-
-
-
-Thursday April 24, 2025
-- Generated by Fortinet -- -
- AWS Accounts Analyzed: 1, Azure Subscriptions Analyzed: 1, GCP Projects Analyzed: 1, Hosts Scanned: 11, Containers Scanned: 16 -
- - The purpose of this report is to highlight the assessment findings for ACME. The findings below are - representative of the cloud accounts and hosts that were in scope of the engagement and cover cloud compliance - and vulnerability findings leveraging FortiCNAPP agentless scanning capabilities. This report provides a - detailed summary of each identified area of interest and how it pertains to your overall cloud security and - risk. -
-- Below is a summary of findings. Additional detail is provided on subsequent pages: -
- -Total Containers with Critical Vulnerabilities
-Hosts with Critical Vulnerabilities
-Total Critical AWS Compliance Findings
-Total Critical Azure Compliance Findings
-Total Critical GCP Compliance Findings
-Total High / Critical Behaviors Detected
-Number of Secrets Detected
-- - This assessment offers a glimpse into the value that FortiCNAPP provides customers, including: - -
--
- Based on the findings of this assessment, Fortinet recommends the following action plan and next steps: -
-- Using FortiCNAPP agentless workload scanning the following SSH Keys have been found on your workloads: -
- -| Hostname | -File Path | -SSH Key Type | -
|---|---|---|
| ip-172-16-1-45.us-east-2.compute.internal | -home/ubuntu/.ssh/id_frontend | -ssh-rsa | -
Using FortiCNAPP agentless compliance functionality, we’ve assessed the current security posture against best - practices, policies, and compliance frameworks. FortiCNAPP identified the following:
- -- Total AWS Accounts Analyzed: 1 - - -
| Account ID | -Severity Count | -Non-compliant Resources | -Total Assessed Resources | -
|---|---|---|---|
| 583683056848 | -High: 8 | -77 | -192 | -
- 
-
- -
| Tenant ID | -Severity Count | -Non-compliant Resources | -Total Assessed Resources | -
|---|---|---|---|
| a329d4bf-4557-4ccf-b132-84e7025ea22d | -High: 15 | -114 | -144 | -
- 
-
-
- -
| Project ID | -Severity Count | -Non-compliant Resources | -Total Assessed Resources | -
|---|---|---|---|
| lacework-demo-dev | -Critical: 4 -High: 2 | -60 | -116 | -
- 
-
- - Using the FortiCNAPP agentless Cloud Log behavioral assessment & any behavioral data from any agents you may - have deployed, we’ve identified the following anomalous or policy-based activity for further investigation. -
- -| Alert ID | -Severity | -Alert Time | -Alert Name | -Description | -
|---|---|---|---|---|
| 478601 | -High | -March 29, 2025 09:41PM | -Potentially Compromised Host | -Host machines may have been compromised. The following entities are suspected. Hosts: ip-10-0-2-5.us-east-2.compute.internal, ip-10-0-1-186.us-east-2.compute.internal. | -
| 442601 | -High | -March 22, 2025 09:17PM | -Potentially Compromised Host | -Host machines may have been compromised. The following entities are suspected. Hosts: ip-10-0-1-186.us-east-2.compute.internal, ip-10-0-2-5.us-east-2.compute.internal. | -
- FortiCNAPP has scanned and identified vulnerable container images and/or hosts and associated risk of the - vulnerabilities present. If the FortiCNAPP agent was not installed as part of this assessment it may be - installed later to highlight observed behavior, communication paths, and context. -
- -- Total Hosts Scanned: 11 -
- - - -- Total Container Images Scanned: 16 -
-| Severity | -Total CVEs | -Hosts Affected | -
|---|---|---|
| Critical | -7 | -2 | -
| High | -1795 | -9 | -
| Medium | -23929 | -11 | -
| Low | -0 | -0 | -
-
- | Severity | -Total CVEs | -Images Affected | -
|---|---|---|
| Critical | -104 | -8 | -
| High | -484 | -10 | -
| Medium | -630 | -16 | -
| Low | -0 | -0 | -
-
- This section contains additional details on the findings that were summarized above:
-This table lists all hosts with "critical" vulnerabilities that have fixes available. Additional - vulnerability information for other severity levels - can be found in the FortiCNAPP UI.
-| - | Hostname | -CVE | -Severity | -Package Name | -Installed Version | -Fixed Version(s) | -
|---|---|---|---|---|---|---|
| 0 | -ip-172-16-1-217.us-east-2.compute.internal | -CVE-2023-45133 | -Critical | -babel-traverse | -6.26.0 | -7.23.2 | -
| 1 | -ip-172-16-1-217.us-east-2.compute.internal | -CVE-2021-44906 | -Critical | -minimist | -1.2.5 | -1.2.6 | -
| 2 | -ip-172-16-1-45.us-east-2.compute.internal | -CVE-2023-45133 | -Critical | -babel-traverse | -6.26.0 | -7.23.2 | -
| 3 | -ip-172-16-1-45.us-east-2.compute.internal | -CVE-2021-44906 | -Critical | -minimist | -1.2.5 | -1.2.6 | -
| 4 | -ip-172-16-1-45.us-east-2.compute.internal | -CVE-2021-44228 | -Critical | -org.apache.logging.log4j:log4j-core | -2.6.1 | -2.15.0 | -
| 5 | -ip-172-16-1-45.us-east-2.compute.internal | -CVE-2021-45046 | -Critical | -org.apache.logging.log4j:log4j-core | -2.6.1 | -2.16.0 | -
| 6 | -ip-172-16-1-45.us-east-2.compute.internal | -CVE-2017-5645 | -Critical | -org.apache.logging.log4j:log4j-core | -2.6.1 | -2.8.2 | -
This table lists all containers with "critical" vulnerabilities that have fixes available. Additional - vulnerability information can be found in the FortiCNAPP UI.
