Profile Applicability:

  • Level 2

Description:

To ensure secure communication, all connections to App Engine applications should be secured by HTTPS by default. This prevents sensitive data from being transmitted over insecure channels.

Rationale:

Insecure HTTP connections are vulnerable to eavesdropping and man-in-the-middle attacks, potentially exposing sensitive data such as user credentials and other private information. By enforcing HTTPS connections, applications ensure secure, encrypted communication between the client and server.

Impact:

All incoming HTTP connections will be automatically redirected to the corresponding HTTPS endpoint. This guarantees that all traffic is encrypted using TLS.

Default Value:

By default, App Engine applications support both HTTP and HTTPS connections. However, HTTPS is not enforced unless explicitly configured.

Audit Steps:

Check Configuration in app.yaml File:

  1. Locate the app.yaml file for the application.

Verify that the following configuration exists to enforce secure connections:

handlers:
- url: /.*
  secure: always
  redirect_http_response_code: 301
  script: auto

Remediation Steps:

Modify the app.yaml File:

  1. Open the app.yaml file for the application.

Add or modify the configuration to enforce HTTPS connections:

handlers:
- url: /.*
  secure: always
  redirect_http_response_code: 301
  script: auto

Redeploy the application to App Engine:

gcloud app deploy


Backout Plan:

Disable Confidential Computing: If confidential computing needs to be disabled, run the following command to disable it on an existing instance:

gcloud compute instances update [INSTANCE_NAME] \
--zone [ZONE] \
--no-confidential-compute

  • This command will remove confidential computing settings from the instance.

  1. Revert to Previous Instance Configuration: If you need to revert to the previous instance configuration, restore the instance to its original settings or recreate the VM without the confidential computing option.

  2. Test and Verify: After rolling back, verify that the instance is working as expected and that confidential computing is no longer enabled.

Notify Stakeholders: Notify the relevant teams and stakeholders about the backout and any operational impact it might have on workloads.

References:

  1. App Engine app.yaml Configuration Reference

CIS Controls:

Control

Description

IG 1

IG 2

IG 3

3.10 Encrypt Sensitive Data in Transit

Encrypt all sensitive data in transit using mechanisms such as TLS or SSH.


16.11 Leverage Vetted Security Components

Use vetted and secure modules for application security components like encryption and authentication to minimize implementation errors.


18.5 Use Standard Encryption Algorithms

Ensure the use of standardized and extensively reviewed encryption algorithms to protect sensitive data.