS Ports from All IP Addresses
- Block Connections to Elasticsearch Ports from All IP Addresses
- Block Connections to FTP Ports from All IP Addresses
- Block Connections to LDAP Ports from All IP Addresses
- Block Connections to Memcached Ports from All IP Addresses
- Block Connections to MongoDB Ports from All IP Addresses
- Block Connections to MySQL Ports from All IP Addresses
- Block Connections to NetBIOS Ports from All IP Addresses
- Block Connections to Oracle Database Ports from All IP Addresses
- Block Connections to POP3 Server Ports from All IP Addresses
- Block Connections to PostgreSQL Server Ports from All IP Addresses
- Block Connections to Redis Server Ports from All IP Addresses
- Block Connections to SMTP Server Ports from All IP Addresses
- Block External IP Address Access on Compute Engine VM Instances
- Block Generic Access to CiscoSecure/WebSM Ports
- Block Generic Access to Directory Service Ports
- Block Generic Access to HTTP Ports
- Block Generic Access to RDP Ports
- Block Generic Access to SSH Ports
- Block Generic Access to Telnet Servers
- Block Overly Permissive Firewall Rules
- Configure Access Controls for the Network Boundary
- Configure Log Metrics and Alerts for Audit Logging Changes
- Configure Log Metrics and Alerts for Cloud SQL Configuration Changes
- Configure Log Metrics and Alerts for Cloud Storage IAM Policy Changes
- Configure Log Metrics and Alerts for Custom Role Changes
- Configure Log Metrics and Alerts for VPC Network Changes
- Configure Log Metrics and Alerts for VPC Network Firewall Changes
- Configure Log Metrics and Alerts for VPC Route Changes
- Configure Log Sinks
- Configure the Allowed Ingress Settings for Cloud Run Organization Policy Constraint
- Configure the Allowed VPC Egress Settings for Cloud Run Organization Policy Constraint
- Configure the Disable VPC External IPv6 Usage Organization Policy
- Configure the Disable VPC Internal IPv6 Usage Organization Policy
- Define a Security Policy to Mitigate for DDoS Events
- Define VPC Connector Egress For Cloud Run Functions
- Enable Control Plane Authorized Networks on GKE Clusters
- Enable Intranode Visibility for GKE Clusters
- Enable IP Alias Range for GKE Clusters
- Enable Load Balancer Logging
- Enable Network Policy on GKE Clusters
- Enable Private Clusters for GKE
- Enable Private Google Access for VPC Subnets
- Enable Private Google Access on an instance
- Enable the Restrict Authorized Networks on Cloud SQL Instances Organization Policy Constraint
- Enforce Deny All Egress Firewall Rule
- Implement Continuous Network Traffic Monitoring
- Prevent IP Forwarding on Compute Engine Instances
- Restrict Default Network Creation for Compute Engine Instances
- Restrict Public IP Addresses on Vertex AI Workbench Notebooks and Instances
- Terminate Network Connections
iso-27001-2022-a-8-21
應找出、實作及監控網路服務的安全機制、服務水準和服務需求。
- Block Connections to Cassandra Ports from All IP Addresses
- Block Connections to DNS Ports from All IP Addresses
- Block Connections to Elasticsearch Ports from All IP Addresses
- Block Connections to FTP Ports from All IP Addresses
- Block Connections to LDAP Ports from All IP Addresses
- Block Connections to Memcached Ports from All IP Addresses
- Block Generic Access to CiscoSecure/WebSM Ports
- Block Generic Access to Directory Service Ports
- Block Generic Access to HTTP Ports
- Block Generic Access to RDP Ports
- Block Generic Access to SSH Ports
- Configure the Allowed Ingress Settings for Cloud Run Organization Policy Constraint
- Enable DNSSEC for Cloud DNS
iso-27001-2022-a-8-22
機構網路應將資訊服務、使用者和資訊系統群組區隔開來。
- Block Connections to MongoDB Ports from All IP Addresses
- Define VPC Connector Egress For Cloud Run Functions
iso-27001-2022-a-8-23
管理外部網站的存取權，減少接觸惡意內容的機會。
iso-27001-2022-a-8-24
應定義並實施有效使用密碼編譯的規則，包括加密金鑰管理。
- Block Connections to NetBIOS Ports from All IP Addresses
- Create and Manage Asymmetric Keys
- Define Cloud KMS Crypto Keys Protection Level
- Define Cloud KMS Crypto Keys Purpose
- Define Secret Manager Rotation Schedule
- Enable CMEK for Cloud SQL Databases
- Enable CMEK for Cloud Storage Buckets
- Enable CMEK on GKE Node Pool Boot Disks
- Enable Confidential Computing for Compute Engine Instances
- Enable CSEK On Compute Engine Persistent Disks
- Enable Encryption on GKE Clusters
- Enable SSL Encryption On AlloyDB Instances
- Enable the Confidential VM Organization Policy Constraint
- Encrypt Data at Rest with CMEK
- Encrypt Pub/Sub topic with CMEK
- Enforce CMEK
- Enforce CMEK for Supported Services
- Enforce HTTPS Traffic Only
- Enforce SSL for all Incoming Database Connections
- Ensure Minimum TLS 1.2 Version
- Restrict Insecure SSL Policies for Compute Engine Instances
- Restrict Legacy TLS Versions
- Restrict Non CMEK Services
- Use TLS 1.2 or Higher
- Verify Cloud KMS Key Version Algorithm
iso-27001-2022-a-8-25
應制定並套用軟體和系統安全開發規則。
- Block Connections to Oracle Database Ports from All IP Addresses
- Configure the Disable VM Serial Port Logging to Stackdriver Organization Policy
- Enable Log Temp Files Flag for PostgreSQL instance
- Require Service Account Key Rotation
- Turn Off Log Executor Stats Flag for PostgreSQL
- Turn off Log Hostname Flag for PostgreSQL
- Turn off Log Parser Stats Flag for PostgreSQL
- Turn off Log Planner Stats Flag for PostgreSQL
- Turn off Log Statement Stats Flag for PostgreSQL
iso-27001-2022-a-8-26
開發或取得應用程式時，應確認、指定及核准資訊安全需求。
iso-27001-2022-a-8-27
應建立、記錄、維護並套用安全系統工程原則，以用於任何資訊系統開發活動。
- Block Connections to PostgreSQL Server Ports from All IP Addresses
- Prevent Nested Virtualization for Compute Engine VMs
- Require Rotation of API Key
- Restrict API Keys for Required APIs Only
iso-27001-2022-a-8-28
軟體開發作業應遵循安全程式設計原則。
iso-27001-2022-a-8-29
在開發生命週期中，應定義及實作安全測試程序。
- Block Connections to SMTP Server Ports from All IP Addresses
- Configure Remote Access Inactivity Timeout
iso-27001-2022-a-8-3
資訊和其他相關資產的存取權，應根據既定的主題專屬存取權控管政策進行限制。
- Block Connections to Cassandra Ports from All IP Addresses
- Block Connections to DNS Ports from All IP Addresses
- Block Connections to Elasticsearch Ports from All IP Addresses
- Block Connections to FTP Ports from All IP Addresses
- Block Connections to LDAP Ports from All IP Addresses
- Block Connections to Memcached Ports from All IP Addresses
- Block Connections to MongoDB Ports from All IP Addresses
- Block Connections to MySQL Ports from All IP Addresses
- Block Connections to NetBIOS Ports from All IP Addresses
- Block Connections to Oracle Database Ports from All IP Addresses
- Block Connections to POP3 Server Ports from All IP Addresses
- Block Connections to PostgreSQL Server Ports from All IP Addresses
- Block Connections to Redis Server Ports from All IP Addresses
- Block Connections to SMTP Server Ports from All IP Addresses
- Block External IP Address Access on Compute Engine VM Instances
- Block Generic Access to CiscoSecure/WebSM Ports
- Block Generic Access to Directory Service Ports
- Block Generic Access to HTTP Ports
- Block Generic Access to RDP Ports
- Block Generic Access to SSH Ports
- Block Generic Access to Telnet Servers
- Block Overly Permissive Firewall Rules
- Block Project-Wide SSH Keys on Compute Engine Instances
- Block Public IP Addresses for AlloyDB Cluster Instances
- Block Public IP Addresses for Cloud SQL Instances
- Block Serial Ports for Compute Engine Instances
- Block Terminal Access on Vertex AI Workbench Instances
- Configure the Allowed VPC Egress Settings for Cloud Run Organization Policy Constraint
- Configure the Disable VPC External IPv6 Usage Organization Policy
- Create GKE Clusters with Limited Privileges
- Define Vertex AI Access Mode
- Disable File Downloads on Vertex AI Workbench Instances
- Don't Use Kubernetes Web UI
- Enable Control Plane Authorized Networks on GKE Clusters
- Enable Intranode Visibility for GKE Clusters
- Enable Network Policy on GKE Clusters
- Enable Private Clusters for GKE
- Enable Private Google Access for VPC Subnets
- Enable Private Google Access on an instance
- Enable Skip Show Database Flag for MySQL
- Enable the Restrict Authorized Networks on Cloud SQL Instances Organization Policy Constraint
- Enable Uniform Bucket-Level Access on Cloud Storage Buckets
- Enforce Deny All Egress Firewall Rule
- Enforce Public Access Prevention
- Restrict Public Access to BigQuery Datasets
- Restrict Public Access to Cloud SQL Database Instances
- Restrict Public Access to Cloud Storage Buckets
- Restrict Public IP Addresses to Compute Engine Instances
- Retain Audit Records
- Set Application Restriction on API Keys
- Set Uniform Bucket Level Access for Cloud Storage Buckets
- Turn Off Contained Database Authentication Flag for SQL Server
- Turn Off Cross Database Ownership Chaining Flag for SQL Server
- Use Least Privilege Service Accounts for GKE Clusters
iso-27001-2022-a-8-30
組織應指導、監控及審查與外包系統開發相關的活動。
iso-27001-2022-a-8-4
應妥善管理原始碼、開發工具和軟體程式庫的讀寫權限。
- Block Public IP Addresses for AlloyDB Cluster Instances
- Block Public IP Addresses for Cloud SQL Instances
- Enable Skip Show Database Flag for MySQL
- Enable Uniform Bucket-Level Access on Cloud Storage Buckets
- Restrict Public Access to BigQuery Datasets
- Restrict Public Access to Cloud SQL Database Instances
- Restrict Public Access to Cloud Storage Buckets
- Restrict Public IP Addresses to Compute Engine Instances
- Turn Off Contained Database Authentication Flag for SQL Server
- Turn Off Cross Database Ownership Chaining Flag for SQL Server
iso-27001-2022-a-8-5
根據資訊存取限制和主題專屬的存取控管政策，實施安全驗證技術和程序。
- Block Service Account Key Creation
- Block Service Account Key Uploads
- Configure Remote Access Inactivity Timeout
- Enable OS Login
- Enable Workload Identity Federation for GKE on clusters
- Enforce Compute Session Inactive Policy
- Ensure Minimum TLS 1.2 Version
iso-27001-2022-a-8-6
應根據目前和預期的容量需求，監控及調整資源用量。
iso-27001-2022-a-8-7
應實施惡意軟體防護措施，並透過適當的使用者宣導活動提供支援。
iso-27001-2022-a-8-8
取得所用資訊系統的技術安全漏洞相關資訊，評估機構面臨這類安全漏洞的風險，並採取適當措施。
- Disable Alpha Features on GKE Clusters
- Disable Legacy Metadata Server Endpoints on Compute Engine
- Enable Artifact Analysis Vulnerability Scanning
- Enable Auto Upgrade on GKE Clusters
- Enable Cloud Asset Inventory Service
- Enable Integrity Monitoring on GKE Clusters
- Enable Secure Boot for Shielded GKE Nodes
- Enable Secure Boot on Compute Engine Instances
- Enable Shielded GKE Nodes on a Cluster
- Enable Shielded VM for Compute Engine Instances
- Require Auto Upgrade Schedule Set for Vertex AI Workbench
- Require Container-Optimized OS for a GKE Cluster
- Subscribe a GKE Cluster to a Release Channel
- Turn Off Local Infile Flag for MySQL
- Use Latest Image Versions on Dataproc Clusters
iso-27001-2022-a-8-9
應建立、記錄、實作、監控及審查硬體、軟體、服務和網路的設定，包括安全設定。
- Avoid RSASHA1 for DNSSEC Signing
- Disable Alpha Features on GKE Clusters
- Disable Legacy Metadata Server Endpoints on Compute Engine
- Don't Use Legacy Networks
- Don't Use User Connections Flag for SQL Server
- Don't Use User Options Flag for SQL Server
- Enable 3625 Trace Database Flag for SQL Server
- Enable Auto Upgrade on GKE Clusters
- Enable Secure Boot for Shielded GKE Nodes
- Enable Secure Boot on Compute Engine Instances
- Enable Shielded GKE Nodes on a Cluster
- Enable Shielded VM for Compute Engine Instances
- Prevent Nested Virtualization for Compute Engine VMs
- Require Auto Upgrade Schedule Set for Vertex AI Workbench
- Require Container-Optimized OS for a GKE Cluster
- Restrict Default Network Creation for Compute Engine Instances
- Subscribe a GKE Cluster to a Release Channel
- Turn Off Remote Access Flag for SQL Server
- Use Custom VPC Networks
- Use Latest Image Versions on Dataproc Clusters
Qatar National Information Assurance Standard v2.1
支援的雲端服務供應商： Google Cloud
卡達 NIAS 旨在為卡達境內的機構提供必要基礎和相關工具，協助機構實作完整的資訊安全管理系統。
這個架構包含下列章節中的雲端控制群組和雲端控制項。
qa-nias-2-1-am-1
系統會根據最低權限原則授予使用者存取權，並以「有知情必要」或「有存取必要」為依據。
- Block Automatic IAM Grants to Default Service Accounts
- Block Legacy Authorization on GKE Clusters
- Block Root Access on Vertex AI Workbench Instances
- Block Service Account Key Uploads
- Block Terminal Access on Vertex AI Workbench Instances
- Create GKE Clusters with Limited Privileges
- Define Vertex AI Access Mode
- Enable OS Login
- Enable Workload Identity Federation for GKE on clusters
- Lock Storage Bucket Retention Policies
- Restrict API Keys for Required APIs Only
- Restrict Public Access to BigQuery Datasets
- Restrict Public Access to Cloud Storage Buckets
- Set Uniform Bucket Level Access for Cloud Storage Buckets
- Turn Off Contained Database Authentication Flag for SQL Server
- Use Least Privilege Service Accounts for GKE Clusters
qa-nias-2-1-am-11
集中式驗證儲存庫 (例如 LDAP 和驗證資料庫) 可防範阻斷服務攻擊，並使用安全且經過驗證的管道擷取驗證資料。這類存放區應記錄下列事件：未經授權的更新或存取；活動的開始和結束日期與時間 (連同系統 ID)；使用者 ID (適用於非法登入)；登入和登出活動 (適用於非法登入)；以及工作階段、終端機或遠端連線。
- Configure Log Metrics and Alerts for Custom Role Changes
- Enable Log Connections Flag for PostgreSQL
- Enable Log Disconnections Flag for PostgreSQL
- Turn Off Contained Database Authentication Flag for SQL Server
qa-nias-2-1-am-12
機構必須根據國家資料分類政策 (IAP-NAT-DCLS) 制定並維護一套政策、計畫和程序，涵蓋系統使用者的身分識別、驗證和授權。
qa-nias-2-1-am-14
每次授予系統存取權時，系統都會驗證所有使用者身分，確保使用者身分專屬。
- Enable OS Login
- Enable OS Login for All Instances at Project Level
- Enable Workload Identity Federation for GKE on clusters
- Require OS Login on Compute Engine Instances
qa-nias-2-1-am-17
未受保護的驗證資訊位於或隨附於系統或裝置，可授予系統存取權或解密加密裝置。
qa-nias-2-1-am-18
使用中的系統驗證資料不會受到攻擊，包括但不限於重播、中間人攻擊和工作階段劫持。
- Block Service Account Key Creation
- Enable Private Google Access for VPC Subnets
- Enable SSL Encryption On AlloyDB Instances
- Enable Workload Identity Federation for GKE on clusters
- Enforce HTTPS Traffic Only
- Enforce SSL for all Incoming Database Connections
- Ensure Minimum TLS 1.2 Version
- Restrict Insecure SSL Policies for Compute Engine Instances
- Restrict Legacy TLS Versions
qa-nias-2-1-am-2
系統會根據資訊的機密程度，透過系統存取控管、身分識別與驗證，以及稽核追蹤記錄，管理及控管存取權。這類存取要求須經員工主管或經理授權。
- Block Automatic IAM Grants to Default Service Accounts
- Enable Uniform Bucket-Level Access on Cloud Storage Buckets
- Restrict Public Access to BigQuery Datasets
- Restrict Public Access to Cloud Storage Buckets
- Set Uniform Bucket Level Access for Cloud Storage Buckets
qa-nias-2-1-am-20
至少每 90 天變更一次密碼。
qa-nias-2-1-am-23
螢幕和工作階段鎖定設定如下：系統使用者閒置最多 15 分鐘後啟動；視需要由系統使用者啟動；鎖定後完全隱藏螢幕上的所有資訊；確保螢幕在鎖定狀態下不會顯示為關閉；讓系統使用者重新驗證身分以解鎖系統；禁止系統使用者停用鎖定機制。
qa-nias-2-1-am-24
如果登入失敗次數達到指定值，或是員工因角色變更或離職而不再需要存取系統，系統就會立即停用存取權。
- Enable OS Login
- Enable OS Login for All Instances at Project Level
- Require OS Login on Compute Engine Instances
qa-nias-2-1-am-3
使用者或實體建立、讀取、更新、刪除或傳輸機構資訊資產的存取權，應以資訊擁有者制定的業務規則所定義的權限矩陣 (階層式) 模型為依據。
- Block Automatic IAM Grants to Default Service Accounts
- Block Legacy Authorization on GKE Clusters
- Define Vertex AI Access Mode
- Enable OS Login
- Enable Uniform Bucket-Level Access on Cloud Storage Buckets
- Enable Workload Identity Federation for GKE on clusters
- Enforce Public Access Prevention
- Lock Storage Bucket Retention Policies
- Restrict API Keys for Required APIs Only
- Set Application Restriction on API Keys
- Set Uniform Bucket Level Access for Cloud Storage Buckets
qa-nias-2-1-am-31
特權帳戶的使用情況會記錄在案、受到控管、可追究責任，並盡量減少使用。特殊權限帳戶只能用於管理工作。
- Block Automatic IAM Grants to Default Service Accounts
- Block Project-Wide SSH Keys on Compute Engine Instances
- Block Root Access on Vertex AI Workbench Instances
- Block Service Account Key Uploads
- Block Terminal Access on Vertex AI Workbench Instances
- Restrict API Access to Google Cloud APIs for Compute Engine Instances
- Restrict User Managed Service Account Keys
- Use Custom Service Accounts for Compute Engine Instances
qa-nias-2-1-am-32
系統管理員會獲派個人帳戶，以執行管理工作。
- Block Project-Wide SSH Keys on Compute Engine Instances
- Block Root Access on Vertex AI Workbench Instances
qa-nias-2-1-am-34
系統管理記錄會更新，以記錄下列資訊：清除活動、系統啟動和關機、元件或系統故障、維護活動、備份和封存活動、系統復原活動，以及特殊或非上班時間活動。
- Configure Log Metrics and Alerts for Cloud SQL Configuration Changes
- Enable AlloyDB Automated Backups on Cluster
- Enable AlloyDB Backups on Cluster
- Enable Automatic Backups for Cloud SQL Databases
- Enable Cloud Logging on GKE Clusters
- Enable Log Error Verbosity Flag for PostgreSQL
- Enable Log Min Error Statement Flag for PostgreSQL
qa-nias-2-1-am-35
除非部門主管明確授權，且業務需求有正當理由，並在完成盡職調查以分析相關風險，以及實作適當的控管措施來降低已識別的風險後，才可提供遠端存取權。
qa-nias-2-1-am-36
存取處理 C3 以上分類資料的系統時，會使用雙重驗證、硬體權杖、生物特徵辨識控制或其他類似方法。
qa-nias-2-1-am-37
遠端存取工作階段會使用適當的端對端加密技術保護，如第 C-10 節「加密安全 (CY)」所述。
- Enable SSL Encryption On AlloyDB Instances
- Ensure Minimum TLS 1.2 Version
- Restrict Legacy TLS Versions
qa-nias-2-1-am-6
任何未經授權的規避組織存取權控管措施行為，都應視為安全事件，並根據既有的事件處理程序和適當的人力資源政策與程序處理。
- Configure Log Metrics and Alerts for Cloud Storage IAM Policy Changes
- Configure Log Metrics and Alerts for Custom Role Changes
- Require Cloud Storage Bucket Logging
qa-nias-2-1-am-7
稽核記錄應以可監控政府政策遵循情形，並協助事件管理的方式啟用及維護。
- Configure Log Metrics and Alerts for Audit Logging Changes
- Configure Log Metrics and Alerts for Cloud SQL Configuration Changes
- Configure Log Metrics and Alerts for Cloud Storage IAM Policy Changes
- Configure Log Metrics and Alerts for Custom Role Changes
- Configure Log Sinks
- Define Retention Period for Cloud Storage Buckets
- Enable Cloud Logging on GKE Clusters
- Enable Firewall Rule Logging
- Enable Flow Logs for VPC Subnet
- Enable Log Checkpoints Flag for PostgreSQL
- Enable Log Connections Flag for PostgreSQL
- Enable Log Disconnections Flag for PostgreSQL
- Enable Log Duration Flag for PostgreSQL instance
- Enable Log Error Verbosity Flag for PostgreSQL
- Enable Log Min Error Statement Flag for PostgreSQL
- Enable Log Min Messages Flag for PostgreSQL
- Enable Log Statement Flag for PostgreSQL
- Enable Log Temp Files Flag for PostgreSQL instance
- Enable Subnet Flow Logs
- Require Cloud Storage Bucket Logging
- Require Object Versioning for Cloud Storage Buckets
- Set Log Min Error Statement Flag for AlloyDB Instances
- Set Log Min Messages Flag for AlloyDB Instances
qa-nias-2-1-am-8
從技術上控管機構網路的邏輯存取權。例如使用網路存取控制 (NAC) 服務和裝置。
qa-nias-2-1-cy-1
加密演算法、加密硬體或軟體、金鑰管理系統和數位簽章應符合 2010 年第 (16) 號電子商務和交易法頒布法中主管機關指定的核准加密/加密演算法和系統。
- Avoid RSASHA1 for DNSSEC Signing
- Define Cloud KMS Crypto Keys Protection Level
- Enable CMEK for AlloyDB Clusters
- Enable CMEK for BigQuery Tables