-| - | Repository | -Image ID | -CVE | -Severity | -Package Name | -Installed Version | -Fixed Version(s) | -
|---|---|---|---|---|---|---|---|
| 0 | -detcaccounts/ecommerce-inventory | -sha256:e01e3ff828c30b87203fbcf381272e6c505dcfaa436d585fba5b04aec7ab9bd0 | -CVE-2024-32002 | -Critical | -git | -1:2.20.1-2+deb10u8 | -1:2.20.1-2+deb10u9 | -
| 1 | -detcaccounts/ecommerce-inventory | -sha256:e01e3ff828c30b87203fbcf381272e6c505dcfaa436d585fba5b04aec7ab9bd0 | -CVE-2023-38408 | -Critical | -openssh | -1:7.9p1-10+deb10u2 | -1:7.9p1-10+deb10u3 | -
| 2 | -detcaccounts/ecommerce-inventory | -sha256:e01e3ff828c30b87203fbcf381272e6c505dcfaa436d585fba5b04aec7ab9bd0 | -CVE-2022-1586, CVE-2022-1587 | -Critical | -pcre2 | -10.32-5 | -10.32-5+deb10u1 | -
| 3 | -detcaccounts/ecommerce-inventory | -sha256:e01e3ff828c30b87203fbcf381272e6c505dcfaa436d585fba5b04aec7ab9bd0 | -CVE-2021-3177 | -Critical | -python2.7 | -2.7.16-2+deb10u1 | -2.7.16-2+deb10u2 | -
| 4 | -detcaccounts/ecommerce-inventory | -sha256:e01e3ff828c30b87203fbcf381272e6c505dcfaa436d585fba5b04aec7ab9bd0 | -CVE-2022-48565 | -Critical | -python2.7 | -2.7.16-2+deb10u1 | -2.7.16-2+deb10u3 | -
| 5 | -detcaccounts/ecommerce-inventory | -sha256:e01e3ff828c30b87203fbcf381272e6c505dcfaa436d585fba5b04aec7ab9bd0 | -CVE-2022-48565 | -Critical | -python3.7 | -3.7.3-2+deb10u4 | -3.7.3-2+deb10u6 | -
| 6 | -detcaccounts/ecommerce-login | -sha256:53955dfb22799ff8c62067e429ceba9856864a48c66fad6c591f4f4316b538cf | -CVE-2024-32002 | -Critical | -git | -1:2.20.1-2+deb10u8 | -1:2.20.1-2+deb10u9 | -
| 7 | -detcaccounts/ecommerce-login | -sha256:53955dfb22799ff8c62067e429ceba9856864a48c66fad6c591f4f4316b538cf | -CVE-2023-38408 | -Critical | -openssh | -1:7.9p1-10+deb10u2 | -1:7.9p1-10+deb10u3 | -
| 8 | -detcaccounts/ecommerce-login | -sha256:53955dfb22799ff8c62067e429ceba9856864a48c66fad6c591f4f4316b538cf | -CVE-2022-1586, CVE-2022-1587 | -Critical | -pcre2 | -10.32-5 | -10.32-5+deb10u1 | -
| 9 | -detcaccounts/ecommerce-login | -sha256:53955dfb22799ff8c62067e429ceba9856864a48c66fad6c591f4f4316b538cf | -CVE-2021-3177 | -Critical | -python2.7 | -2.7.16-2+deb10u1 | -2.7.16-2+deb10u2 | -
| 10 | -detcaccounts/ecommerce-login | -sha256:53955dfb22799ff8c62067e429ceba9856864a48c66fad6c591f4f4316b538cf | -CVE-2022-48565 | -Critical | -python2.7 | -2.7.16-2+deb10u1 | -2.7.16-2+deb10u3 | -
| 11 | -detcaccounts/ecommerce-login | -sha256:53955dfb22799ff8c62067e429ceba9856864a48c66fad6c591f4f4316b538cf | -CVE-2022-48565 | -Critical | -python3.7 | -3.7.3-2+deb10u4 | -3.7.3-2+deb10u6 | -
| 12 | -detcaccounts/ecommerce-order | -sha256:39294e42ebc94c2a3ac0da99d351f90a5878d97b20e050bcfea134f5ff77df0d | -CVE-2024-32002 | -Critical | -git | -1:2.20.1-2+deb10u8 | -1:2.20.1-2+deb10u9 | -
| 13 | -detcaccounts/ecommerce-order | -sha256:39294e42ebc94c2a3ac0da99d351f90a5878d97b20e050bcfea134f5ff77df0d | -CVE-2024-21508 | -Critical | -mysql2 | -2.3.3 | -3.9.4 | -
| 14 | -detcaccounts/ecommerce-order | -sha256:39294e42ebc94c2a3ac0da99d351f90a5878d97b20e050bcfea134f5ff77df0d | -CVE-2024-21511 | -Critical | -mysql2 | -2.3.3 | -3.9.7 | -
| 15 | -detcaccounts/ecommerce-order | -sha256:39294e42ebc94c2a3ac0da99d351f90a5878d97b20e050bcfea134f5ff77df0d | -CVE-2023-38408 | -Critical | -openssh | -1:7.9p1-10+deb10u2 | -1:7.9p1-10+deb10u3 | -
| 16 | -detcaccounts/ecommerce-order | -sha256:39294e42ebc94c2a3ac0da99d351f90a5878d97b20e050bcfea134f5ff77df0d | -CVE-2022-1586, CVE-2022-1587 | -Critical | -pcre2 | -10.32-5 | -10.32-5+deb10u1 | -
| 17 | -detcaccounts/ecommerce-order | -sha256:39294e42ebc94c2a3ac0da99d351f90a5878d97b20e050bcfea134f5ff77df0d | -CVE-2021-3177 | -Critical | -python2.7 | -2.7.16-2+deb10u1 | -2.7.16-2+deb10u2 | -
| 18 | -detcaccounts/ecommerce-order | -sha256:39294e42ebc94c2a3ac0da99d351f90a5878d97b20e050bcfea134f5ff77df0d | -CVE-2022-48565 | -Critical | -python2.7 | -2.7.16-2+deb10u1 | -2.7.16-2+deb10u3 | -
| 19 | -detcaccounts/ecommerce-order | -sha256:39294e42ebc94c2a3ac0da99d351f90a5878d97b20e050bcfea134f5ff77df0d | -CVE-2022-48565 | -Critical | -python3.7 | -3.7.3-2+deb10u4 | -3.7.3-2+deb10u6 | -
| 20 | -detcaccounts/ecommerce-website | -sha256:7aba286656dc7d4b7529ec75090a117f1454fbf28bd8195848da6a69c74338fa | -CVE-2017-1000257 | -Critical | -curl | -7.52.1-r2 | -7.56.1-r0 | -
| 21 | -detcaccounts/ecommerce-website | -sha256:7aba286656dc7d4b7529ec75090a117f1454fbf28bd8195848da6a69c74338fa | -CVE-2017-8816, CVE-2017-8817, CVE-2017-8818 | -Critical | -curl | -7.52.1-r2 | -7.57.0-r0 | -
| 22 | -detcaccounts/ecommerce-website | -sha256:7aba286656dc7d4b7529ec75090a117f1454fbf28bd8195848da6a69c74338fa | -CVE-2018-1000005 | -Critical | -curl | -7.52.1-r2 | -7.58.0-r0 | -
| 23 | -detcaccounts/ecommerce-website | -sha256:7aba286656dc7d4b7529ec75090a117f1454fbf28bd8195848da6a69c74338fa | -CVE-2018-1000120, CVE-2018-1000122 | -Critical | -curl | -7.52.1-r2 | -7.59.0-r0 | -
| 24 | -detcaccounts/ecommerce-website | -sha256:7aba286656dc7d4b7529ec75090a117f1454fbf28bd8195848da6a69c74338fa | -CVE-2018-1000300, CVE-2018-1000301 | -Critical | -curl | -7.52.1-r2 | -7.60.0-r0 | -
