Releases in 2019
**December 2019 - v2.22.1**
----------------------------
1. **Platform & Stability Improvements**
* Improved performance for certain data collection and processing scenarios. Reduced Azure and AWS API throttling issues.
* Fixed following bugs
- Duplicate policy mapping for NIST CSF benchmark ('Ensure that Azure AD security is configured for Service Fabric cluster')
2. **Policies & Benchmarks Additions/Updates**
* Updated FFIEC [ Federal Financial Institutions Examination Council (CAT)] benchmark for AWS, Azure and M365 policies.
**November 2019 - v2.21.1**
----------------------------
1. **User Experience Improvements**
- Updated color codes for RISK matrix for RISK Dashboard and Security Best
practices as below
- Links Cloudneeti Partner id on creation/update of Azure Cloud Account. Please refer to the documentation link here [Link a Partner ID to your Azure accounts](https://docs.microsoft.com/en-us/azure/billing/billing-partner-admin-link-started){target=_blank}.
2. **Platform & Stability Improvements**
* Updated API version and processing logic for following Azure security
policies as per recent updates from Microsoft Azure
- Ensure that Flow Log Status is set to On for Network Security Groups
- Ensure that backup feature is configured for Virtual Machines
* Fixed following bugs
- Welcome email contains special characters
- Notification for account user addition missing
3. **Policies & Benchmarks Additions/Updates**
* Introducing a new security benchmark for AWS
- Cloud Security Alliance's Cloud Control Matrix (CCM v3.0.1)
* Updated CSA CCM v3.0.1 benchmark for Azure and M365 policies.
* Updated NIST CSF v1.1, PCI DSS 3.2, HIPAA, and ISO/IEC 27001 benchmark for
newly added/updated Azure policies.
* Updated 51 AWS security policies for Auto remediation.
**November 2019- v2.20.1**
----------------------------
1. **User Experience Improvements**
* None
2. **Platform & Stability Improvements**
* Fixed following bugs
- UI/UX: Policy Details blade does not show all the columns for the policies with more no of columns.
- UI: Long category title in Security Dashboard was distorting the tiles.
3. **Policies & Benchmarks Additions/Updates**
* Introducing a new security benchmark
- Center for Internet Security CentOS Linux 7 Benchmark v2.2.0 [preview]
**October 2019- v2.19.1**
----------------------------
1. **User Experience Improvements**
* Introducing partner co-branding feature: Co-branding of UI and reports allow a partner to theme the end-user experiences with the partner portal’s look and feel.
* Added documentation link in the left menu bar.
* Removed word report download functionality for further optimization.
* Re-arranged following functionality of policy exclusion as below
| | **Previously** | **Updated** |
| --- | --- | --- |
| Global policy exclusions | Left menu bar -> Settings -> Configure Integrations -> Update Global Policies | Left menu bar -> Configurations -> Security Policy Exclusion |
| Account-level policy exclusion | Left menu bar -> Settings -> Manage Cloud Accounts -> Configure Account -> Configure Security Policies | Left menu bar -> Configurations -> Security Policy Exclusion |
* Updated menu items as below for more appropriate meaning and location
| | **Previously** | **Updated** |
| --- | --- | --- |
| Left menu | Settings | Configurations |
| Left sub menu | Configure Integrations | Integrations |
| Left sub menu | Manage Cloud Accounts | Cloud Accounts |
| Left sub menu | Manage Users | Users & Roles |
| Update License Details | Configure Integrations | Features and Quotas |
* Updated static text as below for more appropriate meaning and location
| | **Previously** | **Updated** |
| --- | --- | --- |
| Compliance Dashboard text for trend charts | Daily Trend | Compliance Trend |
| Features & Quotas | Enabled Cloud Connectors - Quota | Quota for Cloud Accounts |
| Features & Quotas | Total | Quota |
| Features & Quotas | Compliance Bundles | Compliance Frameworks |
| Features & Quotas | Point of Contact | Points of Contact |
2. **Platform & Stability Improvements**
* Added feature to allow a weekly scan frequency for free trial licenses from Azure Marketplace.
* Improved stability for meta-data collection intermittent job execution failures
* Fixed following bugs
- License name missing in the subject line for Email Template.
- Some cloud accounts were not displaying the correct last scan data time.
- Getting error 'Account already exists' when trying to add a new Microsoft Azure Subscription
3. **Policies & Benchmarks Additions/Updates**
* Introducing a new security benchmark
- Center for Internet Security Ubuntu Linux 18.04 LTS Benchmark v1.0.0 [preview]
**October 2019- v2.18.1**
----------------------------
1. **User Experience Improvements**
* Added CSV format summary report download for Office 365 cloud accounts. This feature enables the user to download the report to get a list of controls with compliance status.
* Updated “Cloud Security & Risk Posture” to “Cloud Security Best Practices” for consistency with the Compliance dashboard “Security Best Practices” tile.
* Added search option so that users can search specific policies on any of the benchmark.
2. **Platform & Stability Improvements**
* Added additional security measures while onboarding AWS account using AWS External ID.
3. **Policies & Benchmarks Additions/Updates**
* Updated mapping for “Center for Internet Security AWS Foundations Benchmark v1.2.0 “. Now 46 out of 49 controls are mapped.
**September 2019- v2.17.1**
----------------------------
1. **User Experience Improvements**
* Delivered AWS auto remediations for critical AWS policies. When a misconfiguration occurs, organizations require instant remediation to minimize the window of opportunity for malicious attacks. This self-healing ability enables organizations to enforce their most important security and compliance policies.
