Deployment - June 20, 2019

 Compliance and governance:

• Compliance Engine:
  
  • Added Azure NetworkWatcher entity support.

Deployment - June 19, 2019

Compliance and governance:

• CIS AWS Benchmarks 1.2.0 support added
• 8 new rules added across multiple bundles. Click here for details

BUG FIXES

• DFT-530 - D9.AZU.NET.09 Ensure that 'Public access level' is set to Private for blob containers - GSL syntax updates
• DFT-397 - D9.AZU.CRY.10 Ensure that storage account access keys are periodically regenerated - remediation updates
• DFT-529 - D9.AWS.NET.43 - Ensure that AWS Elastic Load Balancers (ELB) have no inbound rules in their security groups - name update

Deployment - June 18, 2019

Compliance and governance:

• Compliance Engine:
  
  • Optimized AWS information retrieval service for:
    • SNS Subscription.
    • Log Group.
    • Metric Alarms.

Deployment - June 12, 2019

Compliance and governance:

• Compliance engine:
  
  • Added special characters support.
  • Optimized AWS information retrieval service for:
    • VPC Peering connection.

BUG FIXES

DFT-428 - Not able to add exclusion due to special characters.

Deployment - June 10, 2019

Compliance and governance:

• Compliance engine:
  
  • Optimized AWS IAM Policy entity.

BUG FIXES

DFT-527 - IP Lists - Fixed issue with adding IP's.
DFT-513 - Homepage - Filtering to protected assets fix.

Deployment - June 4, 2019

Compliance and governance:

• 34 new rules added across multiple bundles. Click here for details

Deployment - June 2, 2019

Compliance and governance:

• Compliance engine:
  
  • Added Azure Container Registry entity support.
  • Added Azure CosmosDBAccount entity support.

Deployment - May 23, 2019

Compliance and governance:

• Compliance Content Updates:
  
  • 76 new rules added across multiple bundles. Click here for details
• Compliance engine:
  
  • Added AWS SageMaker entity support.

BUG FIXES

DFT-497 - Remediation URL fixes for Azure Port Based Rules
DFT-436 - Key Vault Rules logic (GSL) updates for rules: D9.AZU.CRY.12 and  D9.AZU.CRY.13
DFT-500 - Remove extra brackets for D9.AWS.MON.03 (Ensure a log metric filter and alarm exist for usage of 'root' account)
DFT-435 - D9.GCP.CRY.02 doesn't work for Windows Instances
DFT-498 - D9.AWS.IAM.45 GSL Logic updated to reduce false positives

Deployment - May 16, 2019

Compliance and governance:

• Compliance Engine:
  
  • Optimized AWS information retrieval service for:
    • VPC Flow logs.
    • Internet Gateway.
    • VPN Gateway.
    • Subnet.
    • IAM Account Summary.

Deployment - May 5, 2019

Cross system

• Organizational units
  • Added organizational units support
    For more information click here.

Cloud Inventory

• Protected assets page
  • Enhanced performance.
  • New UI design.
  • Additional entity types support
  • Added export to CSV report

Network Security

• Security group page
  • Enhanced performance.
  • New UI design.

Compliance and governance:

• Compliance Dashboard:
  
  • Enhanced performance.
  • New UI design.

BUG FIXES

DFT-364 - Fixed view SSO settings for Auditors.

Deployment - May 2, 2019

Compliance and governance:

• Compliance engine:
  
  • Added Azure Postgre SQL entity support.

BUG FIXES

DOME-11383 - AWS Onboarding - Fixed External ID generator.
DOME-11372 - GCP Organisations Onboarding fix.
DFT-496 - Security groups - Clone security group fix.

Deployment - May 1, 2019

Across system

• AWS
  • Added AWS China support

Compliance and governance:

• GCP CIS Benchmarks Bundle Updates - added 21 new GCP rules to the Ruleset. For more details click here
• Compliance engine:
  
  • Added AWS S3Bucket Life Cycle information.

BUG FIXES

DFT-491 - Assessment API usage- improved errors handling.
DFT-474 - Fixed Linux Agent Install script.

Deployment - April 30, 2019

Compliance and governance:

• Compliance engine:
  
  • Added GCP VM instance OS information.

Administration:

• Users Page:
  
  • Added Last login details and sort by.