| 25 | -detcaccounts/ecommerce-website | -sha256:7aba286656dc7d4b7529ec75090a117f1454fbf28bd8195848da6a69c74338fa | -CVE-2018-0500 | -Critical | -curl | -7.52.1-r2 | -7.61.0-r0 | -
| 26 | -detcaccounts/ecommerce-website | -sha256:7aba286656dc7d4b7529ec75090a117f1454fbf28bd8195848da6a69c74338fa | -CVE-2018-14618 | -Critical | -curl | -7.52.1-r2 | -7.61.1-r0 | -
| 27 | -detcaccounts/ecommerce-website | -sha256:7aba286656dc7d4b7529ec75090a117f1454fbf28bd8195848da6a69c74338fa | -CVE-2018-16839, CVE-2018-16840, CVE-2018-16842 | -Critical | -curl | -7.52.1-r2 | -7.61.1-r1 | -
| 28 | -detcaccounts/ecommerce-website | -sha256:7aba286656dc7d4b7529ec75090a117f1454fbf28bd8195848da6a69c74338fa | -CVE-2017-8105, CVE-2017-8287 | -Critical | -freetype | -2.7-r0 | -2.7.1-r1 | -
| 29 | -detcaccounts/ecommerce-website | -sha256:7aba286656dc7d4b7529ec75090a117f1454fbf28bd8195848da6a69c74338fa | -CVE-2018-14599, CVE-2018-14600 | -Critical | -libx11 | -1.6.4-r0 | -1.6.6-r0 | -
| 30 | -detcaccounts/ecommerce-website | -sha256:7aba286656dc7d4b7529ec75090a117f1454fbf28bd8195848da6a69c74338fa | -CVE-2018-2938 | -Critical | -openjdk8 | -8.121.13-r0 | -8.181.13-r0 | -
| 31 | -detcaccounts/ecommerce-website | -sha256:7aba286656dc7d4b7529ec75090a117f1454fbf28bd8195848da6a69c74338fa | -CVE-2018-3183 | -Critical | -openjdk8 | -8.121.13-r0 | -8.191.12-r0 | -
| 32 | -detcaccounts/ecommerce-website | -sha256:7aba286656dc7d4b7529ec75090a117f1454fbf28bd8195848da6a69c74338fa | -CVE-2021-44228 | -Critical | -org.apache.logging.log4j:log4j-core | -2.6.1 | -2.15.0 | -
| 33 | -detcaccounts/ecommerce-website | -sha256:7aba286656dc7d4b7529ec75090a117f1454fbf28bd8195848da6a69c74338fa | -CVE-2021-45046 | -Critical | -org.apache.logging.log4j:log4j-core | -2.6.1 | -2.16.0 | -
| 34 | -detcaccounts/ecommerce-website | -sha256:7aba286656dc7d4b7529ec75090a117f1454fbf28bd8195848da6a69c74338fa | -CVE-2017-5645 | -Critical | -org.apache.logging.log4j:log4j-core | -2.6.1 | -2.8.2 | -
| 35 | -detcaccounts/ecommerce-website | -sha256:7aba286656dc7d4b7529ec75090a117f1454fbf28bd8195848da6a69c74338fa | -CVE-2022-22963 | -Critical | -org.springframework.cloud:spring-cloud-function-context | -3.2.2 | -3.2.3 | -
| 36 | -detcaccounts/ecommerce-website | -sha256:7aba286656dc7d4b7529ec75090a117f1454fbf28bd8195848da6a69c74338fa | -CVE-2022-22963 | -Critical | -org.springframework.cloud:spring-cloud-function-core | -3.2.2 | -3.2.3 | -
| 37 | -detcaccounts/ecommerce-website | -sha256:7aba286656dc7d4b7529ec75090a117f1454fbf28bd8195848da6a69c74338fa | -CVE-2016-9841, CVE-2016-9843 | -Critical | -zlib | -1.2.8-r2 | -1.2.11-r0 | -
| 38 | -detcaccounts/voteapp-results-site | -sha256:1c27e07fb052c879bf0237ad0d6bc84ce4084d0a3fa7377fb13f325e95798e80 | -CVE-2022-1664 | -Critical | -dpkg | -1.18.25 | -1.18.26 | -
| 39 | -detcaccounts/voteapp-results-site | -sha256:1c27e07fb052c879bf0237ad0d6bc84ce4084d0a3fa7377fb13f325e95798e80 | -CVE-2021-3918 | -Critical | -json-schema | -0.2.3 | -0.4.0 | -
| 40 | -detcaccounts/voteapp-results-site | -sha256:1c27e07fb052c879bf0237ad0d6bc84ce4084d0a3fa7377fb13f325e95798e80 | -CVE-2021-3520 | -Critical | -lz4 | -0.0~r131-2 | -0.0~r131-2+deb9u1 | -
| 41 | -detcaccounts/voteapp-results-site | -sha256:1c27e07fb052c879bf0237ad0d6bc84ce4084d0a3fa7377fb13f325e95798e80 | -CVE-2021-44906 | -Critical | -minimist | -1.2.5 | -1.2.6 | -
| 42 | -detcaccounts/voteapp-results-site | -sha256:1c27e07fb052c879bf0237ad0d6bc84ce4084d0a3fa7377fb13f325e95798e80 | -CVE-2022-29155 | -Critical | -openldap | -2.4.44+dfsg-5+deb9u8 | -2.4.44+dfsg-5+deb9u9 | -
| 43 | -detcaccounts/voteapp-results-site | -sha256:1c27e07fb052c879bf0237ad0d6bc84ce4084d0a3fa7377fb13f325e95798e80 | -CVE-2022-2421 | -Critical | -socket.io-parser | -3.3.2 | -3.3.3 | -
| 44 | -detcaccounts/voteapp-results-site | -sha256:1c27e07fb052c879bf0237ad0d6bc84ce4084d0a3fa7377fb13f325e95798e80 | -CVE-2022-2421 | -Critical | -socket.io-parser | -3.4.1 | -3.4.2 | -
| 45 | -detcaccounts/voteapp-results-site | -sha256:1c27e07fb052c879bf0237ad0d6bc84ce4084d0a3fa7377fb13f325e95798e80 | -CVE-2021-31597 | -Critical | -xmlhttprequest-ssl | -1.5.5 | -1.6.1 | -
| 46 | -detcaccounts/voteapp-results-site | -sha256:1c27e07fb052c879bf0237ad0d6bc84ce4084d0a3fa7377fb13f325e95798e80 | -CVE-2020-28502 | -Critical | -xmlhttprequest-ssl | -1.5.5 | -1.6.2 | -
| 47 | -detcaccounts/voteapp-website | -sha256:a94d80f1fd196a58a99957a2c7b6f6b387fe88a32b76d1a0b696219bc7e5ac14 | -CVE-2023-38545 | -Critical | -curl | -7.74.0-1.3+deb11u1 | -7.74.0-1.3+deb11u10 | -
| 48 | -detcaccounts/voteapp-website | -sha256:a94d80f1fd196a58a99957a2c7b6f6b387fe88a32b76d1a0b696219bc7e5ac14 | -CVE-2021-22945, CVE-2022-32207 | -Critical | -curl | -7.74.0-1.3+deb11u1 | -7.74.0-1.3+deb11u2 | -
| 49 | -detcaccounts/voteapp-website | -sha256:a94d80f1fd196a58a99957a2c7b6f6b387fe88a32b76d1a0b696219bc7e5ac14 | -CVE-2022-32221 | -Critical | -curl | -7.74.0-1.3+deb11u1 | -7.74.0-1.3+deb11u5 | -
| 50 | -detcaccounts/voteapp-website | -sha256:a94d80f1fd196a58a99957a2c7b6f6b387fe88a32b76d1a0b696219bc7e5ac14 | -CVE-2022-1664 | -Critical | -dpkg | -1.20.9 | -1.20.10 | -