* Added a new option for scan frequency - ‘Weekly’. Customers can now set weekly schedules for collecting the configuration data and tracking remediation progress.
* Released multiple Azure Marketplace offers: https://www.cloudneeti.com/offers.
2. **Platform & Stability Improvements**
* Bug-fixes
1. Networking policies - NSG count issue (mismatch in pass/total count with policy details)
2. Updated asset dashboard for M365 accounts to fix the issue of number of users and number AD applications.
3. **Policies & Benchmarks Additions/Updates**
**September 2019- v2.16.1**
----------------------------
1. **User Experience Improvements**
* Reports: Cloudneeti added a summary report download in CSV format for Azure and AWS cloud accounts. This feature enables the user to download the report to get a list of controls with compliance status.
* Enhancement to show account quota on “Features and Quotas” left menu based on total, consumed, and available.
2. **Platform & Stability Improvements**
* Enhancement of data collection and data processing mechanisms tracing and handling intermittent failures.
3. **Policies & Benchmarks Additions/Updates**
Fixed permission issues for following policies
| **Policy Title** | | --- | | Ensure that WEBSITE_LOAD_CERTIFICATES parameter is not set to '*' for Web Apps | | Ensure that WEBSITE_LOAD_CERTIFICATES parameter is not set to '*' for Function Apps | | Ensure that 'App Service Authentication' is enabled for Function Apps | | Ensure that 'App Insights' are configured for Azure Function Apps | | Ensure that 'Public access level' is set to Private for Blob Containers |Updated policy title and implementation for following policy as per updates in Microsoft Azure API response
| **Old Policy Title** | **Updated Policy Title** | | --- | --- | | Ensure that antivirus mechanism is actively running on the Virtual Machines | Ensure that real time protection is set to ON inside the Windows Virtual Machine || Existing | New |  |  |
|---|
Deprecated following policies from Azure security best practices as those setting are updated in the Azure portal
| **Category** | **Policy Title** | |------------------------|------------------------------------------------------------------------------------------------| | Azure - Networking | Ensure that Virtual Network Gateway(VPN/ExpressRoute) access is restricted for Virtual Network | | Azure - Compute (IaaS) | Ensure that antivirus mechanism is actively running on the Virtual Machines |Added the following 16 new security policies for AWS cloud account
| **Category** | **Policy Title** | | --- | --- | | AWS - Business Continuity | Ensure Multi-AZ feature is Enabled for RDS SQL Instance | | AWS - Business Continuity | Ensure Multi-AZ feature is Enabled for RDS MariaDB Instance | | AWS - Business Continuity | Ensure Multi-AZ feature is Enabled for RDS Oracle Instances | | AWS - Business Continuity | Ensure Multi-AZ feature is Enabled for RDS SQLServer Instances | | AWS - Business Continuity | Ensure Multi-AZ feature is Enabled for RDS Aurora Cluster | | AWS - Data Protection | Ensure that encryption is enabled for RDS SQL Instances | | AWS - Data Protection | Ensure that encryption for storage done with KMS CMKs for each RDS SQL Instance | | AWS - Data Protection | Ensure that encryption is enabled for RDS MariaDB Instances | | AWS - Data Protection | Ensure that encryption for storage done with KMS CMKs for each RDS MariaDB Instance | | AWS - Data Protection | Ensure that encryption is enabled for RDS Oracle Instances | | AWS - Data Protection | Ensure that encryption for storage done with KMS CMKs for each RDS Oracle Instances | | AWS - Data Protection | Ensure that encryption is enabled for RDS RDS SQLServer Instances | | AWS - Data Protection | Ensure that encryption for storage done with KMS CMKs for each RDS SQLServer Instances | | AWS - Data Protection | Ensure that encryption for storage done with KMS CMKs for RDS Aurora MySQL Serverless Cluster | | AWS - Data Protection | Ensure that encryption is enabled for Aurora SQL Instances | | AWS - Data Protection | Ensure that encryption for storage done with KMS CMKs for Aurora SQL Instances |Added the following new security policies for CentOS Linux 7 running on Microsoft Azure.
| **Category** | **Policy Title** | | --- | --- | | Access, Authentication and Authorization | Ensure cron daemon is enabled | | Access, Authentication and Authorization | Ensure SSH PermitUserEnvironment is disabled | | Access, Authentication and Authorization | Ensure SSH Protocol is set to 2 | | Access, Authentication and Authorization | Ensure SSH IgnoreRhosts is enabled | | Access, Authentication and Authorization | Ensure SSH HostbasedAuthentication is disabled | | Access, Authentication and Authorization | Ensure SSH PermitEmptyPasswords is disabled | | Initial Setup | Ensure nodev option set on removable media partitions | | Initial Setup | Ensure nosuid option set on removable media partitions | | Initial Setup | Ensure noexec option set on removable media partitions | | Initial Setup | Ensure XD/NX support is enabled | | Initial Setup | Ensure address space layout randomization (ASLR) is enabled | | Logging and Auditing | Ensure logrotate is configured | | Logging and Auditing | Ensure rsyslog Service is enabled | | Logging and Auditing | Ensure rsyslog default file permissions configured | | Logging and Auditing | Ensure remote rsyslog messages are only accepted on designated log hosts | | Logging and Auditing | Ensure rsyslog or syslog-ng is installed | | Network Configuration | Ensure wireless interfaces are disabled | | Network Configuration | Ensure IP forwarding is disabled | | Network Configuration | Ensure source routed packets are not accepted | | Network Configuration | Ensure broadcast ICMP requests are ignored | | Network Configuration | Ensure bogus ICMP responses are ignored | | Network Configuration | Ensure Reverse Path Filtering is enabled | | Network Configuration | Ensure TCP SYN Cookies is enabled | | Network Configuration | Ensure RDS is disabled | | Services | Ensure rsh server is not enabled | | Services | Ensure telnet server is not enabled | | Services | Ensure Avahi Server is not enabled | | Services | Ensure CUPS is not enabled | | Services | Ensure DHCP Server is not enabled | | Services | Ensure rsh client is not installed | | Services | Ensure telnet client is not installed | | System Maintenance | Ensure permissions on /etc/passwd are configured | | System Maintenance | Ensure permissions on /etc/group are configured | | System Maintenance | Ensure root is the only UID 0 account |Added the following new security policies for Azure cloud account
| **Category** | **Policy Title** | | --- | --- | | Azure - Compute (IaaS) | Ensure that data disks are encrypted for Linux Virtual Machines |Added the following new security policies for Ubuntu 18.04 LTS running on Microsoft Azure.