- Enable CMEK for Cloud SQL Databases
- Enable CMEK for Cloud Storage Buckets
- Enable CMEK on Compute Engine Persistent Disks
- Enable CMEK on GKE Node Pool Boot Disks
- Enable CSEK On Compute Engine Persistent Disks
- Enforce SSL for all Incoming Database Connections
- Require CMEK on Dataproc Clusters
- Restrict Non CMEK Services
- Restrict Service Usage
- Verify Cloud KMS Key Version Algorithm
qa-nias-2-1-cy-2
金鑰的生命週期主要取決於應用程式和所用的資訊基礎架構。如果金鑰遭外洩或疑似遭外洩，應立即撤銷並更換。
qa-nias-2-1-cy-3
無論儲存格式或媒體為何，凡是分類為 C3 (IAP-NAT-DCLS) 的資訊資產，在儲存和傳輸時都會經過加密，防止未經授權的揭露行為。如果風險評估結果顯示有必要，機構可將這些密碼編譯控制項套用至機密性要求較低的資產。
- Define Cloud KMS Crypto Keys Protection Level
- Define Cloud KMS Crypto Keys Purpose
- Enable CMEK for AlloyDB Clusters
- Enable CMEK for BigQuery Datasets
- Enable CMEK for BigQuery Tables
- Enable CMEK for Cloud SQL Databases
- Enable CMEK for Cloud Storage Buckets
- Enable CMEK on Compute Engine Persistent Disks
- Enable CMEK on GKE Node Pool Boot Disks
- Enable CSEK On Compute Engine Persistent Disks
- Enable Encryption on GKE Clusters
- Enable SSL Encryption On AlloyDB Instances
- Encrypt Pub/Sub topic with CMEK
- Enforce CMEK for Supported Services
- Enforce SSL for all Incoming Database Connections
- Require CMEK on Dataproc Clusters
- Restrict Non CMEK Services
- Restrict Service Usage
- Turn Off Log Min Duration Statement Flag for PostgreSQL
qa-nias-2-1-cy-4
分類為 I3 (IAP-NAT-DCLS) 的資訊資產會使用加密雜湊確保完整性。如果風險評估結果顯示有必要，機構可將這些加密控管措施套用至完整性要求較低的資產。
qa-nias-2-1-cy-5
根據主管機關發布的卡達國家密碼標準 - 英文版 v1.0 (或更高版本) 中列出的核准演算法，我們使用下列通訊協定 (或更高版本) 保護傳輸中的 C3 級資料：保護網路流量：TLS (+128 位元) (RFC4346)；保護檔案傳輸：SFTP (SFTP)；保護安全遠端存取：SSH v2 (RFC4253) 或 IPSEC (RFC 4301)；保護電子郵件：僅使用 S/MIME v3 (RFC3851) 或更高版本。如需相關規定，請參閱 CY11。
- Enable SSL Encryption On AlloyDB Instances
- Enforce HTTPS Traffic Only
- Enforce SSL for all Incoming Database Connections
- Ensure Minimum TLS 1.2 Version
- Restrict Insecure SSL Policies for Compute Engine Instances
- Restrict Legacy TLS Versions
qa-nias-2-1-cy-6
無論儲存格式或媒體為何，密碼在儲存或傳輸時都必須經過加密或雜湊處理，並防止未經授權揭露。每次變更密碼時，系統都會加密並異地儲存高權限密碼和備份檔案，確保完整復原。
- Enable CMEK for Cloud SQL Databases
- Enable Encryption on GKE Clusters
- Enforce SSL for all Incoming Database Connections
- Restrict User Managed Service Account Keys
qa-nias-2-1-cy-7
如果使用硬體安全模組 (HSM)，則至少會通過 FIPS 2-140 第 2 級 (FIPS2-140) 或共同準則 (CC3.1) EAL4 認證。
- Enable CMEK for BigQuery Tables
- Enable CMEK for Cloud SQL Databases
- Enable CMEK for Cloud Storage Buckets
- Require CMEK on Dataproc Clusters
qa-nias-2-1-cy-9
我們已根據 (ISO1-11770) 定義合適的金鑰管理程序，並用於管理加密金鑰的生命週期，涵蓋下列功能：金鑰管理員的角色和責任、金鑰產生、雙重控管和知識分割、安全金鑰儲存、金鑰使用、安全金鑰發布和傳輸、金鑰備份和復原、定期金鑰狀態檢查、金鑰遭盜用、金鑰撤銷和銷毀，以及稽核記錄和文件。
- Block Service Account Key Uploads
- Define Cloud KMS Crypto Keys Protection Level
- Enable CMEK for AlloyDB Clusters
- Enable CMEK for BigQuery Datasets
- Enable CMEK for BigQuery Tables
- Enable CMEK for Cloud SQL Databases
- Enable CMEK for Cloud Storage Buckets
- Enable CMEK on Compute Engine Persistent Disks
- Enable CMEK on GKE Node Pool Boot Disks
- Enable CSEK On Compute Engine Persistent Disks
- Enable Encryption on GKE Clusters
- Encrypt Pub/Sub topic with CMEK
- Require CMEK on Dataproc Clusters
- Require Rotation of API Key
- Require Service Account Key Rotation
- Restrict Non CMEK Services
qa-nias-2-1-gs-1
閘道可保護網路免受其他網路侵害，並妥善控管資料流。
- Block Connections to Oracle Database Ports from All IP Addresses
- Block External IP Address Access on Compute Engine VM Instances
- Define VPC Connector Egress For Cloud Run Functions
- Don't Use Legacy Networks
- Enable Control Plane Authorized Networks on GKE Clusters
- Enable Network Policy on GKE Clusters
- Enable Private Google Access for VPC Subnets
- Enable Private Google Access on an instance
- Enforce Public Access Prevention
- Prevent IP Forwarding on Compute Engine Instances
- Restrict Public Access to Cloud SQL Database Instances
- Restrict Public IP Addresses to Compute Engine Instances
qa-nias-2-1-gs-13
如要將資料匯出至分類等級較低的系統，必須先使用分類標籤檢查等方式篩選資料。
qa-nias-2-1-gs-2
將機構網路連線至其他機構網路或不受控管的公用網路時，閘道會以適當的網路裝置控管資料流，確保所有資料流都受到適當控管，且閘道元件位於適當的安全伺服器室內。
- Block Connections to Oracle Database Ports from All IP Addresses
- Block Connections to SMTP Server Ports from All IP Addresses
- Block Generic Access to RDP Ports
- Define VPC Connector Egress For Cloud Run Functions
- Restrict Public Access to Cloud SQL Database Instances
qa-nias-2-1-gs-6
非軍事區 (DMZ) 可透過防火牆和其他具備網路安全功能的設備，將可從外部存取的系統與不受控管的公用網路和內部網路分隔開來。
- Don't Use Legacy Networks
- Enable Network Policy on GKE Clusters
- Restrict Public Access to Cloud SQL Database Instances
- Restrict Public IP Addresses to Compute Engine Instances
qa-nias-2-1-gs-7
閘道必須：是內部網路的唯一通訊路徑；預設拒絕所有進出網路的連線；只允許明確授權的連線；使用與所有連線網路隔離的安全路徑進行管理；提供足夠的稽核功能，以偵測閘道安全漏洞和網路入侵嘗試；以及提供即時警報。
- Block Connections to Cassandra Ports from All IP Addresses
- Block Connections to Elasticsearch Ports from All IP Addresses
- Block Connections to FTP Ports from All IP Addresses
- Block Connections to LDAP Ports from All IP Addresses
- Block Connections to Memcached Ports from All IP Addresses
- Block Connections to MongoDB Ports from All IP Addresses
- Block Connections to MySQL Ports from All IP Addresses
- Block Connections to NetBIOS Ports from All IP Addresses
- Block Connections to Oracle Database Ports from All IP Addresses
- Block Connections to POP3 Server Ports from All IP Addresses
- Block Connections to PostgreSQL Server Ports from All IP Addresses
- Block Connections to Redis Server Ports from All IP Addresses
- Block Connections to SMTP Server Ports from All IP Addresses
- Block Generic Access to CiscoSecure/WebSM Ports
- Block Generic Access to Directory Service Ports
- Block Generic Access to HTTP Ports
- Block Generic Access to RDP Ports
- Block Generic Access to SSH Ports
- Block Generic Access to Telnet Servers
- Block Overly Permissive Firewall Rules
- Block Public IP Addresses for AlloyDB Cluster Instances
- Configure Log Metrics and Alerts for VPC Network Firewall Changes
- Configure Log Metrics and Alerts for VPC Route Changes
- Configure the Allowed Ingress Settings for Cloud Run Organization Policy Constraint
- Configure the Allowed VPC Egress Settings for Cloud Run Organization Policy Constraint
- Configure the Disable VPC External IPv6 Usage Organization Policy
- Enable Control Plane Authorized Networks on GKE Clusters
- Enable Network Policy on GKE Clusters
- Enforce Deny All Egress Firewall Rule
- Enforce Public Access Prevention
- Prevent IP Forwarding on Compute Engine Instances
- Restrict Public Access to Cloud SQL Database Instances
- Restrict Public IP Addresses to Compute Engine Instances
- Use Custom VPC Networks
qa-nias-2-1-gs-8
在正式網站上實作閘道前，我們會先強化閘道，並防範下列情況：惡意程式碼和安全漏洞、錯誤或不當的設定、帳戶遭盜用和權限提升、惡意網路監控、阻斷服務 (DoS) 攻擊，以及資訊或資料外洩。
- Block Connections to LDAP Ports from All IP Addresses
- Block Connections to NetBIOS Ports from All IP Addresses
- Block Generic Access to CiscoSecure/WebSM Ports
- Block Generic Access to SSH Ports
- Configure Log Metrics and Alerts for VPC Network Firewall Changes
- Disable File Downloads on Vertex AI Workbench Instances
- Enable Control Plane Authorized Networks on GKE Clusters
- Enable Private Clusters for GKE
- Enforce HTTPS Traffic Only
- Restrict Insecure SSL Policies for Compute Engine Instances
- Restrict Public Access to Cloud SQL Database Instances
- Restrict Public IP Addresses on Vertex AI Workbench Notebooks and Instances
- Use Custom VPC Networks
qa-nias-2-1-gs-9
我們已建立閘道監控和監督機制，包括威脅防範機制、記錄、快訊和設備監控。請參閱 B-10 節「記錄與安全監控 (SM)」。
- Configure Log Metrics and Alerts for Cloud Storage IAM Policy Changes
- Configure Log Metrics and Alerts for VPC Network Changes
- Configure Log Metrics and Alerts for VPC Network Firewall Changes
- Configure Log Metrics and Alerts for VPC Route Changes
- Enable Cloud DNS Logs Monitoring
- Enable Firewall Rule Logging
- Enable Flow Logs for VPC Subnet
- Enable Load Balancer Logging
- Enable Subnet Flow Logs
- Enable VPC Flow Logs for Compute Engine Instances
qa-nias-2-1-ie-12
確保系統間交換的資訊受到保護，避免遭到濫用、未經授權的存取或資料損毀。如要傳輸分類為 C2、I2 以上的資訊，請使用 CY5 C-10 節「密碼安全 (CY)」中指定的已驗證加密管道。
- Enable SSL Encryption On AlloyDB Instances
- Enforce SSL for all Incoming Database Connections
- Ensure Minimum TLS 1.2 Version
- Restrict Insecure SSL Policies for Compute Engine Instances
- Restrict Legacy TLS Versions
qa-nias-2-1-ie-3
請務必先與交換資訊的實體簽署必要協議 (尤其是保密協議)，再交換資訊。協議應提供責任、資訊交換通知程序、傳輸技術標準、快遞員身分識別、責任、所有權和控制權等資訊。對於供應商和第三方，應使用正式的保密協議 (NDA)。附錄 D 提供 NDA 範本。
qa-nias-2-1-ie-4
機構必須確保用於交換資訊的媒體受到保護，避免機構內外環境發生未經授權的存取、操縱或濫用行為。
qa-nias-2-1-ie-8
保護透過電子郵件傳輸的資訊，避免未經授權的存取、變更或服務中斷。
qa-nias-2-1-ms-20
含有機密資訊的媒體 (包括故障媒體) 會盡可能經過清除，然後再丟棄。
qa-nias-2-1-ns-1
未經授權人員不得公開或列舉內部網路和系統設定、員工或裝置相關目錄服務，以及其他機密技術的詳細資料。
- Block Connections to DNS Ports from All IP Addresses
- Block Public IP Addresses for AlloyDB Cluster Instances
- Block Public IP Addresses for Cloud SQL Instances
- Configure the Allowed VPC Egress Settings for Cloud Run Organization Policy Constraint
- Configure the Disable VPC External IPv6 Usage Organization Policy
- Enable Private Clusters for GKE
- Enable Private Google Access for VPC Subnets
- Enable Private Google Access on an instance
- Restrict Public IP Addresses on Vertex AI Workbench Notebooks and Instances
- Restrict Public IP Addresses to Compute Engine Instances
- Set Log Error Verbosity Flag for AlloyDB Instances
- Turn off Log Hostname Flag for PostgreSQL
qa-nias-2-1-ns-17
系統會設定獨立的內部 DNS 伺服器，並放在內部網路中，用於處理不會向網際網路公開的內部網域資訊。
qa-nias-2-1-ns-2
機構移除或停用所有預設帳戶 (例如根帳戶或管理員)，或按照第 C-6 節「軟體安全性 (SS)」的規定變更密碼。
- Block Root Access on Vertex AI Workbench Instances
- Restrict API Access to Google Cloud APIs for Compute Engine Instances
- Use Custom Service Accounts for Compute Engine Instances
qa-nias-2-1-ns-20
區域檔案會經過數位簽署，並提供區域轉移和動態更新的加密相互驗證和資料完整性。
qa-nias-2-1-ns-21
提供 DNS 資料的加密來源驗證和完整性保證。
qa-nias-2-1-ns-22
只有獲得授權的使用者才能使用 DNS 服務，包括區域轉移。
qa-nias-2-1-ns-25
除非特別啟用，否則網際網路閘道會拒絕所有網際網路服務。
- Block Connections to Cassandra Ports from All IP Addresses
- Block Connections to Elasticsearch Ports from All IP Addresses
- Block Connections to FTP Ports from All IP Addresses
- Block Connections to LDAP Ports from All IP Addresses
- Block Connections to Memcached Ports from All IP Addresses
- Block Connections to MongoDB Ports from All IP Addresses
- Block Connections to MySQL Ports from All IP Addresses
- Block Connections to NetBIOS Ports from All IP Addresses
- Block Connections to Oracle Database Ports from All IP Addresses
- Block Connections to POP3 Server Ports from All IP Addresses
- Block Connections to PostgreSQL Server Ports from All IP Addresses
- Block Connections to Redis Server Ports from All IP Addresses
- Block Connections to SMTP Server Ports from All IP Addresses
- Block External IP Address Access on Compute Engine VM Instances
- Block Generic Access to CiscoSecure/WebSM Ports
- Block Generic Access to Directory Service Ports
- Block Generic Access to HTTP Ports
- Block Generic Access to RDP Ports
- Block Generic Access to SSH Ports
- Block Generic Access to Telnet Servers
- Block Overly Permissive Firewall Rules
- Enable Control Plane Authorized Networks on GKE Clusters
- Enforce Deny All Egress Firewall Rule
- Enforce HTTPS Traffic Only
- Restrict Public Access to Cloud SQL Database Instances
qa-nias-2-1-ns-27
該機構具備監控流量、推斷流量模式和使用情形等必要能力。詳情請參閱 B-10 節「記錄和安全監控 (SM)」。
- Enable Cloud DNS Logs Monitoring
- Enable Cloud Monitoring on GKE Clusters
- Enable Firewall Rule Logging
- Enable Flow Logs for VPC Subnet
- Enable Load Balancer Logging
- Enable Subnet Flow Logs
- Enable VPC Flow Logs for Compute Engine Instances
qa-nias-2-1-ns-29
根據第 C-10 節「密碼編譯安全」(CY)，透過傳輸層安全標準 (TLS) 保護 SMTP 郵件伺服器。
qa-nias-2-1-ns-3
網路設定由網路管理員或類似人員控管，且所有設定變更都必須：透過第 B-5 節「變更管理 (CM)」定義的正式變更控管程序核准；記錄在案，並遵守第 B-12 節「文件 (DC)」定義的網路安全政策和安全計畫；定期審查。系統會根據機構程序保留舊設定，做為變更修訂的一部分。審查設定的頻率應視機構的風險和程序而定。
- Configure Log Metrics and Alerts for VPC Network Changes
- Configure Log Metrics and Alerts for VPC Network Firewall Changes
qa-nias-2-1-ns-5
網路的設計和設定會限制未經授權存取網路基礎架構傳輸資訊的機會。機構應使用下列技術來滿足這項需求：交換器 (而非集線器)；交換器上的連接埠安全性，可限制存取權並停用所有未使用的連接埠；路由器和防火牆，可根據需要瞭解的資訊隔離網路的各個部分；IPsec 或 IP 第 6 版；應用程式層級加密；自動化工具，可比較網路裝置的執行設定與記錄的設定；網路邊緣驗證；限制及管理與機構網路通訊的終端使用者裝置，例如使用 MAC 位址篩選等技術；IPS 或 IDS，可偵測及防止網路內的惡意活動；以及時間和日期限制。
- Block Connections to Cassandra Ports from All IP Addresses
- Block Connections to Elasticsearch Ports from All IP Addresses
- Block External IP Address Access on Compute Engine VM Instances
- Block Generic Access to CiscoSecure/WebSM Ports
- Block Public IP Addresses for AlloyDB Cluster Instances
- Block Public IP Addresses for Cloud SQL Instances
- Configure Log Metrics and Alerts for VPC Route Changes
- Configure the Allowed Ingress Settings for Cloud Run Organization Policy Constraint
- Configure the Allowed VPC Egress Settings for Cloud Run Organization Policy Constraint
- Configure the Disable VPC Internal IPv6 Usage Organization Policy
- Don't Use Legacy Networks
- Enable Intranode Visibility for GKE Clusters
- Enable IP Alias Range for GKE Clusters
- Enable Network Policy on GKE Clusters
- Enable Private Clusters for GKE
- Enable Private Google Access for VPC Subnets
- Enable Private Google Access on an instance
- Enable the Restrict Authorized Networks on Cloud SQL Instances Organization Policy Constraint
- Enforce SSL for all Incoming Database Connections
- Prevent IP Forwarding on Compute Engine Instances
- Restrict Insecure SSL Policies for Compute Engine Instances
- Restrict Public IP Addresses to Compute Engine Instances
qa-nias-2-1-ns-53
語音和數據是不同的網路。區隔應為實體區隔，但允許使用虛擬 LAN。語音閘道會與 PSTN 介接，並將 H.323、SIP 或其他 VoIP 通訊協定與資料網路隔離。
qa-nias-2-1-ns-6
管理網路會採取下列防護措施：透過實作獨立管理 VLAN 或實體獨立基礎架構，將專屬網路用於管理裝置；以及使用安全通道，例如 VPN 或 SSH。
qa-nias-2-1-ns-7
VLAN 用於區隔業務關鍵網路中的 IP 電話流量。
qa-nias-2-1-ns-8
只有最高機密等級的 VLAN 允許管理存取權，且只能存取相同或較低機密等級的 VLAN。
qa-nias-2-1-pr-5
產品安全評估是在專用評估設定中進行，包括功能測試、安全性測試和修補，以防範潛在威脅和安全漏洞。
- Disable Alpha Features on GKE Clusters
- Enable Artifact Analysis Vulnerability Scanning
- Use Latest Image Versions on Dataproc Clusters
qa-nias-2-1-pr-6
產品交付方式符合機構的安全交付安全措施。
qa-nias-2-1-pr-7
安全運送程序應包含偵測竄改或偽裝的措施。
qa-nias-2-1-pr-8
產品是向承諾持續維護產品保證的開發人員購買。
qa-nias-2-1-pr-9
已建立產品修補和更新程序。產品更新應遵循第 B-5 節「變更管理 (CM)」中指定的變更管理政策。
- Enable Auto Upgrade on GKE Clusters
- Require Auto Upgrade Schedule Set for Vertex AI Workbench
- Subscribe a GKE Cluster to a Release Channel
- Use Latest Image Versions on Dataproc Clusters
qa-nias-2-1-ss-13
工作站採用強化的標準作業環境 (SOE)，涵蓋以下項目：移除不需要的軟體；停用已安裝軟體和作業系統中未使用或不需要的功能；針對相關物件實作存取控制，將系統使用者和程式的存取權限制在執行工作所需的最低程度；安裝軟體式防火牆，限制網路連入和連出連線；設定遠端記錄或將本機事件記錄轉移至中央伺服器。
- Block Connections to PostgreSQL Server Ports from All IP Addresses
- Block Generic Access to SSH Ports
- Block Legacy Authorization on GKE Clusters
- Block Project-Wide SSH Keys on Compute Engine Instances
- Block Serial Ports for Compute Engine Instances
- Block Service Account Key Creation
- Block Terminal Access on Vertex AI Workbench Instances
- Configure the Disable VM Serial Port Logging to Stackdriver Organization Policy
- Define Retention Period for Cloud Storage Buckets
- Disable Legacy Metadata Server Endpoints on Compute Engine
- Enable 3625 Trace Database Flag for SQL Server
- Enable OS Login for All Instances at Project Level
- Enforce Deny All Egress Firewall Rule
- Prevent IP Forwarding on Compute Engine Instances
- Prevent Nested Virtualization for Compute Engine VMs
- Require OS Login on Compute Engine Instances
- Restrict API Access to Google Cloud APIs for Compute Engine Instances
- Restrict Public IP Addresses on Vertex AI Workbench Notebooks and Instances
- Turn Off Cross Database Ownership Chaining Flag for SQL Server
- Turn off Log Statement Stats Flag for PostgreSQL
- Use Custom Service Accounts for Compute Engine Instances
qa-nias-2-1-ss-14
移除不必要的檔案共用、確保修補程式為最新版本、停用所有不必要的輸入和輸出功能存取權、移除未使用的帳戶、重新命名預設帳戶，以及更換預設密碼，藉此減少 SOE 和系統中的潛在安全漏洞。
- Block Public IP Addresses for AlloyDB Cluster Instances
- Block Public IP Addresses for Cloud SQL Instances
- Block Root Access on Vertex AI Workbench Instances
- Block Serial Ports for Compute Engine Instances
- Block Service Account Key Uploads
- Block Terminal Access on Vertex AI Workbench Instances
- Configure the Disable VPC Internal IPv6 Usage Organization Policy
- Disable Legacy Metadata Server Endpoints on Compute Engine
- Enable Auto Upgrade on GKE Clusters
- Enable Cloud Asset Inventory Service
- Require Auto Upgrade Schedule Set for Vertex AI Workbench
- Restrict Public Access to Cloud Storage Buckets
- Subscribe a GKE Cluster to a Release Channel
- Turn Off Contained Database Authentication Flag for SQL Server
- Turn Off Cross Database Ownership Chaining Flag for SQL Server
- Turn Off Log Executor Stats Flag for PostgreSQL
- Turn off Log Hostname Flag for PostgreSQL
- Turn Off Log Min Duration Statement Flag for PostgreSQL
- Use Custom VPC Networks
- Use Latest Image Versions on Dataproc Clusters
qa-nias-2-1-ss-15
高風險伺服器 (例如網路、電子郵件、檔案和網際網路通訊協定電話伺服器) 與不受控的公用網路連線時，應遵守下列規範：在伺服器之間維持有效的功能分離，確保伺服器能獨立運作；視需要盡量減少伺服器在網路和檔案系統層級的通訊；將系統使用者和程式的存取權限制在執行職務所需的最低程度。
- Block Automatic IAM Grants to Default Service Accounts
- Block Legacy Authorization on GKE Clusters
- Create GKE Clusters with Limited Privileges
- Don't Use Kubernetes Web UI
- Don't Use User Options Flag for SQL Server
- Enable Intranode Visibility for GKE Clusters
- Enable Network Policy on GKE Clusters
- Require Container-Optimized OS for a GKE Cluster
- Set Application Restriction on API Keys
- Turn Off External Scripts Flag for SQL Server
- Turn Off Local Infile Flag for MySQL
- Turn Off Remote Access Flag for SQL Server
- Use Least Privilege Service Accounts for GKE Clusters
qa-nias-2-1-ss-16
檢查對機構至關重要的所有伺服器，以及遭入侵風險較高的伺服器是否完整。盡可能從受信任的環境執行這些檢查，而非系統本身。
- Configure Log Metrics and Alerts for Audit Logging Changes
- Configure Log Metrics and Alerts for Cloud SQL Configuration Changes
- Enable Auto Repair for GKE Clusters
- Enable Integrity Monitoring on GKE Clusters
- Enable Secure Boot on Compute Engine Instances
- Enable Shielded VM for Compute Engine Instances
- Require Object Versioning for Cloud Storage Buckets
qa-nias-2-1-ss-17
以維護完整性的方式，將完整性資訊安全地儲存在伺服器以外的位置。
qa-nias-2-1-ss-19
根據機構的持續稽核時間表，比較儲存的完整性資訊與目前的完整性資訊，判斷是否發生遭入侵事件，或是系統修改作業完成不正確但合法。
- Configure Log Metrics and Alerts for Cloud SQL Configuration Changes
- Enable Auto Repair for GKE Clusters
- Enable Integrity Monitoring on GKE Clusters
- Enable Object Versioning on Buckets