Cloud Inventory:

• Cloud Account Page:
  
  • Drastically improved page performance.

BUG FIXES

DOME-11097 - Assessment history - results page filters fix.

BUG FIXES

DFT-468 - Policies page - Attach policies - improved performance.
DOME-11146 - Clarity - GCP graph fixes.

Compliance and governance:

• Compliance engine:
  
  • Added GCP Big Query entity.

Compliance and governance:

• Renamed compliance categories:
  • Bundles changed to Rulesets
  • Continuous compliance changed to Policies

Cloud accounts:

• Added cloud account selection for permissions validation.

BUG FIXES

DFT-464 - Security hub support on Oregon region fix.
DFT-429 - Excluded entities does not represented correctly on homepage.

Compliance and governance:

Cloud accounts:

• Added support for GCP Zurich region 

BUG FIXES

DFT-348 - Security groups not being pulled into an onboarded Dome9 account

Compliance and governance:

Compliance and governance:

Compliance and governance:

Compliance and governance:

Compliance and governance:

Compliance and governance:

User menu:

• Added create support ticket option.
  As part of the integration we moved to a unified CheckPoint support system.
  New support tickets will be handled on CheckPoint BEYOND support system.
  Existing tickets will be handled on the previous (HelpCenter) system and the ticket history can be accessed.
  February  14, 2019

Cloud inventory - Add GCP cloud account:

• Redesigned the onboarding structure.
• Added Gsuite onboarding steps.

Compliance dashboard:

• Added improved explanation for the export to CSV option..

BUG FIXES

DFT-434 - Detaching policy in continuous compliance.

Administration - Account settings:

• Redesigned the page
• Added global emails settings

My settings - Email notifications:

• Added under cloud inventory an Invalid AWS and Azure credentials notifications option.

BUG FIXES

DFT-350 - Invalid credentials emails being sent even if all options are disabled.
DFT-276 - Option to disable emails being sent to newly created users

Compliance and governance:

PREVIEW

• Compliance engine:
  
  • AWS S3Bucket added accessPublicBlock support.

Cross system:

• Optimized side filter panels

BUG FIXES

DFT-406 - Fixed KeyVault diagnosticSettings object handling.

Cross system:

• Added support for AWS region Stockholm(eu-north-1)

BUG FIXES

DFT-414 - Exclusions not appearing due to deleted rule.

DFT-383 - Improved big compliance assessment runs handling

BUG FIXES

DFT-394 - GSL fix - Use secure ciphers in CloudFront distribution Rule ID: D9.AWS.CRY.16

DFT-396 - D9.GCP.NET.AG5.VMInstance.22.TCP- Correct description and Remediation

DFT-408 - Dynamo DB -Remove the rule D9.AWS.CRY.18 due to Default encryption settings

DFT-412 - Remove the rules D9.AZU.CRY.07 and D9.AZU.CRY.08

Click here for more details

Compliance and governance:

Protected Assets: 

• Instance entity:
  
  • Added Inspector and findings table.

Email notifications:

• Added filter for cloud accounts.

Compliance Updates:

New Rules:

• D9.GCP.NET.06  - Unused firewall rules
• D9.GCP.NET.07  - Global Firewall rule that allows all traffic
• D9.GCP.CRY.01  - Ensure VM disks are encrypted with Customer-Supplied Encryption Keys (CSEK)
• D9.AWS.IAM.17.HIPAA  - Ensure MFA is enabled for the 'root' account
• D9.GCP.NET.08  - Disable IP forwarding while creating instances
• D9.AWS.CRY.19 - ECS Cluster At-Rest Encryption
• D9.AWS.NET.31 - ECS Cluster should not have services without running tasks
• D9.AWS.NET.33 - ECS Cluster should not have running container instances with unconnected agents
• D9.AWS.NET.34 - Ensure that at least one instance is registered with an ECS Cluster

Deleted Rules:

• D9.AZU.CRY.01 - Ensure that 'SQL Encryption' is set to 'On'
• D9.AZU.MON.01 - Ensure that 'SQL auditing & Threat detection' is set to 'On'
• D9.AWS.IAM.17 - Ensure VIRTUAL MFA is enabled for the "root" account
• D9.AWS.NET.22 - Process for Security Group Management - Detection of new Security Groups