| **Category** | **Policy Title** | | --- | --- | | Access, Authentication and Authorization | Ensure cron daemon is enabled | | Access, Authentication and Authorization | Ensure SSH PermitUserEnvironment is disabled | | Access, Authentication and Authorization | Ensure SSH Protocol is set to 2 | | Access, Authentication and Authorization | Ensure SSH IgnoreRhosts is enabled | | Access, Authentication and Authorization | Ensure SSH HostbasedAuthentication is disabled | | Access, Authentication and Authorization | Ensure SSH PermitEmptyPasswords is disabled | | Initial Setup | Ensure nodev option set on removable media partitions | | Initial Setup | Ensure nosuid option set on removable media partitions | | Initial Setup | Ensure noexec option set on removable media partitions | | Initial Setup | Ensure XD/NX support is enabled | | Initial Setup | Ensure address space layout randomization (ASLR) is enabled | | Logging and Auditing | Ensure rsyslog Service is enabled | | Logging and Auditing | Ensure rsyslog default file permissions configured | | Logging and Auditing | Ensure remote rsyslog messages are only accepted on designated log hosts | | Logging and Auditing | Ensure rsyslog or syslog-ng is installed | | Logging and Auditing | Ensure logrotate is configured | | Network Configuration | Ensure IP forwarding is disabled | | Network Configuration | Ensure source routed packets are not accepted | | Network Configuration | Ensure broadcast ICMP requests are ignored | | Network Configuration | Ensure bogus ICMP responses are ignored | | Network Configuration | Ensure Reverse Path Filtering is enabled | | Network Configuration | Ensure TCP SYN Cookies is enabled | | Network Configuration | Ensure RDS is disabled | | Network Configuration | Ensure wireless interfaces are disabled | | Services | Ensure xinetd is not enabled | | Services | Ensure rsh server is not enabled | | Services | Ensure telnet server is not enabled | | Services | Ensure tftp server is not enabled | | Services | Ensure IMAP and POP3 server is not enabled | | Services | Ensure Avahi Server is not enabled | | Services | Ensure CUPS is not enabled | | Services | Ensure DHCP Server is not enabled | | Services | Ensure LDAP server is not enabled | | Services | Ensure DNS Server is not enabled | | Services | Ensure NIS Client is not installed | | Services | Ensure rsh client is not installed | | Services | Ensure telnet client is not installed | | System Maintenance | Ensure permissions on /etc/passwd are configured | | System Maintenance | Ensure permissions on /etc/group are configured | | System Maintenance | Ensure root is the only UID 0 account |Disabled the following security policies for Azure cloud accounts as there are updates from Microsoft API response. These policies are disabled temporarily.
| **Category** | **Policy Title** | | --- | --- | | Azure - Compute (PaaS and Serverless) | Ensure that 'Python version' is latest, if used to run the web app | | Azure - Compute (PaaS and Serverless) | Ensure that latest supported Java version is used for Web Application | | Azure - Compute (PaaS and Serverless) | Ensure that '.Net Framework' version is latest, if used as a part of the web app | | Azure - Compute (PaaS and Serverless) | Ensure that latest supported PHP version is used for Web Application | | Azure - Compute (PaaS and Serverless) | Ensure that latest supported Node.js version is used for Web Application | | Azure - Compute (PaaS and Serverless) | Ensure that latest supported Java version is used for Mobile Apps | | Azure - Compute (PaaS and Serverless) | Ensure that latest supported PHP version is used for Mobile Apps | | Azure - Compute (PaaS and Serverless) | Ensure that latest supported PHP version is used for API Apps | | Azure - Compute (PaaS and Serverless) | Ensure that latest supported PHP version is used for Function Apps | | Azure - Compute (PaaS and Serverless) | Ensure that latest supported Java version is used for API Apps | | Azure - Compute (PaaS and Serverless) | Ensure that latest supported Node.js version is used for Function Apps | | Azure - Compute (PaaS and Serverless) | Ensure that latest supported Node.js version is used for API Apps | | Azure - Compute (PaaS and Serverless) | Ensure that latest supported Node.js version is used for Mobile Apps |Added the following new security policies for AWS cloud account
| **Category** | **Policy Title** | | --- | --- | | AWS - Audit and Logging | Ensure that Event Subscription is enabled for RDS Aurora Postgres Serverless Cluster | | AWS - Business Continuity | Ensure that sufficient backup retention period is applied to RDS Aurora Postgres Serverless Cluster | | AWS - Data Protection | Ensure that Deletion Protection feature is enabled for RDS Aurora Postgres Serverless Cluster | | AWS - Data Protection | Ensure that encryption for storage done with KMS CMKs for RDS Aurora Postgres Serverless Cluster | | AWS - Governance | Ensure that Copy Tags to Snapshots feature is enabled for RDS Aurora Postgres Serverless Cluster | | AWS - Governance | Ensure that unique master username is used for RDS Aurora Postgres Serverless Cluster | | AWS - Governance | Ensure that AutoPause feature is enabled for RDS Aurora Postgres Serverless Cluster | | AWS - Identity and Access Management | Ensure data-tier security group are configured for RDS Aurora Postgres Serverless Cluster | | AWS - Networking | Ensure that public subnets is not assigned to RDS Aurora Postgres Serverless Cluster |Deprecated following policy from Azure security best practices as this setting is updated in the Azure portal.