qa-nias-2-1-ss-2
所有應用程式 (包括新開發的應用程式) 都會根據「國家資料分類政策」(IAP-NAT-DCLS) 分類，並根據機密性、完整性和可用性評等，獲得適當的安全防護。
- Define Set Storage Class Lifestyle Action on Bucket
- Define Storage Class Lifestyle Action
- Enable AlloyDB Automated Backups on Cluster
- Enable AlloyDB Backups on Cluster
- Enable Automatic Backups for Cloud SQL Databases
- Enable Cloud Asset Inventory Service
- Encrypt Pub/Sub topic with CMEK
- Enforce CMEK for Supported Services
- Require CMEK on Dataproc Clusters
- Restrict Service Usage
qa-nias-2-1-ss-20
組織必須根據資訊及通訊科技 (ICT) 安全事件管理程序，解決偵測到的任何變更。
qa-nias-2-1-ss-21
我們會審查所有軟體應用程式，判斷是否嘗試建立任何外部連線。如果包含自動輸出連線功能，機構應做出業務決策，判斷是否允許或拒絕這些連線，包括評估這麼做涉及的風險。
- Configure the Allowed VPC Egress Settings for Cloud Run Organization Policy Constraint
- Define VPC Connector Egress For Cloud Run Functions
- Disable File Downloads on Vertex AI Workbench Instances
qa-nias-2-1-ss-23
各個網頁應用程式元件之間的連線和存取權會盡量減少。
- Configure the Allowed Ingress Settings for Cloud Run Organization Policy Constraint
- Configure the Allowed VPC Egress Settings for Cloud Run Organization Policy Constraint
- Don't Use Legacy Networks
- Enable Intranode Visibility for GKE Clusters
- Enable Network Policy on GKE Clusters
qa-nias-2-1-ss-24
我們使用適當的密碼編譯控制項，保護儲存和傳輸中的個人資訊和私密資料。
- Define Cloud KMS Crypto Keys Purpose
- Enable SSL Encryption On AlloyDB Instances
- Enforce CMEK for Supported Services
- Enforce HTTPS Traffic Only
- Enforce SSL for all Incoming Database Connections
- Ensure Minimum TLS 1.2 Version
qa-nias-2-1-ss-29
資料庫檔案受到保護，可避免存取行為繞過資料庫的一般存取控制措施。
- Block Public IP Addresses for Cloud SQL Instances
- Enable CMEK for AlloyDB Clusters
- Enable CMEK for BigQuery Datasets
- Enable CMEK for BigQuery Tables
- Enable CMEK for Cloud SQL Databases
- Enable the Restrict Authorized Networks on Cloud SQL Instances Organization Policy Constraint
- Enable Uniform Bucket-Level Access on Cloud Storage Buckets
- Restrict Public Access to BigQuery Datasets
- Set Uniform Bucket Level Access for Cloud Storage Buckets
- Turn Off Contained Database Authentication Flag for SQL Server
- Turn Off Cross Database Ownership Chaining Flag for SQL Server
- Turn Off External Scripts Flag for SQL Server
- Turn Off Local Infile Flag for MySQL
- Turn Off Remote Access Flag for SQL Server
qa-nias-2-1-ss-3
安全需求 (包括功能、技術和保證需求) 的開發和實作，是系統需求的一部分。
qa-nias-2-1-ss-30
資料庫提供功能，可稽核系統使用者的動作。
- Configure Log Metrics and Alerts for Cloud SQL Configuration Changes
- Enable Log Connections Flag for PostgreSQL
- Enable Log Disconnections Flag for PostgreSQL
- Enable Log Duration Flag for PostgreSQL instance
- Enable Log Min Error Statement Flag for PostgreSQL
- Enable Log Statement Flag for PostgreSQL
- Enable Log Temp Files Flag for PostgreSQL instance
- Set Log Min Error Statement Flag for AlloyDB Instances
- Set Log Min Messages Flag for AlloyDB Instances
qa-nias-2-1-ss-31
如果系統使用者沒有足夠的權限查看資料庫內容，就無法在搜尋引擎查詢結果清單中看到相關聯的中繼資料。如果無法適當篩選資料庫查詢結果，機構必須確保所有查詢結果都經過適當清除，以符合系統使用者的最低安全權限。
- Enable Skip Show Database Flag for MySQL
- Set Log Error Verbosity Flag for AlloyDB Instances
- Turn off Log Hostname Flag for PostgreSQL
qa-nias-2-1-ss-4
我們提供專屬的測試和開發基礎架構，包括系統和資料，與實際工作環境系統分開。此外，環境之間的資訊流應根據定義及記錄的政策嚴格限制，只有具備明確業務需求且有權寫入軟體權威來源的系統使用者，才能獲得存取權，且應停用寫入權限。
qa-nias-2-1-ss-5
無論是取得或開發的應用程式，都必須通過適當的品質和安全保障測試與檢查，確保系統符合預期的安全需求，才能用於正式版。
qa-nias-2-1-ss-6
軟體開發人員編寫程式碼時會採用安全程式設計做法，包括：遵守最佳做法 (例如 Mitre 前 25 大最危險的程式設計錯誤)；設計軟體時，會使用完成工作所需的最低權限層級；預設拒絕存取權；檢查所有系統呼叫的回傳值；以及驗證所有輸入內容。
qa-nias-2-1-ss-7
軟體應先經過審查和/或測試是否有安全漏洞，再用於正式環境。軟體應由獨立第三方審查及/或測試，而非開發人員。
qa-nias-2-1-vl-1
任何 MD 和筆電都已啟用緊急銷毀、鎖定方案、遠端清除或自動銷毀功能。
qa-nias-2-1-vl-2
根據業界公認的最佳做法、安全防護指南和供應商建議，強化管理程序、管理層、虛擬機器和相關元件。
- Block Legacy Authorization on GKE Clusters
- Block Project-Wide SSH Keys on Compute Engine Instances
- Block Root Access on Vertex AI Workbench Instances
- Block Serial Ports for Compute Engine Instances
- Block Terminal Access on Vertex AI Workbench Instances
- Configure the Disable VM Serial Port Logging to Stackdriver Organization Policy
- Configure the Disable VPC Internal IPv6 Usage Organization Policy
- Create GKE Clusters with Limited Privileges
- Disable Alpha Features on GKE Clusters
- Disable Legacy Metadata Server Endpoints on Compute Engine
- Don't Use Kubernetes Web UI
- Don't Use User Connections Flag for SQL Server
- Don't Use User Options Flag for SQL Server
- Enable 3625 Trace Database Flag for SQL Server
- Enable Auto Upgrade on GKE Clusters
- Enable CMEK on GKE Node Pool Boot Disks
- Enable Confidential Computing for Compute Engine Instances
- Enable CSEK On Compute Engine Persistent Disks
- Enable Encryption on GKE Clusters
- Enable Integrity Monitoring on GKE Clusters
- Enable IP Alias Range for GKE Clusters
- Enable Log Locks Wait Flag for PostgreSQL instance
- Enable OS Login
- Enable OS Login for All Instances at Project Level
- Enable Secure Boot for Shielded GKE Nodes
- Enable Secure Boot on Compute Engine Instances
- Enable Shielded GKE Nodes on a Cluster
- Enable Shielded VM for Compute Engine Instances
- Enable the Confidential VM Organization Policy Constraint
- Enable Workload Identity Federation for GKE on clusters
- Prevent IP Forwarding on Compute Engine Instances
- Prevent Nested Virtualization for Compute Engine VMs
- Require CMEK on Dataproc Clusters
- Require Container-Optimized OS for a GKE Cluster
- Require OS Login on Compute Engine Instances
- Restrict API Access to Google Cloud APIs for Compute Engine Instances
- Subscribe a GKE Cluster to a Release Channel
- Turn Off Cross Database Ownership Chaining Flag for SQL Server
- Turn Off External Scripts Flag for SQL Server
- Turn Off Local Infile Flag for MySQL
- Turn Off Log Executor Stats Flag for PostgreSQL
- Turn Off Log Min Duration Statement Flag for PostgreSQL
- Turn off Log Statement Stats Flag for PostgreSQL
- Turn Off Remote Access Flag for SQL Server
- Use Custom Service Accounts for Compute Engine Instances
- Use Custom VPC Networks
- Use Latest Image Versions on Dataproc Clusters
qa-nias-2-1-vl-3
強制執行最低權限原則，並區分管理虛擬環境的職責，具體做法如下：在中央虛擬化管理軟體中，為每位管理員定義特定角色和細部權限；盡可能限制對 Hypervisor 的直接管理存取權；視風險和處理資訊的分類而定，機構應考慮使用多重驗證，或由多位管理員共同或分別控管管理員密碼。詳情請參閱 C9 存取權管理一節。
- Block Automatic IAM Grants to Default Service Accounts
- Block Legacy Authorization on GKE Clusters
- Block Project-Wide SSH Keys on Compute Engine Instances
- Create GKE Clusters with Limited Privileges
- Enable OS Login for All Instances at Project Level
- Require OS Login on Compute Engine Instances
- Restrict API Access to Google Cloud APIs for Compute Engine Instances
- Use Custom Service Accounts for Compute Engine Instances
- Use Least Privilege Service Accounts for GKE Clusters
qa-nias-2-1-vl-5
虛擬化技術環境應搭配第三方安全技術，提供多層安全控管機制 (例如深度防禦方法)，以補足供應商和技術本身提供的控管機制。
- Enable Confidential Computing for Compute Engine Instances
- Enable Intranode Visibility for GKE Clusters
- Enable the Confidential VM Organization Policy Constraint
qa-nias-2-1-vl-6
根據虛擬機器處理或儲存的資料分類，將虛擬機器區隔開來。
qa-nias-2-1-vl-7
變更管理程序涵蓋虛擬技術環境。包括確保虛擬機器設定檔已更新，且虛擬機器映像檔的完整性隨時維持不變；此外，也應注意維護及更新非處於啟用狀態 (閒置或不再使用) 的 VM。詳情請參閱 B6 節「變更管理」。
- Enable Auto Repair for GKE Clusters
- Enable Auto Upgrade on GKE Clusters
- Enable Secure Boot on Compute Engine Instances
- Require Auto Upgrade Schedule Set for Vertex AI Workbench
- Subscribe a GKE Cluster to a Release Channel
- Use Latest Image Versions on Dataproc Clusters
qa-nias-2-1-vl-8
虛擬技術環境的記錄應與其他 IT 基礎架構一起記錄及監控。請參閱 B10 節「記錄和安全性監控」。
- Configure Log Metrics and Alerts for Cloud SQL Configuration Changes
- Configure Log Metrics and Alerts for Cloud Storage IAM Policy Changes
- Configure Log Metrics and Alerts for VPC Network Changes
- Configure Log Metrics and Alerts for VPC Network Firewall Changes
- Configure Log Metrics and Alerts for VPC Route Changes
- Configure Log Sinks
- Enable Cloud DNS Logs Monitoring
- Enable Cloud Logging on GKE Clusters
- Enable Firewall Rule Logging
- Enable Flow Logs for VPC Subnet
- Enable Load Balancer Logging
- Enable Log Checkpoints Flag for PostgreSQL
- Enable Log Connections Flag for PostgreSQL
- Enable Log Locks Wait Flag for PostgreSQL instance
- Enable Log Min Messages Flag for PostgreSQL
- Enable Subnet Flow Logs
- Enable VPC Flow Logs for Compute Engine Instances
NIST 800-53 Revision 5
支援的雲端服務供應商： Google Cloud
提供安全和隱私權控管措施的完整目錄，協助您建立完善的資安計畫。這套架構原本是美國聯邦系統的強制規定，現在已成為各行各業機構的最佳做法。
這個架構包含下列章節中的雲端控制群組和雲端控制項。
nist-r5-ac-02
A. 定義並記錄允許和禁止在系統中使用的帳戶類型。B. 指派帳戶管理員。C. 要求群組和角色成員資格須符合機構定義的必要條件和標準。D. 指定： a. 系統的授權使用者。b. 群組和角色成員資格。c. 每個帳戶的存取授權或權限，以及機構定義的屬性。E. 要求機構定義的人員或角色核准帳戶建立要求。F. 根據機構定義的政策、程序、先決條件和條件，建立、啟用、修改、停用及移除帳戶。G. 監控帳戶使用情形。H. 通知帳戶管理員和機構內定義的人員或角色：a. 機構定義的時間範圍，在此期間內不再需要帳戶。b. 機構定義的時間範圍，適用於遭終止或轉移的使用者。c. 機構定義的時間範圍，在此期間內，個別人員的系統使用情形或必要知會事項會有所變更。I. 根據下列條件授權存取系統：a. 有效的存取授權。b. 預定系統用途。c. 機構定義的屬性。J. 依據機構定義的頻率，檢查帳戶是否符合帳戶管理規定。K. 建立並實施相關程序，在使用者從群組中移除時，變更共用或群組帳戶驗證器。L. 配合人員終止和轉移程序，調整帳戶管理程序。
nist-r5-ac-03
根據適用的存取控管政策，強制執行核准的授權，以邏輯方式存取資訊和系統資源。
- Block Automatic IAM Grants to Default Service Accounts
- Block External IP Address Access on Compute Engine VM Instances
- Block Legacy Authorization on GKE Clusters
- Block Public IP Addresses for AlloyDB Cluster Instances
- Block Public IP Addresses for Cloud SQL Instances
- Block Service Account Key Creation
- Block Service Account Key Uploads
- Configure the Allowed VPC Egress Settings for Cloud Run Organization Policy Constraint
- Configure the Disable VM Serial Port Logging to Stackdriver Organization Policy
- Configure the Disable VPC External IPv6 Usage Organization Policy
- Configure the Disable VPC Internal IPv6 Usage Organization Policy
- Create GKE Clusters with Limited Privileges
- Define Cloud KMS Crypto Keys Purpose
- Define Storage Class Lifestyle Action
- Disable Legacy Metadata Server Endpoints on Compute Engine
- Enable Confidential Computing for Compute Engine Instances
- Enable Control Plane Authorized Networks on GKE Clusters
- Enable Network Policy on GKE Clusters
- Enable Private Clusters for GKE
- Enable Private Google Access for VPC Subnets
- Enable Private Google Access on an instance
- Enable Skip Show Database Flag for MySQL
- Enable the Confidential VM Organization Policy Constraint
- Enable the Restrict Authorized Networks on Cloud SQL Instances Organization Policy Constraint
- Enable Uniform Bucket-Level Access on Cloud Storage Buckets
- Enable Workload Identity Federation for GKE on clusters
- Enforce CMEK for Supported Services
- Enforce Deny All Egress Firewall Rule
- Enforce Public Access Prevention
- Require Service Account Key Rotation
- Restrict Public Access to BigQuery Datasets
- Restrict Public Access to Cloud SQL Database Instances
- Restrict Public Access to Cloud Storage Buckets
- Restrict Public IP Addresses to Compute Engine Instances
- Restrict User Managed Service Account Keys
- Set Application Restriction on API Keys
- Set Uniform Bucket Level Access for Cloud Storage Buckets
- Turn Off Contained Database Authentication Flag for SQL Server
- Turn Off Cross Database Ownership Chaining Flag for SQL Server
nist-r5-ac-04
根據機構定義的資訊流控管政策，強制執行核准的授權，控管系統內和連線系統之間的資訊流。
- Enable Control Plane Authorized Networks on GKE Clusters
- Enable IP Alias Range for GKE Clusters
- Enable Network Policy on GKE Clusters
- Enable Private Clusters for GKE
- Enforce Deny All Egress Firewall Rule
nist-r5-ac-05
找出並記錄需要離職人員的組織定義職責。定義系統存取授權，以支援職責區隔。
- Block Public IP Addresses for AlloyDB Cluster Instances
- Block Public IP Addresses for Cloud SQL Instances
- Enable Skip Show Database Flag for MySQL
- Enable Uniform Bucket-Level Access on Cloud Storage Buckets
- Restrict Public Access to BigQuery Datasets
- Restrict Public Access to Cloud SQL Database Instances
- Restrict Public Access to Cloud Storage Buckets
- Restrict Public IP Addresses to Compute Engine Instances
- Turn Off Contained Database Authentication Flag for SQL Server
- Turn Off Cross Database Ownership Chaining Flag for SQL Server
nist-r5-ac-06
採用最小權限原則，只允許使用者或代表使用者執行的程序，存取完成指派組織工作所需的資源。
- Block Automatic IAM Grants to Default Service Accounts
- Block Legacy Authorization on GKE Clusters
- Block Public IP Addresses for AlloyDB Cluster Instances
- Block Public IP Addresses for Cloud SQL Instances
- Configure the Allowed VPC Egress Settings for Cloud Run Organization Policy Constraint
- Configure the Disable VM Serial Port Logging to Stackdriver Organization Policy
- Create GKE Clusters with Limited Privileges
- Define Cloud KMS Crypto Keys Purpose
- Disable Legacy Metadata Server Endpoints on Compute Engine
- Enable Confidential Computing for Compute Engine Instances
- Enable Skip Show Database Flag for MySQL
- Enable the Restrict Authorized Networks on Cloud SQL Instances Organization Policy Constraint
- Enable Uniform Bucket-Level Access on Cloud Storage Buckets
- Enable Workload Identity Federation for GKE on clusters
- Enforce Public Access Prevention
- Restrict Public Access to BigQuery Datasets
- Restrict Public Access to Cloud SQL Database Instances
- Restrict Public Access to Cloud Storage Buckets
- Restrict Public IP Addresses to Compute Engine Instances
- Set Application Restriction on API Keys
- Set Uniform Bucket Level Access for Cloud Storage Buckets
- Turn Off Contained Database Authentication Flag for SQL Server
- Turn Off Cross Database Ownership Chaining Flag for SQL Server
- Use Least Privilege Service Accounts for GKE Clusters
nist-r5-ac-06-05
將系統中的高權限帳戶限制為僅限機構定義的人員或角色。
- Block Automatic IAM Grants to Default Service Accounts
- Create GKE Clusters with Limited Privileges
- Enable Workload Identity Federation for GKE on clusters
nist-r5-ac-07
強制限制使用者在機構定義的時間範圍內，連續登入失敗的次數。如果嘗試次數超過上限，系統會自動鎖定帳戶或節點一段時間 (由機構組織定義)；鎖定帳戶或節點，直到管理員解除鎖定為止；根據機構組織定義的延遲演算法，延遲下一個登入提示；通知系統管理員；採取機構組織定義的其他動作。
nist-r5-ac-12
在符合機構定義的條件或觸發需要中斷工作階段的事件後，自動終止使用者工作階段。
nist-r5-ac-17
針對允許的每種遠端存取類型，制定並記錄使用限制、設定和連線需求，以及實作指引。允許這類連線前，請先授權系統的每種遠端存取類型。
- Block Project-Wide SSH Keys on Compute Engine Instances
- Block Service Account Key Creation
- Block Service Account Key Uploads
- Define VPC Connector Egress For Cloud Run Functions
nist-r5-ac-17-03
透過授權及管理的網路存取控制點，將遠端存取權路徑導向這些控制點。
nist-r5-ac-17-04
僅在可評估證據的格式中，以及為了滿足機構定義的需求，才透過遠端存取授權執行具備權限的指令，並存取與安全性相關的資訊。在系統的安全計畫中，記錄遠端存取的理由。
nist-r5-ac-18
針對每種無線存取類型，建立設定需求、連線需求和導入指引。允許這類連線前，請先授權系統的每種無線存取類型。
nist-r5-ac-19
為機構控管的行動裝置制定設定規定、連線規定和實作指引，包括這些裝置不在控管區域內時的規定。授權行動裝置連線至機構系統。
nist-r5-au-01
制定、記錄及發布符合規定的稽核和問責政策，以及實施程序，確保政策涵蓋目的、範圍、角色和責任。指派專責人員管理這份文件，並根據排定的時間表或因應特定事件，定期審查及更新政策和程序。
nist-r5-au-02
A. 找出系統可記錄的事件類型，以支援稽核功能：B. 與需要稽核相關資訊的其他機構實體協調事件記錄功能，引導並提供事件記錄選取條件的資訊。C. 指定機構定義的事件類型 (AU-02a 中定義的事件類型子集)，以及每個已識別事件類型的記錄頻率或記錄情況。D. 請說明您認為所選記錄事件類型足以支援事件事後調查的原因。E. 根據機構定義的頻率，檢查並更新選取的記錄事件類型。
- Configure Log Metrics and Alerts for Cloud Storage IAM Policy Changes
- Enable Audit Logs for Google Cloud Services
- Enable Cloud Logging on GKE Clusters
- Enable Intranode Visibility for GKE Clusters
- Enable Log Locks Wait Flag for PostgreSQL instance
- Enable Subnet Flow Logs
- Enable VPC Flow Logs for Compute Engine Instances
- Turn off Log Hostname Flag for PostgreSQL
- Turn Off Log Min Duration Statement Flag for PostgreSQL
nist-r5-au-03
確保稽核記錄包含可證明下列事項的資訊：A. 發生事件的類型，B. 事件發生的時間。C. 事件發生的位置。D. 事件來源。D. 事件的結果。F. 與活動相關的個人、主題、物體和實體身分。
- Enable Cloud Logging on GKE Clusters
- Enable Log Connections Flag for PostgreSQL
- Enable Log Disconnections Flag for PostgreSQL
- Enable Log Error Verbosity Flag for PostgreSQL
- Enable Log Min Error Statement Flag for PostgreSQL
- Enable Log Min Messages Flag for PostgreSQL
- Enable Log Statement Flag for PostgreSQL
- Set Log Error Verbosity Flag for AlloyDB Instances
- Set Log Min Error Statement Flag for AlloyDB Instances
- Set Log Min Messages Flag for AlloyDB Instances
- Turn Off Log Min Duration Statement Flag for PostgreSQL
nist-r5-au-03-01
產生稽核記錄，其中包含機構定義的額外資訊。
nist-r5-au-04
分配稽核記錄儲存空間容量，以符合機構定義的稽核記錄保留規定。
- Allocate Audit Log Storage Capacity
- Enable Log Checkpoints Flag for PostgreSQL
- Enable Log Duration Flag for PostgreSQL instance
nist-r5-au-05
如果稽核記錄程序失敗，請在組織定義的時間範圍內，向組織定義的人員或角色發出快訊。採取機構定義的額外動作。
nist-r5-au-05-02
在機構定義的即時期間內，當發生需要即時警報的機構定義稽核記錄失敗事件時，向機構定義的人員、角色或地點提供警報。
nist-r5-au-06
依據機構定義的頻率，檢閱及分析系統稽核記錄，找出機構定義的不當或異常活動，以及這些活動的潛在影響。向機構定義的人員或角色回報調查結果。根據執法資訊、情報資訊或其他可靠資訊來源，調整系統內的稽核記錄審查、分析和報告層級。
- Enable Cloud DNS Logs Monitoring
- Enable Cloud Logging on GKE Clusters
- Enable Log Locks Wait Flag for PostgreSQL instance
- Enable Subnet Flow Logs
- Enable VPC Flow Logs for Compute Engine Instances
- Turn off Log Hostname Flag for PostgreSQL
nist-r5-au-07
提供並實作稽核記錄縮減和報表產生功能，支援稽核記錄隨選檢閱、分析和報表需求，以及事件的事後調查。這項功能不得變更原始內容或稽核記錄的時間順序。
- Configure Log Metrics and Alerts for Cloud Storage IAM Policy Changes
- Enable Cloud DNS Logs Monitoring
- Enable Log Connections Flag for PostgreSQL
- Enable Log Disconnections Flag for PostgreSQL
- Enable Log Error Verbosity Flag for PostgreSQL
- Enable Log Min Error Statement Flag for PostgreSQL
- Enable Log Min Messages Flag for PostgreSQL
- Enable Log Statement Flag for PostgreSQL
- Set Log Error Verbosity Flag for AlloyDB Instances
- Set Log Min Error Statement Flag for AlloyDB Instances
- Set Log Min Messages Flag for AlloyDB Instances
nist-r5-au-11
根據記錄保留政策，在機構定義的時間範圍內保留稽核記錄，以便在事件發生後進行調查，並符合法規和機構資訊保留要求。
- Enable Log Checkpoints Flag for PostgreSQL
- Enable Log Duration Flag for PostgreSQL instance
- Retain Audit Records
nist-r5-au-12
A. 針對系統可稽核的事件類型 (如機構定義系統元件的 AU-2a 所述)，提供稽核記錄產生功能。B. 允許機構定義的人員或角色選取系統特定元件要記錄的事件類型。C. 針對 AU-2c 中定義的事件類型產生稽核記錄，包括 AU-3 中定義的稽核記錄內容。
- Configure Log Metrics and Alerts for Cloud Storage IAM Policy Changes
- Enable Log Connections Flag for PostgreSQL
- Enable Log Disconnections Flag for PostgreSQL
- Enable Log Error Verbosity Flag for PostgreSQL
- Enable Log Min Error Statement Flag for PostgreSQL
- Enable Log Min Messages Flag for PostgreSQL
- Enable Log Statement Flag for PostgreSQL
- Set Log Error Verbosity Flag for AlloyDB Instances
- Set Log Min Error Statement Flag for AlloyDB Instances
- Set Log Min Messages Flag for AlloyDB Instances
nist-r5-ca-2-2
根據機構定義的頻率，在已公告或未公告的情況下，將下列項目納入控制措施評估：深入監控、安全儀器、自動安全測試案例、安全漏洞掃描、惡意使用者測試、內部威脅評估、效能和負載測試、資料外洩或資料遺失評估，或是機構定義的其他形式評估。
nist-r5-ca-7
制定系統層級的持續監控策略，並根據機構層級的持續監控策略實施持續監控，包括：A. 建立機構定義的系統層級指標。B. 建立組織定義的頻率，以監控和評估控管措施的有效性。C. 根據持續監控策略，持續評估控管措施。D. 根據持續監控策略，持續監控系統和機構定義的指標。E. 關聯和分析控制評估和監控產生的資訊。F. 針對控制評估和監控資訊的分析結果採取回應措施。G. 按照機構定義的頻率，向機構定義的人員或角色回報系統的安全和隱私權狀態。
nist-r5-ca-9
A. 授權機構定義的系統元件或元件類別與系統建立內部連線。B. 針對每個內部連線，記錄介面特徵、安全性和隱私權規定，以及通訊資訊的性質。C. 在符合機構定義的條件後，終止內部系統連線。D. 按照機構定義的頻率，檢查是否仍需各項內部連線。
