PingSafe Knowledge Base

Back to home

PingSafe Knowledge Base

GCP Knowledge Base

GCP Knowledge Base

We have written articles that explain security checks done by PingSafe on GCP and how engineering teams can fix the vulnerabilities.

Google Cloud VPC

Open RPC

Metadata Included In Firewall Logging

Open Oracle

Open NetBIOS

All Ports Open

Open SSH

Open Kibana

Open SMTP

Open Hadoop HDFS NameNode WebUI

Open FTP

Open VNC Client

Open RDP

Open DNS

Open VNC Server

Open CIFS

Open Salt

Open SMBoTCP

Open Docker

Open Cassandra

Open MYSQL

Open Telnet

Firewall Rule Logs Disabled

Open Hadoop HDFS NameNode Metadata Service

Open MSSQL

Open Redis

Private Access Disabled

Open SQL Server

Open Oracle Auto Data Warehouse

Open PostgreSQL

Sub Networks Flow Logs Disabled

Open MongoDB

See more

Google Cloud IAM

Service Over Per Account Failure Limit

Personal Accounts are in Use

IAM Users With Both Service Account User And Service Account Admin Role

Service Account Keys Not Managed By Google

Managed Service Accounts With Admin Access

User With IAM Service Account User Role

Service Account Key Rotation Due

Users with Admin and CryptoKey Roles

See more

Google Cloud Load Balancing

Load Balancing Backend Service Logging Disabled

Load Balancing CDN Disabled

Security Policy Disabled

Load Balancers Using Insecure Ciphers

Load Balancing HTTPS Disabled

See more

Google Cloud Logging

Audit Logging Not Configured Properly

VPC Network Log Alert Missing

Log Encryption Disabled

Project Ownership Log Alert Missing

Custom Role Log Alert Missing

Audit Configuration Log Alert Missing

VPC Network Route Log Alert Missing

Storage Permissions Log Alert Missing

SQL Configuration Log Alert Missing

Dangling Log Sink Bucket

Log Sinks Disabled

VPC Firewall Rule Log Alert Missing

Audit Logging Exempted Members

See more

Google Cloud Kubernetes Engine

Basic Authentication Enabled

Secure Boot Disabled

Cluster Encryption Not Desired Level

Node Encryption Not On Desired Protection Level

Automatic Node Repair Disabled

Logging Disabled

Cluster Not Using Least Privilege

Private Endpoint Disabled

COS Image Disabled

Master Authorized Network Disabled

Alias IP Ranges Disabled

Shielded Nodes Disabled

Private Cluster Disabled

Legacy Authorization Enabled

Monitoring Disabled

Default Service Account Used

Web Dashboard Enabled

Automatic Node Upgrades Disabled

Integrity Monitoring Disabled

Network Policy Disabled

Kubernetes Alpha Enabled

See more

Google Cloud Pub/Sub

Pub/Sub Subscriptions Dead Lettering Disabled

GCP Pub/Sub Topics Low Encryption

Google Compute Engine

VM Disk Image Publicly Accessible

Instance Template Machine Type Not Desired

Instance Automatic Restart Disabled

Old Persistent Disk Snapshots Used

IP Forwarding Enabled

Instance Default Service Account Used

Shielded VM Disabled

OS Login 2FA Disabled

OS Login Disabled

Connect Serial Ports Enabled

Instance Public Access Enabled

Instance Disk Encryption Not As Desired

Instances Not Multi Zonal

Autoscale Disabled

VM Max Instances Limit Reached

Instance Is Not Desired Machine Type

Preemptible VM Instance Used

Instance Not Using Desired Machine Image

Project Wide SSH Enabled

VM Instance On Host Maintenance Not Configured

VM Instance Disks Auto Delete Enabled

VM Instances Default Privilege

Managed VM Instance Group Automatic Healing Disabled

VM Instance Deletion Protection Missing

See more

Google Cloud Key Management Service (KMS)

Key Publicly Accessible

Key Rotation Disabled

Key Management Low Encryption

Google Cloud DNS

DNS Security RSA SHA1 Enabled

DNS Security Disabled

Google Cloud Storage

Bucket Customer-Managed Encryption Disabled

Lifecycle Management Rules Missing

Storage Bucket Retention Policy Not Locked

Bucket Uniform Level Access Disabled

Cloud Storage Bucket Versioning Disabled

Storage Bucket Retention Policy Expired

Storage Bucket Retention Policy About to Expire

Storage Bucket Retention Policy Not Set

Storage Bucket Publicly Accessible

Bucket Logging Disabled

See more

Google Cloud Dataproc

Customer Managed Encryption Disabled

Google Cloud SQL

MySQL Local Infile Enabled

PostgreSQL Checkpoint Logs Disabled

PostgreSQL Min Duration Logs Enabled

PostgreSQL Disconnection Logs Disabled

SQL Cross DB Ownership Chaining Enabled

SQL Contained Database Authentication Enabled

SQL Automated Backups Disabled

Public IP is attached to SQL instances

PostgreSQL Max Connections Not As Desired

Root Password Not Set For MySQL Instances

Mysql Version Not As Desired

PostgreSQL Version Not As Desired

PostgreSQL Undesired Error Logging Level

SSL Disabled For SQL Databases

MySQL Slow Query Logs Disabled

SQL Database Publicly Accessible

SQL Server Certificates Expired

DB Non-Restorable

SQL Automatic Storage Increase Disabled

PostgreSQL Lock Wait Logs Disabled

PostgreSQL Temp File Logs Disabled

SQL Automatic Failover To Another Zone Missing

SQL Instance Customer-Managed Encryption Disabled

SQL Server Certificates About To Expire

PostgreSQL Connection Logs Disabled

Any Host Access For Root User Enabled

See more

Google Cloud Spanner

Spanner Instance Node Count Above Allowed Count

Google Cloud Deployment Manager

Deployment Instances Expired

Google Cloud BigQuery

Public Dataset Policy

Customer Managed Encryption Disabled

Google Cloud Dataflow

Dataflow Jobs Encryption Not At Desired Level