DigitalOcean encryption, keys & secrets security checks
Encryption at rest and in transit, key rotation, and the API keys, tokens and credentials that outlive the people who created them.
On DigitalOcean, Black Cat runs 4 checks in this area on every scan. Each one below lists its severity, how to fix it, and the compliance controls it satisfies where a control applies. See what access the DigitalOcean connector needs.
Checks (4)
severity: high SSL Not Enforced fix difficulty: medium #
Enforce SSL/TLS connections to the managed database cluster
- Log in to the DigitalOcean Cloud Control Panel
- Navigate to Manage > Databases and click the affected database cluster name
- Select the "Settings" tab and locate the "Connection" or "SSL" section
- Enable the "Require SSL" option and save
- Update all application connection strings to use SSL mode (e.g. `sslmode=require` for PostgreSQL)
- Verify connections succeed and that plain-text connections are refused
Satisfies: ISO 27001:2022 A.8.24 SOC 2 Type II CC6.1 CIS Controls v8 CIS-03.10 NIST CSF 2.0 PR.DS-02 GDPR (SaaS Security) GDPR-5.1f.i HIPAA (SaaS Security) HIPAA-312.e NIS2 Directive NIS2-21.h DORA (SaaS Security) DORA-9.7
severity: high No SSL Termination fix difficulty: medium #
Add an HTTPS forwarding rule with a TLS certificate to the load balancer
- Log in to the DigitalOcean Cloud Control Panel
- Navigate to Networking > Load Balancers and click the affected load balancer name
- Select the "Settings" tab and locate "Forwarding Rules"
- Click "Edit" and add a rule: Entry Protocol HTTPS (port 443), Target Protocol HTTP or HTTPS
- Upload or select a TLS certificate (you can use a Let's Encrypt certificate via the panel)
- Save the rule and verify HTTPS traffic is correctly forwarded to backend Droplets
Satisfies: ISO 27001:2022 A.8.24 SOC 2 Type II CC6.1 CIS Controls v8 CIS-03.10 NIST CSF 2.0 PR.DS-02 GDPR (SaaS Security) GDPR-5.1f.i GDPR (SaaS Security) GDPR-44.2 HIPAA (SaaS Security) HIPAA-312.e NIS2 Directive NIS2-21.h DORA (SaaS Security) DORA-9.7
severity: medium Insecure Backend fix difficulty: medium #
Update load balancer forwarding rules to use HTTPS as the backend target protocol
- Log in to the DigitalOcean Cloud Control Panel
- Navigate to Networking > Load Balancers and click the affected load balancer name
- Select the "Settings" tab and locate "Forwarding Rules"
- Click "Edit" and change the Target Protocol for existing rules from HTTP to HTTPS
- Ensure backend Droplets are configured to serve TLS on the target port
- Save the changes and verify end-to-end encrypted traffic is working correctly
Satisfies: ISO 27001:2022 A.8.24 SOC 2 Type II CC6.1 CIS Controls v8 CIS-03.10 NIST CSF 2.0 PR.DS-02 GDPR (SaaS Security) GDPR-5.1f.i HIPAA (SaaS Security) HIPAA-312.e NIS2 Directive NIS2-21.h DORA (SaaS Security) DORA-9.7
severity: medium HTTP Allowed fix difficulty: easy #
Enforce HTTPS-only access for the App Platform application
- Log in to the DigitalOcean Cloud Control Panel
- Navigate to Manage > Apps and click the affected application name
- Select the "Settings" tab and go to the "Domains" section
- Enable the "Redirect HTTP to HTTPS" or "Force HTTPS" option for each domain
- Save the settings and test that HTTP requests are redirected to HTTPS
Satisfies: ISO 27001:2022 A.8.24 SOC 2 Type II CC6.1 CIS Controls v8 CIS-03.10 NIST CSF 2.0 PR.DS-02 GDPR (SaaS Security) GDPR-5.1f.i GDPR (SaaS Security) GDPR-44.2 HIPAA (SaaS Security) HIPAA-312.e NIS2 Directive NIS2-21.h DORA (SaaS Security) DORA-9.7