| **Category** | **Policy Title** | | --- | --- | | Azure - Networking | Ensure that retention period is greater than 90 days for Network Security Group flow logs |Added the following new policy for Azure
| **Category** | **Policy Title** | | --- | --- | | Azure - Networking | Ensure that Flow Log Status is set to On for Network Security Groups |Deprecated following 21 policies for AWS accounts. These are now replaced by the much more atomic policies (refer next bullet point).
| **Category** | **Policy Title** | | --- | --- | | AWS - Business Continuity | Ensure Auto Minor Version Upgrade feature is Enabled for Relational Database Service Instances | | AWS - Business Continuity | Ensure backup retention policy is set for Relational Database Service | | AWS - Business Continuity | Ensure that backtracking is enabled for Amazon Aurora MySQL database clusters | | AWS - Governance | Ensure that Copy Tags to Snapshots feature is enabled for Amazon RDS instances | | AWS - Data Protection | Ensure Deletion Protection feature is enabled for AWS RDS database instances | | AWS - Data Protection | Ensure that encryption is enabled for RDS instances | | AWS - Identity and Access Management | Ensure IAM Database Authentication feature is enabled for AWS RDS MySQL and PostgreSQL database instances | | AWS - Audit and Logging | Ensure that Event Subscription is enabled for RDS instance | | AWS - Data Protection | Ensure Performance Insights feature is enabled for Amazon RDS database instances | | AWS - Networking | Ensure that public access is not given to RDS database instance | | AWS - Storage and Databases | Ensure that port number should not be set as default port number for AWS RDS Instances | | AWS - Data Protection | Ensure that encryption for storage done with KMS CMKs for each RDS instance | | AWS - Networking | Ensure that public subnets is not assigned to RDS database instances | | AWS - Governance | Ensure that unique master user name is used for each RDS database instance | | AWS - Identity and Access Management | Ensure that Amazon RDS database snapshots are not accessible to all AWS accounts | | AWS - Business Continuity | Ensure that sufficient backup retention period is applied to RDS Instances | | AWS - Data In Transit Encryption | Ensure that Transport Encryption feature enabled for AWS RDS SQL Server instances | | AWS - Data Protection | Ensure that Deletion Protection feature is enabled for Aurora database clusters | | AWS - Audit and Logging | Ensure Log Exports feature is enabled for Amazon Aurora Serverless databases | | AWS - Governance | Ensure that AutoPause feature is enabled for Amazon Aurora Serverless clusters | | AWS - Identity and Access Management | Ensure data-tier security group are configured for RDS Aurora Clusters |Added the following 83 new AWS security policies
| **Category** | **Policy Title** | | --- | --- | | AWS - Audit and Logging | Ensure that Event Subscription is enabled for RDS SQL Instance | | AWS - Audit and Logging | Ensure that Event Subscription is enabled for RDS MariaDB Instance | | AWS - Audit and Logging | Ensure that Event Subscription is enabled for RDS Oracle Instances | | AWS - Audit and Logging | Ensure that Event Subscription is enabled for RDS SQLServer Instances | | AWS - Audit and Logging | Ensure that Event Subscription is enabled for RDS Aurora Cluster | | AWS - Audit and Logging | Ensure that Event Subscription is enabled for RDS Aurora MySQL Serverless Cluster | | AWS - Audit and Logging | Ensure Log Exports feature is enabled for RDS Aurora MySQL Serverless Cluster | | AWS - Audit and Logging | Ensure that Event Subscription is enabled for Aurora SQL Instances | | AWS - Business Continuity | Ensure Auto Minor Version Upgrade feature is Enabled for RDS SQL Instances | | AWS - Business Continuity | Ensure backup retention policy is set for RDS SQL Instances | | AWS - Business Continuity | Ensure that sufficient backup retention period is applied to RDS SQL Instances | | AWS - Business Continuity | Ensure Auto Minor Version Upgrade feature is Enabled for RDS MariaDB Instances | | AWS - Business Continuity | Ensure backup retention policy is set for RDS MariaDB Instances | | AWS - Business Continuity | Ensure that sufficient backup retention period is applied to RDS MariaDB Instances | | AWS - Business Continuity | Ensure Auto Minor Version Upgrade feature is Enabled forRDS Oracle Instances | | AWS - Business Continuity | Ensure backup retention policy is set for RDS Oracle Instances | | AWS - Business Continuity | Ensure that sufficient backup retention period is applied to RDS Oracle Instances | | AWS - Business Continuity | Ensure Auto Minor Version Upgrade feature is Enabled for RDS SQLServer Instances | | AWS - Business Continuity | Ensure backup retention policy is set for RDS SQLServer Instance | | AWS - Business Continuity | Ensure that sufficient backup retention period is applied to RDS SQLServer Instances | | AWS - Business Continuity | Ensure backup retention policy is set for RDS Aurora Cluster | | AWS - Business Continuity | Ensure that sufficient backup retention period is applied to RDS Aurora Cluster | | AWS - Business Continuity | Ensure that backtracking is enabled for Amazon RDS Aurora Cluster | | AWS - Business Continuity | Ensure that sufficient backup retention period is applied to RDS Aurora MySQL Serverless Cluster | | AWS - Business Continuity | Ensure Auto Minor Version Upgrade feature is Enabled for Aurora SQL Instances | | AWS - Business Continuity | Ensure AWS Elastic Block Store (EBS) volumes have recent snapshots available for point-in-time recovery | | AWS - Data In Transit Encryption | Ensure that Transport Encryption feature enabled for AWS RDS SQLServer Instances | | AWS - Data Protection | Ensure Deletion Protection feature is enabled for RDS SQL Instances | | AWS - Data Protection | Ensure Performance Insights feature is enabled for Amazon RDS SQL Instances | | AWS - Data Protection | Ensure Deletion Protection feature is enabled for RDS MariaDB Instances | | AWS - Data Protection | Ensure Performance Insights feature is enabled for RDS MariaDB Instances | | AWS - Data Protection | Ensure Deletion Protection feature is enabled for AWS RDS Oracle Instances | | AWS - Data Protection | Ensure Performance Insights feature is enabled for RDS Oracle Instances | | AWS - Data Protection | Ensure Deletion Protection feature is enabled for RDS SQLServer Instances | | AWS - Data Protection | Ensure Performance Insights feature is enabled for RDS SQLServer Instances | | AWS - Data Protection | Ensure that Deletion Protection feature is enabled for RDS Aurora Cluster | | AWS - Data Protection | Ensure that Deletion Protection feature is enabled for RDS Aurora MySQL Serverless Cluster | | AWS - Data Protection | Ensure Performance Insights feature is enabled for Aurora SQL Instances | | AWS - Data Protection | Ensure Amazon EBS snapshots are encrypted to meet security and compliance requirements| | AWS - Governance | Ensure that Copy Tags to Snapshots feature is enabled for RDS SQL Instances | | AWS - Governance | Ensure that unique master user name is used for each RDS SQL Instance | | AWS - Governance | Ensure that Copy Tags to Snapshots feature is enabled for RDS MariaDB Instances | | AWS - Governance | Ensure that unique master user name is used for each RDS MariaDB Instance | | AWS - Governance | Ensure that Copy Tags to Snapshots feature is enabled for RDS Oracle Instances | | AWS - Governance | Ensure that unique master user name is used for each RDS Oracle Instances | | AWS - Governance | Ensure that Copy Tags to Snapshots feature is enabled for RDS SQLServer Instances | | AWS - Governance | Ensure that unique master user name is used for each RDS SQLServer Instances | | AWS - Governance | Ensure that Copy Tags to Snapshots feature is enabled for RDS Aurora Cluster | | AWS - Governance | Ensure that Copy Tags to Snapshots feature is enabled for RDS Aurora MySQL Serverless Cluster | | AWS - Governance | Ensure that unique master user name is used for RDS Aurora MySQL Serverless Cluster | | AWS - Governance | Ensure Amazon RDS Reserved Instances contract are renewed before expiration in 7 days | | AWS - Governance | Ensure Amazon RDS Reserved Instances contract are renewed before expiration in 30 days | | AWS - Governance | Ensure that AutoPause feature is enabled for RDS Aurora MySQL Serverless Cluster | | AWS - Governance | Ensure that unique master user name is used for Aurora SQL Instances | | AWS - Identity and Access Management | Ensure IAM Database Authentication feature is enabled for RDS SQL Instances | | AWS - Identity and Access Management | Ensure data-tier security group are configured for RDS SQL Instances | | AWS - Identity and Access Management | Ensure data-tier security group are configured for RDS MariaDB Instances | | AWS - Identity and Access Management | Ensure data-tier security group are configured for RDS Oracle Instances | | AWS - Identity and Access Management | Ensure data-tier security group are configured for RDS SQLServer Instances | | AWS - Identity and Access Management | Ensure IAM Database Authentication feature is enabled for RDS Aurora Cluster | | AWS - Identity and Access Management | Ensure data-tier security group are configured for RDS Aurora Clusters | | AWS - Identity and Access Management | Ensure data-tier security group are configured for RDS Aurora MySQL Serverless Cluster | | AWS - Identity and Access Management | Ensure data-tier security group are configured for RDS Aurora SQL Instance | | AWS - Identity and Access Management | Ensure that Amazon RDS database snapshots are not accessible to all AWS accounts | | AWS - Identity and Access Management | Ensure that your Amazon EBS volume snapshots are not accessible to all AWS accounts | | AWS - Identity and Access Management | Avoid the use of the \"root\" account | | AWS - Identity and Access Management | Ensure no root account access key exists | | AWS - Networking | Ensure that public access is not given to RDS SQL Instance | | AWS - Networking | Ensure that public subnets are not assigned to RDS SQL Instances | | AWS - Networking | Ensure that public access is not given to RDS MariaDB Instance | | AWS - Networking | Ensure that public subnets are not assigned to RDS MariaDB Instances | | AWS - Networking | Ensure that public access is not given to RDS Oracle Instances | | AWS - Networking | Ensure that public subnets are not assigned to RDS Oracle Instances | | AWS - Networking | Ensure that public access is not given to RDS SQLServer Instances | | AWS - Networking | Ensure that public subnets are not assigned to RDS SQLServer Instances | | AWS - Networking | Ensure that public subnets are not assigned to RDS Aurora MySQL Serverless Cluster | | AWS - Networking | Ensure that public access is not given to Aurora SQL Instances | | AWS - Networking | Ensure that public subnets are not assigned to Aurora SQL Instances | | AWS - Storage and Databases | Ensure that port number should not be set as default port number for RDS SQL Instances | | AWS - Storage and Databases | Ensure that port number should not be set as default port number for RDS MariaDB Instances | | AWS - Storage and Databases | Ensure that port number should not be set as default port number for RDS Oracle Instances | | AWS - Storage and Databases | Ensure that port number should not be set as default port number for RDS SQLServer Instances | | AWS - Storage and Databases | Ensure that port number should not be set as default port number for Aurora SQL Instances |Added the following 4 new Office 365 security policies
