The 33 DigitalOcean security checks Black Cat runs
Black Cat SSPM evaluates 33 security policies against your DigitalOcean configuration on every scan, classifies each finding by risk, and provides remediation steps. Browse them by topic below.
How to connect DigitalOcean — what access Black Cat needs, and why.
Encryption, keys & secrets
4 checks · highest severity: high
Network security
7 checks · highest severity: critical
Configuration hardening
16 checks · highest severity: high
Encryption, keys & secrets (4)
- SSL Not Enforced severity: high
- No SSL Termination severity: high
- Insecure Backend severity: medium
- HTTP Allowed severity: medium
Network security (7)
- No VPC severity: high
- No Firewall severity: critical
- Allows All Inbound severity: high
- SSH Open To All severity: critical
- Allows All Outbound severity: medium
- Publicly Accessible severity: critical
- Default VPC Used severity: low
Configuration hardening (16)
- Email Not Verified severity: medium
- Backups Disabled severity: medium
- IPv6 Disabled severity: low
- No Droplets Attached severity: low
- Outdated Version severity: medium
- No Backups severity: medium
- Outdated Kubernetes Version severity: medium
- Auto Upgrade Disabled severity: medium
- Surge Upgrade Disabled severity: low
- No Garbage Collection severity: low
- Basic Tier severity: info
- Kubernetes HA Disabled severity: high
- Kubernetes No Registry Integration severity: medium
- Database No Maintenance Window severity: medium
- Database Single Node severity: high
- Droplet Powered Off severity: low
Other checks (6)
severity: high Weak SSH Key fix difficulty: medium #
Replace weak RSA SSH keys with Ed25519 or ECDSA keys
- Generate a new strong key locally with `ssh-keygen -t ed25519 -C "your_email@example.com"`
- Log in to the DigitalOcean Cloud Control Panel
- Navigate to Settings > Security (or Account > Security) and click "Add SSH Key"
- Paste the new public key and save it
- Update the Droplet's `~/.ssh/authorized_keys` to include the new key and remove the old weak key
- Delete the old weak SSH key from Account > Security to prevent future use
Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.1 CIS Controls v8 CIS-06.1 NIST CSF 2.0 PR.AA-05 GDPR (SaaS Security) GDPR-25.2 HIPAA (SaaS Security) HIPAA-312.a NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2
severity: medium Kubernetes SSO Not Enabled fix difficulty: medium #
Enable OIDC SSO for the Kubernetes cluster
- Log in to the DigitalOcean control panel
- Navigate to Kubernetes > Clusters
- Select the target cluster
- Under Authentication, enable "OIDC Single Sign-On"
- Configure your OIDC identity provider URL and client credentials
- Save the configuration and verify kubectl access via SSO
Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.1 CIS Controls v8 CIS-06.1 NIST CSF 2.0 PR.AA-05 GDPR (SaaS Security) GDPR-25.2 HIPAA (SaaS Security) HIPAA-312.a NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2
severity: high Plain Text Env Var fix difficulty: easy #
Convert sensitive environment variables to encrypted App Platform secrets
- Log in to the DigitalOcean Cloud Control Panel
- Navigate to Manage > Apps and click the affected application name
- Select the "Settings" tab and go to "App-Level Environment Variables"
- Identify variables that contain sensitive values (tokens, passwords, keys)
- Click "Edit" next to each sensitive variable and change its type from "Plaintext" to "Secret"
- Save and redeploy the application; verify the variable value is masked in the UI
Satisfies: ISO 27001:2022 A.8.12 SOC 2 Type II CC6.7 CIS Controls v8 CIS-03.1 NIST CSF 2.0 PR.DS-01 GDPR (SaaS Security) GDPR-5.1f.iii HIPAA (SaaS Security) HIPAA-308.a4 NIS2 Directive NIS2-21.a.3 DORA (SaaS Security) DORA-9.11
severity: low Monitoring Disabled fix difficulty: easy #
Install the DigitalOcean monitoring agent on the Droplet
- Log in to the DigitalOcean Cloud Control Panel
- Navigate to Manage > Droplets and click the affected Droplet name
- Select the "Graphs" tab; if the agent is not installed a banner will appear
- Follow the on-screen instructions to install the monitoring agent via SSH
- Alternatively, SSH into the Droplet and run the install script shown in the panel
- Reload the Graphs tab to confirm metrics are being collected
Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC7.2 CIS Controls v8 CIS-08 NIST CSF 2.0 DE.CM GDPR (SaaS Security) GDPR-32.1d HIPAA (SaaS Security) HIPAA-312.b NIS2 Directive NIS2-21.b.2 DORA (SaaS Security) DORA-10.1
severity: medium Single Node Cluster fix difficulty: medium #
Add additional nodes or node pools to the DOKS cluster for high availability
- Log in to the DigitalOcean Cloud Control Panel
- Navigate to Manage > Kubernetes and click the affected cluster name
- Select the "Nodes" tab
- Click "Add Node Pool" or resize the existing node pool to at least 2 nodes
- Choose an appropriate Droplet size and the desired number of nodes
- Save and wait for the new nodes to enter the Ready state
Satisfies: GDPR (SaaS Security) GDPR-32.1c NIS2 Directive NIS2-21.c DORA (SaaS Security) DORA-12.1
severity: medium No Health Check fix difficulty: easy #
Configure a health check on the load balancer to detect and remove unhealthy backends
- Log in to the DigitalOcean Cloud Control Panel
- Navigate to Networking > Load Balancers and click the affected load balancer name
- Select the "Settings" tab and locate "Health Checks"
- Click "Edit" and set the protocol (HTTP or TCP), port, and path (e.g. `/health`)
- Configure check interval, response timeout, and unhealthy threshold values
- Save and verify that backend Droplets show a healthy status in the Droplets tab
Satisfies: NIS2 Directive NIS2-21.c DORA (SaaS Security) DORA-12.1