What this control covers
Utilize an active discovery tool to identify assets connected to the enterprise's network. Configure the active discovery tool to execute daily, or more frequently.
Why it matters
A defended network limits blast radius after an initial compromise — the difference between an incident and a breach is often the controls described here.
How to implement
AWS
Segment workloads into separate VPCs/accounts per environment. Use security groups as stateful allow-lists (least-port, source by SG ID not 0.0.0.0/0) and VPC Flow Logs to CloudWatch/S3. Front public services with AWS WAF + Shield Advanced and use PrivateLink/VPC Endpoints to keep service traffic off the internet.
Azure
Use Network Security Groups and Application Security Groups for east-west, and an Azure Firewall or NVA in a hub VNet for north-south. Enforce Private Endpoints for PaaS and turn on Defender for Cloud — Network for adaptive hardening recommendations.
GCP
Use VPC Service Controls to draw a perimeter around sensitive APIs and a hierarchical Firewall policy at the org/folder level so projects inherit a deny-by-default posture. Front HTTP workloads with the global Cloud Load Balancer + Cloud Armor.
Evidence to collect
infra_scan— See the iCompaas Evidence library for the canonical source for this evidence type.
Infrastructure posture tooling (AWS Config, Azure Policy, Nessus) verifies platform hardening. Focus: Utilize an Active Discovery Tool.
Quick checklist
- Utilize — Network / Active Discovery Tool
- Configure — Network / Active Discovery Tool
Related articles on this site
- Microsoft Cloud Security Posture Management (CSPM)
- 2.10 Ensure that Microsoft Cloud App Security (MCAS) integration with Security Center is selected
- Ensure that Activity Log Alert exists for Create or Update Network Security Group
- 5.2.4 Ensure that Activity Log Alert exists for Delete Network Security Group