| **Category** | **Policy Title** |--------------------------------------|-------------------------------------------| | M365 - Apps | Ensure that AD Application keys are rotated before they expire. | | M365 - Identity | Ensure that there are no guest users | | M365 - Identity | Ensure Amazon Neptune instances have Auto Minor Version Upgrade feature enabled | | M365 - Identity | Ensure that Service Principal Certificates are renewed before it expires |Added the following 21 new AWS security policies.
| **Category** | **Policy Title** | |--------------------------------------|-------------------------------------------| | AWS - Business Continuity | Ensure that Amazon Neptune database clusters have the Multi-AZ feature enabled | | AWS - Business Continuity | Ensure AWS Neptune clusters have sufficient backup retention period set for compliance purposes | |AWS - Compute | Ensure that the latest execution environment is used for your AWS Lambda functions | |AWS - Compute | Ensure that tracing is enabled for your AWS Lambda functions| |AWS - Data In Transit Encryption|Ensure EBS volumes are encrypted with KMS CMKs in order to have full control over data encryption and decryption.| |AWS - Data In Transit Encryption| Ensure that encryption with KMS key implemented for each SNS topic| |AWS - Data In Transit Encryption| Ensure that KMS CMK is used to encrypt SQS queue| |AWS - Data Protection | Ensure that existing Elastic Block Store (EBS) attached volumes are encrypted| |AWS - Data Protection| Identify and remove any unattached Elastic Block Store volumes to improve security.| |AWS - Data Protection | Ensure Simple Notification Service are not using HTTP as delivery protocol in subscription | |AWS - Data Protection | Ensure that AWS Simple Notification Service topics are not exposed to everyone | |AWS - Data Protection | Ensure that AWS Simple Queue Service queues are not exposed to everyone | |AWS - Data Protection | Ensure that Server-Side Encryption is enabled for Amazon SQS queues | |AWS - Governance | Ensure Amazon Organization is in use to consolidate all AWS accounts into an organization | |AWS - Governance | Ensure there is a Dead Letter Queue configured for each Amazon SQS queue | |AWS - Governance | Ensure that there are no publicly accessible AWS Lambda functions | |AWS - Identity and Access Management | Ensure that Everyone is not allowed to publish in SNS topics| |AWS - Identity and Access Management | Ensure that Everyone is not allowed to subscribe to SNS topics | |AWS - Identity and Access Management | Ensure that access to VPC-only resources is used for your AWS Lambda functions | |AWS - Identity and Access Management | Ensure that no admin privileges are given to Lambda functions | |AWS - Identity and Access Management | Ensure you do not allow unknown cross account access via permission policies to AWS Lambda functions |Deprecated the following Azure security policy
| **Category** | **Policy Title** | |--------------------------------------|-------------------------------------------| |Azure - Compute (IaaS) | Ensure that VM images are always hardened with Azure CIS benchmark|Addition of the following 10 new AWS security policies.
| **Category** | **Policy Title** | |--------------------------------------|------------------------------------------------------------------------------------------------------| | AWS - Audit and Logging | Ensure that Object level write event log is enabled for S3 bucket | | AWS - Audit and Logging | Ensure that Object level read event log is enabled for S3 bucket | | AWS - Business Continuity | Ensure Amazon Neptune instances have Auto Minor Version Upgrade feature enabled | | AWS - Business Continuity | Ensure that AWS Redshift Reserved Nodes are renewed in The Next 7 Days | | AWS - Business Continuity | Ensure that AWS Redshift Reserved Nodes are renewed in The Next 30 Days | | AWS - Business Continuity | Ensure that Termination Protection feature is enabled for AWS CloudFormation stacks | | AWS - Data In Transit Encryption | Ensure that AWS Neptune instances enforce data-at-rest encryption using KMS CMKs | | AWS - Data In Transit Encryption | Ensure that Amazon Neptune graph database instances are encrypted | | AWS - Identity and Access Management | Ensure IAM Database Authentication feature is enabled for Amazon Neptune clusters | | AWS - Monitoring | Ensure to integrate Simple Notification Service with AWS CloudFormation stack |
**September 2019- v2.15.1**
----------------------------
1. **New Marketplace Offers**
* Microsoft Azure customers worldwide now gain access to Cloudneeti to take advantage of the Continuous Cloud Security and Compliance Assurance for Microsoft Azure, Amazon Web Services and Office 365. With the current release below SKU's are available on Azure Marketplace.