| 51 | -detcaccounts/voteapp-website | -sha256:a94d80f1fd196a58a99957a2c7b6f6b387fe88a32b76d1a0b696219bc7e5ac14 | -CVE-2024-45491, CVE-2024-45492 | -Critical | -expat | -2.2.10-2+deb11u3 | -2.2.10-2+deb11u6 | -
| 52 | -detcaccounts/voteapp-website | -sha256:a94d80f1fd196a58a99957a2c7b6f6b387fe88a32b76d1a0b696219bc7e5ac14 | -CVE-2024-37371 | -Critical | -krb5 | -1.18.3-6+deb11u1 | -1.18.3-6+deb11u5 | -
| 53 | -detcaccounts/voteapp-website | -sha256:a94d80f1fd196a58a99957a2c7b6f6b387fe88a32b76d1a0b696219bc7e5ac14 | -CVE-2021-46848 | -Critical | -libtasn1-6 | -4.16.0-2 | -4.16.0-2+deb11u1 | -
| 54 | -detcaccounts/voteapp-website | -sha256:a94d80f1fd196a58a99957a2c7b6f6b387fe88a32b76d1a0b696219bc7e5ac14 | -CVE-2022-29155 | -Critical | -openldap | -2.4.57+dfsg-3 | -2.4.57+dfsg-3+deb11u1 | -
| 55 | -detcaccounts/voteapp-website | -sha256:a94d80f1fd196a58a99957a2c7b6f6b387fe88a32b76d1a0b696219bc7e5ac14 | -CVE-2022-1292 | -Critical | -openssl | -1.1.1n-0+deb11u1 | -1.1.1n-0+deb11u2 | -
| 56 | -detcaccounts/voteapp-website | -sha256:a94d80f1fd196a58a99957a2c7b6f6b387fe88a32b76d1a0b696219bc7e5ac14 | -CVE-2022-2068 | -Critical | -openssl | -1.1.1n-0+deb11u1 | -1.1.1n-0+deb11u3 | -
| 57 | -detcaccounts/voteapp-website | -sha256:a94d80f1fd196a58a99957a2c7b6f6b387fe88a32b76d1a0b696219bc7e5ac14 | -CVE-2024-5535 | -Critical | -openssl | -1.1.1n-0+deb11u1 | -1.1.1w-0+deb11u2 | -
| 58 | -detcaccounts/voteapp-website | -sha256:a94d80f1fd196a58a99957a2c7b6f6b387fe88a32b76d1a0b696219bc7e5ac14 | -CVE-2022-1586, CVE-2022-1587 | -Critical | -pcre2 | -10.36-2 | -10.36-2+deb11u1 | -
| 59 | -detcaccounts/voteapp-website | -sha256:a94d80f1fd196a58a99957a2c7b6f6b387fe88a32b76d1a0b696219bc7e5ac14 | -CVE-2022-37434 | -Critical | -zlib | -1:1.2.11.dfsg-2+deb11u1 | -1:1.2.11.dfsg-2+deb11u2 | -
| 60 | -library/postgres | -sha256:e09e90144645e02137d087f0dc059f4d2e3c6356ef8f9e40eeb15d1c901dbc73 | -CVE-2022-23806 | -Critical | -go-compiler | -1.16.7 | -1.16.14 | -
| 61 | -library/postgres | -sha256:e09e90144645e02137d087f0dc059f4d2e3c6356ef8f9e40eeb15d1c901dbc73 | -CVE-2024-37371 | -Critical | -krb5 | -1.18.3-6+deb11u1 | -1.18.3-6+deb11u5 | -
| 62 | -library/postgres | -sha256:e09e90144645e02137d087f0dc059f4d2e3c6356ef8f9e40eeb15d1c901dbc73 | -CVE-2022-3515 | -Critical | -libksba | -1.5.0-3 | -1.5.0-3+deb11u1 | -
| 63 | -library/postgres | -sha256:e09e90144645e02137d087f0dc059f4d2e3c6356ef8f9e40eeb15d1c901dbc73 | -CVE-2022-47629 | -Critical | -libksba | -1.5.0-3 | -1.5.0-3+deb11u2 | -
| 64 | -library/postgres | -sha256:e09e90144645e02137d087f0dc059f4d2e3c6356ef8f9e40eeb15d1c901dbc73 | -CVE-2021-46848 | -Critical | -libtasn1-6 | -4.16.0-2 | -4.16.0-2+deb11u1 | -
| 65 | -library/postgres | -sha256:e09e90144645e02137d087f0dc059f4d2e3c6356ef8f9e40eeb15d1c901dbc73 | -CVE-2024-5535 | -Critical | -openssl | -1.1.1n-0+deb11u3 | -1.1.1w-0+deb11u2 | -
| 66 | -library/postgres | -sha256:e09e90144645e02137d087f0dc059f4d2e3c6356ef8f9e40eeb15d1c901dbc73 | -CVE-2022-1586, CVE-2022-1587 | -Critical | -pcre2 | -10.36-2 | -10.36-2+deb11u1 | -
| 67 | -library/postgres | -sha256:e09e90144645e02137d087f0dc059f4d2e3c6356ef8f9e40eeb15d1c901dbc73 | -CVE-2022-37434 | -Critical | -zlib | -1:1.2.11.dfsg-2+deb11u1 | -1:1.2.11.dfsg-2+deb11u2 | -
| - | Account ID | -Category | -Title | -Severity | -Resources | -
|---|---|---|---|---|---|
| 0 | -583683056848 | -Networking | -Ensure no Network Access Control Lists (ACL) allow ingress from 0.0.0.0/0 to remote server administration ports | -High | -21 / 26 | -
| 1 | -583683056848 | -Networking | -Ensure the default security group of every Virtual Private Cloud (VPC) restricts all traffic | -High | -21 / 42 | -
| 2 | -583683056848 | -Logging | -Enable AWS Config in all regions | -High | -17 / 17 | -
| 3 | -583683056848 | -Identity and Access Management | -Ensure Identity and Access Management (IAM) policies that allow full "*:*" administrative privileges are not attached to roles | -High | -10 / 60 | -
| 4 | -583683056848 | -Networking | -Ensure no security groups allow ingress from 0.0.0.0/0 to remote server administration ports | -High | -4 / 42 | -
| 5 | -583683056848 | -Identity and Access Management | -Ensure Identity and Access Management (IAM) policies that allow full "*:*" administrative privileges are not attached to users | -High | -2 / 3 | -
| 6 | -583683056848 | -Storage RDS | -Enable encryption for Relational Database Service (RDS) Instances | -High | -1 / 1 | -
| 7 | -583683056848 | -Logging | -Ensure AWS Config is recording Global Resources in at least one region | -High | -1 / 1 | -
| Tenant ID | -Category | -Title | -Severity | -Resources | -
|---|---|---|---|---|
| a329d4bf-4557-4ccf-b132-84e7025ea22d | -Networking | -Ensure that Network Watcher is 'Enabled' (includes Reserved access regions) | -High | -55 / 58 | -
| a329d4bf-4557-4ccf-b132-84e7025ea22d | -Networking | -Ensure that Network Watcher is 'Enabled' (excludes Reserved access regions) | -High | -41 / 58 | -
| a329d4bf-4557-4ccf-b132-84e7025ea22d | -Virtual Machines | -Encrypt 'OS and Data' disks with Customer Managed Key (CMK) | -High | -4 / 4 | -
