Compliance Updates:

New Rules:

• D9.GCP.NET.06  - Unused firewall rules
• D9.GCP.NET.07  - Global Firewall rule that allows all traffic
• D9.GCP.CRY.01  - Ensure VM disks are encrypted with Customer-Supplied Encryption Keys (CSEK)
• D9.AWS.IAM.17.HIPAA  - Ensure MFA is enabled for the 'root' account
• D9.GCP.NET.08  - Disable IP forwarding while creating instances
• D9.AWS.CRY.19 - ECS Cluster At-Rest Encryption
• D9.AWS.NET.31 - ECS Cluster should not have services without running tasks
• D9.AWS.NET.33 - ECS Cluster should not have running container instances with unconnected agents
• D9.AWS.NET.34 - Ensure that at least one instance is registered with an ECS Cluster

Deleted Rules:

• D9.AZU.CRY.01 - Ensure that 'SQL Encryption' is set to 'On'
• D9.AZU.MON.01 - Ensure that 'SQL auditing & Threat detection' is set to 'On'
• D9.AWS.IAM.17 - Ensure VIRTUAL MFA is enabled for the "root" account
• D9.AWS.NET.22 - Process for Security Group Management - Detection of new Security Groups

Changes To Existing Rules  - Click Here

BUG FIXES

• DFT-289 Rename rule in GCP bundle
• DFT-287 Remove Duplicate Azure Rule "Ensure that 'SQL auditing & Threat detection' is set to 'On' 
• DFT-286 Remove Duplicate Azure RuleSQLDB should not have encryption.status='Disabled'
• DFT-290 - D9.AZU.MON.04 GSL Update to SQLDB should have threatDetection.state='Enabled'
• DFT-296 Rule Update - New rule added for HIPAA bundle only: IamUser where name like '%root_account%' should have mfaType='Hardware' or mfaType='Virtual'
• DFT-299 CIS Foundations 1.1.0 Rule "D9.AWS.MON.07" logic update

For more information please click here

PREVIEW

Compliance Updates:

New Bundles:

• AWS ISO 27001:2013 Automated Validation of ISO 27001:2013 Requirements for AWS
• Azure ISO 27001:2013 Automated Validation of ISO 27001:2013 Requirements for Azure
• GCP ISO 27001:2013 Automated Validation of ISO 27001:2013 Requirements for GCP

New Rules:

• D9.AWS.LOG.13 - ELB is created with Access logs enabled
• D9.AWS.NET.30 - ECS Cluster should have active services
• D9.AWS.NET.31 - ECS Cluster should not have services without running tasks
• D9.AWS.NET.32 - ECS Cluster instances must be placed in a VPC
• D9.AWS.NET.33 - ECS Cluster should not have running container instances with unconnected agents
• D9.AWS.CRY.19 - ElastiCache At-Rest Encryption
• D9.AWS.NET.34 - Ensure that at least one instance is registered with an ECS Cluster

Rules Changes:

BUG FIXES

• S3 bucket should have versioning MFA delete enabled.
  • GSL updated to: S3Bucket should have versioning.mfaDelete=true
• Use secure ciphers in CloudFront distribution.
  • GSL updated to: CloudFront should have distributionConfig.viewerCertificate.minimumProtocolVersion like 'TLSv1.1%'
• Ensure a log metric filter and alarm exist for Management Console sign-in without MFA
  • GSL Updated to: List<CloudTrail> should have items with [ hasSNSSubscriber='true' and metricFilters with [filterPattern isFilterPatternEqual('{ ($.eventName = ConsoleLogin) && ($.additionalEventData.MFAUsed != Yes) }') or filterPattern isFilterPatternEqual('{ $.userIdentity.sessionContext.attributes.mfaAuthenticated != true }')] ] length() > 0]

Additional Rule Changes including Wording Changes - Updated Rule Names, Description and Remediation Fields, Compliance Sections Updates.

For more information please click here

PREVIEW

Compliance engine:

Compliance Bundles change

BUG FIXES

• Clarity:
  
  • Fixed VPC Peering to cross region handling.
    
• Compliance engine:
  
  • Fixed tool tips and UI flickering.

PREVIEW

• Compliance engine:
  • AWS VPN Connection entity support.

FEATURES/FUNCTIONALITY

• Dynamic Access page:
  
  • Added UI improvements.
  • Added terminate all support

BUG FIXES

• Policy Reports:
  • Fixed export to CSV formatting.
    
• IAM Reports:
  • Fixed Credentials report export to CSV date fields support.
• Home Page:
  • Fixed cloud account findings.

PREVIEW

• Compliance engine:
  • Azure Locks entity support.