Refer to all the Cloudneeti’s Azure Marketplace offers here- https://www.cloudneeti.com/offers
**August 2019- v2.14.1**
------------------------
1. **User Experience Improvements**
* Enhancements to Risk Dashboard for
1. Field name updates for aptness and clarity.
2. Removal of mitigated control % tile.
* Enhancement to Configure Integrations to show dependency between different tiles for relevance.
* Updated the color for the ‘high’ risk impact -to differentiate with that of 'critical' risk impact.
2. **Platform & Stability Improvements**
* Enhancement to display appropriate Authorization error message in Manage Users section in case if Azure Service Principal does not have permission to access Azure Active directory.
3. **Policies & Benchmarks Additions/Updates**
* Enhancements to recommendation section Azure VM baseline policies.
* Removed duplicate policy numbers across different categories in Cloud Security Risk Posture.
## **August 2019- v2.13.1**
1. **User Experience Improvements**
* Segregated Manage License menu into two menus.
1. Features and Quotas: A new view that provides all the features and quotas associated with customer’s license.
2. Configure Integrations: A new page that lists and allows customers to configure integrations available within product. Integrations like reporting data feeds, Ticketing (Incident management) etc.
* NIST Cybersecurity Framework v1.1 Benchmark: An update to the NIST CSF v1.1 summary view to clarify the level1 and level2 domains along with mappings to new Azure, AWS and Office365 policies.
* ‘Audit logs’ menu item has now been moved from under ‘Settings’ header to main menu for easy discoverability and relevance.
* Azure Marketplace Free Trial: Customers will be able to try before they buy on [ Azure marketplace ](https://azuremarketplace.microsoft.com/en/marketplace/apps/cloudneeti.cloudneeti_azmkt_free_trial?tab=Overview){target=_blank} . With this offering Customers can try out our product for their Azure, AWS and O365 cloud accounts.
2. **Platform & Stability Improvements**
* Enhancement to AWS data collection and data processing mechanism for better exception handling and retry mechanism for intermittent failures.
* Improved page load performance for various summary and detailed pages with content pagination.
* Improved parallization to collect and process data for various Azure and AWS cloud services.
3. **Policies & Benchmarks Additions/Updates**
* Updation of following compliance benchmark for Azure and AWS cloud accounts.
- AWS: GxP Life Sciences - FDA 21 CFR PART 11 AND PART 820.30
- Azure: GxP Life Science - FDA 21 CFR PART 11 AND PART 820.30
* Addition of following compliance benchmark for M365 accounts.
- M365: GxP Life Sciences - FDA 21 CFR PART 11 AND PART 820.30
* Updates to Azure NSG related policies to consider port ranges.
* Enhancements to Azure App service-related policies to include the latest updated versions.
## **July 2019- v2.12.1**
1. **User Experience Improvements**
* Self-service free trial experience the power of security and compliance automation in your AWS and Azure cloud environment with 1 month free trial of Cloudneeti Continuous Cloud Assurance. Cloudneeti self-service free trial is available at Azure Marketplace.
* Enhancements to Risk dashboard for screen resolution and “Risk Level Trend” chart.
* Enhancements to Manage Features page to show license type and cloud connector quotas.
* Notification message updated to include operation id.
2. **Platform & Stability Improvements**
* Data collection and processing performance and scale improvements for many policies.
* Enhancements to OS and data disk encryption policies.
3. **Policies & Benchmarks Additions/Updates**
* Addition of following compliance benchmark for Azure and AWS cloud account
1. AWS: GxP Life Sciences - FDA 21 CFR PART 11
2. Azure: GxP Life Science - FDA 21 CFR PART 11
## **July 2019- v2.11.1**
1. **User Experience Improvements**
* Risk Dashboard: Cloudneeti introduces Risk dashboard based on “NIST Cyber Security Framework v1.1”. Last month we introduced our Industry leading Risk Posture (a matrix of machine learning infused Risk Likelihood prediction overlaid with Risk Impact). And this month we are topping that by combining it with a NIST CSF v1.1. A continuous risk assurance ensures a solid basis for justifying remediation plans, strategies and resource requests to management.
* Reporting: Cloudneeti added detailed report download in word format for Azure and AWS cloud accounts. This feature enables the user to download the report to get a list of resources and controls.
* Documentation: Cloudneeti released a user-friendly version of the documentation site.
2. **Platform & Stability Improvements**
* Performance enhancements to data collection and processing mechanism.
* Azure and AWS - category name to category id updates for performance optimizations.
3. **Policies & Benchmarks Additions/Updates**
* Added additional 16 controls to following compliance benchmark for AWS cloud accounts.
1. AWS: FFIEC - Federal Financial Institutions Examination Council (CAT).
## **July 2019- v2.10.1**
1. **User Experience Improvements**
* Enhancements to Asset dashboard for AWS resource location map.
* Enhancements to Asset dashboard for Azure for Users count.
2. **Platform & Stability Improvements**
* Enhancements to “Cloud Security and Risk Posture“.
* Performance improvements for AWS data collection with lambda parallelism and orchestration.
* NoSQL database automatic scale-out and performance optimizations.