- Block Generic Access to RDP Ports
- Block Generic Access to SSH Ports
- Prevent IP Forwarding on Compute Engine Instances
nist-r5-cm-01
A. 為機構定義的人員或角色開發、記錄及發布： a. 在機構層級、任務或業務流程層級，或系統層級定義的設定管理政策。政策必須說明目的、範圍、角色、責任、管理承諾、機構實體間的協調，以及法規遵循。政策必須符合適用的法律、行政命令、指令、法規、政策、標準和指南。b. 有助於落實設定管理政策和相關設定管理控制措施的程序。B. 指派組織定義的官方人員，負責管理設定管理政策和程序的開發、文件編寫和發布。C. 依據機構定義的頻率和事件，檢查並更新目前的設定管理政策和程序。
- Don't Use User Connections Flag for SQL Server
- Don't Use User Options Flag for SQL Server
- Enable 3625 Trace Database Flag for SQL Server
- Enable Cloud Asset Inventory Service
nist-r5-cm-02
A. 在設定控制項下，開發、記錄及維護系統的現行基準設定。B. 查看並更新系統的基準設定：a. 依機構定義的頻率。b. 在機構定義的情況下，必須提供這類資訊。c. 安裝或升級系統元件時。
- Avoid RSASHA1 for DNSSEC Signing
- Don't Use Legacy Networks
- Don't Use User Connections Flag for SQL Server
- Don't Use User Options Flag for SQL Server
- Enable 3625 Trace Database Flag for SQL Server
- Enable Cloud Asset Inventory Service
- Enable DNSSEC for Cloud DNS
nist-r5-cm-06
A. 使用機構定義的常見安全設定，為系統中使用的元件建立並記錄設定，反映與作業需求一致的最嚴格模式。B. 實作配置設定。C. 根據機構定義的作業需求，找出、記錄並核准機構定義系統元件的任何設定偏差。D. 根據機構政策和程序，監控及控管設定變更。
- Avoid RSASHA1 for DNSSEC Signing
- Block Serial Ports for Compute Engine Instances
- Disable Legacy Metadata Server Endpoints on Compute Engine
- Don't Use Legacy Networks
- Don't Use User Connections Flag for SQL Server
- Don't Use User Options Flag for SQL Server
- Enable 3625 Trace Database Flag for SQL Server
- Enable Cloud Asset Inventory Service
- Enable DNSSEC for Cloud DNS
- Turn Off Remote Access Flag for SQL Server
nist-r5-cm-07
將系統設定為只提供機構定義的任務必要功能。禁止或限制使用機構定義的函式、通訊埠、通訊協定、軟體或服務。
- Avoid RSASHA1 for DNSSEC Signing
- Block Serial Ports for Compute Engine Instances
- Disable Legacy Metadata Server Endpoints on Compute Engine
- Don't Use Legacy Networks
- Don't Use User Connections Flag for SQL Server
- Don't Use User Options Flag for SQL Server
- Enable 3625 Trace Database Flag for SQL Server
- Enable Cloud Asset Inventory Service
- Enable DNSSEC for Cloud DNS
- Set Application Restriction on API Keys
- Turn Off External Scripts Flag for SQL Server
- Turn Off Remote Access Flag for SQL Server
- Use Custom VPC Networks
nist-r5-cm-09
為系統開發、記錄及實作設定管理計畫，該計畫應：A. 說明角色、職責，以及設定管理程序和流程。B. 建立程序，在整個系統開發生命週期中識別設定項目，並管理設定項目的設定。C. 定義系統的設定項目，並將設定項目置於設定管理下方。D. 由機構定義的人員或角色審查及核准。E. 保護設定管理計畫，避免未經授權的揭露和修改。
- Avoid RSASHA1 for DNSSEC Signing
- Don't Use Legacy Networks
- Don't Use User Connections Flag for SQL Server
- Don't Use User Options Flag for SQL Server
- Enable 3625 Trace Database Flag for SQL Server
- Enable Cloud Asset Inventory Service
- Enable DNSSEC for Cloud DNS
nist-r5-cp-06
建立替代儲存空間網站，包括允許儲存及擷取系統備份資訊的必要協議。確認替代儲存空間網站提供的控制項與主要網站相同。
nist-r5-cp-07
A. 建立替代處理站點，包括必要的協議，以便在主要處理功能無法使用時，允許在機構定義的時間範圍內，轉移和恢復機構定義的系統運作，以執行重要任務和業務功能，並符合復原時間和復原點目標。B. 在備援處理地點提供設備和用品，以便在機構定義的轉移和恢復時間內，轉移及恢復作業，或簽訂合約以支援運送至該地點。C. 在替代處理地點提供與主要地點同等的控制措施。
nist-r5-ia-04
管理系統 ID 的方式：A. 取得機構定義人員或角色的授權，指派個人、群組、角色、服務或裝置 ID。B. 選取可識別個人、群組、角色、服務或裝置的 ID。C. 將 ID 指派給預期對象 (個人、群組、角色、服務或裝置)。D. 防止在機構定義的時間範圍內重複使用 ID。
nist-r5-ia-05
管理系統驗證器：a. 在初始驗證器發布程序中，驗證接收驗證器的個人、群組、角色、服務或裝置身分。b. 為機構核發的任何驗證器建立初始驗證器內容。c. 確保驗證器具有足夠的機制強度，可供預期用途使用。d. 建立並實施初始驗證器發放、驗證器遺失/遭盜用/損壞，以及驗證器撤銷的行政程序。e. 在首次使用前變更預設驗證器。f. 根據機構定義的時間週期 (依驗證器類型) 或機構定義的事件，變更或重新整理驗證器。例如：保護驗證器內容，防止未經授權的揭露和修改。h. 要求使用者採取特定控制措施，並讓裝置實施這些措施，以保護驗證器。i. 在群組或角色帳戶的成員資格變更時，變更這些帳戶的驗證器。
- Block Project-Wide SSH Keys on Compute Engine Instances
- Enable CMEK for AlloyDB Clusters
- Enable CMEK for BigQuery Datasets
- Enable CMEK for BigQuery Tables
- Enable CMEK for Cloud SQL Databases
- Enable CMEK for Cloud Storage Buckets
- Enable CMEK on Compute Engine Persistent Disks
- Enable CSEK On Compute Engine Persistent Disks
- Enable Workload Identity Federation for GKE on clusters
- Encrypt Pub/Sub topic with CMEK
- Require CMEK on Dataproc Clusters
- Require Service Account Key Rotation
- Restrict API Access to Google Cloud APIs for Compute Engine Instances
- Restrict User Managed Service Account Keys
- Use Custom Service Accounts for Compute Engine Instances
nist-r5-ia-08
明確識別及驗證非機構使用者，或代表非機構使用者執行的程序。
nist-r5-ma-04
A. 核准並監控非本機的維護和診斷活動。B. 僅允許使用非本機維護和診斷工具，且須符合機構政策，並記錄在系統的安全計畫中。C. 建立非本機維護和診斷工作階段時，請採用高強度驗證機制。D. 維護非本地維修和診斷活動的記錄。E. 完成非本機維護作業後，終止工作階段和網路連線。
- Block Public IP Addresses for AlloyDB Cluster Instances
- Block Public IP Addresses for Cloud SQL Instances
nist-r5-mp-02
將機構定義的數位或非數位媒體類型存取權，限制在機構定義的人員或角色。
- Block Public IP Addresses for AlloyDB Cluster Instances
- Block Public IP Addresses for Cloud SQL Instances
- Enable Skip Show Database Flag for MySQL
- Enable Uniform Bucket-Level Access on Cloud Storage Buckets
- Restrict Public Access to BigQuery Datasets
- Restrict Public Access to Cloud SQL Database Instances
- Restrict Public Access to Cloud Storage Buckets
- Restrict Public IP Addresses to Compute Engine Instances
- Turn Off Contained Database Authentication Flag for SQL Server
- Turn Off Cross Database Ownership Chaining Flag for SQL Server
nist-r5-pe-01
A. 為機構定義的人員或角色開發、記錄及發布： a. 在機構、任務或業務程序層級，或系統層級定義的實體與環境保護政策。政策必須說明目的、範圍、角色、責任、管理承諾、機構實體間的協調，以及法規遵循。政策必須符合適用的法律、行政命令、指令、法規、政策、標準和指南。b. 協助實體與環境保護政策和相關實體與環境保護控制措施的實施程序。B. 指派機構定義的官方人員，負責管理實體和環境保護政策與程序的開發、文件編寫和發布。C. 根據機構定義的頻率和事件，檢查並更新目前的實體和環境保護政策與程序。
nist-r5-pl-08
A. 為系統開發安全和隱私權架構：a. 說明保護機構資訊機密性、完整性和可用性的相關規定和做法。b. 說明處理個人識別資訊時應採取的做法和規定，盡量降低個人隱私權風險。c. 說明這些架構如何整合到企業架構中，並為企業架構提供支援。d. 說明外部系統和服務的任何假設和依附元件。B. 請依機構定義的頻率檢查及更新架構，以反映企業架構的變更。C. 在安全和隱私權計畫、作業概念 (CONOPS)、重要性分析、組織程序，以及採購和收購中，反映計畫的架構變更。
nist-r5-ra-03
A. 進行風險評估，包括：a. 找出系統的威脅和安全漏洞。b. 判斷未經授權存取、使用、揭露、干擾、修改或毀損系統、系統處理/儲存/傳輸的資訊，以及任何相關資訊，可能造成的危害程度和嚴重性。c. 判斷處理個人識別資訊對個人造成負面影響的可能性和程度。B. 從機構和任務/業務流程的角度，將風險評估結果和風險管理決策與系統層級的風險評估整合；C. 在安全性與隱私權計畫、風險評估報告和機構定義的文件中，記錄風險評估結果。D. 以機構定義的頻率查看風險評估結果。E. 將風險評估結果發布給機構定義的人員或角色。F 按照機構定義的頻率，或在系統、作業環境或其他可能影響系統安全或隱私狀態的條件發生重大變化時，更新風險評估。
nist-r5-ra-05
A. 依據機構定義的程序，以機構定義的頻率或隨機監控及掃描系統和代管應用程式的安全漏洞，並在發現可能影響系統的新安全漏洞時回報；B. 採用安全漏洞監控工具和技術，利用下列標準促進工具互通性，並自動執行部分安全漏洞管理程序：a. 列舉平台、軟體瑕疵和不當設定。b. 檢查清單和測試程序格式。c. 評估安全漏洞的影響。C. 分析安全漏洞掃描報告和安全漏洞監控結果。D. 根據組織的風險評估結果，在組織定義的回應時間內修正正當的安全漏洞。E. 與機構指定的人員或角色分享從安全漏洞監控程序和控制項評估中取得的資訊，協助消除其他系統中的類似安全漏洞。F. 使用安全漏洞監控工具，並確保工具可隨時更新要掃描的安全漏洞。
nist-r5-sa-03
使用機構定義的系統開發生命週期，取得、開發及管理系統，並納入資訊安全和隱私權考量。在整個系統開發生命週期中，定義並記錄資訊安全和隱私權角色與職責。找出負責資訊安全和隱私權的人員，並瞭解他們的角色和職責。將機構的資訊安全和隱私權風險管理程序，整合到系統開發生命週期活動中。
- Don't Use User Connections Flag for SQL Server
- Don't Use User Options Flag for SQL Server
- Enable 3625 Trace Database Flag for SQL Server
- Enable Cloud Asset Inventory Service
- Enable Confidential Computing for Compute Engine Instances
nist-r5-sa-08
在系統和系統元件的規格、設計、開發、實作和修改過程中，套用機構定義的安全性和隱私權工程原則。
- Don't Use User Connections Flag for SQL Server
- Don't Use User Options Flag for SQL Server
- Enable 3625 Trace Database Flag for SQL Server
- Enable Cloud Asset Inventory Service
- Require Rotation of API Key
- Use Custom VPC Networks
nist-r5-sa-10
要求系統、系統元件或系統服務的開發人員：A. 在系統、元件或服務的設計、開發、實作、運作或處置期間，執行設定管理。B. 在設定管理下，記錄、管理及控管機構定義的設定項目變更完整性。C. 只對系統、元件或服務實作機構核准的變更。D. 記錄系統、元件或服務的核准變更，以及這類變更可能造成的安全和隱私權影響。E. 追蹤系統、元件或服務中的安全漏洞和漏洞解決情況，並向機構定義的人員回報結果。
- Don't Use User Connections Flag for SQL Server
- Don't Use User Options Flag for SQL Server
- Enable 3625 Trace Database Flag for SQL Server
- Enable Artifact Analysis Vulnerability Scanning
- Enable Cloud Asset Inventory Service
nist-r5-sa-11
在系統開發生命週期的所有設計後階段，要求系統、系統元件或系統服務的開發人員：A. 制定並實施持續進行安全性和隱私權評估的計畫；B. 按照機構定義的頻率，以及機構定義的深度和涵蓋範圍，執行單元、整合、系統、迴歸測試。C. 提供評估計畫的執行證明，以及測試和評估結果。D. 導入可驗證的瑕疵修復程序。E. 修正測試和評估期間發現的缺點。
nist-r5-sa-15
要求系統、系統元件或系統服務的開發人員遵循已記錄的開發程序，該程序應：明確處理安全性與隱私權要求、識別開發程序中使用的標準和工具、記錄開發程序中使用的特定工具選項和工具設定，以及記錄、管理及確保開發程序和所用工具的變更完整性。依據機構定義的頻率，檢查開發程序、標準、工具、工具選項和工具設定，判斷所選用和採用的程序、標準、工具、工具選項和工具設定，是否符合機構定義的安全和隱私權規定。
nist-r5-sa-21
要求機構定義的系統、系統元件或系統服務開發人員，必須具備適當的存取授權，這類授權由指派的機構定義官方政府職責決定。開發人員必須符合機構定義的其他人員篩選條件。
nist-r5-sc-03
將安全功能與非安全功能分開。
nist-r5-sc-05
防範機構定義的阻斷服務事件所造成的影響。根據阻斷服務事件類型，採用機構定義的控管機制。
nist-r5-sc-07
監控及控管系統外部管理介面和系統內主要內部管理介面的通訊。為可公開存取的系統元件實作子網路，這些元件在實體和邏輯上都與內部機構網路分開。只能透過受管理介面連線至外部網路或系統，這些介面是由根據機構安全和隱私權架構安排的邊界防護裝置組成。
- Block Connections to Cassandra Ports from All IP Addresses
- Block Connections to DNS Ports from All IP Addresses
- Block Connections to Elasticsearch Ports from All IP Addresses
- Block Connections to FTP Ports from All IP Addresses
- Block Connections to LDAP Ports from All IP Addresses
- Block Connections to Memcached Ports from All IP Addresses
- Block Connections to MongoDB Ports from All IP Addresses
- Block Connections to MySQL Ports from All IP Addresses
- Block Connections to NetBIOS Ports from All IP Addresses
- Block Connections to Oracle Database Ports from All IP Addresses
- Block Connections to POP3 Server Ports from All IP Addresses
- Block Connections to PostgreSQL Server Ports from All IP Addresses
- Block Connections to Redis Server Ports from All IP Addresses
- Block Connections to SMTP Server Ports from All IP Addresses
- Block External IP Address Access on Compute Engine VM Instances
- Block Generic Access to CiscoSecure/WebSM Ports
- Block Generic Access to Directory Service Ports
- Block Generic Access to HTTP Ports
- Block Generic Access to RDP Ports
- Block Generic Access to SSH Ports
- Block Generic Access to Telnet Servers
- Block Overly Permissive Firewall Rules
- Configure Access Controls for the Network Boundary
- Configure the Allowed Ingress Settings for Cloud Run Organization Policy Constraint
- Configure the Allowed VPC Egress Settings for Cloud Run Organization Policy Constraint
- Configure the Disable VPC External IPv6 Usage Organization Policy
- Configure the Disable VPC Internal IPv6 Usage Organization Policy
- Define VPC Connector Egress For Cloud Run Functions
- Enable Control Plane Authorized Networks on GKE Clusters
- Enable IP Alias Range for GKE Clusters
- Enable Network Policy on GKE Clusters
- Enable Private Clusters for GKE
- Enable Private Google Access for VPC Subnets
- Enable Private Google Access on an instance
- Enable SSL Encryption On AlloyDB Instances
- Enable the Restrict Authorized Networks on Cloud SQL Instances Organization Policy Constraint
- Enforce Deny All Egress Firewall Rule
- Prevent IP Forwarding on Compute Engine Instances
- Restrict Insecure SSL Policies for Compute Engine Instances
- Use Custom VPC Networks
nist-r5-sc-07-05
預設拒絕網路通訊流量，並在受管理介面中，為機構定義的系統允許例外狀況。
- Block External IP Address Access on Compute Engine VM Instances
- Enable Private Clusters for GKE
- Enforce Deny All Egress Firewall Rule
nist-r5-sc-08
保護傳輸資訊的機密性和完整性。
- Block Project-Wide SSH Keys on Compute Engine Instances
- Enable Confidential Computing for Compute Engine Instances
- Enable the Confidential VM Organization Policy Constraint
- Enforce HTTPS Traffic Only
- Enforce SSL for all Incoming Database Connections
- Restrict Legacy TLS Versions
nist-r5-sc-10
在工作階段結束時，或在組織定義的閒置時間過後，終止與通訊工作階段相關聯的網路連線。
nist-r5-sc-12
在系統內採用密碼編譯時，請根據金鑰管理規定 (例如機構定義的金鑰產生、發布、儲存、存取和銷毀規定)，建立及管理加密編譯金鑰。
- Define Cloud KMS Crypto Keys Protection Level
- Enable CMEK on GKE Node Pool Boot Disks
- Enable Confidential Computing for Compute Engine Instances
- Enable Encryption on GKE Clusters
- Enable the Confidential VM Organization Policy Constraint
- Enforce CMEK for Supported Services
- Require Service Account Key Rotation
- Restrict Non CMEK Services
- Restrict User Managed Service Account Keys
- Verify Cloud KMS Key Version Algorithm
nist-r5-sc-13
判斷密碼編譯的必要用途，並針對每個用途實作所需的特定密碼編譯類型。
- Define Cloud KMS Crypto Keys Protection Level
- Enable CMEK on GKE Node Pool Boot Disks
- Enable Encryption on GKE Clusters
- Enforce CMEK for Supported Services
- Enforce HTTPS Traffic Only
- Enforce SSL for all Incoming Database Connections
- Restrict Legacy TLS Versions
- Restrict Non CMEK Services
- Use TLS 1.2 or Higher
- Verify Cloud KMS Key Version Algorithm
nist-r5-sc-23
保護通訊工作階段的真實性。
nist-r5-sc-28
保護機構定義的靜態資訊機密性和完整性。
- Enable CMEK for AlloyDB Clusters
- Enable CMEK for BigQuery Datasets
- Enable CMEK for BigQuery Tables
- Enable CMEK for Cloud SQL Databases
- Enable CMEK for Cloud Storage Buckets
- Enable CMEK on Compute Engine Persistent Disks
- Enable CMEK on GKE Node Pool Boot Disks
- Enable Confidential Computing for Compute Engine Instances
- Enable CSEK On Compute Engine Persistent Disks
- Enable Encryption on GKE Clusters
- Enable the Confidential VM Organization Policy Constraint
- Encrypt Pub/Sub topic with CMEK
- Require CMEK on Dataproc Clusters
- Restrict Non CMEK Services
nist-r5-sc-28-01
實作加密機制，防止未經授權揭露及修改機構定義的資訊，這些資訊會儲存在機構定義的系統元件中。
nist-r5-si-01
A. 為機構定義的人員或角色開發、記錄及發布： a. 在機構層級、任務或業務流程層級，或系統層級定義的系統與資訊完整性政策。政策必須說明目的、範圍、角色、責任、管理承諾、機構實體間的協調，以及法規遵循。政策必須符合適用的法律、行政命令、指令、法規、政策、標準和指南。b. 有助於落實系統與資訊完整性政策，以及相關系統與資訊完整性控管措施的程序。B. 指派組織定義的官方人員，負責管理系統與資訊完整性政策和程序的開發、文件編寫和發布。C. 依據機構定義的頻率和事件，檢查並更新目前的系統和資訊完整性政策與程序。
nist-r5-si-02
找出、回報及修正系統瑕疵。安裝前，請先測試與瑕疵補救措施相關的軟體和韌體更新，確認有效性及潛在副作用。在發布安全性相關軟體和韌體更新後，於機構定義的時間範圍內安裝更新。將瑕疵修正作業納入機構的設定管理程序。
- Block Legacy Authorization on GKE Clusters
- Disable Alpha Features on GKE Clusters
- Disable Legacy Metadata Server Endpoints on Compute Engine
- Enable Artifact Analysis Vulnerability Scanning
- Enable Auto Upgrade on GKE Clusters
- Enable Shielded VM for Compute Engine Instances
- Require Container-Optimized OS for a GKE Cluster
- Subscribe a GKE Cluster to a Release Channel
nist-r5-si-02-02
使用機構定義的自動化機制，以機構定義的頻率，判斷系統元件是否已安裝適用的安全性相關軟體和韌體更新。
nist-r5-si-03
A. 在系統進入和退出點導入以簽章或非簽章為基礎的惡意程式碼防護機制，偵測並清除惡意程式碼。B. 根據機構的設定管理政策和程序，在有新版本時自動更新惡意程式碼防護機制。C. 設定惡意程式碼防護機制，以： a. 依據機構政策，以機構定義的頻率定期掃描系統，並在端點、網路進入和退出點，即時掃描來自外部來源的檔案 (在下載、開啟或執行檔案時)。b. 偵測到惡意程式碼時，系統會封鎖惡意程式碼、隔離惡意程式碼、採取機構定義的動作，並向機構定義的人員或角色傳送快訊。D. 解決惡意程式碼偵測和清除期間收到誤報的問題，以及這類問題對系統可用性造成的潛在影響。
nist-r5-si-04
A. 監控系統，偵測： a. 根據機構定義的監控目標，偵測攻擊和潛在攻擊指標。b. 未經授權的本機、網路和遠端連線。B. 透過機構定義的技術和方法，找出系統的未授權使用情形。C. 啟動內部監控功能或部署監控裝置： a. 在系統中策略性地收集機構決定的必要資訊。b. 在系統內的臨時位置，追蹤機構感興趣的特定類型交易。D. 分析偵測到的事件和異常狀況。E. 當機構作業和資產、個人、其他機構或國家/地區的風險發生變化時，請調整系統監控活動的層級。F. 取得有關系統監控活動的法律意見。G. 視需要或按照機構定義的頻率，向機構定義的人員或角色提供機構定義的系統監控資訊。
- Enable Cloud Monitoring on GKE Clusters
- Enable Flow Logs for VPC Subnet
- Enable Intranode Visibility for GKE Clusters
- Enable Log Locks Wait Flag for PostgreSQL instance
- Enable Subnet Flow Logs
- Enable VPC Flow Logs for Compute Engine Instances
nist-r5-si-04-02
運用自動化工具和機制，近乎即時地分析事件。
nist-r5-si-04-04
判斷異常或未經授權的活動，或是連入和連出通訊流量的條件。以機構定義的頻率監控機構定義的異常或未授權活動/情況，以及內送和外寄通訊流量。
nist-r5-si-07
a. 使用完整性驗證工具，偵測機構定義的軟體、韌體和資訊是否遭到未經授權的變更。b. 偵測到軟體、韌體和資訊未經授權的變更時，採取機構定義的動作。
- Enable Confidential Computing for Compute Engine Instances
- Enable Integrity Monitoring on GKE Clusters
- Enable Shielded GKE Nodes on a Cluster
- Enable Shielded VM for Compute Engine Instances
- Turn Off External Scripts Flag for SQL Server
nist-r5-si-07-01
在啟動時、機構定義的過渡狀態或安全性相關事件發生時，以機構定義的頻率，對機構定義的軟體、韌體和資訊執行完整性檢查。
nist-r5-si-07-02
使用自動化工具，在完整性驗證期間發現差異時，通知機構定義的人員或角色。
nist-r5-si-12
根據適用法律、行政命令、指令、法規、政策、標準、指南和作業規定，管理及保留系統內的資訊和系統輸出的資訊。
NIST AI 600-1 Privacy Controls
支援的雲端服務供應商： Google Cloud
採用 NIST AI 600-1 隱私權控管措施，確保生成式 AI 採用過程符合規範
這個架構包含下列章節中的雲端控制群組和雲端控制項。
nist-600-1-gv-6.1-001
根據相關第三方權利，將不同類型的生成式 AI (GAI) 內容分類。例如類別著作權、智慧財產權和資料隱私權。
- Configure Model Armor with Sensitive Data Filters
- Label Dataset Sensitivity Based on Sensitive Data Protection Findings
nist-600-1-mg-2.2-002
記錄訓練資料來源，追蹤 AI 生成內容的來源和出處。
nist-600-1-mg-2.2-007
使用即時稽核工具，協助追蹤及驗證 AI 生成資料的沿革和真實性。
nist-600-1-mg-2.2-009
在適當和適用的情況下，考慮在 GAI 開發過程中，負責任地使用合成資料和其他隱私權強化技術，在不揭露個人識別資訊或導致同質化的情況下，比對真實資料的統計屬性。
nist-600-1-mg-3.2-003
文件來源、訓練資料類型和來源、與 GAI 應用程式及其內容出處相關的資料中可能存在的偏誤、架構、預先訓練模型的訓練程序 (包括超參數資訊、訓練時間長度，以及套用的任何微調程序)。
nist-600-1-mp-2.1-002
針對 GAI 系統中的資料和內容流程進行測試與評估，包括但不限於原始資料來源、資料轉換和決策條件。
nist-600-1-mp-4.1-001
定期監控 AI 生成內容的隱私權風險，並處理任何可能洩漏 PII 或私密資料的情況。
nist-600-1-mp-4.1-004
盡可能根據適用的法律和政策，記錄訓練資料的策劃政策。
nist-600-1-mp-4.1-005
制定資料收集、保留和最低品質的政策，並考量下列風險：揭露不當的化生放核資訊；使用非法或危險內容；具備冒犯性的網路能力；訓練資料不平衡，可能導致有害偏見；洩漏個人識別資訊，包括個人臉部特徵。
nist-600-1-mp-4.1-009
運用各種方法，偵測生成的文字、圖片、影片或音訊輸出內容是否含有 PII 或私密資料。
nist-600-1-mp-4.1-010
對訓練資料的使用情況進行適當的盡職調查，評估智慧財產權和隱私權風險，包括檢查使用專屬或敏感訓練資料是否符合適用法律。
nist-600-1-ms-1.1-002
整合相關工具，分析內容出處、偵測資料異常狀況、驗證數位簽章的真實性，以及找出與不實資訊或操弄行為相關的模式。
nist-600-1-ms-2.2-004
使用去識別化、差異隱私或其他隱私權強化技術，盡量降低將 AI 生成內容連結回個別人類主體的風險。
nist-600-1-ms-2.5-005
確認生成式人工智慧 (GAI) 系統訓練資料和測試、評估、驗證和驗證 (TEVV) 資料來源，以及微調或檢索增強生成資料有根據。
nist-600-1-ms-2.6-002
評估系統訓練資料中是否存在有害偏見、智慧財產權侵害、資料隱私權侵害、猥褻、極端主義、暴力或化學/生物/放射性/核子 (CBRN) 資訊，以及這些問題的嚴重程度。
nist-600-1-ms-2.9-002
記錄 GAI 模型詳細資料，包括：建議用途和機構價值、假設和限制、資料收集方法、資料出處、資料品質、模型架構 (例如卷積神經網路和 Transformer)、最佳化目標、訓練演算法、RLHF 方法、微調或檢索增強生成方法、評估資料、倫理考量、法律和法規要求。
NIST Cybersecurity Framework 1.1
支援的雲端服務供應商： Google Cloud
這個策略架構可協助機構管理網路安全風險。這個架構將活動歸納為五項核心功能：識別、保護、偵測、應變和復原，可讓您從高層次瞭解自己的安全狀態。
這個架構包含下列章節中的雲端控制群組和雲端控制項。
nist-csf-de-ae
異常狀況和事件 (DE.AE)：偵測到異常活動，並瞭解事件的潛在影響。
- Enable Artifact Analysis Vulnerability Scanning
- Enable Subnet Flow Logs
- Enable VPC Flow Logs for Compute Engine Instances
nist-csf-de-ae-1
建立及管理使用者和系統的網路作業基準和預期資料流程。
- Don't Use Kubernetes Web UI
- Enable Firewall Rule Logging
- Enable Log Checkpoints Flag for PostgreSQL
- Enable Log Locks Wait Flag for PostgreSQL instance
- Enable Log Temp Files Flag for PostgreSQL instance
- Prevent Nested Virtualization for Compute Engine VMs
- Require Cloud Storage Bucket Logging
- Restrict Public IP Addresses on Vertex AI Workbench Notebooks and Instances
- Turn Off Log Executor Stats Flag for PostgreSQL
- Turn off Log Hostname Flag for PostgreSQL
- Turn off Log Parser Stats Flag for PostgreSQL
- Turn off Log Planner Stats Flag for PostgreSQL
- Turn off Log Statement Stats Flag for PostgreSQL
nist-csf-de-ae-2
分析偵測到的事件，瞭解攻擊目標和方法。
- Enable Cloud DNS Logs Monitoring
- Enable Log Checkpoints Flag for PostgreSQL
- Implement Event Logging for Google Cloud Services
- Require Cloud Storage Bucket Logging
nist-csf-de-ae-3
系統會從多個來源和感應器收集事件資料，並建立關聯。
- Configure Log Metrics and Alerts for Audit Logging Changes
- Configure Log Metrics and Alerts for Cloud SQL Configuration Changes
- Configure Log Metrics and Alerts for Cloud Storage IAM Policy Changes
- Configure Log Metrics and Alerts for Custom Role Changes
- Configure Log Metrics and Alerts for VPC Network Changes
- Configure Log Metrics and Alerts for VPC Network Firewall Changes
- Configure Log Metrics and Alerts for VPC Route Changes
- Configure Log Sinks
- Enable Firewall Rule Logging
- Enable Load Balancer Logging
- Enable Log Checkpoints Flag for PostgreSQL
- Enable Log Connections Flag for PostgreSQL
- Enable Log Disconnections Flag for PostgreSQL
- Enable Log Error Verbosity Flag for PostgreSQL
- Enable Log Min Error Statement Flag for PostgreSQL