Changes To Existing Rules  - Click Here

BUG FIXES

• DFT-289 Rename rule in GCP bundle
• DFT-287 Remove Duplicate Azure Rule "Ensure that 'SQL auditing & Threat detection' is set to 'On'
• DFT-286 Remove Duplicate Azure RuleSQLDB should not have encryption.status='Disabled'
• DFT-290 - D9.AZU.MON.04 GSL Update to SQLDB should have threatDetection.state='Enabled'
• DFT-296 Rule Update - New rule added for HIPAA bundle only: IamUser where name like '%root_account%' should have mfaType='Hardware' or mfaType='Virtual'
• DFT-299 CIS Foundations 1.1.0 Rule "D9.AWS.MON.07" logic update

For more information please click here

PREVIEW

Compliance Updates:

New Bundles:

• AWS ISO 27001:2013 Automated Validation of ISO 27001:2013 Requirements for AWS
• Azure ISO 27001:2013 Automated Validation of ISO 27001:2013 Requirements for Azure
• GCP ISO 27001:2013 Automated Validation of ISO 27001:2013 Requirements for GCP

New Rules:

• D9.AWS.LOG.13 - ELB is created with Access logs enabled
• D9.AWS.NET.30 - ECS Cluster should have active services
• D9.AWS.NET.31 - ECS Cluster should not have services without running tasks
• D9.AWS.NET.32 - ECS Cluster instances must be placed in a VPC
• D9.AWS.NET.33 - ECS Cluster should not have running container instances with unconnected agents
• D9.AWS.CRY.19 - ElastiCache At-Rest Encryption
• D9.AWS.NET.34 - Ensure that at least one instance is registered with an ECS Cluster

Rules Changes:

BUG FIXES

• S3 bucket should have versioning MFA delete enabled.
  • GSL updated to: S3Bucket should have versioning.mfaDelete=true
• Use secure ciphers in CloudFront distribution.
  • GSL updated to: CloudFront should have distributionConfig.viewerCertificate.minimumProtocolVersion like 'TLSv1.1%'
• Ensure a log metric filter and alarm exist for Management Console sign-in without MFA
  • GSL Updated to: List<CloudTrail> should have items with [ hasSNSSubscriber='true' and metricFilters with [filterPattern isFilterPatternEqual('{ ($.eventName = ConsoleLogin) && ($.additionalEventData.MFAUsed != Yes) }') or filterPattern isFilterPatternEqual('{ $.userIdentity.sessionContext.attributes.mfaAuthenticated != true }')] ] length() > 0]

Additional Rule Changes including Wording Changes - Updated Rule Names, Description and Remediation Fields, Compliance Sections Updates.

For more information please click here

PREVIEW

Compliance engine:

Compliance Bundles change

BUG FIXES

• Clarity:
  
  • Fixed VPC Peering to cross region handling.
    
• Compliance engine:
  
  • Fixed tool tips and UI flickering.

PREVIEW

• Compliance engine:
  • AWS VPN Connection entity support.

FEATURES/FUNCTIONALITY

• Dynamic Access page:
  
  • Added UI improvements.
  • Added terminate all support

BUG FIXES

• Policy Reports:
  • Fixed export to CSV formatting.
    
• IAM Reports:
  • Fixed Credentials report export to CSV date fields support.
• Home Page:
  • Fixed cloud account findings.

PREVIEW

• Compliance engine:
  • Azure Locks entity support.

CROSS SYSTEM

• New Main menu
  
  • Improved the product categories

BUG FIXES

• Security groups:
  
  • Added SG type name to the title.
• IAM Reports:
  
  • Fixed Credentials report date fields sorting.
• Home Page:
  
  • Fixed inaccurate cloud account information sync.

FEATURES/FUNCTIONALITY

• Compliance engine:
  • IAM User - Added new field: "mfaType" which will be of values "None" / "Hardware" / "Virtual".
  • CloudTrail - Expanded the metric filters structure to better troubleshoot sns subscriptions,

BUG FIXES

• Compliance engine:
  • Fixed missing region field for S3Buckets.

PREVIEW

• Compliance engine:
  • AWS WAF Regional entity support.

BUG FIXES

• Compliance engine:
  • IAM Role combined policies fix.
    
• Clarity:
  
  • Performance improvements.

