Ransomware attack prevention standard
This ruleset contains security requirements to reduce risks from ransomware attacks in the Yandex Cloud cloud infrastructure.
Ransomware is one of the most common and destructive types of cyberattacks: attackers encrypt the victim's data and demand a ransom for recovery. In cloud environments, ransomware attacks can affect object storages, virtual machine disks, databases, and backups.
Complying with these requirements helps ensure protection against ransomware attacks and mitigate the consequences of a successful attack:
|
Requirement ID |
Requirement |
Check ID in the CSPM module |
|
Yandex ID accounts are used only in exceptional cases |
||
|
Service accounts have minimal privileges. |
cspm.access.sa-privileges-org-roles |
|
|
Service account keys are periodically rotated. |
||
|
Two-factor authentication for privileged accounts is in place. |
||
|
The Object lock feature is enabled in Object Storage. |
||
|
Disk and database backups are in place. |
||
|
The last service account authentication date is tracked in Identity and Access Management. |
||
|
The date of last access key use is tracked in Identity and Access Management. |
||
|
Yandex Audit Trails is enabled. |