- Enable Log Min Messages Flag for PostgreSQL
- Enable Log Statement Flag for PostgreSQL
- Require Cloud Storage Bucket Logging
- Set Log Error Verbosity Flag for AlloyDB Instances
- Set Log Min Error Statement Flag for AlloyDB Instances
- Set Log Min Messages Flag for AlloyDB Instances
- Turn Off Log Min Duration Statement Flag for PostgreSQL
nist-csf-de-ae-4
判斷事件的影響。
nist-csf-de-ae-5
建立事件快訊門檻。
- Enable Firewall Rule Logging
- Enable IP Alias Range for GKE Clusters
- Enable Log Checkpoints Flag for PostgreSQL
- Require Cloud Storage Bucket Logging
nist-csf-de-cm
安全持續監控 (DE.CM)：監控資訊系統和資產，找出網路安全事件並驗證防護措施的有效性。
nist-csf-de-cm-1
監控網路，偵測潛在的網路安全事件。
- Block Connections to DNS Ports from All IP Addresses
- Block Connections to Elasticsearch Ports from All IP Addresses
- Block Connections to FTP Ports from All IP Addresses
- Block Connections to LDAP Ports from All IP Addresses
- Block Connections to Memcached Ports from All IP Addresses
- Block Connections to MongoDB Ports from All IP Addresses
- Block Connections to MySQL Ports from All IP Addresses
- Block Connections to NetBIOS Ports from All IP Addresses
- Block Connections to Oracle Database Ports from All IP Addresses
- Block Connections to POP3 Server Ports from All IP Addresses
- Block Connections to PostgreSQL Server Ports from All IP Addresses
- Block Connections to Redis Server Ports from All IP Addresses
- Block Connections to SMTP Server Ports from All IP Addresses
- Block Generic Access to CiscoSecure/WebSM Ports
- Block Generic Access to HTTP Ports
- Block Generic Access to Telnet Servers
- Block Overly Permissive Firewall Rules
- Enable Integrity Monitoring on GKE Clusters
- Enable Log Checkpoints Flag for PostgreSQL
- Enable Log Connections Flag for PostgreSQL
- Enable Log Disconnections Flag for PostgreSQL
- Enable Log Error Verbosity Flag for PostgreSQL
- Enable Log Min Error Statement Flag for PostgreSQL
- Enable Log Min Messages Flag for PostgreSQL
- Enable Log Statement Flag for PostgreSQL
- Implement Continuous Network Traffic Monitoring
- Prevent Nested Virtualization for Compute Engine VMs
- Require Cloud Storage Bucket Logging
- Restrict Public IP Addresses on Vertex AI Workbench Notebooks and Instances
- Set Log Error Verbosity Flag for AlloyDB Instances
- Set Log Min Error Statement Flag for AlloyDB Instances
- Set Log Min Messages Flag for AlloyDB Instances
- Turn Off Log Min Duration Statement Flag for PostgreSQL
nist-csf-de-cm-2
監控實體環境，偵測潛在的網路安全事件。
nist-csf-de-cm-3
監控人員活動，偵測潛在的網路安全事件。
- Enable Log Checkpoints Flag for PostgreSQL
- Require Cloud Storage Bucket Logging
- Retain Audit Records
nist-csf-de-cm-4
偵測到惡意程式碼。
- Block Connections to FTP Ports from All IP Addresses
- Block Connections to LDAP Ports from All IP Addresses
- Block Connections to Memcached Ports from All IP Addresses
- Block Connections to MongoDB Ports from All IP Addresses
- Block Connections to MySQL Ports from All IP Addresses
- Block Connections to NetBIOS Ports from All IP Addresses
- Block Connections to Oracle Database Ports from All IP Addresses
- Block Connections to POP3 Server Ports from All IP Addresses
- Block Connections to PostgreSQL Server Ports from All IP Addresses
- Block Connections to Redis Server Ports from All IP Addresses
- Block Connections to SMTP Server Ports from All IP Addresses
- Block Generic Access to CiscoSecure/WebSM Ports
- Block Generic Access to HTTP Ports
- Block Generic Access to Telnet Servers
- Block Overly Permissive Firewall Rules
- Enable Log Checkpoints Flag for PostgreSQL
- Require Cloud Storage Bucket Logging
nist-csf-de-cm-5
系統偵測到未經授權的行動代碼。
- Block Connections to FTP Ports from All IP Addresses
- Block Connections to LDAP Ports from All IP Addresses
- Block Connections to Memcached Ports from All IP Addresses
- Block Connections to MongoDB Ports from All IP Addresses
- Block Connections to MySQL Ports from All IP Addresses
- Block Connections to NetBIOS Ports from All IP Addresses
- Block Connections to Oracle Database Ports from All IP Addresses
- Block Connections to POP3 Server Ports from All IP Addresses
- Block Connections to PostgreSQL Server Ports from All IP Addresses
- Block Connections to Redis Server Ports from All IP Addresses
- Block Connections to SMTP Server Ports from All IP Addresses
- Block Generic Access to CiscoSecure/WebSM Ports
- Block Generic Access to HTTP Ports
- Block Generic Access to Telnet Servers
- Block Overly Permissive Firewall Rules
- Configure the Allowed Ingress Settings for Cloud Run Organization Policy Constraint
- Enable Log Checkpoints Flag for PostgreSQL
- Enable OS Login
- Require Cloud Storage Bucket Logging
nist-csf-de-cm-6
監控外部服務供應商的活動，偵測潛在的網路安全事件。
nist-csf-de-cm-7
監控未經授權的人員、連線、裝置和軟體。
- Block Connections to DNS Ports from All IP Addresses
- Block Connections to Elasticsearch Ports from All IP Addresses
- Block Connections to FTP Ports from All IP Addresses
- Block Connections to LDAP Ports from All IP Addresses
- Block Connections to Memcached Ports from All IP Addresses
- Block Connections to MongoDB Ports from All IP Addresses
- Block Connections to MySQL Ports from All IP Addresses
- Block Connections to NetBIOS Ports from All IP Addresses
- Block Connections to Oracle Database Ports from All IP Addresses
- Block Connections to POP3 Server Ports from All IP Addresses
- Block Connections to PostgreSQL Server Ports from All IP Addresses
- Block Connections to Redis Server Ports from All IP Addresses
- Block Connections to SMTP Server Ports from All IP Addresses
- Block Generic Access to CiscoSecure/WebSM Ports
- Block Generic Access to HTTP Ports
- Block Generic Access to Telnet Servers
- Block Overly Permissive Firewall Rules
- Enable Cloud Logging on GKE Clusters
- Enable Cloud Monitoring on GKE Clusters
- Enable Integrity Monitoring on GKE Clusters
- Enable Intranode Visibility for GKE Clusters
- Enable Log Checkpoints Flag for PostgreSQL
- Enforce Compute Session Inactive Policy
- Implement Continuous Network Traffic Monitoring
- Prevent Nested Virtualization for Compute Engine VMs
- Require Cloud Storage Bucket Logging
nist-csf-de-cm-8
執行安全漏洞掃描。
- Configure the Allowed Ingress Settings for Cloud Run Organization Policy Constraint
- Don't Use Kubernetes Web UI
- Enable Auto Upgrade on GKE Clusters
- Enable Cloud Monitoring on GKE Clusters
- Enable OS Login
- Implement Continuous Network Traffic Monitoring
- Require Binary Authorization on a Cluster
- Restrict Insecure SSL Policies for Compute Engine Instances
- Subscribe a GKE Cluster to a Release Channel
nist-csf-de-dp-1
明確定義偵測作業的角色與職責，確保問責制。
- Enable Log Checkpoints Flag for PostgreSQL
- Prevent Nested Virtualization for Compute Engine VMs
- Require Cloud Storage Bucket Logging
nist-csf-de-dp-4
系統會傳達事件偵測資訊。
- Block Root Access on Vertex AI Workbench Instances
- Block Terminal Access on Vertex AI Workbench Instances
- Enable Firewall Rule Logging
- Enable Log Checkpoints Flag for PostgreSQL
- Require Cloud Storage Bucket Logging
nist-csf-id-am
資產管理：識別並管理可協助機構達成業務目標的資料、人員、裝置、系統和設施，並根據這些資產對機構目標和機構風險策略的重要性，採取一致的管理方式。
- Define Cloud KMS Crypto Keys Protection Level
- Define Cloud KMS Crypto Keys Purpose
- Enable Artifact Analysis Vulnerability Scanning
- Enforce CMEK for Supported Services
- Restrict Legacy TLS Versions
- Verify Cloud KMS Key Version Algorithm
nist-csf-id-am-1
清查機構內的實體裝置和系統。
- Block External IP Address Access on Compute Engine VM Instances
- Define VPC Connector Egress For Cloud Run Functions
- Don't Use Kubernetes Web UI
- Enable Cloud Asset Inventory Service
- Enable Log Locks Wait Flag for PostgreSQL instance
- Enable Log Temp Files Flag for PostgreSQL instance
- Enable OS Login
- Turn Off Log Executor Stats Flag for PostgreSQL
- Turn off Log Parser Stats Flag for PostgreSQL
- Turn off Log Planner Stats Flag for PostgreSQL
- Turn off Log Statement Stats Flag for PostgreSQL
nist-csf-id-am-4
外部資訊系統已編目。
- Don't Use Kubernetes Web UI
- Enable OS Login for All Instances at Project Level
- Require OS Login on Compute Engine Instances
nist-csf-id-am-6
為全體員工和第三方利害關係人 (例如供應商、客戶、合作夥伴) 建立網路安全角色和責任。
nist-csf-id-gv-1
建立並傳達組織網路安全政策。
- Define Vertex AI Access Mode
- Enable CMEK for Cloud SQL Databases
- Enable CMEK for Cloud Storage Buckets
- Enable Log Duration Flag for PostgreSQL instance
- Enable Private Google Access for VPC Subnets
- Enable SSL Encryption On AlloyDB Instances
- Enable the Confidential VM Organization Policy Constraint
- Restrict Default Network Creation for Compute Engine Instances
nist-csf-id-gv-3
瞭解並管理與網路安全相關的法律和法規要求，包括隱私權和公民自由義務。
- Block Generic Access to Directory Service Ports
- Enable CMEK for Cloud SQL Databases
- Enable Log Duration Flag for PostgreSQL instance
- Require Object Versioning for Cloud Storage Buckets
nist-csf-id-gv-4
管理和風險管理程序可因應網路安全風險。
nist-csf-id-ra-1
找出並記錄資產安全漏洞。
- Don't Use Kubernetes Web UI
- Enable the Restrict Authorized Networks on Cloud SQL Instances Organization Policy Constraint
- Use Latest Image Versions on Dataproc Clusters
nist-csf-id-ra-2
網路威脅情報來自資訊分享論壇和來源。
- Configure the Allowed VPC Egress Settings for Cloud Run Organization Policy Constraint
- Configure the Disable VPC External IPv6 Usage Organization Policy
- Configure the Disable VPC Internal IPv6 Usage Organization Policy
- Define a Security Policy to Mitigate for DDoS Events
- Don't Use Kubernetes Web UI
nist-csf-id-ra-3
找出並記錄內部和外部威脅。
- Enable the Restrict Authorized Networks on Cloud SQL Instances Organization Policy Constraint
- Use Latest Image Versions on Dataproc Clusters
nist-csf-id-sc-3
與供應商和第三方合作夥伴簽訂合約，以實施適當措施，達成機構網路安全計畫和網路供應鏈風險管理計畫的目標。
nist-csf-pr-ac
身分管理、驗證和存取控管 (PR.AC)：實體和邏輯資產與相關設施的存取權僅限於授權使用者、程序和裝置，並根據未經授權存取授權活動和交易的評估風險進行管理。
- Block Automatic IAM Grants to Default Service Accounts
- Block Service Account Key Creation
- Block Service Account Key Uploads
- Define Cloud KMS Crypto Keys Protection Level
- Define Cloud KMS Crypto Keys Purpose
- Define Storage Class Lifestyle Action
- Enable Artifact Analysis Vulnerability Scanning
- Enforce CMEK for Supported Services
- Enforce Public Access Prevention
- Restrict Legacy TLS Versions
- Set Uniform Bucket Level Access for Cloud Storage Buckets
- Verify Cloud KMS Key Version Algorithm
nist-csf-pr-ac-1
系統會為授權裝置、使用者和程序核發、管理、驗證、撤銷及稽核身分和憑證。
- Block External IP Address Access on Compute Engine VM Instances
- Block Generic Access to Directory Service Ports
- Define VPC Connector Egress For Cloud Run Functions
- Don't Use Kubernetes Web UI
- Enable CMEK for Cloud SQL Databases
- Enable CMEK for Cloud Storage Buckets
- Enable OS Login
- Enable OS Login for All Instances at Project Level
- Enable Private Google Access for VPC Subnets
- Enable SSL Encryption On AlloyDB Instances
- Enable the Confidential VM Organization Policy Constraint
- Enable Workload Identity Federation for GKE on clusters
- Require OS Login on Compute Engine Instances
- Restrict API Access to Google Cloud APIs for Compute Engine Instances
- Restrict Default Network Creation for Compute Engine Instances
- Restrict Insecure SSL Policies for Compute Engine Instances
- Turn Off Contained Database Authentication Flag for SQL Server
- Use Custom Service Accounts for Compute Engine Instances
nist-csf-pr-ac-2
我們會管理及保護資產的實體存取權。
nist-csf-pr-ac-3
遠端存取權由他人管理。
- Block Automatic IAM Grants to Default Service Accounts
- Configure Access Controls for the Network Boundary
- Configure the Disable VPC External IPv6 Usage Organization Policy
- Define a Security Policy to Mitigate for DDoS Events
- Enable Control Plane Authorized Networks on GKE Clusters
- Enable OS Login for All Instances at Project Level
- Enable Private Clusters for GKE
- Enable Private Google Access on an instance
- Enable Secure Boot on Compute Engine Instances
- Enable Workload Identity Federation for GKE on clusters
- Encrypt Pub/Sub topic with CMEK
- Enforce HTTPS Traffic Only
- Require OS Login on Compute Engine Instances
- Use Least Privilege Service Accounts for GKE Clusters
- Use TLS 1.2 or Higher
nist-csf-pr-ac-4
存取權限和授權作業均採用最小權限和權責劃分原則進行管理。
- Block Automatic IAM Grants to Default Service Accounts
- Block Connections to Cassandra Ports from All IP Addresses
- Block Generic Access to Directory Service Ports
- Block Legacy Authorization on GKE Clusters
- Block Public IP Addresses for AlloyDB Cluster Instances
- Block Public IP Addresses for Cloud SQL Instances
- Configure Access Controls for the Network Boundary
- Configure Remote Access Inactivity Timeout
- Configure the Allowed VPC Egress Settings for Cloud Run Organization Policy Constraint
- Configure the Disable VM Serial Port Logging to Stackdriver Organization Policy
- Configure the Disable VPC External IPv6 Usage Organization Policy
- Create GKE Clusters with Limited Privileges
- Define Secret Manager Rotation Schedule
- Don't Use Kubernetes Web UI
- Enable Control Plane Authorized Networks on GKE Clusters
- Enable Log Checkpoints Flag for PostgreSQL
- Enable Log Duration Flag for PostgreSQL instance
- Enable OS Login for All Instances at Project Level
- Enable Private Clusters for GKE
- Enable Private Google Access for VPC Subnets
- Enable Skip Show Database Flag for MySQL
- Enable the Confidential VM Organization Policy Constraint
- Enable the Restrict Authorized Networks on Cloud SQL Instances Organization Policy Constraint
- Enable Uniform Bucket-Level Access on Cloud Storage Buckets
- Enforce Compute Session Inactive Policy
- Require Cloud Storage Bucket Logging
- Require Object Versioning for Cloud Storage Buckets
- Require OS Login on Compute Engine Instances
- Restrict Default Network Creation for Compute Engine Instances
- Restrict Public Access to BigQuery Datasets
- Restrict Public Access to Cloud SQL Database Instances
- Restrict Public Access to Cloud Storage Buckets
- Restrict Public IP Addresses to Compute Engine Instances
- Restrict Service Usage
- Set Application Restriction on API Keys
- Turn Off Contained Database Authentication Flag for SQL Server
- Turn Off Cross Database Ownership Chaining Flag for SQL Server
- Use Least Privilege Service Accounts for GKE Clusters
nist-csf-pr-ac-5
保護網路完整性 (例如網路隔離、網路區隔)。
- Block Connections to Cassandra Ports from All IP Addresses
- Block Connections to DNS Ports from All IP Addresses
- Block Connections to Elasticsearch Ports from All IP Addresses
- Block Connections to FTP Ports from All IP Addresses
- Block Connections to LDAP Ports from All IP Addresses
- Block Connections to Memcached Ports from All IP Addresses
- Block Connections to MongoDB Ports from All IP Addresses
- Block Connections to MySQL Ports from All IP Addresses
- Block Connections to NetBIOS Ports from All IP Addresses
- Block Connections to Oracle Database Ports from All IP Addresses
- Block Connections to POP3 Server Ports from All IP Addresses
- Block Connections to PostgreSQL Server Ports from All IP Addresses
- Block Connections to Redis Server Ports from All IP Addresses
- Block Connections to SMTP Server Ports from All IP Addresses
- Block Generic Access to HTTP Ports
- Block Generic Access to Telnet Servers
- Block Overly Permissive Firewall Rules
- Enable Intranode Visibility for GKE Clusters
- Enable Network Policy on GKE Clusters
- Enforce Deny All Egress Firewall Rule
- Prevent Nested Virtualization for Compute Engine VMs
- Restrict Public IP Addresses on Vertex AI Workbench Notebooks and Instances
- Use TLS 1.2 or Higher
nist-csf-pr-ac-6
身分會經過驗證並綁定至憑證，且會在互動中聲明。
- Enable Private Google Access for VPC Subnets
- Enable the Confidential VM Organization Policy Constraint
nist-csf-pr-ac-7
根據交易風險 (例如個人安全和隱私權風險，以及其他機構風險)，驗證使用者、裝置和其他資產 (例如單一因素、多重因素)。
- Block Connections to DNS Ports from All IP Addresses
- Block Connections to Elasticsearch Ports from All IP Addresses
- Block Connections to FTP Ports from All IP Addresses
- Block Connections to LDAP Ports from All IP Addresses
- Block Connections to Memcached Ports from All IP Addresses
- Block Connections to MongoDB Ports from All IP Addresses
- Block Connections to MySQL Ports from All IP Addresses
- Block Connections to NetBIOS Ports from All IP Addresses
- Block Connections to Oracle Database Ports from All IP Addresses
- Block Connections to POP3 Server Ports from All IP Addresses
- Block Connections to PostgreSQL Server Ports from All IP Addresses
- Block Connections to Redis Server Ports from All IP Addresses
- Block Connections to SMTP Server Ports from All IP Addresses
- Block Generic Access to HTTP Ports
- Block Generic Access to Telnet Servers
- Block Overly Permissive Firewall Rules
- Enable Private Google Access for VPC Subnets
- Enable the Confidential VM Organization Policy Constraint
- Enforce Compute Session Inactive Policy
- Restrict Default Network Creation for Compute Engine Instances
nist-csf-pr-ds-1
靜態資料受到保護。
- Enable CMEK for AlloyDB Clusters
- Enable CMEK for BigQuery Datasets
- Enable CMEK for BigQuery Tables
- Enable CMEK for Cloud SQL Databases
- Enable CMEK for Cloud Storage Buckets
- Enable CMEK on Compute Engine Persistent Disks
- Enable CMEK on GKE Node Pool Boot Disks
- Enable Confidential Computing for Compute Engine Instances
- Enable CSEK On Compute Engine Persistent Disks
- Enable Encryption on GKE Clusters
- Enable Log Checkpoints Flag for PostgreSQL
- Enable Log Duration Flag for PostgreSQL instance
- Enable SSL Encryption On AlloyDB Instances
- Encrypt Data at Rest with CMEK
- Encrypt Pub/Sub topic with CMEK
- Enforce CMEK
- Require Cloud Storage Bucket Logging
- Require CMEK on Dataproc Clusters
- Require Object Versioning for Cloud Storage Buckets
- Restrict Non CMEK Services
nist-csf-pr-ds-2
保護傳輸中的資料。
- Block Connections to DNS Ports from All IP Addresses
- Block Connections to Elasticsearch Ports from All IP Addresses
- Block Connections to FTP Ports from All IP Addresses
- Block Connections to LDAP Ports from All IP Addresses
- Block Connections to Memcached Ports from All IP Addresses
- Block Connections to MongoDB Ports from All IP Addresses
- Block Connections to MySQL Ports from All IP Addresses
- Block Connections to NetBIOS Ports from All IP Addresses
- Block Connections to Oracle Database Ports from All IP Addresses
- Block Connections to POP3 Server Ports from All IP Addresses
- Block Connections to PostgreSQL Server Ports from All IP Addresses
- Block Connections to Redis Server Ports from All IP Addresses