FEATURES/FUNCTIONALITY

• AWS Onboarding:
  • Updated the dome9-read-only policy in order to support WAF for web ACL. [Details]

BUG FIXES

• Compliance engine:
  • Dashboard - Improved exporting large files to CSV.
• Policy Reports and Security groups page:
  • UI text and titles fixes.

Compliance Bundles change

BUG FIXES

• Compliance engine:
  • Dashboard - Failed to trigger download CSV file.
• Clarity
  • VPC without assets fix.

FEATURES/FUNCTIONALITY

• Compliance engine:
  • ElastiCache entity added tags support.

BUG FIXES

• Clarity
  • Peered VPC assets fix.

PREVIEW

• Compliance engine:
  • AWS VPN Gateway entity support.

FEATURES/FUNCTIONALITY

• Compliance engine:
  • Added List<Entity> rules support.
  • Added GroupBy [object] rules support.

 Examples:

• Ensure no more than 5 IAM Admins exist in any particular account.
  

  List<IamUser> should have items with[name like 'admin' or name like 'administrator'] length() < LIMIT

• To detect if your account is near the EC2 Security Group Limit in a VPC.
  

  List<SecurityGroup> should have items groupBy [vpc.id] contain-all [values length() < LIMIT]

BUG FIXES

• Compliance engine
  • Assessments history
• User Permissions fix

PREVIEW

• Compliance engine:
  • AWS AMI entity support.
    • Check if the image is private
      

      AMI should have isPublic='false'

BUG FIXES

• GSL
  • Query 'Region should have hasCloudTrail=true' returns invalid results after 'isMultiRegion' is toggled OFF
• Dynamic Access Lease
  • Setting default access lease time does not reflect or update 'GET ACCESS' default time.

PREVIEW

• Azure Protection mode:
  • Added NSG Tamper protection support.

• Cloud accounts:
  • Added support for Azure tamper protection view.

• Audits and Alerts page:
  • Added Invalid credentials alert for Azure.

BUG FIXES

• UI/Description
  
  • Fixed description to shouldn't (EC2 Instance there shouldn't be any High level findings in Inspector Scans).
  • Update name of the s3 to stay in 1 line to " AWS Dome9 S3 Bucket Security"

FEATURES/FUNCTIONALITY

• Compliance engine:
  • Added triggered by column to Assessment history

FEATURES/FUNCTIONALITY

• Compliance engine:
  • KMS entity added tags support.

FEATURES/FUNCTIONALITY

• UI/Optimization:
  
  • Optimized the account statistics on the homepage (Network, IAM and S3 information).

PREVIEW

• Compliance engine:
  • AWS DynamoDB entity support.

Examples:
DynamoDB is encrypted:

DynamoDbTable should have encrypted=true

DynamoDB table size:

DynamoDbTable should have tableSizeBytes<100

DynamoDB number of items:

DynamoDbTable should have itemCount<100

FEATURES/FUNCTIONALITY

• Compliance engine:
  • AWS Instance entity added Image details support (Image name, Is public, owner Id, etc').
• AWS Onboarding:
  • Updated the dome9-read-only policy in order to support DynamoDB and ElasticCache tags. [Details]

FEATURES/FUNCTIONALITY

• Compliance engine:
  • Redshift entity added tags support.

FEATURES/FUNCTIONALITY

• Compliance engine:
  • Kinesis entity added tags support.
  • Lambda entity added tags support.
  • EFS entity added tags support.

BUG FIXES

• Cross system
  • Export to CSV component fix.
• Security groups page
  • Clone security groups - Peered security groups fix.

FEATURES/FUNCTIONALITY

Compliance Bundles change

Dome9 now has new and improved compliance bundles! Compliance Engine bundle management will be based on the unified mapping of the Dome9 compliance checks to various security and compliance frameworks.

Additional Client Impact:

New Findings in Continuous Compliance Scheduled Reports

New Findings being sent to SIEM system [Details]

• Compliance engine:
  • RDS entity added tags support.

BUG FIXES

• Compliance engine
  • Edit Bundle JSON - UI freeze.
• Protected Assets
  • Roles info data validation fix.
• IAM Reports
  • Fixed role entity managed policies support.

PREVIEW

• Compliance engine:
  • Azure Storage entity support.

