Skip to content

The 33 DigitalOcean security checks Black Cat runs

Black Cat SSPM evaluates 33 security policies against your DigitalOcean configuration on every scan, classifies each finding by risk, and provides remediation steps. Browse them by topic below.

How to connect DigitalOcean — what access Black Cat needs, and why.

Encryption, keys & secrets (4)

Network security (7)

Configuration hardening (16)

Other checks (6)

severity: high Weak SSH Key fix difficulty: medium #

Replace weak RSA SSH keys with Ed25519 or ECDSA keys

  1. Generate a new strong key locally with `ssh-keygen -t ed25519 -C "your_email@example.com"`
  2. Log in to the DigitalOcean Cloud Control Panel
  3. Navigate to Settings > Security (or Account > Security) and click "Add SSH Key"
  4. Paste the new public key and save it
  5. Update the Droplet's `~/.ssh/authorized_keys` to include the new key and remove the old weak key
  6. Delete the old weak SSH key from Account > Security to prevent future use

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.1 CIS Controls v8 CIS-06.1 NIST CSF 2.0 PR.AA-05 GDPR (SaaS Security) GDPR-25.2 HIPAA (SaaS Security) HIPAA-312.a NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: medium Kubernetes SSO Not Enabled fix difficulty: medium #

Enable OIDC SSO for the Kubernetes cluster

  1. Log in to the DigitalOcean control panel
  2. Navigate to Kubernetes > Clusters
  3. Select the target cluster
  4. Under Authentication, enable "OIDC Single Sign-On"
  5. Configure your OIDC identity provider URL and client credentials
  6. Save the configuration and verify kubectl access via SSO

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.1 CIS Controls v8 CIS-06.1 NIST CSF 2.0 PR.AA-05 GDPR (SaaS Security) GDPR-25.2 HIPAA (SaaS Security) HIPAA-312.a NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: high Plain Text Env Var fix difficulty: easy #

Convert sensitive environment variables to encrypted App Platform secrets

  1. Log in to the DigitalOcean Cloud Control Panel
  2. Navigate to Manage > Apps and click the affected application name
  3. Select the "Settings" tab and go to "App-Level Environment Variables"
  4. Identify variables that contain sensitive values (tokens, passwords, keys)
  5. Click "Edit" next to each sensitive variable and change its type from "Plaintext" to "Secret"
  6. Save and redeploy the application; verify the variable value is masked in the UI

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.12 SOC 2 Type II CC6.7 CIS Controls v8 CIS-03.1 NIST CSF 2.0 PR.DS-01 GDPR (SaaS Security) GDPR-5.1f.iii HIPAA (SaaS Security) HIPAA-308.a4 NIS2 Directive NIS2-21.a.3 DORA (SaaS Security) DORA-9.11

severity: low Monitoring Disabled fix difficulty: easy #

Install the DigitalOcean monitoring agent on the Droplet

  1. Log in to the DigitalOcean Cloud Control Panel
  2. Navigate to Manage > Droplets and click the affected Droplet name
  3. Select the "Graphs" tab; if the agent is not installed a banner will appear
  4. Follow the on-screen instructions to install the monitoring agent via SSH
  5. Alternatively, SSH into the Droplet and run the install script shown in the panel
  6. Reload the Graphs tab to confirm metrics are being collected

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC7.2 CIS Controls v8 CIS-08 NIST CSF 2.0 DE.CM GDPR (SaaS Security) GDPR-32.1d HIPAA (SaaS Security) HIPAA-312.b NIS2 Directive NIS2-21.b.2 DORA (SaaS Security) DORA-10.1

severity: medium Single Node Cluster fix difficulty: medium #

Add additional nodes or node pools to the DOKS cluster for high availability

  1. Log in to the DigitalOcean Cloud Control Panel
  2. Navigate to Manage > Kubernetes and click the affected cluster name
  3. Select the "Nodes" tab
  4. Click "Add Node Pool" or resize the existing node pool to at least 2 nodes
  5. Choose an appropriate Droplet size and the desired number of nodes
  6. Save and wait for the new nodes to enter the Ready state

Vendor docs ↗

Satisfies: GDPR (SaaS Security) GDPR-32.1c NIS2 Directive NIS2-21.c DORA (SaaS Security) DORA-12.1

severity: medium No Health Check fix difficulty: easy #

Configure a health check on the load balancer to detect and remove unhealthy backends

  1. Log in to the DigitalOcean Cloud Control Panel
  2. Navigate to Networking > Load Balancers and click the affected load balancer name
  3. Select the "Settings" tab and locate "Health Checks"
  4. Click "Edit" and set the protocol (HTTP or TCP), port, and path (e.g. `/health`)
  5. Configure check interval, response timeout, and unhealthy threshold values
  6. Save and verify that backend Droplets show a healthy status in the Droplets tab

Vendor docs ↗

Satisfies: NIS2 Directive NIS2-21.c DORA (SaaS Security) DORA-12.1

The information on this page is provided for general informational purposes and is believed to be accurate as of its most recent update. Product names, logos, and trademarks are the property of their respective owners and are used for identification purposes only; their use does not imply any affiliation with or endorsement by those owners. Descriptions of third-party applications and of compliance frameworks are based on publicly available documentation and may change over time.

See these checks run on your stack

Start a free 14-day trial — no credit card required.

Start Free Trial