Profile Applicability:

  • Level 2

Description:

To ensure secure communication, all connections to App Engine applications should be secured by HTTPS by default. This prevents sensitive data from being transmitted over insecure channels.

Rationale:

Insecure HTTP connections are vulnerable to eavesdropping and man-in-the-middle attacks, potentially exposing sensitive data such as user credentials and other private information. By enforcing HTTPS connections, applications ensure secure, encrypted communication between the client and server.

Impact:

All incoming HTTP connections will be automatically redirected to the corresponding HTTPS endpoint. This guarantees that all traffic is encrypted using TLS.

Default Value:

By default, App Engine applications support both HTTP and HTTPS connections. However, HTTPS is not enforced unless explicitly configured.

Audit Steps:

Check Configuration in app.yaml File:

  1. Locate the app.yaml file for the application.

Verify that the following configuration exists to enforce secure connections:

handlers:
- url: /.*
  secure: always
  redirect_http_response_code: 301
  script: auto

Remediation Steps:

Modify the app.yaml File:

  1. Open the app.yaml file for the application.

Add or modify the configuration to enforce HTTPS connections:

handlers:
- url: /.*
  secure: always
  redirect_http_response_code: 301
  script: auto

Redeploy the application to App Engine:

gcloud app deploy


Backout Plan:

Disable Confidential Computing: If confidential computing needs to be disabled, run the following command to disable it on an existing instance:

gcloud compute instances update [INSTANCE_NAME] \
--zone [ZONE] \
--no-confidential-compute

  • This command will remove confidential computing settings from the instance.

  1. Revert to Previous Instance Configuration: If you need to revert to the previous instance configuration, restore the instance to its original settings or recreate the VM without the confidential computing option.

  2. Test and Verify: After rolling back, verify that the instance is working as expected and that confidential computing is no longer enabled.

Notify Stakeholders: Notify the relevant teams and stakeholders about the backout and any operational impact it might have on workloads.

References:

  1. App Engine app.yaml Configuration Reference

CIS Controls:

Control

Description

IG 1

IG 2

IG 3

3.10 Encrypt Sensitive Data in Transit

Encrypt all sensitive data in transit using mechanisms such as TLS or SSH.

✅

✅


16.11 Leverage Vetted Security Components

Use vetted and secure modules for application security components like encryption and authentication to minimize implementation errors.

✅

✅


18.5 Use Standard Encryption Algorithms

Ensure the use of standardized and extensively reviewed encryption algorithms to protect sensitive data.

✅

✅