CROSS SYSTEM

• New Main menu
  
  • Improved the product categories

BUG FIXES

• Security groups:
  
  • Added SG type name to the title.
• IAM Reports:
  
  • Fixed Credentials report date fields sorting.
• Home Page:
  
  • Fixed inaccurate cloud account information sync.

FEATURES/FUNCTIONALITY

• Compliance engine:
  • IAM User - Added new field: "mfaType" which will be of values "None" / "Hardware" / "Virtual".
  • CloudTrail - Expanded the metric filters structure to better troubleshoot sns subscriptions,

BUG FIXES

• Compliance engine:
  • Fixed missing region field for S3Buckets.

PREVIEW

• Compliance engine:
  • AWS WAF Regional entity support.

BUG FIXES

• Compliance engine:
  • IAM Role combined policies fix.
    
• Clarity:
  
  • Performance improvements.

FEATURES/FUNCTIONALITY

• AWS Onboarding:
  • Updated the dome9-read-only policy in order to support WAF for web ACL. [Details]

BUG FIXES

• Compliance engine:
  • Dashboard - Improved exporting large files to CSV.
• Policy Reports and Security groups page:
  • UI text and titles fixes.

Compliance Bundles change

BUG FIXES

• Compliance engine:
  • Dashboard - Failed to trigger download CSV file.
• Clarity
  • VPC without assets fix.

FEATURES/FUNCTIONALITY

• Compliance engine:
  • ElastiCache entity added tags support.

BUG FIXES

• Clarity
  • Peered VPC assets fix.

PREVIEW

• Compliance engine:
  • AWS VPN Gateway entity support.

FEATURES/FUNCTIONALITY

• Compliance engine:
  • Added List<Entity> rules support.
  • Added GroupBy [object] rules support.

 Examples:

• Ensure no more than 5 IAM Admins exist in any particular account.
  

  List<IamUser> should have items with[name like 'admin' or name like 'administrator'] length() < LIMIT

• To detect if your account is near the EC2 Security Group Limit in a VPC.
  

  List<SecurityGroup> should have items groupBy [vpc.id] contain-all [values length() < LIMIT]

BUG FIXES

• Compliance engine
  • Assessments history
• User Permissions fix

PREVIEW

• Compliance engine:
  • AWS AMI entity support.
    • Check if the image is private
      

      AMI should have isPublic='false'

BUG FIXES

• GSL
  • Query 'Region should have hasCloudTrail=true' returns invalid results after 'isMultiRegion' is toggled OFF
• Dynamic Access Lease
  • Setting default access lease time does not reflect or update 'GET ACCESS' default time.

PREVIEW

• Azure Protection mode:
  • Added NSG Tamper protection support.

• Cloud accounts:
  • Added support for Azure tamper protection view.

• Audits and Alerts page:
  • Added Invalid credentials alert for Azure.

BUG FIXES

• UI/Description
  
  • Fixed description to shouldn't (EC2 Instance there shouldn't be any High level findings in Inspector Scans).
  • Update name of the s3 to stay in 1 line to " AWS Dome9 S3 Bucket Security"

FEATURES/FUNCTIONALITY

• Compliance engine:
  • Added triggered by column to Assessment history

FEATURES/FUNCTIONALITY

• Compliance engine:
  • KMS entity added tags support.

FEATURES/FUNCTIONALITY

• UI/Optimization:
  
  • Optimized the account statistics on the homepage (Network, IAM and S3 information).

PREVIEW

• Compliance engine:
  • AWS DynamoDB entity support.

Examples:
DynamoDB is encrypted:

DynamoDbTable should have encrypted=true

DynamoDB table size:

DynamoDbTable should have tableSizeBytes<100

DynamoDB number of items:

DynamoDbTable should have itemCount<100

FEATURES/FUNCTIONALITY

• Compliance engine:
  • AWS Instance entity added Image details support (Image name, Is public, owner Id, etc').
    
    
• AWS Onboarding:
  • Updated the dome9-read-only policy in order to support DynamoDB and ElasticCache tags. [Details]

FEATURES/FUNCTIONALITY

• Compliance engine:
  • Redshift entity added tags support.

FEATURES/FUNCTIONALITY

• Compliance engine:
  • Kinesis entity added tags support.
  • Lambda entity added tags support.
  • EFS entity added tags support.

BUG FIXES

• Cross system
  • Export to CSV component fix.
• Security groups page
  • Clone security groups - Peered security groups fix.

FEATURES/FUNCTIONALITY

Compliance Bundles change

Dome9 now has new and improved compliance bundles! Compliance Engine bundle management will be based on the unified mapping of the Dome9 compliance checks to various security and compliance frameworks.