Examples:

Encryption key is enabled rule:

StorageAccount should have encryption.key.enabled=true

Check that StorageAccount uses only https traffic:

StorageAccount should have httpsOnlyTraffic=true

PREVIEW

• Compliance engine:
  • Route 53 Domain entity support.

Examples:

Route53Domain should not have expirationTime before(-1, 'minutes')

Route53Domain should not have autoRenew=false

Route53Domain should not have expirationTime before(7, 'days')

• Compliance engine:
  • Added GDPR Readiness bundle.
  • Added NIST 800-53 Rev 4 bundle.
• Account page:
  • Billable assets definition and link to protected assets.

BUG FIXES

• Compliance engine
  • Navigation exceptions from compliance reports.
• IAM Reports
  • Fixed role entity support.

PREVIEW

• Protected assets page:
  
  • Guard Duty integration, Added Alerts and findings tab to show findings.

FEATURES/FUNCTIONALITY

• AWS Onboarding:
  • Updated the dome9-read-only policy in order to support Guard duty

PREVIEW

• Compliance engine:
  • Azure Redis entity support.

PREVIEW

• Compliance engine:
  • AcmCertificate entity support.

Examples:

AcmCertificate should not have notAfter before(-1, 'minutes')

ApplicationLoadBalancershould not havelisteners with [ certificates with [ expiration before(-1, 'minutes') ] ]

ELBshould not haveelbListeners with [ certificate.expiration before(-1, 'minutes') ]

FEATURES/FUNCTIONALITY

• Cloud Accounts:
  • Added Validate all permissions button, will try to validate permissions on all of the missing permissions cloud accounts.

BUG FIXES

• Compliance engine
  • Fixed tags result output.

PREVIEW

• Compliance engine:
  • Route53 entity support.

Examples:

Route53HostedZone should not have recordSets contain-any [ records contain-any [ assetMetadata.type='S3Bucket' and assetMetadata.exists=false] ]

Route53HostedZone should not have recordSets contain-any [ records contain-any [ assetMetadata.type='CloudFront' and assetMetadata.exists=false] ]

Route53HostedZone should not have recordSets contain-any [ records contain-any [ assetMetadata.type='CloudFront' and assetMetadata.active=false] ]

PREVIEW

• Compliance engine:
  • IAMServerCertificates entity support.
  • ELB and ApplicationLoadBalancer entities added IAM Certificate support.

Examples:

IamServerCertificate should not have expiration before(0, 'minutes')

ELB should not have elbListeners with [ certificate.iamServerCertificate.expiration before(1, 'months') ]

ApplicationLoadBalancer should not have listeners with [ certificates with [ iamServerCertificate.expiration before(0, 'minutes') ] ]

FEATURES/FUNCTIONALITY

• Compliance engine - S3 Bucket Security Posture:
  • This bundle has been updated to include the rule - S3 Buckets - without server-side-encryption enabled.

PREVIEW

• Compliance engine:
  • ELB entity added security policies and ciphers support.
  • ApplicationLoadBalancer entity added access logs support.
  • NetworkLoadBalancer entity added access logs support.

Examples:

ELB should not have elbListeners with [ policies with [ attributes contain-any [$ in ( 'ECDHE-RSA-RC4-SHA', 'EXP-RC4-MD5') ] ] ]

ApplicationLoadBalancer should have attributes contain-any [ key='access_logs.s3.enabled' and value='true' ]

FEATURES/FUNCTIONALITY

• Compliance engine - Dome9 AWS Dashboards policy:
  • S3 Buckets - without server-side-encryption enabled - expanded rule to support all server side encryption types.

BUG FIXES

• User Interface
  
  • Fixed tab panels items when refreshing page.
• S3 Buckets
  • Without server-side-encryption enabled rule - causes false positives for customers

PREVIEW

• Compliance engine:
  • Kinesis entity support.

FEATURES/FUNCTIONALITY

• AWS Onboarding:
  • Updated the dome9-read-only policy in order to support Kinesis

FEATURES/FUNCTIONALITY

• Clarity:
  • Added EFS asset count and attached security groups icon

BUG FIXES

• RFC6890 Support
  
  • Fixed internal network RFC6890 support.
• RDS / Redshift
  • Fixed RDS and Redshift state coloring.
• VPC display
  
  • Fixed un-managed VPC display for wrong security groups.