- Block Connections to SMTP Server Ports from All IP Addresses
- Block Generic Access to HTTP Ports
- Block Generic Access to Telnet Servers
- Block Overly Permissive Firewall Rules
- Block Project-Wide SSH Keys on Compute Engine Instances
- Configure the Allowed VPC Egress Settings for Cloud Run Organization Policy Constraint
- Enable CMEK for Cloud SQL Databases
- Enable CMEK for Cloud Storage Buckets
- Enable SSL Encryption On AlloyDB Instances
- Enforce SSL for all Incoming Database Connections
- Prevent Nested Virtualization for Compute Engine VMs
- Use TLS 1.2 or Higher
nist-csf-pr-ds-3
在移除、轉移和處置期間，資產會受到正式管理。
nist-csf-pr-ds-4
確保容量充足，維持可用性。
nist-csf-pr-ds-5
實作資料外洩防護措施。
nist-csf-pr-ip
資訊保護程序和程序 (PR.IP)：維護並使用安全性政策 (涵蓋目的、範圍、角色、職責、管理承諾，以及組織實體之間的協調)，以及程序和程序，以管理資訊系統和資產的保護措施。
nist-csf-pr-ip-1
建立並維護資訊科技或工業控制系統的基準設定，同時納入安全原則 (例如最低功能概念)。
- Block External IP Address Access on Compute Engine VM Instances
- Block Root Access on Vertex AI Workbench Instances
- Block Terminal Access on Vertex AI Workbench Instances
- Configure the Disable VM Serial Port Logging to Stackdriver Organization Policy
- Define VPC Connector Egress For Cloud Run Functions
- Disable Alpha Features on GKE Clusters
- Disable Legacy Metadata Server Endpoints on Compute Engine
- Don't Use Legacy Networks
- Don't Use User Connections Flag for SQL Server
- Don't Use User Options Flag for SQL Server
- Enable 3625 Trace Database Flag for SQL Server
- Enable CMEK for Cloud SQL Databases
- Enable DNSSEC for Cloud DNS
- Enable Log Checkpoints Flag for PostgreSQL
- Enable Log Duration Flag for PostgreSQL instance
- Enable Secure Boot for Shielded GKE Nodes
- Enable Shielded GKE Nodes on a Cluster
- Encrypt Data at Rest with CMEK
- Enforce CMEK
- Require Binary Authorization on a Cluster
- Require Container-Optimized OS for a GKE Cluster
- Turn Off External Scripts Flag for SQL Server
- Turn Off Local Infile Flag for MySQL
- Turn off Log Hostname Flag for PostgreSQL
- Use Custom VPC Networks
nist-csf-pr-ip-10
測試應變和復原計畫。
nist-csf-pr-ip-12
制定並實施安全漏洞管理計畫。
- Disable Legacy Metadata Server Endpoints on Compute Engine
- Restrict Insecure SSL Policies for Compute Engine Instances
- Use Latest Image Versions on Dataproc Clusters
nist-csf-pr-ip-2
我們已導入系統開發生命週期，以管理系統。
- Require Rotation of API Key
- Restrict API Keys for Required APIs Only
- Restrict Insecure SSL Policies for Compute Engine Instances
nist-csf-pr-ip-3
已建立控管設定變更的程序。
- Block Root Access on Vertex AI Workbench Instances
- Block Terminal Access on Vertex AI Workbench Instances
- Enable CMEK for Cloud SQL Databases
nist-csf-pr-ip-4
備份、維護及測試資訊。
- Block Generic Access to Directory Service Ports
- Enable AlloyDB Automated Backups on Cluster
- Enable AlloyDB Backups on Cluster
- Enable Automatic Backups for Cloud SQL Databases
- Enable Log Checkpoints Flag for PostgreSQL
- Enable Log Duration Flag for PostgreSQL instance
- Require Cloud Storage Bucket Logging
- Require Object Versioning for Cloud Storage Buckets
nist-csf-pr-ip-6
資料會根據政策銷毀。
- Enable Log Checkpoints Flag for PostgreSQL
- Enable Log Duration Flag for PostgreSQL instance
- Require Cloud Storage Bucket Logging
- Require Object Versioning for Cloud Storage Buckets
nist-csf-pr-ip-9
已制定並管理應變計畫 (事件應變和營運持續) 和復原計畫 (事件復原和災難復原)。
nist-csf-pr-ma-1
使用經過核准和控管的工具，維護及修理機構資產，並記錄相關作業。
- Block Root Access on Vertex AI Workbench Instances
- Block Terminal Access on Vertex AI Workbench Instances
- Enable Auto Repair for GKE Clusters
- Enable Auto Upgrade on GKE Clusters
- Subscribe a GKE Cluster to a Release Channel
nist-csf-pr-pt
防護技術 (PR.PT)：管理技術安全解決方案，確保系統和資產安全無虞且具備復原能力，並符合相關政策、程序和協議。
- Block Service Account Key Creation
- Block Service Account Key Uploads
- Define Cloud KMS Crypto Keys Protection Level
- Define Cloud KMS Crypto Keys Purpose
- Define Retention Period for Cloud Storage Buckets
- Define Storage Class Lifestyle Action
- Enable Object Versioning on Buckets
- Enforce CMEK for Supported Services
- Enforce Public Access Prevention
- Lock Storage Bucket Retention Policies
- Restrict Legacy TLS Versions
- Terminate Network Connections
- Verify Cloud KMS Key Version Algorithm
nist-csf-pr-pt-1
稽核和記錄會依據政策決定、記錄、實作及審查。
- Configure Log Metrics and Alerts for Audit Logging Changes
- Configure Log Metrics and Alerts for Cloud SQL Configuration Changes
- Configure Log Metrics and Alerts for Cloud Storage IAM Policy Changes
- Configure Log Metrics and Alerts for Custom Role Changes
- Configure Log Metrics and Alerts for VPC Network Changes
- Configure Log Metrics and Alerts for VPC Network Firewall Changes
- Configure Log Metrics and Alerts for VPC Route Changes
- Configure Log Sinks
- Define a Security Policy to Mitigate for DDoS Events
- Define Secret Manager Rotation Schedule
- Enable Cloud DNS Logs Monitoring
- Enable Firewall Rule Logging
- Enable Load Balancer Logging
- Enable Log Checkpoints Flag for PostgreSQL
- Enable Log Duration Flag for PostgreSQL instance
- Enforce HTTPS Traffic Only
- Implement Event Logging for Google Cloud Services
- Require Cloud Storage Bucket Logging
- Require Object Versioning for Cloud Storage Buckets
nist-csf-pr-pt-3
設定系統時，請只提供必要功能，以納入最小功能原則。
- Configure the Disable VM Serial Port Logging to Stackdriver Organization Policy
- Disable Legacy Metadata Server Endpoints on Compute Engine
- Enable Log Checkpoints Flag for PostgreSQL
- Enable Log Duration Flag for PostgreSQL instance
- Restrict Insecure SSL Policies for Compute Engine Instances
- Set Application Restriction on API Keys
- Turn Off External Scripts Flag for SQL Server
nist-csf-pr-pt-4
通訊和控制網路受到保護。
- Block Connections to DNS Ports from All IP Addresses
- Block Connections to Elasticsearch Ports from All IP Addresses
- Block Connections to FTP Ports from All IP Addresses
- Block Connections to LDAP Ports from All IP Addresses
- Block Connections to Memcached Ports from All IP Addresses
- Block Connections to MongoDB Ports from All IP Addresses
- Block Connections to MySQL Ports from All IP Addresses
- Block Connections to NetBIOS Ports from All IP Addresses
- Block Connections to Oracle Database Ports from All IP Addresses
- Block Connections to POP3 Server Ports from All IP Addresses
- Block Connections to PostgreSQL Server Ports from All IP Addresses
- Block Connections to Redis Server Ports from All IP Addresses
- Block Connections to SMTP Server Ports from All IP Addresses
- Block Generic Access to HTTP Ports
- Block Generic Access to Telnet Servers
- Block Overly Permissive Firewall Rules
- Disable Alpha Features on GKE Clusters
- Enable Secure Boot for Shielded GKE Nodes
- Enable Shielded GKE Nodes on a Cluster
- Enforce HTTPS Traffic Only
nist-csf-pr-pt-5
我們實作了各種機制 (例如安全機制、負載平衡、熱插拔)，確保在正常和不利情況下都能滿足復原能力需求。
- Enable Secure Boot on Compute Engine Instances
- Turn Off Log Executor Stats Flag for PostgreSQL
- Turn off Log Parser Stats Flag for PostgreSQL
- Turn off Log Planner Stats Flag for PostgreSQL
- Turn off Log Statement Stats Flag for PostgreSQL
nist-csf-rc-im
改善 (RC.IM)：將學到的經驗納入日後活動，改善復原計畫和程序。
nist-csf-rc-rp-1
在網路安全事件發生期間或之後執行復原計畫。
nist-csf-rs-an
分析 (RS.AN)：進行分析，確保有效回應並支援復原活動。
nist-csf-rs-an-1
我們會調查偵測系統發出的通知。
- Enable Cloud DNS Logs Monitoring
- Enable Firewall Rule Logging
- Enable Log Temp Files Flag for PostgreSQL instance
- Implement Event Logging for Google Cloud Services
- Turn Off Log Executor Stats Flag for PostgreSQL
- Turn off Log Hostname Flag for PostgreSQL
- Turn off Log Parser Stats Flag for PostgreSQL
- Turn off Log Planner Stats Flag for PostgreSQL
- Turn off Log Statement Stats Flag for PostgreSQL
nist-csf-rs-an-5
建立相關程序，接收、分析及回應內部和外部來源 (例如內部測試、安全公告或安全研究人員) 向機構揭露的安全漏洞。
nist-csf-rs-co-1
人員知道需要應變時的角色和作業順序。
nist-csf-rs-co-4
與利害關係人的協調作業會依據應變計畫進行。
nist-csf-rs-im-2
回應策略已更新。
nist-csf-rs-mi-2
事件已緩解。
nist-csf-rs-rp-1
事件發生期間或之後執行回應計畫。
PCI DSS v4.0.1
支援的雲端服務供應商： Google Cloud
這項監管架構為處理、儲存或傳輸持卡人資料的商家，定義了強制性的 PCI 資料安全標準 (DSS)。PCI DSS 訂定了具體的技術和作業要求，協助保護處理、儲存或傳輸的持卡人資料。PCI DSS 提供一套規範性技術和作業要求，協助防範詐欺。這個架構符合 PCI DSS v4.0.1。
這個架構包含下列章節中的雲端控制群組和雲端控制項。
pci-dss-v4-1-2-1
必須定義、實作及維護 NSC 規則組合的設定標準。
- Block Connections to Cassandra Ports from All IP Addresses
- Block Connections to DNS Ports from All IP Addresses
- Block Connections to Elasticsearch Ports from All IP Addresses
- Block Connections to FTP Ports from All IP Addresses
- Block Connections to LDAP Ports from All IP Addresses
- Block Connections to Memcached Ports from All IP Addresses
- Block Connections to MongoDB Ports from All IP Addresses
- Block Connections to MySQL Ports from All IP Addresses
- Block Connections to NetBIOS Ports from All IP Addresses
- Block Connections to Oracle Database Ports from All IP Addresses
- Block Connections to POP3 Server Ports from All IP Addresses
- Block Connections to PostgreSQL Server Ports from All IP Addresses
- Block Connections to Redis Server Ports from All IP Addresses
- Block Connections to SMTP Server Ports from All IP Addresses
- Block Generic Access to CiscoSecure/WebSM Ports
- Block Generic Access to Directory Service Ports
- Block Generic Access to HTTP Ports
- Block Generic Access to RDP Ports
- Block Generic Access to SSH Ports
- Block Generic Access to Telnet Servers
- Block Overly Permissive Firewall Rules
- Block Public IP Addresses for AlloyDB Cluster Instances
- Configure Access Controls for the Network Boundary
- Configure Network Traffic Monitoring
- Define a Security Policy to Mitigate for DDoS Events
- Don't Use Legacy Networks
- Enable Control Plane Authorized Networks on GKE Clusters
- Enable Flow Logs for VPC Subnet
- Enable Network Policy on GKE Clusters
- Enable Subnet Flow Logs
- Enable the Restrict Authorized Networks on Cloud SQL Instances Organization Policy Constraint
- Enable VPC Flow Logs for Compute Engine Instances
- Enforce Deny All Egress Firewall Rule
- Enforce Public Access Prevention
- Prevent IP Forwarding on Compute Engine Instances
- Restrict Default Network Creation for Compute Engine Instances
- Restrict Public Access to Cloud SQL Database Instances
- Terminate Network Connections
- Use Custom VPC Networks
pci-dss-v4-1-2-6
針對所有使用中且被視為不安全的服務、通訊協定和通訊埠，都必須定義及實作安全防護功能，以降低風險。
- Block Connections to Cassandra Ports from All IP Addresses
- Block Connections to DNS Ports from All IP Addresses
- Block Connections to Elasticsearch Ports from All IP Addresses
- Block Connections to FTP Ports from All IP Addresses
- Block Connections to LDAP Ports from All IP Addresses
- Block Connections to Memcached Ports from All IP Addresses
- Block Connections to MongoDB Ports from All IP Addresses
- Block Connections to MySQL Ports from All IP Addresses
- Block Connections to NetBIOS Ports from All IP Addresses
- Block Connections to Oracle Database Ports from All IP Addresses
- Block Connections to POP3 Server Ports from All IP Addresses
- Block Connections to PostgreSQL Server Ports from All IP Addresses
- Block Connections to Redis Server Ports from All IP Addresses
- Block Connections to SMTP Server Ports from All IP Addresses
- Block Generic Access to CiscoSecure/WebSM Ports
- Block Generic Access to Directory Service Ports
- Block Generic Access to HTTP Ports
- Block Generic Access to RDP Ports
- Block Generic Access to SSH Ports
- Block Generic Access to Telnet Servers
- Block Overly Permissive Firewall Rules
- Block Public IP Addresses for Cloud SQL Instances
- Don't Use Legacy Networks
- Enable DNSSEC for Cloud DNS
- Enforce Deny All Egress Firewall Rule
- Enforce HTTPS Traffic Only
- Enforce Public Access Prevention
- Restrict Insecure SSL Policies for Compute Engine Instances
- Restrict Public Access to Cloud SQL Database Instances
- Restrict Public IP Addresses to Compute Engine Instances
- Use Custom VPC Networks
pci-dss-v4-1-3-1
傳入 CDE 的流量必須僅限於必要流量，並明確拒絕其他所有流量。
- Block Connections to Cassandra Ports from All IP Addresses
- Block Connections to DNS Ports from All IP Addresses
- Block Connections to Elasticsearch Ports from All IP Addresses
- Block Connections to FTP Ports from All IP Addresses
- Block Connections to LDAP Ports from All IP Addresses
- Block Connections to Memcached Ports from All IP Addresses
- Block Connections to MongoDB Ports from All IP Addresses
- Block Connections to MySQL Ports from All IP Addresses
- Block Connections to NetBIOS Ports from All IP Addresses
- Block Connections to Oracle Database Ports from All IP Addresses
- Block Connections to POP3 Server Ports from All IP Addresses
- Block Connections to PostgreSQL Server Ports from All IP Addresses
- Block Connections to Redis Server Ports from All IP Addresses
- Block Connections to SMTP Server Ports from All IP Addresses
- Block External IP Address Access on Compute Engine VM Instances
- Block Generic Access to CiscoSecure/WebSM Ports
- Block Generic Access to Directory Service Ports
- Block Generic Access to HTTP Ports
- Block Generic Access to Telnet Servers
- Block Overly Permissive Firewall Rules
- Block Public IP Addresses for AlloyDB Cluster Instances
- Block Public IP Addresses for Cloud SQL Instances
- Configure Access Controls for the Network Boundary
- Configure the Allowed Ingress Settings for Cloud Run Organization Policy Constraint
- Define a Security Policy to Mitigate for DDoS Events
- Enable Control Plane Authorized Networks on GKE Clusters
- Enable Network Policy on GKE Clusters
- Enable Private Clusters for GKE
- Enforce Public Access Prevention
- Restrict Public Access to Cloud SQL Database Instances
- Restrict Public IP Addresses on Vertex AI Workbench Notebooks and Instances
- Restrict Public IP Addresses to Compute Engine Instances
pci-dss-v4-1-3-2
CDE 的輸出流量必須僅限於必要流量，並明確拒絕其他所有流量。
- Block Generic Access to RDP Ports
- Block Generic Access to SSH Ports
- Configure Access Controls for the Network Boundary
- Configure the Allowed VPC Egress Settings for Cloud Run Organization Policy Constraint
- Define VPC Connector Egress For Cloud Run Functions
- Enable Network Policy on GKE Clusters
- Enable Private Clusters for GKE
- Enable Private Google Access for VPC Subnets
- Enable Private Google Access on an instance
- Enforce Deny All Egress Firewall Rule
pci-dss-v4-1-4-1
NSC 會在受信任和不受信任的網路之間實作。
- Block Connections to Cassandra Ports from All IP Addresses
- Block Connections to DNS Ports from All IP Addresses
- Block Connections to Elasticsearch Ports from All IP Addresses
- Block Connections to FTP Ports from All IP Addresses
- Block Connections to LDAP Ports from All IP Addresses
- Block Connections to Memcached Ports from All IP Addresses
- Block Connections to MongoDB Ports from All IP Addresses
- Block Connections to MySQL Ports from All IP Addresses
- Block Connections to NetBIOS Ports from All IP Addresses
- Block Connections to Oracle Database Ports from All IP Addresses
- Block Connections to POP3 Server Ports from All IP Addresses
- Block Connections to PostgreSQL Server Ports from All IP Addresses
- Block Connections to Redis Server Ports from All IP Addresses
- Block Connections to SMTP Server Ports from All IP Addresses
- Block External IP Address Access on Compute Engine VM Instances
- Block Generic Access to CiscoSecure/WebSM Ports
- Block Generic Access to Directory Service Ports
- Block Generic Access to HTTP Ports
- Block Generic Access to RDP Ports
- Block Generic Access to SSH Ports
- Block Generic Access to Telnet Servers
- Block Overly Permissive Firewall Rules
- Configure Access Controls for the Network Boundary
- Configure the Allowed Ingress Settings for Cloud Run Organization Policy Constraint
- Configure the Allowed VPC Egress Settings for Cloud Run Organization Policy Constraint
- Configure the Disable VPC External IPv6 Usage Organization Policy
- Define a Security Policy to Mitigate for DDoS Events
- Define VPC Connector Egress For Cloud Run Functions
- Enable Control Plane Authorized Networks on GKE Clusters
- Enable Private Clusters for GKE
- Enable Private Google Access for VPC Subnets
- Enable Private Google Access on an instance
- Enable the Restrict Authorized Networks on Cloud SQL Instances Organization Policy Constraint
- Enforce Deny All Egress Firewall Rule
- Enforce HTTPS Traffic Only
- Prevent IP Forwarding on Compute Engine Instances
pci-dss-v4-1-4-2
從不受信任網路到受信任網路的連入流量，必須限制為以下項目：與授權提供可公開存取服務、通訊協定和通訊埠的系統元件通訊；對受信任網路中系統元件啟動的通訊進行有狀態的回應；以及拒絕所有其他流量。
- Define a Security Policy to Mitigate for DDoS Events
- Enable Control Plane Authorized Networks on GKE Clusters
- Use Custom VPC Networks
pci-dss-v4-1-4-3
必須實施反假冒措施，以偵測並阻止來源 IP 位址經過假冒的流量進入信任的網路。
pci-dss-v4-1-4-4
儲存持卡人資料的系統元件不得直接從不受信任的網路存取。
- Block Public IP Addresses for AlloyDB Cluster Instances
- Block Public IP Addresses for Cloud SQL Instances
- Enable Private Clusters for GKE
- Restrict Public Access to BigQuery Datasets
- Restrict Public Access to Cloud SQL Database Instances
- Restrict Public Access to Cloud Storage Buckets
- Restrict Public IP Addresses to Compute Engine Instances
pci-dss-v4-10-1-1
所有在第 10 項要求中列出的安全政策和作業程序，都已記錄在案、維持最新狀態、實際使用，且所有受影響的當事人皆知悉。
pci-dss-v4-10-2-1
所有系統元件和持卡人資料都已啟用稽核記錄，且處於有效狀態。
- Enable Cloud DNS Logs Monitoring
- Enable Log Checkpoints Flag for PostgreSQL
- Enable Log Disconnections Flag for PostgreSQL
- Enable Log Duration Flag for PostgreSQL instance
- Enable Log Error Verbosity Flag for PostgreSQL
- Enable Log Locks Wait Flag for PostgreSQL instance
- Enable Log Min Error Statement Flag for PostgreSQL
- Enable Log Min Messages Flag for PostgreSQL
- Enable Log Temp Files Flag for PostgreSQL instance
- Set Log Error Verbosity Flag for AlloyDB Instances
- Set Log Min Error Statement Flag for AlloyDB Instances
- Set Log Min Messages Flag for AlloyDB Instances
pci-dss-v4-10-2-1-1
稽核記錄會擷取每位使用者存取持卡人資料的所有記錄。
pci-dss-v4-10-2-1-2
稽核記錄會擷取具備管理員存取權的任何使用者所採取的動作，包括應用程式或系統帳戶的任何互動式使用。
pci-dss-v4-10-2-1-4
稽核記錄會擷取所有無效的邏輯存取嘗試。
- Enable Firewall Rule Logging
- Enable Load Balancer Logging
- Enable Log Connections Flag for PostgreSQL
- Enable Subnet Flow Logs
- Enable VPC Flow Logs for Compute Engine Instances
pci-dss-v4-10-3-3
稽核記錄檔 (包括外部技術的記錄檔) 會立即備份到安全的中央內部記錄伺服器，或難以修改的其他媒體。
pci-dss-v4-10-4-1-1
系統會使用自動化機制審查稽核記錄。
- Configure Log Metrics and Alerts for Audit Logging Changes
- Configure Log Metrics and Alerts for Cloud SQL Configuration Changes
- Configure Log Metrics and Alerts for Cloud Storage IAM Policy Changes
- Configure Log Metrics and Alerts for Custom Role Changes
- Configure Log Metrics and Alerts for VPC Network Changes