| a329d4bf-4557-4ccf-b132-84e7025ea22d | -Networking | -Evaluate and restrict SSH access from the Internet | -High | -2 / 5 | -
| a329d4bf-4557-4ccf-b132-84e7025ea22d | -Networking | -Evaluate and restrict HTTP(S) access from the Internet | -High | -2 / 5 | -
| a329d4bf-4557-4ccf-b132-84e7025ea22d | -Storage Accounts | -Set Default Network Access Rule for Storage Accounts to Deny | -High | -1 / 1 | -
| a329d4bf-4557-4ccf-b132-84e7025ea22d | -Logging and Monitoring | -Ensure that Activity Log Alert exists for Create or Update Network Security Group | -High | -1 / 1 | -
| a329d4bf-4557-4ccf-b132-84e7025ea22d | -Logging and Monitoring | -Ensure that Activity Log Alert exists for Delete Network Security Group | -High | -1 / 1 | -
| a329d4bf-4557-4ccf-b132-84e7025ea22d | -Logging and Monitoring | -Ensure that Activity Log Alert exists for Create or Update Security Solution | -High | -1 / 1 | -
| a329d4bf-4557-4ccf-b132-84e7025ea22d | -Logging and Monitoring | -Ensure that Activity Log Alert exists for Delete Security Solution | -High | -1 / 1 | -
| a329d4bf-4557-4ccf-b132-84e7025ea22d | -Logging and Monitoring | -Ensure that Activity Log Alert exists for Create or Update SQL Server Firewall Rule | -High | -1 / 1 | -
| a329d4bf-4557-4ccf-b132-84e7025ea22d | -Logging and Monitoring | -Ensure that Activity Log Alert exists for Delete SQL Server Firewall Rule | -High | -1 / 1 | -
| a329d4bf-4557-4ccf-b132-84e7025ea22d | -Logging and Monitoring | -Ensure that Activity Log Alert exists for Create or Update Public IP Address rule | -High | -1 / 1 | -
| a329d4bf-4557-4ccf-b132-84e7025ea22d | -Logging and Monitoring | -Ensure that Activity Log Alert exists for Delete Public IP Address rule | -High | -1 / 1 | -
| a329d4bf-4557-4ccf-b132-84e7025ea22d | -Networking | -Evaluate and restrict Remote Desktop Protocol (RDP) access from the Internet | -High | -1 / 5 | -
| Project ID | -Category | -Title | -Severity | -Resources | -
|---|---|---|---|---|
| lacework-demo-dev | -Virtual Machines | -Encrypt VM Disks for Critical VMs With Customer-Supplied Encryption Keys (CSEK) | -Critical | -18 / 18 | -
| lacework-demo-dev | -Virtual Machines | -Encrypt VM Disks for Critical VMs With Customer-Supplied Encryption Keys (CSEK) | -Critical | -18 / 18 | -
| lacework-demo-dev | -Networking | -Restrict Remote Desktop Protocol (RDP) Access From the Internet | -Critical | -2 / 24 | -
| lacework-demo-dev | -Networking | -Restrict Remote Desktop Protocol (RDP) Access From the Internet | -Critical | -2 / 24 | -
| lacework-demo-dev | -Virtual Machines | -Ensure That Compute Instances Do Not Have Public IP Addresses | -High | -10 / 16 | -
| lacework-demo-dev | -Virtual Machines | -Ensure That Compute Instances Do Not Have Public IP Addresses | -High | -10 / 16 | -
This table contains CIS compliance findings with a severity of "Critical". Other severity levels can be - reviewed in the FortiCNAPP UI.
-| - | Project ID | -Category | -Control | -Violations | -
|---|---|---|---|---|
| 42 | -lacework-demo-dev | -Networking | -Restrict Remote Desktop Protocol (RDP) Access From the Internet | -Region:global Resource: //compute.googleapis.com/projects/lacework-demo-dev/global/firewalls/default-allow-rdp Reasons: ['RDPAccessAllowed'] Region:global Resource: //compute.googleapis.com/projects/lacework-demo-dev/global/firewalls/default-allow-rdp Reasons: ['RDPAccessAllowed'] |
-
| 54 | -lacework-demo-dev | -Virtual Machines | -Encrypt VM Disks for Critical VMs With Customer-Supplied Encryption Keys (CSEK) | -Region:us-central1-c Resource: //compute.googleapis.com/projects/lacework-demo-dev/zones/us-central1-c/disks/disk-clone-xaccount Reasons: ['DiskNotEncryptedWithCSEK'] Region:us-central1-c Resource: //compute.googleapis.com/projects/lacework-demo-dev/zones/us-central1-c/disks/disk-clone-xaccount Reasons: ['DiskNotEncryptedWithCSEK'] Region:us-east1-b Resource: //compute.googleapis.com/projects/lacework-demo-dev/zones/us-east1-b/disks/activity-generator Reasons: ['DiskNotEncryptedWithCSEK'] Region:us-east1-b Resource: //compute.googleapis.com/projects/lacework-demo-dev/zones/us-east1-b/disks/activity-generator Reasons: ['DiskNotEncryptedWithCSEK'] Region:us-east1-b Resource: //compute.googleapis.com/projects/lacework-demo-dev/zones/us-east1-b/disks/datalayer0 Reasons: ['DiskNotEncryptedWithCSEK'] Region:us-east1-b Resource: //compute.googleapis.com/projects/lacework-demo-dev/zones/us-east1-b/disks/datalayer0 Reasons: ['DiskNotEncryptedWithCSEK'] Region:us-east1-b Resource: //compute.googleapis.com/projects/lacework-demo-dev/zones/us-east1-b/disks/datalayer1 Reasons: ['DiskNotEncryptedWithCSEK'] Region:us-east1-b Resource: //compute.googleapis.com/projects/lacework-demo-dev/zones/us-east1-b/disks/datalayer1 Reasons: ['DiskNotEncryptedWithCSEK'] Region:us-east1-b Resource: //compute.googleapis.com/projects/lacework-demo-dev/zones/us-east1-b/disks/gke-sharedgke-default-node-pool-f1d63e9e-pqrt Reasons: ['DiskNotEncryptedWithCSEK'] Region:us-east1-b Resource: //compute.googleapis.com/projects/lacework-demo-dev/zones/us-east1-b/disks/gke-sharedgke-default-node-pool-f1d63e9e-pqrt Reasons: ['DiskNotEncryptedWithCSEK'] Region:us-east1-b