Configuring Host Vulnerability Assessment (HVA)

Before you can begin assessing hosts in your environment for vulnerabilities, some configuration is required within the relevant CSP associated with your cloud environments as well as within InsightCloudSec.

Support

InsightCloudSec supports assessing the following host types with a size of 100GB or less:

• AWS EC2 - Windows or Linux
• Azure Virtual Machine (VM) - Windows or Linux
• Google Compute Engine - Windows or Linux

Prerequisites

• InsightCloudSec Admin permissions (Domain or Org Admin)
• Appropriate permissions in AWS, Azure, and/or GCP:
  • For you to create roles or policies
  • For InsightCloudSec to execute host assessments (outlined in the following sections)

AWS

The permissions included in this section are required to enable host assessments within AWS environments. Also included in this section is the standard HVA policy that is used with the universal AWS onboarding experience. You have two options for enabling HVA for AWS:

1. Navigate to the IAM policy associated with InsightCloudSec and manually add the AWS HVA Permissions to it
2. Attach the AWS HVA Policy to the role associated with InsightCloudSec

Azure

The permissions included in this section are required to enable host assessments within Azure environments. Also included in this section is a standard HVA policy that can be used during the universal Azure onboarding experience. You have two options for enabling HVA for Azure:

1. Navigate to the role associated with InsightCloudSec and manually add the Azure HVA Permissions to it
2. Attach the Azure HVA Role to the role associated with InsightCloudSec

json
1
{
2
    "properties": {
3
        "roleName": "Disk Access for Host Vulnerability Assessment",
4
        "description": "Read Disk Properties, Revoke and Generate SAS URLs, Create and Delete Snapshots",
5
        "assignableScopes": [
6
            "/subscriptions/<subscription-id>"
7
        ],
8
        "permissions": [
9
            {
10
                "actions": [
11
                    "Microsoft.Compute/snapshots/read",
12
                    "Microsoft.Compute/snapshots/write",
13
                    "Microsoft.Compute/snapshots/delete",
14
                    "Microsoft.Compute/snapshots/beginGetAccess/action",
15
                    "Microsoft.Compute/snapshots/endGetAccess/action",
16
                    "Microsoft.Compute/disks/read",
17
                    "Microsoft.Compute/disks/beginGetAccess/action"
18
                ],
19
                "notActions": [],
20
                "dataActions": [],
21
                "notDataActions": []
22
            }
23
        ]
24
    }
25
}

Azure HVA Limitations

HVA for Azure does not support:

• VMWare vSphere VMs or Azure Classic VMs (EOL in September 2023)
• Disks with data access authentication mode enabled
• Disks encrypted with customer-provided keys. Review the Azure Blog for more information

GCP

For GCP HVA, InsightCloudSec supports in-cloud assessment, which means all disk snapshots and scans occur in your GCP environment. InsightCloudSec creates disk snapshots and copies them directly to an InsightCloudSec-owned GCP project where the assessment and any other necessary operations are performed, minimizing cost to you.

To accomplish in-cloud assessment, GCP HVA uses a separate in-cloud service account that is owned by InsightCloudsec and created for each user instead of using the service account associated with normal InsightCloudSec harvesting. This special service account can be created from InsightCloudSec. To enable HVA for GCP:

1. Log in to the GCP Console and navigate to the relevant project.
2. Create a custom role that contains the GCP HVA Permissions. Review the GCP documentation for more information on creating a role.
   • If you use CMEK-encrypted disks, you'll also need to grant specific permissions to the InsightCloudSec Compute Engine Service Agent. Review the GCP HVA Permissions section for more information.
3. Login to InsightCloudSec and navigate to Vulnerabilities > Vulnerability Settings.
4. Click Generate Service Account.
5. Click Copy and Open GCP Console.
6. Grant the created service account the custom HVA role you just created. Review the GCP documentation for more information on granting a role.

GCP HVA Limitations

GCP HVA support is limited by the following:

• Cannot assess instances with disks encrypted by a Customer Supplied Encryption Key
• Cannot assess Local SSDs

Configuring HVA

Before hosts can be regularly assessed for vulnerabilities, you must enable the feature and properly scope the hosts that should be assessed. These configuration settings (and others) can be found on the Vulnerability Settings page, which is accessed from the Vulnerabilities page.

Enabling Assessments

1. Login to InsightCloudSec and navigate to the Vulnerabilities page.
2. Click Settings.
3. Navigate to the Host Assessment tab.
4. Click the Enable Host Vulnerability Assessment toggle. The Assessment Scope section appears.

Scoping Assessments

After enabling the feature, you must scope your environment to the hosts that should be assessed. Scoping relies on the Advanced Filtering mechanism seen throughout InsightCloudSec.

After the feature has been enabled and a scope has been applied, InsightCloudSec will begin reporting on the assessment coverage for the scoped cloud accounts. Click the Coverage graph to open the Assessment Coverage window, which shows a detailed report, including progress summary and assessment errors for the InsightCloudSec organization grouped by cloud account.

In-region Assessment Mapping

In this section, you can find the region that InsightCloudSec runs assessments in based on which region the host is located for each supported Cloud Service Provider (CSP) -- AWS, GCP, and Azure.

To change the region assessment mapping:

1. Login to InsightCloudSec and navigate to the Vulnerabilities page.
2. Click Settings.
3. Navigate to the Host Assessment tab.
4. Navigate to the CSP you wish to update the mapping for.
5. Update the Run Assessment In drop-down menu for the desired new region.

Downloading Assessment History

Click the Download Assessment History button to download all Host-related assessment history.

Troubleshooting

If you're experiencing issues harvesting and assessing hosts, review the Cloud VM HVA FAQ or contact support.

Using Cloud VM

Cloud VM is available from the main navigation in InsightCloudSec under Security > Vulnerabilities. Review the Vulnerability Management User Guide for more information.