3. **Policies & Benchmarks Additions/Updates**
* Addition of following compliance benchmark for AWS cloud accounts.
1. AWS: FFIEC - Federal Financial Institutions Examination Council (CAT).
## **June 2019- v2.9.1**
1. **User Experience Improvements**
* Auto-remediation: Cloudneeti delivers automated remediation for critical Microsoft Azure policies. When a misconfiguration occurs, organizations need instant remediation to minimize the window of opportunity for malicious intentions. This self-healing ability enables organizations to ensure their security and compliance policies are always enforced.
* Dashboards updated as follows
1. CISO Dashboard --> Compliance
2. SOC Dashboard --> Security
3. Assets Dashboard --> Assets
* Enhancements to download PDF report to include Risk Posture.
2. **Platform & Stability Improvements**
* Performance enhancements to data collection and processing mechanism.
* Optimization with high performance AES 256 encryption/decryption
* Enhancement to notification systems if failed to connect to customer AWS account.
* Scale, stability and performance improvements for AWS data collection (batching and scaling)
3. **Policies & Benchmarks Additions/Updates**
* Addition of following compliance benchmarks for Azure and AWS cloud accounts
1. Azure: SOC2 - AICPA TSC 2017
2. AWS: SOC2 - AICPA TSC 2017
3. AWS: NIST Cybersecurity Framework (CSF v1.1)
* Updated AWS Compliance Mapping for HIPAA, GDPR, and PCI DSS 3.2.1
## **June 2019- v2.8.1**
1. **User Experience Improvements**
* Improved navigation from CISO dashboard - Sunburst chart to “Cloud Security and Risk Posture”.
* Added navigation from SOC dashboard - category to “Cloud Security and Risk Posture”.
* Enhancements to ‘Manage Users’ a menu under settings. This facilitates to manage account & license users (add/update/delete).
* Enhancements to ‘Audit log’ a menu under settings.
* Updates of mappings for PCI-DSS3.2, ISO/IEC 27001 with existing AWS related controls.
2. **Platform & Stability Improvements**
* Stability and enhancement to Policy based Risk Posture. Refer blog for more details on: Cloudneeti Introduces Risk Posture.
* Performance enhancements to data collection and processing mechanism.
* Various stability and bug fixes.
3. **Policies & Benchmarks Additions/Updates**
## **May 2019- v2.7.1**
1. **User Experience Improvements**
* Availability of Release Notes to the logged in users – These will list new features, updates to existing functionality, security policies and compliance benchmarks etc.
* ‘Manage Users’ a separate menu under settings. Earlier this was part of managing licensing features. This facilitates to manage account & license users (add/update/delete).
2. **Platform & Stability Improvements**
* Introducing Policy based Risk Posture – An ability for customers to understand cloud risks with a matrix view of Risk severity vs Risk likelihood. This feature allows customers to prioritize top risks for remediations.
* Stability updates and enhancements to ServiceNow ticketing integrations.
* Various stability and bug fixes.
3. **Policies & Benchmarks Additions/Updates**
## **April 2019- v2.6.1**
1. **User Experience Improvements**
* Look and Feel enhancements to PDF summary reports.
* Enhancements to CISO dashboard for All Accounts aggregation.
* Search and Alphabetical ordering of cloud accounts allowing easy access to 100s of cloud accounts.
2. **Platform & Stability Improvements**
* Enhancements to system performance related telemetry for backend services.
* Various stability and bug fixes.
3. **Policies & Benchmarks Additions/Updates**
## **April 2019- v2.5.1**
1. **User Experience Improvements**
* Introducing aggregation of all security and compliance benchmarks at a License level (aka Customer/Business Unit). Initial release for CISO dashboards displaying All Accounts (Aggregated).
* Enhanced navigation of dashboard Separate URLs for CISO/SOC/Assets Dashboards.
* Enhancements to PDF reporting with summarized trend charts.
* Asset dashboard released in preview for AWS and M365 cloud accounts.
2. **Platform & Stability Improvements**
* Database performance optimizations with re-indexing and re-partitioning.
## **April 2019- v2.4.1**
1. **User Experience Improvements**
* Enhancements to AWS Asset Dashboard
2. **Policies & Benchmarks**
## **March 2019- v2.3.1**
1. **Policies & Benchmarks Additions/Updates**
* Updates of mappings for “ISO/IEC 27001 Information Security Management Standards” with existing Azure, AWS and M365 related controls
## **March 2019- v2.2.1**
1. **User Experience Improvements**
* New option for download PDF summary report is now available, depicting a high-level summary of your current compliance status with respect to specific benchmark or standard.
* Account management menu is now easily accessible on every account page.
* Added support for multiple version benchmarks.
2. **Platform & Stability Improvements**
* Added option for on demand data collection (available as a Re-Scan option for Cloud accounts).
* Daylight Savings Bug Patches.
3. **Policies & Benchmarks Additions/Updates**
* [ CIS Microsoft Azure Foundations v1.1.0 ](https://www.cisecurity.org/partner/cloudneeti/) is now available
* CIS certified Cloudneeti for CIS Azure Foundations Benchmark v1.1 [ (https://www.cisecurity.org/partner/cloudneeti/) ](https://www.cisecurity.org/partner/cloudneeti/)
* CIS certified Cloudneeti for Amazon Web Services Foundations Benchmark v1.2.0 [ (https://www.cisecurity.org/partner/cloudneeti/) ](https://www.cisecurity.org/partner/cloudneeti/)