cloud-report
Version:
Collects and analyzes cloud resources
180 lines (179 loc) • 8.59 kB
JavaScript
;
Object.defineProperty(exports, "__esModule", { value: true });
const types_1 = require("../../../types");
const base_1 = require("../../base");
class PasswordPolicyAnalyzer extends base_1.BaseAnalyzer {
analyze(params, fullReport) {
const password_policy_report = params.password_policy;
const password_policy = { type: types_1.CheckAnalysisType.Security };
password_policy.what = "Is account password policy following best practices?";
password_policy.why = `It is important to have secure password policy as
leaked or weak passwords can give direct access to attackers`;
password_policy.recommendation = "Recommended to have secure password policy";
password_policy.benchmark = ['all', 'cis'];
const analysis = [];
if (!password_policy_report) {
analysis.push({
action: "Add strong password policy for the account",
message: "Account does not have password policy",
resourceSummary: {
name: "Resource",
value: "Password Policy",
},
severity: types_1.SeverityStatus.Failure,
});
password_policy.regions = { global: analysis };
return { password_policy };
}
const minimumPasswordLengthAnalysis = {
resourceSummary: {
name: "Option",
value: "Minimum Password Length",
},
};
if (password_policy_report.MinimumPasswordLength < 8) {
minimumPasswordLengthAnalysis.severity = types_1.SeverityStatus.Failure;
minimumPasswordLengthAnalysis.message = "Password length should at least 8";
minimumPasswordLengthAnalysis.action = "Set this to 8";
}
else {
minimumPasswordLengthAnalysis.severity = types_1.SeverityStatus.Good;
minimumPasswordLengthAnalysis.message = "This has a recommended value";
}
analysis.push(minimumPasswordLengthAnalysis);
const passwordRequireSymbolsAnalysis = {
resourceSummary: {
name: "Option",
value: "Require Symbols",
},
};
if (!password_policy_report.RequireSymbols) {
passwordRequireSymbolsAnalysis.severity = types_1.SeverityStatus.Failure;
passwordRequireSymbolsAnalysis.message = "Strong password requires symbols";
passwordRequireSymbolsAnalysis.action = "Enable this";
}
else {
passwordRequireSymbolsAnalysis.severity = types_1.SeverityStatus.Good;
passwordRequireSymbolsAnalysis.message = "Already Enabled";
}
analysis.push(passwordRequireSymbolsAnalysis);
const passwordRequireNumbersAnalysis = {
resourceSummary: {
name: "Option",
value: `Require Numbers`,
},
};
if (!password_policy_report.RequireNumbers) {
passwordRequireNumbersAnalysis.severity = types_1.SeverityStatus.Failure;
passwordRequireNumbersAnalysis.message = "Strong password requires numbers";
passwordRequireNumbersAnalysis.action = "Enable this";
}
else {
passwordRequireNumbersAnalysis.severity = types_1.SeverityStatus.Good;
passwordRequireNumbersAnalysis.message = "Already Enabled";
}
analysis.push(passwordRequireNumbersAnalysis);
const passwordRequireUppercaseCharactersAnalysis = {
resourceSummary: {
name: "Option",
value: "Require Uppercase Characters",
},
};
if (!password_policy_report.RequireUppercaseCharacters) {
passwordRequireUppercaseCharactersAnalysis.severity = types_1.SeverityStatus.Failure;
passwordRequireUppercaseCharactersAnalysis.message = "Strong password requires upper case letters";
passwordRequireUppercaseCharactersAnalysis.action = "Enable this";
}
else {
passwordRequireUppercaseCharactersAnalysis.severity = types_1.SeverityStatus.Good;
passwordRequireUppercaseCharactersAnalysis.message = "Already Enabled";
}
analysis.push(passwordRequireUppercaseCharactersAnalysis);
const passwordRequireLowercaseCharactersAnalysis = {
resourceSummary: {
name: "Option",
value: "Require Lowercase Characters",
},
};
if (!password_policy_report.RequireLowercaseCharacters) {
passwordRequireLowercaseCharactersAnalysis.severity = types_1.SeverityStatus.Failure;
passwordRequireLowercaseCharactersAnalysis.message = "Strong password requires lower case letters";
passwordRequireLowercaseCharactersAnalysis.action = "Enable this";
}
else {
passwordRequireLowercaseCharactersAnalysis.severity = types_1.SeverityStatus.Good;
passwordRequireLowercaseCharactersAnalysis.message = "Already Enabled";
}
analysis.push(passwordRequireLowercaseCharactersAnalysis);
const expirePasswordsAnalysis = {
resourceSummary: {
name: "Option",
value: "Expire Passwords",
},
};
if (!password_policy_report.ExpirePasswords) {
expirePasswordsAnalysis.severity = types_1.SeverityStatus.Failure;
expirePasswordsAnalysis.message = `To enforce regular change of passwords,
it should be expired after certian time`;
expirePasswordsAnalysis.action = "Enable this";
}
else {
expirePasswordsAnalysis.severity = types_1.SeverityStatus.Good;
expirePasswordsAnalysis.message = "Already Enabled";
}
analysis.push(expirePasswordsAnalysis);
const maxPasswordAgeAnalysis = {
resourceSummary: {
name: "Option",
value: "Max Password Age",
},
};
if (!password_policy_report.MaxPasswordAge) {
maxPasswordAgeAnalysis.severity = types_1.SeverityStatus.Failure;
maxPasswordAgeAnalysis.message = "Password should be change at lease once in 90 days";
maxPasswordAgeAnalysis.action = "Set this to 90";
}
else {
maxPasswordAgeAnalysis.severity = types_1.SeverityStatus.Good;
maxPasswordAgeAnalysis.message = "This has a recommended value";
}
analysis.push(maxPasswordAgeAnalysis);
const passwordReusePreventionAnalysis = {
resourceSummary: {
name: "Option",
value: "Password Reuse Prevention",
},
};
if (!password_policy_report.PasswordReusePrevention) {
passwordReusePreventionAnalysis.severity = types_1.SeverityStatus.Failure;
passwordReusePreventionAnalysis.message = `New password shouldn't be
same as at least last 3 used passwords`;
passwordReusePreventionAnalysis.action = "Set this to 3";
}
else {
passwordReusePreventionAnalysis.severity = types_1.SeverityStatus.Good;
passwordReusePreventionAnalysis.message = "This has a recommended value";
}
analysis.push(passwordReusePreventionAnalysis);
const passwordHardExpiryAnalysis = {
resourceSummary: {
name: "Option",
value: "Hard Expiry",
},
};
if (!password_policy_report.HardExpiry) {
passwordHardExpiryAnalysis.severity = types_1.SeverityStatus.Warning;
passwordHardExpiryAnalysis.message = "User should contact the admin to reset the expired password";
passwordHardExpiryAnalysis.action = `Set this to true. Use caution here if
there is only admin for your account then don't set this`;
}
else {
passwordHardExpiryAnalysis.severity = types_1.SeverityStatus.Good;
passwordHardExpiryAnalysis.message = "This has a recommended value";
}
analysis.push(passwordHardExpiryAnalysis);
password_policy.regions = { global: analysis };
return { password_policy };
}
}
exports.PasswordPolicyAnalyzer = PasswordPolicyAnalyzer;