The 45 Teleport security checks Black Cat runs

Black Cat SSPM evaluates 45 security policies against your Teleport configuration on every scan, classifies each finding by risk, and provides remediation steps. Browse them by topic below.

How to connect Teleport — what access Black Cat needs, and why.

Identity, MFA & sign-in (11)

Cluster MFA Disabled severity: critical
Session MFA Not Enforced severity: high
TOTP Without WebAuthn severity: medium
Local Auth Enabled With SSO severity: medium
Passwordless Without Hardware Key Policy severity: medium
Admin Action MFA Not Enforced severity: high
Expired Certificate Disconnect Disabled severity: medium
Device Trust Disabled severity: low
Role Does Not Require Session MFA severity: medium
Local User Has No MFA Device severity: high
User Uses Only TOTP for MFA severity: low

Access control & privilege (21)

Role Has Wildcard Node Labels severity: critical
Role Has Wildcard Database Labels severity: critical
Role Has Wildcard Kubernetes Labels severity: critical
Role Has Wildcard App Labels severity: high
Role Enables SSH Agent Forwarding severity: high
Role Has Unlimited Session TTL severity: high
Role Allows Impersonation severity: high
Role Has Broad Admin RBAC Rules severity: high
User Account Is Locked severity: medium
Local User Has No SSO Identity severity: medium
User Has Excessive Roles severity: medium
User Has Admin Role severity: high
Auth Connector Maps Claims to Admin Role severity: high
Auth Connector Has Broad Claim Mapping severity: medium
Auth Connector Has No Role Mappings severity: high
GitHub Connector Maps All Teams severity: medium
Token Uses Static Join Method severity: critical
Token Has No Expiry severity: high
Token Grants Auth System Role severity: critical
Token Grants Admin Role severity: high
Trusted Cluster Has Broad Role Map severity: high

Logging & audit (6)

Session Recording Disabled severity: critical
Session Recording in Async Mode severity: medium
Session Recording in Proxy Mode severity: medium
Proxy Host Key Checks Disabled severity: high
Role Disables Session Recording severity: critical
Audit Log Using Local Filesystem Storage severity: medium

Configuration hardening (3)

Trusted Cluster Is Disabled severity: low
No Client Idle Timeout Configured severity: medium
Node Running Outdated Teleport Version severity: medium

Other checks (4)

severity: high Database Configured Without TLS fix difficulty: medium #

Configure TLS on the database connection to encrypt data in transit

Export the database resource with tctl get db/<name> > db.yaml
Update the database spec to include the correct TLS certificate and CA configuration
Apply the updated resource with tctl create -f db.yaml
Test database connectivity to verify TLS is working correctly

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.24 SOC 2 Type II CC6.1 CIS Controls v8 CIS-03.10 NIST CSF 2.0 PR.DS-02 GDPR (SaaS Security) GDPR-5.1f.i HIPAA (SaaS Security) HIPAA-312.e NIS2 Directive NIS2-21.h DORA (SaaS Security) DORA-9.7

severity: high Application Has TLS Verification Disabled fix difficulty: medium #

Enable TLS certificate verification for the application to prevent man-in-the-middle attacks

Export the application resource with tctl get app/<name> > app.yaml
Set insecure_skip_verify to false in the spec
Ensure the application backend uses a valid TLS certificate signed by a trusted CA
Apply the updated resource with tctl create -f app.yaml
Test application access to verify the TLS connection succeeds

Vendor docs ↗