- Configure Log Metrics and Alerts for VPC Network Firewall Changes
- Configure Log Metrics and Alerts for VPC Route Changes
pci-dss-v4-10-5-1
保留至少 12 個月的稽核記錄，並確保最近三個月的記錄可立即用於分析。
pci-dss-v4-11-5-1
使用入侵偵測和入侵防護技術來偵測和/或防止網路入侵，具體做法如下：監控 CDE 邊界的所有流量；監控 CDE 關鍵點的所有流量；在發生疑似入侵情事時，通知相關人員；將所有入侵偵測和防護引擎、基準和簽名保持在最新狀態。
- Configure Network Traffic Monitoring
- Define a Security Policy to Mitigate for DDoS Events
- Enable Flow Logs for VPC Subnet
- Enable Subnet Flow Logs
- Enable VPC Flow Logs for Compute Engine Instances
- Implement Continuous Network Traffic Monitoring
pci-dss-v4-12-10-5
安全事件應變計畫包括監控及回應安全監控系統的警示，包括但不限於：入侵偵測和入侵防禦系統；網路安全控制；重要檔案的變更偵測機制；付款頁面的變更和竄改偵測機制；偵測未經授權的無線存取點。
- Enable Cloud Logging on GKE Clusters
- Enable Cloud Monitoring on GKE Clusters
- Enable Firewall Rule Logging
- Enable Flow Logs for VPC Subnet
- Enable Intranode Visibility for GKE Clusters
- Enable Log Connections Flag for PostgreSQL
- Enable Log Disconnections Flag for PostgreSQL
- Enable Log Error Verbosity Flag for PostgreSQL
- Enable Log Min Error Statement Flag for PostgreSQL
- Enable Log Min Messages Flag for PostgreSQL
- Enable Log Statement Flag for PostgreSQL
- Implement Continuous Network Traffic Monitoring
- Require Cloud Storage Bucket Logging
pci-dss-v4-12-5-1
維護並更新 PCI DSS 適用範圍內的系統元件清單，包括功能和用途說明。
pci-dss-v4-2-2-1
您必須制定、實作及維護設定標準，確保這些標準涵蓋所有系統元件、解決所有已知的安全漏洞、符合業界認可的系統強化標準或供應商強化建議、在發現新的安全漏洞問題時更新 (如規定 6.3.1 所述)，並在設定新系統時套用，且在系統元件連線至正式環境之前或之後立即驗證是否已套用。
- Block Legacy Authorization on GKE Clusters
- Disable Alpha Features on GKE Clusters
- Disable Legacy Metadata Server Endpoints on Compute Engine
- Don't Use User Connections Flag for SQL Server
- Don't Use User Options Flag for SQL Server
- Enable 3625 Trace Database Flag for SQL Server
- Enable PodSecurityPolicies for GKE Clusters
- Enable Secure Boot for Shielded GKE Nodes
- Enable Secure Boot on Compute Engine Instances
- Require Container-Optimized OS for a GKE Cluster
pci-dss-v4-2-2-3
必須管理需要不同安全等級的主要功能，確保系統元件上只有一個主要功能，或同一系統元件上具有不同安全等級的主要功能彼此隔離，或同一系統元件上具有不同安全等級的主要功能都受到保護，達到安全需求最高的功能所要求的等級。
pci-dss-v4-2-2-4
僅啟用必要的服務、通訊協定、Daemon 和函式，並移除或停用所有不必要的功能。
- Block Serial Ports for Compute Engine Instances
- Block Terminal Access on Vertex AI Workbench Instances
- Configure the Allowed Ingress Settings for Cloud Run Organization Policy Constraint
- Configure the Allowed VPC Egress Settings for Cloud Run Organization Policy Constraint
- Configure the Disable VM Serial Port Logging to Stackdriver Organization Policy
- Disable Alpha Features on GKE Clusters
- Disable File Downloads on Vertex AI Workbench Instances
- Don't Use Kubernetes Web UI
- Restrict Service Usage
- Turn Off Cross Database Ownership Chaining Flag for SQL Server
- Turn Off External Scripts Flag for SQL Server
- Turn Off Local Infile Flag for MySQL
- Turn Off Log Executor Stats Flag for PostgreSQL
- Turn off Log Hostname Flag for PostgreSQL
- Turn off Log Parser Stats Flag for PostgreSQL
- Turn off Log Planner Stats Flag for PostgreSQL
- Turn off Log Statement Stats Flag for PostgreSQL
- Turn Off Remote Access Flag for SQL Server
pci-dss-v4-2-2-5
如有任何不安全的服務、通訊協定或常駐程式，請務必記錄業務理由，並記錄及實作額外的安全功能，以降低使用不安全服務、通訊協定或常駐程式的風險。
- Block Connections to Cassandra Ports from All IP Addresses
- Block Connections to DNS Ports from All IP Addresses
- Block Connections to Elasticsearch Ports from All IP Addresses
- Block Connections to FTP Ports from All IP Addresses
- Block Connections to LDAP Ports from All IP Addresses
- Block Connections to Memcached Ports from All IP Addresses
- Block Connections to MongoDB Ports from All IP Addresses
- Block Connections to MySQL Ports from All IP Addresses
- Block Connections to NetBIOS Ports from All IP Addresses
- Block Connections to Oracle Database Ports from All IP Addresses
- Block Connections to POP3 Server Ports from All IP Addresses
- Block Connections to PostgreSQL Server Ports from All IP Addresses
- Block Connections to Redis Server Ports from All IP Addresses
- Block Connections to SMTP Server Ports from All IP Addresses
- Block Generic Access to CiscoSecure/WebSM Ports
- Block Generic Access to Directory Service Ports
- Block Generic Access to HTTP Ports
- Block Generic Access to Telnet Servers
- Block Overly Permissive Firewall Rules
pci-dss-v4-2-2-6
您必須設定系統安全性參數，才能防止濫用。
- Block Legacy Authorization on GKE Clusters
- Block Root Access on Vertex AI Workbench Instances
- Block Serial Ports for Compute Engine Instances
- Block Terminal Access on Vertex AI Workbench Instances
- Disable File Downloads on Vertex AI Workbench Instances
- Don't Use Kubernetes Web UI
- Enable DNSSEC for Cloud DNS
- Enable Shielded GKE Nodes on a Cluster
- Enable Shielded VM for Compute Engine Instances
- Enable the Confidential VM Organization Policy Constraint
- Prevent Nested Virtualization for Compute Engine VMs
- Require Container-Optimized OS for a GKE Cluster
- Restrict Public IP Addresses on Vertex AI Workbench Notebooks and Instances
- Turn Off Cross Database Ownership Chaining Flag for SQL Server
- Turn Off External Scripts Flag for SQL Server
- Turn Off Local Infile Flag for MySQL
- Turn Off Log Executor Stats Flag for PostgreSQL
- Turn off Log Hostname Flag for PostgreSQL
- Turn Off Log Min Duration Statement Flag for PostgreSQL
- Turn off Log Parser Stats Flag for PostgreSQL
- Turn off Log Planner Stats Flag for PostgreSQL
- Turn off Log Statement Stats Flag for PostgreSQL
- Turn Off Remote Access Flag for SQL Server
pci-dss-v4-2-2-7
所有非控制台的管理存取權都必須使用強效加密技術加密。
- Enable SSL Encryption On AlloyDB Instances
- Enforce HTTPS Traffic Only
- Enforce SSL for all Incoming Database Connections
- Use TLS 1.2 or Higher
pci-dss-v4-3-2-1
實施資料保留和處置政策、程序和流程，盡量減少帳戶資料儲存量，且必須至少包含下列項目：涵蓋所有帳戶資料儲存位置；涵蓋授權完成前儲存的所有敏感性驗證資料 (SAD)；將資料儲存量和保留時間限制在法律或法規和業務需求範圍內；針對儲存的帳戶資料制定具體保留規定，定義保留期限並包含有記錄的業務理由；根據保留政策，在不再需要帳戶資料時，安全刪除或使帳戶資料無法復原的程序；以及至少每三個月驗證一次的程序，確保已安全刪除或使超過定義保留期限的帳戶資料無法復原。
- Define Retention Period for Cloud Storage Buckets
- Define Set Storage Class Lifestyle Action on Bucket
- Define Storage Class Lifestyle Action
pci-dss-v4-3-3-2
授權完成前以電子方式儲存的 SAD 必須使用強效加密技術加密。
- Enable CMEK for AlloyDB Clusters
- Enable CMEK for Cloud Storage Buckets
- Enable CMEK on Compute Engine Persistent Disks
- Enable CSEK On Compute Engine Persistent Disks
- Encrypt Data at Rest with CMEK
- Enforce CMEK
- Enforce CMEK for Supported Services
- Require CMEK on Dataproc Clusters
pci-dss-v4-3-3-3
發卡機構和支援發卡服務並儲存機密驗證資料的公司，必須確保儲存的機密驗證資料僅限於正當發卡業務需求，並使用強效加密技術保護及加密資料。
- Enable CMEK for AlloyDB Clusters
- Enable CMEK for Cloud Storage Buckets
- Enable CMEK on Compute Engine Persistent Disks
- Enable CSEK On Compute Engine Persistent Disks
- Encrypt Data at Rest with CMEK
- Enforce CMEK
- Enforce CMEK for Supported Services
- Require CMEK on Dataproc Clusters
pci-dss-v4-3-5-1
使用以下任何一種方法，讓 PAN 無論儲存在任何位置都無法讀取：根據整個 PAN 的強加密技術產生單向雜湊值；截斷 (不能使用雜湊來替代 PAN 的截斷部分)；如果環境中存在相同 PAN 的雜湊和截斷版本，或相同 PAN 的不同截斷格式，則會採取額外控制措施，確保不同版本無法相互關聯，以重建原始 PAN；索引權杖；以及搭配相關金鑰管理程序和程序的強加密技術。
- Enable CMEK for AlloyDB Clusters
- Enable CMEK for BigQuery Datasets
- Enable CMEK for BigQuery Tables
- Enable CMEK for Cloud SQL Databases
- Enable CMEK for Cloud Storage Buckets
- Enable CMEK on Compute Engine Persistent Disks
- Enable Encryption on GKE Clusters
- Encrypt Data at Rest with CMEK
- Encrypt Pub/Sub topic with CMEK
- Enforce CMEK
- Require CMEK on Dataproc Clusters
pci-dss-v4-3-5-1-3
如果使用磁碟或磁碟分割區層級加密 (而非檔案、資料欄或欄位層級的資料庫加密) 讓 PAN 無法讀取，請確保：邏輯存取權是與原生作業系統驗證和存取控制機制分開獨立管理；解密金鑰不會與使用者帳戶建立關聯；以及允許存取未加密資料的驗證要素 (例如密碼、密語或加密金鑰) 會安全儲存。
pci-dss-v4-3-6-1
必須定義及實施程序，以防用來保護已儲存帳戶資料的加密編譯金鑰遭到洩露和濫用，包括將金鑰存取權限制在必要的最少管理員人數。
pci-dss-v4-3-6-1-2
用來保護儲存帳戶資料的私密金鑰和私密金鑰，必須隨時以至少下列其中一種形式儲存：以至少與資料加密金鑰同等強度的金鑰加密金鑰加密，並與資料加密金鑰分開儲存；儲存在安全密碼編譯裝置 (SCD) 中 (例如硬體安全模組 (HSM) 或 PTS 核准的互動點裝置)；以及至少兩個完整長度的金鑰元件或金鑰共用，且符合業界認可的方法。
pci-dss-v4-3-7-1
必須實施金鑰管理政策和程序，包括產生用於保護儲存帳戶資料的強大加密金鑰。
pci-dss-v4-3-7-2
必須實施金鑰管理政策和程序，包括安全地發布用於保護儲存帳戶資料的加密金鑰。
pci-dss-v4-3-7-3
必須實施金鑰管理政策和程序，包括安全儲存用於保護已儲存帳戶資料的加密金鑰。
pci-dss-v4-3-7-5
必須實施金鑰管理政策和程序，包括在下列情況下，視需要淘汰、更換或銷毀用於保護儲存帳戶資料的金鑰：金鑰已達到定義的密碼週期結束時間；金鑰完整性已減弱 (包括瞭解明文金鑰元件的人員離職，或金鑰元件所屬角色變更)；金鑰疑似或已知遭盜用；淘汰或更換的金鑰不會用於加密作業。
pci-dss-v4-4-2-1
在開放的公開網路上傳輸 PAN 時，必須採用高強度密碼編譯和安全性通訊協定，確保只接受信任的金鑰和憑證；用於在開放的公開網路上傳輸 PAN 時保護資料的憑證有效，且未過期或遭撤銷；使用的通訊協定只支援安全版本或設定，不支援回溯或使用不安全版本、演算法、金鑰大小或實作方式；加密強度適合使用的加密方法。
- Enable SSL Encryption On AlloyDB Instances
- Enforce HTTPS Traffic Only
- Enforce SSL for all Incoming Database Connections
- Ensure Minimum TLS 1.2 Version
- Restrict Insecure SSL Policies for Compute Engine Instances
- Restrict Legacy TLS Versions
- Use TLS 1.2 or Higher
pci-dss-v4-5-2-1
除了根據規定 5.2.3 進行定期評估後，判定不會受到惡意軟體威脅的系統元件外，所有系統元件都必須部署反惡意軟體解決方案。
pci-dss-v4-5-2-2
部署的防惡意軟體解決方案必須偵測所有已知類型的惡意軟體，並移除、封鎖或遏止所有已知類型的惡意軟體。
pci-dss-v4-6-2-3
在發布至正式環境或提供給客戶前，必須先審查專屬和自訂軟體，找出並修正潛在的程式碼安全漏洞，做法如下：程式碼審查可確保程式碼是根據安全程式碼編寫指南開發；程式碼審查可找出現有和新興的軟體安全漏洞；並在發布前實作適當的修正措施。
pci-dss-v4-6-3-1
必須找出並管理安全漏洞，確保：使用業界公認的安全漏洞資訊來源 (包括國際和國家電腦緊急應變小組 (CERT) 的警報) 找出新的安全漏洞；根據業界最佳做法和潛在影響，為漏洞指派風險等級；風險等級至少要找出所有被視為高風險或對環境至關重要的漏洞；涵蓋客製化和第三方軟體 (例如作業系統和資料庫) 的漏洞。
pci-dss-v4-6-3-3
所有系統元件都必須安裝適用的安全修補程式或更新，防範已知安全漏洞，確保：在發布重大安全漏洞的修補程式或更新 (根據規定 6.3.1 的風險等級程序識別) 後一個月內安裝；以及在實體評估環境風險嚴重程度後，於適當時間範圍內安裝所有其他適用的安全修補程式或更新 (根據規定 6.3.1 的風險等級程序識別)。
- Enable Auto Upgrade on GKE Clusters
- Require Auto Upgrade Schedule Set for Vertex AI Workbench
- Require Container-Optimized OS for a GKE Cluster
- Subscribe a GKE Cluster to a Release Channel
pci-dss-v4-6-4-1
對於對外公開的網頁應用程式，必須持續因應新威脅和安全漏洞，並使用下列任一方法防範已知攻擊：使用手動或自動化應用程式安全漏洞安全評估工具或方法，審查對外公開的網頁應用程式，做法如下：至少每 12 個月一次，並在重大變更後進行；由專門處理應用程式安全性的實體進行；至少包含第 6.2.4 節中所有常見的軟體攻擊；所有安全漏洞都依第 6.3.1 節的規定分級；所有安全漏洞都已修正；修正後重新評估應用程式。 或者，安裝自動化技術解決方案，持續偵測及防範網路攻擊，具體做法如下：安裝在面向大眾的網頁應用程式前方，偵測及防範網路攻擊；視情況主動執行並保持最新狀態；產生稽核記錄；設定為封鎖網路攻擊或產生警報，並立即展開調查。
pci-dss-v4-6-4-2
對於對外公開的網頁應用程式，必須部署自動化技術解決方案，持續偵測及防範網路攻擊，並進行下列最低限度的檢查：安裝在對外公開的網頁應用程式前方，並設定為偵測及防範網路攻擊；視情況主動執行及更新；產生稽核記錄；設定為封鎖網路攻擊或產生警報，並立即進行調查。
pci-dss-v4-7-2-1
必須定義存取控管模式，並包含下列存取權授予方式：根據實體的業務和存取需求授予適當的存取權；根據使用者的職位分類和功能授予系統元件和資料資源的存取權；以及執行工作功能所需的最低權限 (例如使用者、管理員)。
pci-dss-v4-7-2-2
必須根據工作分類和職務，以及執行工作責任所需的最低權限，指派使用者 (包括具備權限的使用者) 的存取權。
- Define Vertex AI Access Mode
- Enable Workload Identity Federation for GKE on clusters
- Restrict API Access to Google Cloud APIs for Compute Engine Instances
- Set Uniform Bucket Level Access for Cloud Storage Buckets
pci-dss-v4-7-2-5
所有應用程式和系統帳戶，以及相關存取權，都必須根據系統或應用程式運作所需的最低權限指派及管理，並確保存取權僅限於需要使用的系統、應用程式或程序。
- Block Automatic IAM Grants to Default Service Accounts
- Define Vertex AI Access Mode
- Enable Workload Identity Federation for GKE on clusters
- Restrict API Access to Google Cloud APIs for Compute Engine Instances
- Restrict API Keys for Required APIs Only
- Set Application Restriction on API Keys
- Use Custom Service Accounts for Compute Engine Instances
- Use Least Privilege Service Accounts for GKE Clusters
pci-dss-v4-7-3-1
必須設置存取控管系統，根據使用者的「需要知道」原則限制存取權，並涵蓋所有系統元件。
pci-dss-v4-7-3-2
存取權控管系統必須根據工作分類和職能，強制執行指派給個人、應用程式和系統的權限。
- Block Legacy Authorization on GKE Clusters
- Enable OS Login
- Enable Workload Identity Federation for GKE on clusters
pci-dss-v4-7-3-3
存取控制系統必須預設為拒絕所有存取要求。
pci-dss-v4-8-2-1
必須為所有使用者指派唯一 ID，才能允許他們存取系統元件或持卡人資料。
pci-dss-v4-8-2-3
如果服務供應商可遠端存取客戶端設備，必須為每個客戶端設備使用不重複的驗證因素。
pci-dss-v4-8-2-5
必須立即撤銷已終止使用者的存取權。
pci-dss-v4-8-2-8
如果使用者工作階段閒置超過 15 分鐘，使用者必須重新驗證，才能重新啟用終端機或工作階段。
pci-dss-v4-8-3-1
使用者和管理員存取系統元件時，必須使用至少一種驗證要素進行驗證，包括您知道的資訊 (例如密碼或密語)、您擁有的憑證 (例如符記裝置或智慧型卡片)，以及您的生物特徵辨識要素。
pci-dss-v4-8-3-2
在所有系統元件上傳輸和儲存驗證因素時，必須使用高強度密碼編譯，確保驗證因素無法讀取。
pci-dss-v4-8-3-9
如果密碼或密語是使用者存取的唯一驗證因素 (在任何單一因素驗證實作中)，則必須至少每 90 天變更一次，或動態分析帳戶的安全狀態，並據此自動判斷資源的即時存取權。
pci-dss-v4-8-6-2
凡是可用於互動式登入的應用程式和系統帳戶密碼或密碼片語，都不得以硬式編碼方式寫入指令碼、設定或屬性檔案，或是自訂原始碼。
pci-dss-v4-8-6-3
任何應用程式和系統帳戶的密碼或密語都必須受到保護，以免遭到濫用，方法如下：定期變更密碼或密語 (頻率應根據實體的目標風險分析結果而定，該分析會根據規定 12.3.1 中指定的所有要素進行)，並在懷疑或確認遭到入侵時變更密碼或密語；密碼或密語的複雜程度應足以因應實體變更密碼或密語的頻率。
- Define Secret Manager Rotation Schedule
- Require Rotation of API Key
- Require Service Account Key Rotation
Security Essentials
支援的雲端服務供應商： Google Cloud
Google Cloud 安全性基礎功能為 Google Cloud 客戶提供基礎安全性和法規遵循基準。這個架構以 Google 廣泛的威脅情報和最佳做法為基礎，可讓您瞭解自己的安全防護機制，並從一開始就符合常見的法規遵循要求。
這個架構包含下列雲端控管機制：
- Block Generic Access to CiscoSecure/WebSM Ports
- Block Generic Access to Directory Service Ports
- Block Generic Access to HTTP Ports
- Block Generic Access to RDP Ports
- Block Generic Access to SSH Ports
- Block Generic Access to Telnet Servers
- Block Legacy Authorization on GKE Clusters
- Block Overly Permissive Firewall Rules
- Block Public IP Address for Vertex AI Workbench Instances
- Block Public IP Addresses for AlloyDB Cluster Instances
- Block Public IP Addresses for Cloud SQL Instances
- Block Serial Ports for Compute Engine Instances
- Configure the Allowed Ingress Settings for Cloud Run Organization Policy Constraint
- Configure the Allowed VPC Egress Settings for Cloud Run Organization Policy Constraint
- Configure the Disable VM Serial Port Logging to Stackdriver Organization Policy
- Configure the Disable VPC External IPv6 Usage Organization Policy
- Create GKE Clusters with Limited Privileges
- Don't Use Kubernetes Web UI
- Enable AlloyDB Backups on Cluster
- Enable Automatic Backups for Cloud SQL Databases
- Enable Control Plane Authorized Networks on GKE Clusters
- Enable DNSSEC for Cloud DNS
- Enable Encryption on GKE Clusters
- Enable Flow Logs for VPC Subnet
- Enable OS Login
- Enable OS Login for All Instances at Project Level
- Enable PodSecurityPolicies for GKE Clusters
- Enable Secure Boot on Compute Engine Instances
- Enable Shielded VM for Compute Engine Instances
- Enable the Restrict Authorized Networks on Cloud SQL Instances Organization Policy Constraint
- Enforce SSL for all Incoming Database Connections
- Prevent IP Forwarding on Compute Engine Instances
- Prevent Nested Virtualization for Compute Engine VMs
- Require Container-Optimized OS for a GKE Cluster
- Require Service Account Key Rotation
- Restrict API Access to Google Cloud APIs for Compute Engine Instances
- Restrict Default Network Creation for Compute Engine Instances
- Restrict Insecure SSL Policies for Compute Engine Instances
- Restrict Public Access to Cloud SQL Database Instances
- Restrict Public IP Addresses to Compute Engine Instances
- Restrict User Managed Service Account Keys
- Set Uniform Bucket Level Access for Cloud Storage Buckets
- Use Custom VPC Networks
- Use Latest Image Versions on Dataproc Clusters
SOC2 2017
支援的雲端服務供應商： Google Cloud
獨立稽核人員可使用這項監管架構，評估及報告貴機構與 AICPA 信託服務準則 (例如安全性與可用性) 相關的控管措施。稽核報告會評估貴機構的系統和處理的資料。這個架構符合 SOC 2 2017 (2022 年修訂重點) 標準。
這個架構包含下列章節中的雲端控制群組和雲端控制項。
soc2-2017-a-1-2-11
管理階層會找出可能影響系統和相關資料可用性的資料復原能力威脅 (例如勒索軟體攻擊)，並實施減輕風險的程序。
- Enable AlloyDB Automated Backups on Cluster
- Enable AlloyDB Backups on Cluster
- Enable Automatic Backups for Cloud SQL Databases
- Enable Object Versioning on Buckets
- Require Object Versioning for Cloud Storage Buckets
soc2-2017-a-1-2-8
我們已制定程序來備份資料、監控備份失敗情況，並在發生這類情況時啟動修正措施。
- Enable AlloyDB Automated Backups on Cluster
- Enable AlloyDB Backups on Cluster
- Enable Automatic Backups for Cloud SQL Databases
soc2-2017-c-1-1-2
除非法律或法規另有規定，否則我們只會在必要時保留機密資訊，以達成特定目的。
soc2-2017-c-1-1-3
我們已制定政策和程序，確保機密資訊在指定保留期間內不會遭到清除或毀損。
soc2-2017-c-1-2-2
我們已制定政策和程序，自動或手動清除或銷毀已確定要銷毀的機密資訊。
soc2-2017-cc-1-3-3
管理階層和董事會會視需要，在機構的各個層級委派權責、定義職責，並運用適當的程序和技術指派職責及劃分職務。
- Block Automatic IAM Grants to Default Service Accounts
- Enable Uniform Bucket-Level Access on Cloud Storage Buckets
- Set Uniform Bucket Level Access for Cloud Storage Buckets
- Use Custom Service Accounts for Compute Engine Instances
soc2-2017-cc-2-1-2
資訊系統會擷取內部和外部資料來源。
- Enable Audit Logs for Google Cloud Services
- Enable Cloud Asset Inventory Service
- Enable Cloud DNS Logs Monitoring
- Enable Cloud Logging on GKE Clusters
- Enable Firewall Rule Logging
- Enable Flow Logs for VPC Subnet
- Enable Load Balancer Logging
- Enable Log Checkpoints Flag for PostgreSQL
- Enable Log Connections Flag for PostgreSQL
- Enable Log Disconnections Flag for PostgreSQL
- Enable Log Duration Flag for PostgreSQL instance
- Enable Log Locks Wait Flag for PostgreSQL instance
- Enable Log Min Error Statement Flag for PostgreSQL
- Enable Log Statement Flag for PostgreSQL
- Enable Subnet Flow Logs
- Enable VPC Flow Logs for Compute Engine Instances
- Implement Event Logging for Google Cloud Services
- Require Cloud Storage Bucket Logging
soc2-2017-cc-2-1-6
實體會識別、記錄及維護系統元件的記錄，例如基礎架構、軟體和其他資訊資產。資訊資產包括實體端點裝置和系統、虛擬系統、資料和資料流、外部資訊系統，以及組織角色。
soc2-2017-cc-2-2-1
我們已制定程序，向全體人員傳達必要資訊，協助他們瞭解並履行內部控管責任。
soc2-2017-cc-3-2-5
風險評估包括考量如何管理風險，以及是否要接受、避免、降低或分攤風險。
- Configure the Disable VPC Internal IPv6 Usage Organization Policy
- Define a Security Policy to Mitigate for DDoS Events
soc2-2017-cc-3-2-7
實體會找出系統元件的弱點，包括系統程序、基礎架構、軟體、
soc2-2017-cc-4-1-1
管理包括持續評估和個別評估的平衡。
soc2-2017-cc-4-1-5
持續評估會納入業務程序，並因應情況變化進行調整。
soc2-2017-cc-4-1-8
管理階層會持續進行各種風險和控管評估，判斷內部控管機制是否到位且運作正常。視實體目標而定，這類風險和控制評估可能包括第一線和第二線的監控與控制測試、內部稽核評估、法規遵循評估、復原能力評估、安全漏洞掃描、安全性評估、滲透測試和第三方評估。
soc2-2017-cc-4-2-2
我們會視情況將缺失事項告知負責採取矯正措施的當事人、高階管理人員和董事會。
- Configure Log Metrics and Alerts for Audit Logging Changes
- Configure Log Metrics and Alerts for Cloud SQL Configuration Changes
- Configure Log Metrics and Alerts for Cloud Storage IAM Policy Changes
- Configure Log Metrics and Alerts for Custom Role Changes
- Configure Log Metrics and Alerts for VPC Network Changes
- Configure Log Metrics and Alerts for VPC Network Firewall Changes
- Configure Log Metrics and Alerts for VPC Route Changes
soc2-2017-cc-5-2-2
管理階層會選擇並開發技術基礎架構的控管活動，這些活動的設計和實作目的，是為了確保技術處理的完整性、準確性和可用性。
- Enable Auto Repair for GKE Clusters
- Enable Automatic Backups for Cloud SQL Databases
- Enforce HTTPS Traffic Only
- Enforce SSL for all Incoming Database Connections
- Restrict Legacy TLS Versions
soc2-2017-cc-5-2-3
管理階層會選取並制定控制活動，以限制授權使用者的技術存取權，確保其權限與工作職責相符，並保護實體的資產免於外部威脅。
soc2-2017-cc-5-3-1
管理階層會透過政策建立控管活動，並將這些活動納入業務程序和員工的日常活動，藉此確立預期目標，並透過相關程序指定行動。
soc2-2017-cc-6-1-10
如果實體認為適當，會根據風險減緩策略，使用加密技術保護靜態、處理中或傳輸中的資料。
- Enable CMEK for AlloyDB Clusters
- Enable CMEK for BigQuery Datasets
- Enable CMEK for BigQuery Tables
- Enable CMEK for Cloud SQL Databases
- Enable CMEK for Cloud Storage Buckets
- Enable CMEK on Compute Engine Persistent Disks
- Enable CMEK on GKE Node Pool Boot Disks
- Enable Confidential Computing for Compute Engine Instances
- Enable CSEK On Compute Engine Persistent Disks
- Enable Encryption on GKE Clusters
- Enable SSL Encryption On AlloyDB Instances