Resource: //compute.googleapis.com/projects/lacework-demo-dev/zones/us-east1-b/disks/mongodb Reasons: ['DiskNotEncryptedWithCSEK'] Region:us-east1-b Resource: //compute.googleapis.com/projects/lacework-demo-dev/zones/us-east1-b/disks/mongodb Reasons: ['DiskNotEncryptedWithCSEK'] Region:us-east1-b Resource: //compute.googleapis.com/projects/lacework-demo-dev/zones/us-east1-b/disks/ticketing-utilty Reasons: ['DiskNotEncryptedWithCSEK'] Region:us-east1-b Resource: //compute.googleapis.com/projects/lacework-demo-dev/zones/us-east1-b/disks/ticketing-utilty Reasons: ['DiskNotEncryptedWithCSEK'] Region:us-east1-c Resource: //compute.googleapis.com/projects/lacework-demo-dev/zones/us-east1-c/disks/gke-sharedgke-default-node-pool-da487fab-1wjx Reasons: ['DiskNotEncryptedWithCSEK'] Region:us-east1-c Resource: //compute.googleapis.com/projects/lacework-demo-dev/zones/us-east1-c/disks/gke-sharedgke-default-node-pool-da487fab-1wjx Reasons: ['DiskNotEncryptedWithCSEK'] Region:us-east1-d Resource: //compute.googleapis.com/projects/lacework-demo-dev/zones/us-east1-d/disks/gke-sharedgke-default-node-pool-0899760d-hjvn Reasons: ['DiskNotEncryptedWithCSEK'] Region:us-east1-d Resource: //compute.googleapis.com/projects/lacework-demo-dev/zones/us-east1-d/disks/gke-sharedgke-default-node-pool-0899760d-hjvn Reasons: ['DiskNotEncryptedWithCSEK'] |
-
| 130 | -lacework-demo-dev | -Networking | -Restrict Remote Desktop Protocol (RDP) Access From the Internet | -Region:global Resource: //compute.googleapis.com/projects/lacework-demo-dev/global/firewalls/default-allow-rdp Reasons: ['RDPAccessAllowed'] Region:global Resource: //compute.googleapis.com/projects/lacework-demo-dev/global/firewalls/default-allow-rdp Reasons: ['RDPAccessAllowed'] |
-
| 142 | -lacework-demo-dev | -Virtual Machines | -Encrypt VM Disks for Critical VMs With Customer-Supplied Encryption Keys (CSEK) | -Region:us-central1-c Resource: //compute.googleapis.com/projects/lacework-demo-dev/zones/us-central1-c/disks/disk-clone-xaccount Reasons: ['DiskNotEncryptedWithCSEK'] Region:us-central1-c Resource: //compute.googleapis.com/projects/lacework-demo-dev/zones/us-central1-c/disks/disk-clone-xaccount Reasons: ['DiskNotEncryptedWithCSEK'] Region:us-east1-b Resource: //compute.googleapis.com/projects/lacework-demo-dev/zones/us-east1-b/disks/activity-generator Reasons: ['DiskNotEncryptedWithCSEK'] Region:us-east1-b Resource: //compute.googleapis.com/projects/lacework-demo-dev/zones/us-east1-b/disks/activity-generator Reasons: ['DiskNotEncryptedWithCSEK'] Region:us-east1-b Resource: //compute.googleapis.com/projects/lacework-demo-dev/zones/us-east1-b/disks/datalayer0 Reasons: ['DiskNotEncryptedWithCSEK'] Region:us-east1-b Resource: //compute.googleapis.com/projects/lacework-demo-dev/zones/us-east1-b/disks/datalayer0 Reasons: ['DiskNotEncryptedWithCSEK'] Region:us-east1-b Resource: //compute.googleapis.com/projects/lacework-demo-dev/zones/us-east1-b/disks/datalayer1 Reasons: ['DiskNotEncryptedWithCSEK'] Region:us-east1-b Resource: //compute.googleapis.com/projects/lacework-demo-dev/zones/us-east1-b/disks/datalayer1 Reasons: ['DiskNotEncryptedWithCSEK'] Region:us-east1-b Resource: //compute.googleapis.com/projects/lacework-demo-dev/zones/us-east1-b/disks/gke-sharedgke-default-node-pool-f1d63e9e-pqrt Reasons: ['DiskNotEncryptedWithCSEK'] Region:us-east1-b Resource: //compute.googleapis.com/projects/lacework-demo-dev/zones/us-east1-b/disks/gke-sharedgke-default-node-pool-f1d63e9e-pqrt Reasons: ['DiskNotEncryptedWithCSEK'] Region:us-east1-b Resource: //compute.googleapis.com/projects/lacework-demo-dev/zones/us-east1-b/disks/mongodb Reasons: ['DiskNotEncryptedWithCSEK'] Region:us-east1-b Resource: //compute.googleapis.com/projects/lacework-demo-dev/zones/us-east1-b/disks/mongodb Reasons: ['DiskNotEncryptedWithCSEK'] Region:us-east1-b Resource: //compute.googleapis.com/projects/lacework-demo-dev/zones/us-east1-b/disks/ticketing-utilty Reasons: ['DiskNotEncryptedWithCSEK'] Region:us-east1-b Resource: //compute.googleapis.com/projects/lacework-demo-dev/zones/us-east1-b/disks/ticketing-utilty Reasons: ['DiskNotEncryptedWithCSEK'] Region:us-east1-c Resource: //compute.googleapis.com/projects/lacework-demo-dev/zones/us-east1-c/disks/gke-sharedgke-default-node-pool-da487fab-1wjx Reasons: ['DiskNotEncryptedWithCSEK'] Region:us-east1-c Resource: //compute.googleapis.com/projects/lacework-demo-dev/zones/us-east1-c/disks/gke-sharedgke-default-node-pool-da487fab-1wjx Reasons: ['DiskNotEncryptedWithCSEK'] Region:us-east1-d Resource: //compute.googleapis.com/projects/lacework-demo-dev/zones/us-east1-d/disks/gke-sharedgke-default-node-pool-0899760d-hjvn Reasons: ['DiskNotEncryptedWithCSEK'] Region:us-east1-d Resource: //compute.googleapis.com/projects/lacework-demo-dev/zones/us-east1-d/disks/gke-sharedgke-default-node-pool-0899760d-hjvn Reasons: ['DiskNotEncryptedWithCSEK'] |
-
+Based on the findings of this assessment, Fortinet recommends the following action plan and next steps: +
+ +Goal: Fix all Critical vulnerabilities and achieve CIS compliance using FortiCNAPP Rapid Assessment Report.