Additional Client Impact:

New Findings in Continuous Compliance Scheduled Reports

New Findings being sent to SIEM system [Details]

• Compliance engine:
  • RDS entity added tags support.

BUG FIXES

• Compliance engine
  • Edit Bundle JSON - UI freeze.
• Protected Assets
  • Roles info data validation fix.
• IAM Reports
  • Fixed role entity managed policies support.

PREVIEW

• Compliance engine:
  • Azure Storage entity support.

Examples:

Encryption key is enabled rule:

StorageAccount should have encryption.key.enabled=true

Check that StorageAccount uses only https traffic:

StorageAccount should have httpsOnlyTraffic=true

PREVIEW

• Compliance engine:
  • Route 53 Domain entity support.

Examples:

Route53Domain should not have expirationTime before(-1, 'minutes')

Route53Domain should not have autoRenew=false

Route53Domain should not have expirationTime before(7, 'days')

• Compliance engine:
  • Added GDPR Readiness bundle.
  • Added NIST 800-53 Rev 4 bundle.
• Account page:
  • Billable assets definition and link to protected assets.

BUG FIXES

• Compliance engine
  • Navigation exceptions from compliance reports.
• IAM Reports
  • Fixed role entity support.

PREVIEW

• Protected assets page:
  
  • Guard Duty integration, Added Alerts and findings tab to show findings.

FEATURES/FUNCTIONALITY

• AWS Onboarding:
  • Updated the dome9-read-only policy in order to support Guard duty

PREVIEW

• Compliance engine:
  • Azure Redis entity support.

PREVIEW

• Compliance engine:
  • AcmCertificate entity support.

Examples:

AcmCertificate should not have notAfter before(-1, 'minutes')

ApplicationLoadBalancershould not havelisteners with [ certificates with [ expiration before(-1, 'minutes') ] ]

ELBshould not haveelbListeners with [ certificate.expiration before(-1, 'minutes') ]

FEATURES/FUNCTIONALITY

• Cloud Accounts:
  • Added Validate all permissions button, will try to validate permissions on all of the missing permissions cloud accounts.

BUG FIXES

• Compliance engine
  • Fixed tags result output.

PREVIEW

• Compliance engine:
  • Route53 entity support.

Examples:

Route53HostedZone should not have recordSets contain-any [ records contain-any [ assetMetadata.type='S3Bucket' and assetMetadata.exists=false] ]

Route53HostedZone should not have recordSets contain-any [ records contain-any [ assetMetadata.type='CloudFront' and assetMetadata.exists=false] ]

Route53HostedZone should not have recordSets contain-any [ records contain-any [ assetMetadata.type='CloudFront' and assetMetadata.active=false] ]

PREVIEW

• Compliance engine:
  • IAMServerCertificates entity support.
  • ELB and ApplicationLoadBalancer entities added IAM Certificate support.

Examples:

IamServerCertificate should not have expiration before(0, 'minutes')

ELB should not have elbListeners with [ certificate.iamServerCertificate.expiration before(1, 'months') ]

ApplicationLoadBalancer should not have listeners with [ certificates with [ iamServerCertificate.expiration before(0, 'minutes') ] ]

FEATURES/FUNCTIONALITY

• Compliance engine - S3 Bucket Security Posture:
  • This bundle has been updated to include the rule - S3 Buckets - without server-side-encryption enabled.

PREVIEW

• Compliance engine:
  • ELB entity added security policies and ciphers support.
  • ApplicationLoadBalancer entity added access logs support.
  • NetworkLoadBalancer entity added access logs support.

Examples:

ELB should not have elbListeners with [ policies with [ attributes contain-any [$ in ( 'ECDHE-RSA-RC4-SHA', 'EXP-RC4-MD5') ] ] ]

ApplicationLoadBalancer should have attributes contain-any [ key='access_logs.s3.enabled' and value='true' ]

FEATURES/FUNCTIONALITY

• Compliance engine - Dome9 AWS Dashboards policy:
  • S3 Buckets - without server-side-encryption enabled - expanded rule to support all server side encryption types.

BUG FIXES

• User Interface
  
  • Fixed tab panels items when refreshing page.
• S3 Buckets
  • Without server-side-encryption enabled rule - causes false positives for customers

PREVIEW

• Compliance engine:
  • Kinesis entity support.

FEATURES/FUNCTIONALITY

• AWS Onboarding:
  • Updated the dome9-read-only policy in order to support Kinesis

FEATURES/FUNCTIONALITY

• Clarity:
  • Added EFS asset count and attached security groups icon

BUG FIXES

• RFC6890 Support
  
  • Fixed internal network RFC6890 support.
• RDS / Redshift
  • Fixed RDS and Redshift state coloring.
• VPC display
  
  • Fixed un-managed VPC display for wrong security groups.