- Enable the Confidential VM Organization Policy Constraint
- Encrypt Data at Rest with CMEK
- Encrypt Pub/Sub topic with CMEK
- Enforce CMEK
- Enforce CMEK for Supported Services
- Enforce HTTPS Traffic Only
- Enforce SSL for all Incoming Database Connections
- Ensure Minimum TLS 1.2 Version
- Require CMEK on Dataproc Clusters
- Restrict Insecure SSL Policies for Compute Engine Instances
- Restrict Non CMEK Services
- Use TLS 1.2 or Higher
soc2-2017-cc-6-1-11
實體會在產生、儲存、使用及銷毀加密編譯金鑰時提供保護。密碼編譯模組、演算法、金鑰長度和架構符合實體的風險減緩策略。
- Avoid RSASHA1 for DNSSEC Signing
- Create and Manage Asymmetric Keys
- Define Cloud KMS Crypto Keys Protection Level
- Define Cloud KMS Crypto Keys Purpose
- Define Secret Manager Rotation Schedule
- Enable CMEK for AlloyDB Clusters
- Enable CMEK for BigQuery Datasets
- Enable CMEK for BigQuery Tables
- Enable CMEK for Cloud SQL Databases
- Enable CMEK for Cloud Storage Buckets
- Enable CMEK on Compute Engine Persistent Disks
- Enable CMEK on GKE Node Pool Boot Disks
- Enable CSEK On Compute Engine Persistent Disks
- Enable Encryption on GKE Clusters
- Encrypt Pub/Sub topic with CMEK
- Enforce CMEK
- Require CMEK on Dataproc Clusters
- Require Service Account Key Rotation
- Verify Cloud KMS Key Version Algorithm
soc2-2017-cc-6-1-12
機密資訊的邏輯存取權和使用權僅限於特定用途。
soc2-2017-cc-6-1-3
實體會限制資訊資產的邏輯存取權，包括：基礎架構 (例如伺服器、儲存空間、網路元素、API 和端點裝置)、軟體，以及靜態、處理中或傳輸中的資料，方法是使用存取權控制軟體、規則集和標準設定強化程序。
- Block Automatic IAM Grants to Default Service Accounts
- Block Connections to Cassandra Ports from All IP Addresses
- Block Connections to DNS Ports from All IP Addresses
- Block Connections to Elasticsearch Ports from All IP Addresses
- Block Connections to FTP Ports from All IP Addresses
- Block Connections to LDAP Ports from All IP Addresses
- Block Connections to Memcached Ports from All IP Addresses
- Block Connections to MongoDB Ports from All IP Addresses
- Block Connections to MySQL Ports from All IP Addresses
- Block Connections to NetBIOS Ports from All IP Addresses
- Block Connections to Oracle Database Ports from All IP Addresses
- Block Connections to POP3 Server Ports from All IP Addresses
- Block Connections to PostgreSQL Server Ports from All IP Addresses
- Block Connections to Redis Server Ports from All IP Addresses
- Block Connections to SMTP Server Ports from All IP Addresses
- Block External IP Address Access on Compute Engine VM Instances
- Block Generic Access to CiscoSecure/WebSM Ports
- Block Generic Access to Directory Service Ports
- Block Generic Access to HTTP Ports
- Block Generic Access to Telnet Servers
- Block Overly Permissive Firewall Rules
- Block Project-Wide SSH Keys on Compute Engine Instances
- Block Root Access on Vertex AI Workbench Instances
- Block Service Account Key Creation
- Block Terminal Access on Vertex AI Workbench Instances
- Configure Remote Access Inactivity Timeout
- Define Vertex AI Access Mode
- Define VPC Connector Egress For Cloud Run Functions
- Disable Legacy Metadata Server Endpoints on Compute Engine
- Enable Confidential Computing for Compute Engine Instances
- Enable Control Plane Authorized Networks on GKE Clusters
- Enable CSEK On Compute Engine Persistent Disks
- Enable Network Policy on GKE Clusters
- Enable the Restrict Authorized Networks on Cloud SQL Instances Organization Policy Constraint
- Enable Uniform Bucket-Level Access on Cloud Storage Buckets
- Enforce Compute Session Inactive Policy
- Enforce Public Access Prevention
- Restrict Public Access to BigQuery Datasets
- Restrict Public Access to Cloud SQL Database Instances
- Restrict Public Access to Cloud Storage Buckets
- Set Application Restriction on API Keys
- Set Uniform Bucket Level Access for Cloud Storage Buckets
- Terminate Network Connections
soc2-2017-cc-6-1-4
實體會先識別及驗證人員、基礎架構和軟體，再允許存取資訊資產 (無論是本機或遠端)。如果實體認為這類保護措施適合其風險減輕策略，就會採用更複雜或進階的使用者驗證技術，例如多重驗證。
soc2-2017-cc-6-1-5
實體會根據風險降低策略，使用網路區隔、零信任架構和其他技術，將實體資訊技術中不相關的部分彼此隔離。
- Block Public IP Addresses for AlloyDB Cluster Instances
- Configure Network Traffic Monitoring
- Enable Network Policy on GKE Clusters
- Enable Private Clusters for GKE
- Enable Private Google Access for VPC Subnets
- Enable Private Google Access on an instance
- Prevent IP Forwarding on Compute Engine Instances
soc2-2017-cc-6-1-7
我們結合資料分類、獨立資料結構、連接埠限制、存取通訊協定限制、使用者識別和數位憑證，為資訊資產建立存取權控管規則和設定標準。
- Block Automatic IAM Grants to Default Service Accounts
- Block Connections to Cassandra Ports from All IP Addresses
- Block Connections to DNS Ports from All IP Addresses
- Block Connections to Elasticsearch Ports from All IP Addresses
- Block Connections to FTP Ports from All IP Addresses
- Block Connections to LDAP Ports from All IP Addresses
- Block Connections to Memcached Ports from All IP Addresses
- Block Connections to MongoDB Ports from All IP Addresses
- Block Connections to MySQL Ports from All IP Addresses
- Block Connections to NetBIOS Ports from All IP Addresses
- Block Connections to Oracle Database Ports from All IP Addresses
- Block Connections to POP3 Server Ports from All IP Addresses
- Block Connections to PostgreSQL Server Ports from All IP Addresses
- Block Connections to Redis Server Ports from All IP Addresses
- Block Connections to SMTP Server Ports from All IP Addresses
- Block Generic Access to CiscoSecure/WebSM Ports
- Block Generic Access to Directory Service Ports
- Block Generic Access to HTTP Ports
- Block Generic Access to RDP Ports
- Block Generic Access to SSH Ports
- Block Generic Access to Telnet Servers
- Block Overly Permissive Firewall Rules
- Block Project-Wide SSH Keys on Compute Engine Instances
- Block Root Access on Vertex AI Workbench Instances
- Block Terminal Access on Vertex AI Workbench Instances
- Configure Remote Access Inactivity Timeout
- Configure the Allowed Ingress Settings for Cloud Run Organization Policy Constraint
- Configure the Allowed VPC Egress Settings for Cloud Run Organization Policy Constraint
- Define Vertex AI Access Mode
- Enable Control Plane Authorized Networks on GKE Clusters
- Enable the Restrict Authorized Networks on Cloud SQL Instances Organization Policy Constraint
- Enable Uniform Bucket-Level Access on Cloud Storage Buckets
- Enforce Public Access Prevention
- Restrict Public Access to BigQuery Datasets
- Restrict Public Access to Cloud SQL Database Instances
- Restrict Public Access to Cloud Storage Buckets
- Set Uniform Bucket Level Access for Cloud Storage Buckets
- Terminate Network Connections
- Use Custom VPC Networks
- Use Least Privilege Service Accounts for GKE Clusters
soc2-2017-cc-6-1-9
在取得存取憑證並於網路或存取點上實作之前，新的內部和外部基礎架構與軟體都會經過註冊、授權和記錄。不再需要存取權，或不再使用基礎架構和軟體時，系統會移除憑證並停用存取權。
- Enable OS Login
- Enable OS Login for All Instances at Project Level
- Require OS Login on Compute Engine Instances
- Require Rotation of API Key
- Require Service Account Key Rotation
- Restrict User Managed Service Account Keys
soc2-2017-cc-6-2-3
如果存取憑證失效，系統會停用、銷毀或以其他方式防止使用。
soc2-2017-cc-6-3-2
如果不再需要受保護的資訊資產，系統會移除存取權。
soc2-2017-cc-6-3-3
實體會使用存取權控管結構 (例如角色型存取權控管)，限制受保護資訊資產的存取權、限制權限，並支援不相容功能的隔離。
- Block Legacy Authorization on GKE Clusters
- Block Root Access on Vertex AI Workbench Instances
- Create GKE Clusters with Limited Privileges
- Define Vertex AI Access Mode
- Enable 3625 Trace Database Flag for SQL Server
- Enable OS Login
- Enable Skip Show Database Flag for MySQL
- Restrict API Access to Google Cloud APIs for Compute Engine Instances
- Restrict API Keys for Required APIs Only
- Set Application Restriction on API Keys
- Use Custom Service Accounts for Compute Engine Instances
- Use Least Privilege Service Accounts for GKE Clusters
soc2-2017-cc-6-5-1
當實體、供應商和員工擁有的實體資產和其他裝置不再需要資料和軟體，或實體不再控管資產時，我們已制定程序，可從這些資產和裝置中移除、刪除資料和軟體，或讓資料和軟體無法存取。
soc2-2017-cc-6-6
實體會實施邏輯存取安全措施，防範系統邊界外的來源所造成的威脅。
- Block Public IP Addresses for AlloyDB Cluster Instances
- Block Serial Ports for Compute Engine Instances
- Enable DNSSEC for Cloud DNS
- Enforce Public Access Prevention
- Restrict Public Access to BigQuery Datasets
- Restrict Public Access to Cloud SQL Database Instances
- Restrict Public Access to Cloud Storage Buckets
- Restrict Public IP Addresses to Compute Engine Instances
soc2-2017-cc-6-6-1
透過通訊管道 (例如 FTP 網站、路由器連接埠) 進行的活動類型受到限制。
- Block Connections to Cassandra Ports from All IP Addresses
- Block Connections to DNS Ports from All IP Addresses
- Block Connections to Elasticsearch Ports from All IP Addresses
- Block Connections to FTP Ports from All IP Addresses
- Block Connections to LDAP Ports from All IP Addresses
- Block Connections to Memcached Ports from All IP Addresses
- Block Connections to MongoDB Ports from All IP Addresses
- Block Connections to MySQL Ports from All IP Addresses
- Block Connections to NetBIOS Ports from All IP Addresses
- Block Connections to Oracle Database Ports from All IP Addresses
- Block Connections to POP3 Server Ports from All IP Addresses
- Block Connections to PostgreSQL Server Ports from All IP Addresses
- Block Connections to Redis Server Ports from All IP Addresses
- Block Connections to SMTP Server Ports from All IP Addresses
- Block External IP Address Access on Compute Engine VM Instances
- Block Generic Access to CiscoSecure/WebSM Ports
- Block Generic Access to Directory Service Ports
- Block Generic Access to HTTP Ports
- Block Generic Access to RDP Ports
- Block Generic Access to SSH Ports
- Block Generic Access to Telnet Servers
- Block Overly Permissive Firewall Rules
- Configure Access Controls for the Network Boundary
- Configure the Allowed Ingress Settings for Cloud Run Organization Policy Constraint
- Configure the Allowed VPC Egress Settings for Cloud Run Organization Policy Constraint
- Define VPC Connector Egress For Cloud Run Functions
- Enable Control Plane Authorized Networks on GKE Clusters
- Enable Private Clusters for GKE
- Enable the Restrict Authorized Networks on Cloud SQL Instances Organization Policy Constraint
soc2-2017-cc-6-6-4
設定、實作及維護邊界防護系統 (例如防火牆、非軍事區、入侵偵測或防範系統，以及端點偵測與應變系統)，保護外部存取點。
- Block Connections to Cassandra Ports from All IP Addresses
- Block Connections to DNS Ports from All IP Addresses
- Block Connections to Elasticsearch Ports from All IP Addresses
- Block Connections to FTP Ports from All IP Addresses
- Block Connections to LDAP Ports from All IP Addresses
- Block Connections to Memcached Ports from All IP Addresses
- Block Connections to MongoDB Ports from All IP Addresses
- Block Connections to MySQL Ports from All IP Addresses
- Block Connections to NetBIOS Ports from All IP Addresses
- Block Connections to Oracle Database Ports from All IP Addresses
- Block Connections to POP3 Server Ports from All IP Addresses
- Block Connections to PostgreSQL Server Ports from All IP Addresses
- Block Connections to Redis Server Ports from All IP Addresses
- Block Connections to SMTP Server Ports from All IP Addresses
- Block External IP Address Access on Compute Engine VM Instances
- Block Generic Access to CiscoSecure/WebSM Ports
- Block Generic Access to Directory Service Ports
- Block Generic Access to HTTP Ports
- Block Generic Access to RDP Ports
- Block Generic Access to SSH Ports
- Block Generic Access to Telnet Servers
- Block Overly Permissive Firewall Rules
- Block Public IP Addresses for Cloud SQL Instances
- Configure Access Controls for the Network Boundary
- Configure the Allowed Ingress Settings for Cloud Run Organization Policy Constraint
- Configure the Allowed VPC Egress Settings for Cloud Run Organization Policy Constraint
- Configure the Disable VPC External IPv6 Usage Organization Policy
- Define a Security Policy to Mitigate for DDoS Events
- Define VPC Connector Egress For Cloud Run Functions
- Enable Network Policy on GKE Clusters
- Enable the Restrict Authorized Networks on Cloud SQL Instances Organization Policy Constraint
- Enforce Deny All Egress Firewall Rule
- Restrict Default Network Creation for Compute Engine Instances
- Restrict Public IP Addresses on Vertex AI Workbench Notebooks and Instances
- Use Custom VPC Networks
soc2-2017-cc-6-7-1
我們使用資料遺失防護程序和技術，限制授權和執行資訊傳輸、移動及移除作業的能力。
soc2-2017-cc-6-7-2
加密技術或安全通訊管道可用於保護資料傳輸，以及連線存取點以外的其他通訊。
- Enable SSL Encryption On AlloyDB Instances
- Enforce HTTPS Traffic Only
- Enforce SSL for all Incoming Database Connections
- Ensure Minimum TLS 1.2 Version
- Restrict Insecure SSL Policies for Compute Engine Instances
- Restrict Legacy TLS Versions
- Use TLS 1.2 or Higher
soc2-2017-cc-6-8-1
只有授權人員可以安裝及修改應用程式和軟體。只有授權人員可以使用可規避正常作業或安全程序的公用程式軟體，且這類軟體會定期受到監控。
soc2-2017-cc-6-8-2
我們已制定相關程序，可偵測軟體和設定參數的變更，這些變更可能表示有未經授權或惡意的軟體。
- Enable Integrity Monitoring on GKE Clusters
- Enable Secure Boot for Shielded GKE Nodes
- Enable Secure Boot on Compute Engine Instances
soc2-2017-cc-7-1-1
實體已定義用於強化系統的設定標準。
- Block Serial Ports for Compute Engine Instances
- Disable Legacy Metadata Server Endpoints on Compute Engine
- Don't Use Kubernetes Web UI
- Don't Use Legacy Networks
- Don't Use User Connections Flag for SQL Server
- Don't Use User Options Flag for SQL Server
- Enable Log Error Verbosity Flag for PostgreSQL
- Enable Log Min Error Statement Flag for PostgreSQL
- Enable Log Min Messages Flag for PostgreSQL
- Enable PodSecurityPolicies for GKE Clusters
- Enable Secure Boot for Shielded GKE Nodes
- Enable Shielded GKE Nodes on a Cluster
- Enable Shielded VM for Compute Engine Instances
- Ensure Minimum TLS 1.2 Version
- Prevent Nested Virtualization for Compute Engine VMs
- Require Binary Authorization on a Cluster
- Require Container-Optimized OS for a GKE Cluster
- Require OS Login on Compute Engine Instances
- Restrict Default Network Creation for Compute Engine Instances
- Restrict Insecure SSL Policies for Compute Engine Instances
- Restrict Legacy TLS Versions
- Set Log Error Verbosity Flag for AlloyDB Instances
- Set Log Min Error Statement Flag for AlloyDB Instances
- Set Log Min Messages Flag for AlloyDB Instances
- Turn Off Contained Database Authentication Flag for SQL Server
- Turn Off Cross Database Ownership Chaining Flag for SQL Server
- Turn Off External Scripts Flag for SQL Server
- Turn Off Local Infile Flag for MySQL
- Turn Off Log Executor Stats Flag for PostgreSQL
- Turn off Log Hostname Flag for PostgreSQL
- Turn Off Log Min Duration Statement Flag for PostgreSQL
- Turn off Log Parser Stats Flag for PostgreSQL
- Turn off Log Planner Stats Flag for PostgreSQL
- Turn off Log Statement Stats Flag for PostgreSQL
- Turn Off Remote Access Flag for SQL Server
soc2-2017-cc-7-1-3
IT 系統包含變更偵測機制 (例如檔案完整性監控工具)，可提醒人員注意重要系統檔案、設定檔或內容檔案的未經授權修改。
- Configure Log Metrics and Alerts for Audit Logging Changes
- Configure Log Metrics and Alerts for Cloud SQL Configuration Changes
- Configure Log Metrics and Alerts for Cloud Storage IAM Policy Changes
- Configure Log Metrics and Alerts for Custom Role Changes
- Configure Log Metrics and Alerts for VPC Network Changes
- Configure Log Metrics and Alerts for VPC Network Firewall Changes
- Configure Log Metrics and Alerts for VPC Route Changes
soc2-2017-cc-7-1-5
實體會定期進行基礎架構和軟體安全漏洞掃描，以及在環境發生重大變更後進行掃描，以找出潛在的安全漏洞或設定錯誤。及時採取行動，補救已發現的缺失，以利達成實體目標。
soc2-2017-cc-7-2-1
基礎架構和軟體會定義及實作偵測政策、程序和工具，以找出潛在入侵、不當存取，以及系統運作或異常活動中的異常情況。程序可能包括：定義安全事件偵測和管理機制、使用情報來源找出新發現的威脅和安全漏洞，以及記錄異常系統活動。
- Configure Log Metrics and Alerts for Audit Logging Changes
- Configure Log Metrics and Alerts for Cloud SQL Configuration Changes
- Configure Log Metrics and Alerts for Cloud Storage IAM Policy Changes
- Configure Log Metrics and Alerts for Custom Role Changes
- Configure Log Metrics and Alerts for VPC Network Changes
- Configure Log Metrics and Alerts for VPC Network Firewall Changes
- Configure Log Metrics and Alerts for VPC Route Changes
- Configure Network Traffic Monitoring
- Configure Security Logging Policies for Google Cloud Services
- Enable Audit Logs for Google Cloud Services
- Enable Cloud DNS Logs Monitoring
- Enable Cloud Logging on GKE Clusters
- Enable Cloud Monitoring on GKE Clusters
- Enable Firewall Rule Logging
- Enable Flow Logs for VPC Subnet
- Enable Intranode Visibility for GKE Clusters
- Enable Load Balancer Logging
- Enable Log Locks Wait Flag for PostgreSQL instance
- Enable Subnet Flow Logs
- Enable VPC Flow Logs for Compute Engine Instances
- Implement Continuous Network Traffic Monitoring
- Implement Event Logging for Google Cloud Services
- Require Cloud Storage Bucket Logging
soc2-2017-cc-7-2-2
偵測措施旨在找出異常情況，這些情況可能是因為實體障礙遭到實際或企圖破壞、授權人員未經授權的行為、使用遭盜用的身分識別和驗證憑證、從系統邊界外未經授權的存取行為、授權外部人員遭到入侵，以及實作或連線未經授權的硬體和軟體。
- Enable Subnet Flow Logs
- Enable VPC Flow Logs for Compute Engine Instances
- Implement Continuous Network Traffic Monitoring
soc2-2017-cc-7-3-2
偵測到的安全事件會通知負責管理安全計畫的人員，並由他們審查，必要時採取行動。
soc2-2017-cc-8-1-1
在系統及其元件 (基礎架構、資料、軟體，以及手動和自動程序) 的整個生命週期中，管理系統變更的程序用於支援達成實體目標。
soc2-2017-cc-8-1-14
我們已建立相關流程，可及時識別、評估、測試、核准及實作基礎架構和軟體的修補程式。
- Enable Auto Upgrade on GKE Clusters
- Require Auto Upgrade Schedule Set for Vertex AI Workbench
- Require Container-Optimized OS for a GKE Cluster
- Subscribe a GKE Cluster to a Release Channel
- Use Latest Image Versions on Dataproc Clusters
soc2-2017-cc-8-1-5
我們已制定程序，在實作前追蹤系統變更。
soc2-2017-p-4-2-1
除非法律或法規另有規定，否則我們只會在達成上述目的的必要時間內保留個人資訊。
soc2-2017-p-4-2-2
我們已實施相關政策和程序，確保個人資訊在指定保留期間內不會遭到刪除或毀損。
soc2-2017-pi-1-2-3
系統輸入活動記錄會及時建立並維護，確保完整性和準確性。
soc2-2017-pi-1-3-4
系統會及時完整且準確地記錄處理活動。
- Configure Security Logging Policies for Google Cloud Services
- Enable Audit Logs for Google Cloud Services
- Enable Flow Logs for VPC Subnet
- Enable Load Balancer Logging
- Enable Log Checkpoints Flag for PostgreSQL
- Enable Log Connections Flag for PostgreSQL
- Enable Log Disconnections Flag for PostgreSQL
- Enable Log Duration Flag for PostgreSQL instance
- Enable Log Error Verbosity Flag for PostgreSQL
- Enable Log Min Messages Flag for PostgreSQL
- Enable Log Statement Flag for PostgreSQL
- Enable Log Temp Files Flag for PostgreSQL instance
- Enable Subnet Flow Logs
- Enable VPC Flow Logs for Compute Engine Instances
- Implement Event Logging for Google Cloud Services
- Require Cloud Storage Bucket Logging
- Set Log Error Verbosity Flag for AlloyDB Instances
- Set Log Min Error Statement Flag for AlloyDB Instances
- Set Log Min Messages Flag for AlloyDB Instances
soc2-2017-pi-1-5
實體會根據系統規格，實施政策和程序，以完整、準確且及時的方式儲存輸入內容、處理中的項目和輸出內容，達成實體的目標。
soc2-2017-pi-1-5-1
儲存的項目會受到保護，避免遭竊、損毀、毀壞或變質，導致輸出內容無法符合規格。
soc2-2017-pi-1-5-2
系統記錄會封存，且封存內容受到保護，可防止遭竊、損毀、破壞或劣化，確保可供使用。