+ +Minimum Fortinet Protection Cloud Stack:
+ +{{date}}
-- Generated by {{author}} -- {% if pdf %} -
- {% set summary_data = [] %} - {% if aws_compliance_data %} - {% set _ = summary_data.append('AWS Accounts Analyzed: ' ~ aws_compliance_data.cloud_accounts_count) %} - {% endif %} - {% if azure_compliance_data %} - {% set _ = summary_data.append('Azure Subscriptions Analyzed: ' ~ azure_compliance_data.cloud_accounts_count) %} - {% endif %} - {% if gcp_compliance_data %} - {% set _ = summary_data.append('GCP Projects Analyzed: ' ~ gcp_compliance_data.cloud_accounts_count) %} - {% endif %} - {% if host_vulns_data %} - {% set _ = summary_data.append('Hosts Scanned: ' ~ host_vulns_data.hosts_scanned_count) %} - {% endif %} - {% if container_vulns_data %} - {% set _ = summary_data.append('Containers Scanned: ' ~ container_vulns_data.containers_scanned_count) %} - {% endif %} - {{ summary_data | join(', ') }} -
- The purpose of this report is to highlight the assessment findings for {{customer}}. The findings below are - representative of the cloud accounts and hosts that were in scope of the engagement and cover cloud compliance - and vulnerability findings leveraging FortiCNAPP agentless scanning capabilities. This report provides a - detailed summary of each identified area of interest and how it pertains to your overall cloud security and - risk. -
-- Below is a summary of findings. Additional detail is provided on subsequent pages: + This Cloud Security Assessment provides a comprehensive analysis of {{customer}}'s security posture across cloud infrastructure, workloads, and compliance frameworks. The findings below represent actionable intelligence to strengthen your security position.
-Total Containers with Critical Vulnerabilities
-Hosts with Critical Vulnerabilities
-Total Critical AWS Compliance Findings
-Total Critical Azure Compliance Findings
-Total Critical GCP Compliance Findings
-Total High / Critical Behaviors Detected
-Number of Secrets Detected
-- - This assessment offers a glimpse into the value that FortiCNAPP provides customers, including: - -
--
Based on the assessment findings, the following actions are prioritized by severity and impact:
+ +{{secrets_data.secrets_count}} secret(s) have been detected in your workloads. Rotate these credentials and investigate potential unauthorized access.
+{{host_vulns_data.critical_vuln_count}} host(s) have critical vulnerabilities with available patches. Prioritize patching systems with network exposure.
+{{container_vulns_data.critical_vuln_count}} container image(s) contain critical vulnerabilities. Update base images and redeploy affected workloads.
+- Using FortiCNAPP agentless workload scanning the following SSH Keys have been found on your workloads: -
+ {% if aws_compliance_data and aws_compliance_data.critical_finding_count > 0 %} +{{aws_compliance_data.critical_finding_count}} critical compliance finding(s) detected. Review IAM policies, encryption settings, and network configurations.
+{{azure_compliance_data.critical_finding_count}} critical compliance finding(s) detected. Review Azure AD, storage security, and network security groups.
+{{alerts_data.high_critical_finding_count}} high/critical behavioral alert(s) require investigation for potential security incidents or policy violations.
+Implement continuous security monitoring and schedule recurring assessments to track remediation progress and detect new risks.
+Using FortiCNAPP agentless compliance functionality, we’ve assessed the current security posture against best - practices, policies, and compliance frameworks. FortiCNAPP identified the following:
- {% endif %} + + + +{% if secrets_data and secrets_data.secrets_count > 0 %} +Generate new SSH keys and update all systems using the compromised keys.
+Review authentication logs for any unauthorized access using the exposed credentials.
+Use a secrets manager (HashiCorp Vault, AWS Secrets Manager) to prevent future exposure.
+Verify and restrict file permissions on all secret files to ensure only authorized users and processes can access them. Implement least-privilege access controls using appropriate file permissions (e.g., 600 for private keys).
+
- Total AWS Accounts Analyzed: {{aws_compliance_data.cloud_accounts_count}}
-
+
+{% if aws_compliance_data or azure_compliance_data or gcp_compliance_data %}
+Compliance Findings
- {{ aws_compliance_data.compliance_summary.to_html(index=False) | safe }}
- {{ aws_compliance_data.compliance_findings_by_service_bar_graphic | safe }}
- {{ aws_compliance_data.compliance_findings_by_account_bar_graphic | safe }}
-
+ FortiCNAPP has assessed your cloud security posture against CIS benchmarks and industry best practices. The following findings highlight areas requiring attention to maintain compliance and reduce risk. +
- {% if azure_compliance_data and azure_compliance_data.summary_count > 0 %} -Total AWS Accounts Analyzed: {{aws_compliance_data.cloud_accounts_count}}
+ {{ aws_compliance_data.compliance_summary.to_html(index=False) | safe }} + {{ aws_compliance_data.compliance_findings_by_service_bar_graphic | safe }} + {{ aws_compliance_data.compliance_findings_by_account_bar_graphic | safe }} +-
Total Azure Subscriptions Analyzed: {{azure_compliance_data.cloud_accounts_count}}
{{ azure_compliance_data.compliance_summary.to_html(index=False) | safe }} {{ azure_compliance_data.compliance_findings_by_service_bar_graphic | safe }} {{ azure_compliance_data.compliance_findings_by_account_bar_graphic | safe }} - --
Total GCP Projects Analyzed: {{gcp_compliance_data.cloud_accounts_count}}
{{ gcp_compliance_data.compliance_summary.to_html(index=False) | safe }} {{ gcp_compliance_data.compliance_findings_by_service_bar_graphic | safe }} {{ gcp_compliance_data.compliance_findings_by_account_bar_graphic | safe }} -- Using the FortiCNAPP agentless Cloud Log behavioral assessment & any behavioral data from any agents you may - have deployed, we’ve identified the following anomalous or policy-based activity for further investigation. -
+ {% endif %} + +{% endif %} + + +{% if alerts_data %} +Focus on alerts indicating potential compromise, data exfiltration, or privilege escalation.
+Cross-reference alert timestamps with CloudTrail, Azure Activity Logs, or GCP Audit Logs.
+Tune FortiCNAPP policies to reduce false positives and enhance detection accuracy.
+- FortiCNAPP has scanned and identified vulnerable container images and/or hosts and associated risk of the - vulnerabilities present. If the FortiCNAPP agent was not installed as part of this assessment it may be - installed later to highlight observed behavior, communication paths, and context. -
+ +{% endif %} - {% if host_vulns_data %} -- Total Hosts Scanned: {{host_vulns_data.hosts_scanned_count}} -
+ +{% if ciem_data %} ++ Analysis of cloud identities with excessive privileges and unused entitlements across AWS, Azure, and GCP environments. Identities with high unused permissions represent a significant security risk and should be reviewed for least privilege adherence. +
-- Total Container Images Scanned: {{container_vulns_data.containers_scanned_count}} -
-| Principal ID | +Name | +Admin | +MFA | +Unused Entitlements | +Risk | +
|---|---|---|---|---|---|
{{ row.PRINCIPAL_ID[:40] }}... |
+ {{ row.NAME }} | ++ {% if row.has_full_admin %} + ✓ + {% else %} + - + {% endif %} + | ++ + {{ row.mfa_status }} + + | +
+ {{ row.unused_count }} / {{ row.total_count }}
+ ({{ row.unused_percentage }}%) + |
+ + + {{ row.risk_severity }} + + | +
+ Highlighted rows indicate identities with full administrative access. + MFA status: Enabled = MFA configured, + Disabled = No MFA, + Unknown = Status not determined. +
{% endif %} -+ Found {{ ciem_data[provider].root_count }} identities with full administrative privileges. + {% if ciem_data[provider].critical_count == 0 %} + None have ≥{{ ciem_data[provider].threshold }} unused entitlements. + {% endif %} +
+ {% endif %} + + {% if ciem_data[provider].high_privilege_count > 0 and ciem_data[provider].high_privilege_count > ciem_data[provider].critical_count %} ++ Found {{ ciem_data[provider].high_privilege_count }} identities with ≥{{ ciem_data[provider].threshold }} unused entitlements. + {% if ciem_data[provider].critical_count == 0 %} + None have full administrative access. + {% endif %} +
{% endif %} -This section contains additional details on the findings that were summarized above:
- {% if host_vulns_data or container_vulns_data %} -| Principal ID | +Name | +Admin | +MFA | +Unused % | +Unused/Total | +Risk | +
|---|---|---|---|---|---|---|
{{ row.PRINCIPAL_ID[:30] }}... |
+ {{ row.NAME }} | ++ {% if row.has_full_admin %} + ✓ + {% else %} + - + {% endif %} + | ++ + {{ row.mfa_status }} + + | ++ {{ row.unused_percentage }}% + | ++ {{ row.unused_count }} / {{ row.total_count }} + | ++ + {{ row.risk_severity }} + + | +
+ Showing top 25 identities sorted by risk. Identities with highlighted rows have both admin access and ≥{{ ciem_data[provider].threshold }} unused entitlements. +
{% endif %} - {% if host_vulns_data and not host_vulns_data.fixable_vulns.empty %} -This table lists all hosts with "critical" vulnerabilities that have fixes available. Additional - vulnerability information for other severity levels - can be found in the FortiCNAPP UI.
