Integrations · Cloud Providers
Azure ChinaCloud
ProofTrail connects to Azure ChinaCloud through its API, as infrastructure monitoring, access review. Each sync feeds the checks below, and a failing check opens a task for its owner.
Cloud Monitoring Data
Track cloud resources and their configuration: encryption, backups, network exposure, logging and identities. Synced every 12 hours.
- Infra provider should be configured
- Infrastructure resource should have an owner
- Database should be encrypted at rest
- Storage should be encrypted at rest
- Database backups should be enabled
- Storage versioning should be enabled
- Resource should be protected from direct internet traffic
- Network access rules should deny by default
- TLS should be enforced for connections
- Production endpoints should be served over HTTPS
- Audit logs should be enabled
- Resource health should be monitored
- Cloud console users should have MFA enabled
- Cloud root account should be protected with MFA and unused
- Cloud credentials unused for 90 days should be disabled
- Threat detection should be enabled
- Compute disks should be encrypted
- Administrative ports should not be open to the internet
- Network flow logs should be enabled
- Production databases should have deletion protection
- Production databases should be highly available
- Database backups should be kept for at least 7 days
- Encryption keys should be rotated automatically
- Secret vaults should be protected against deletion
- Cloud console password policy should be strong
- Cloud root account should not be used for daily work
- Cloud access keys should be rotated every 90 days
- Container images should be scanned on push
- Container registry admin user should be disabled
- Audit log file integrity validation should be enabled
- Storage access logging should be enabled
- Instance metadata service should require session tokens
- Load balancers should only negotiate TLS 1.2 or later
- Monitoring alerts should notify an on-call channel
- Infra entity should be classified
- Disks and analytics workspaces should be backed up
- Database infrastructure double encryption should be enabled
Access Control Data
Sync user accounts to ensure access is granted only to authorized personnel. Synced every 24 hours.
- Rules for who can access critical systems should be configured
- User access to critical system should be valid
- User should be identified
- User should have MFA enabled
- MFA should be enforced on critical system
- Periodic review of access to critical systems should be completed
- Access should be removed for offboarded user
- User should be identified (for access systems outside the audit scope)
- User access to critical system should be valid (for access systems outside the audit scope)
- User should have MFA enabled (for access systems outside the audit scope)
- MFA should be enforced on critical system (for access systems outside the audit scope)
- Access should be removed for offboarded user (for access systems outside the audit scope)