- {{ host_vulns_data.fixable_vulns.to_html() | safe }} {% endif %} + {% endfor %} + + + {% set total_high_privilege = (ciem_data.AWS.high_privilege_count if ciem_data.AWS and ciem_data.AWS.high_privilege_count is defined else 0) + (ciem_data.AZURE.high_privilege_count if ciem_data.AZURE and ciem_data.AZURE.high_privilege_count is defined else 0) + (ciem_data.GCP.high_privilege_count if ciem_data.GCP and ciem_data.GCP.high_privilege_count is defined else 0) %} + {% if total_high_privilege > 0 %} +Immediately enable Multi-Factor Authentication (MFA) for all identities, especially those with administrative access or high unused entitlements. MFA significantly reduces the risk of credential compromise.
+Review and remove unused permissions from identities with ≥70 unused entitlements. These over-provisioned identities violate least privilege principles and increase attack surface.
+Audit all identities with full administrative access. Remove admin privileges where not absolutely necessary and implement role-based access control (RBAC).
+Apply the principle of least privilege across all identities. Grant only the minimum permissions required for each role and regularly review access rights.
+Implement temporary privilege escalation for administrative tasks instead of permanent admin access. Use JIT access mechanisms to reduce standing privileges.
+This table lists all containers with "critical" vulnerabilities that have fixes available. Additional - vulnerability information can be found in the FortiCNAPP UI.
- {{ container_vulns_data.fixable_vulns.to_html() | safe }} ++ FortiCNAPP has performed agentless vulnerability scanning across your workloads. The following findings identify vulnerable hosts and container images with associated remediation guidance. +
+This table contains CIS compliance findings with a severity of "Critical". Other severity levels can be - reviewed in the FortiCNAPP UI.
- {{ aws_compliance_data.critical_details.to_html().replace("\\n","This table contains CIS compliance findings with a severity of "Critical". Other severity levels can be - reviewed in the FortiCNAPP UI.
- {{ azure_compliance_data.critical_details.to_html().replace("\\n","This section contains granular details for remediation teams.
+ + {% if host_vulns_data or container_vulns_data %} ++ This report displays Critical vulnerabilities with CVSS score 10.0 (the highest severity). + The Risk Score shown represents the vulnerability impact, which is calculated based on: +
++ Note: Risk Score differs from CVSS score. CVSS measures vulnerability severity, while Risk Score measures blast radius and organizational impact. +
+High CVSS, public exploits, Internet-exposed, and critical hosts first.
+OS & software updates; automate where possible; test critical patches.
+Remove unused software/services, close unnecessary ports, harden configs.
+Firewalls, restricted SSH/VPN, segmentation; monitor exposed ports.
+Regularly scan hosts, confirm remediation, focus on exploitable + Internet-exposed hosts.
+Use IDS/EDR; watch logs for suspicious activity.
+Backup before patching; track remediation; include exposure in reports.
+This table contains CIS compliance findings with a severity of "Critical". Other severity levels can be - reviewed in the FortiCNAPP UI.
- {{ gcp_compliance_data.critical_details.to_html().replace("\\n","+ This report displays Critical vulnerabilities with CVSS score 10.0 (the highest severity). + The Risk Score shown represents the vulnerability impact, which is calculated based on: +
++ Note: Risk Score differs from CVSS score. CVSS measures vulnerability severity, while Risk Score measures blast radius and organizational impact. +
++ Achieving and maintaining cloud compliance requires a systematic approach combining automation, continuous monitoring, and proactive remediation. Follow these best practices to strengthen your compliance posture: +
+Deploy automated tools like FortiCNAPP to continuously scan cloud environments for configuration drift, policy violations, and compliance gaps. Real-time monitoring enables immediate detection and faster remediation of non-compliant resources before they become security risks.
+Configure automated responses for common compliance violations such as open security groups, unencrypted storage, or missing tags. Use Infrastructure-as-Code (IaC) to enforce compliant configurations and prevent manual misconfigurations.
+Address critical findings first, focusing on publicly exposed resources, data encryption gaps, IAM misconfigurations, and logging deficiencies. These pose the highest risk to your security posture and regulatory standing.
+Define compliance policies as code to enforce security standards across all cloud accounts and environments. Use tools like Terraform, CloudFormation, or Azure Policy to codify CIS benchmarks, NIST frameworks, and regulatory requirements.
+Ensure CloudTrail (AWS), Activity Logs (Azure), and Cloud Audit Logs (GCP) are enabled across all regions and accounts. Centralize logs in a SIEM or log analytics platform for compliance reporting and forensic analysis.
+Schedule recurring compliance scans (weekly or monthly) to track remediation progress and identify new violations. Compare results over time to measure improvement and demonstrate compliance to auditors.
+Review and restrict IAM permissions to the minimum required for each role. Remove unused accounts, enforce MFA, rotate credentials regularly, and monitor privileged access with session recording and just-in-time access.
+Maintain compliance documentation including policies, procedures, remediation tracking, and audit reports. Generate executive dashboards showing compliance scores, trend analysis, and remediation velocity for stakeholders and auditors.
++ Cloud environments are dynamic—resources are created, modified, and deleted constantly. Point-in-time compliance scans provide only a snapshot. + Continuous compliance monitoring ensures your security posture remains strong 24/7 by detecting drift immediately and enabling rapid response to new violations. +
++ FortiCNAPP provides real-time compliance monitoring across AWS, Azure, and GCP with automated detection, prioritized remediation guidance, and executive reporting to maintain continuous compliance. +
+Based on the findings of this assessment, we recommend the following action plan:
+Engage with your Fortinet account team and partner to review service offerings and prioritize remediation efforts.
+