-
Notifications
You must be signed in to change notification settings - Fork 178
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
- Loading branch information
1 parent
dbb9a14
commit 9ea6604
Showing
40 changed files
with
335 additions
and
4 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
18 changes: 18 additions & 0 deletions
18
en/azure/azurepolicy/resource-location-matches-resource-group.md
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,18 @@ | ||
| [](https://cloudsploit.com) | ||
|
|
||
| # AZURE / Azure Policy / Resource Location Matches Resource Group | ||
|
|
||
| ## Quick Info | ||
|
|
||
| | | | | ||
| |-|-| | ||
| | **Plugin Title** | Resource Location Matches Resource Group | | ||
| | **Cloud** | AZURE | | ||
| | **Category** | Azure Policy | | ||
| | **Description** | Ensures deployed resources match the resource groups they are in, as well as ensuring the Audit resource location matches resource group location policy is assigned. | | ||
| | **More Info** | Monitoring changes to resources follows Security and Compliance best practices. Being able to track resource location changes adds a level of accountability. | | ||
| | **AZURE Link** | https://docs.microsoft.com/en-us/azure/governance/policy/assign-policy-portal | | ||
| | **Recommended Action** | 1. Navigate to the Policy service. 2. Select the Assignments blade. 3. Click on Assign Policy. 4. Click to search a Policy definition, search for and select: Audit resource location matches resource group location. 5. Under Parameters, select your Allowed locations. 6. Click on Assign. | | ||
|
|
||
| ## Detailed Remediation Steps | ||
|
|
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,18 @@ | ||
| [](https://cloudsploit.com) | ||
|
|
||
| # AZURE / Azure Policy / Resources Allowed Locations | ||
|
|
||
| ## Quick Info | ||
|
|
||
| | | | | ||
| |-|-| | ||
| | **Plugin Title** | Resources Allowed Locations | | ||
| | **Cloud** | AZURE | | ||
| | **Category** | Azure Policy | | ||
| | **Description** | Ensures deployed resources and resource groups belong to the list set in the Allowed locations for resource groups policy. | | ||
| | **More Info** | Monitoring changes to resources follows Security and Compliance best practices. Being able to track resource location changes adds a level of accountability. | | ||
| | **AZURE Link** | https://docs.microsoft.com/en-us/azure/governance/policy/assign-policy-portal | | ||
| | **Recommended Action** | 1. Navigate to the Policy service. 2. Select the Assignments blade. 3. Click on Assign Policy. 4. Click to search a Policy definition, search for and select: Allowed locations for resource groups. 5. Under Parameters, select your Allowed locations. 6. Click on Assign. | | ||
|
|
||
| ## Detailed Remediation Steps | ||
|
|
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,18 @@ | ||
| [](https://cloudsploit.com) | ||
|
|
||
| # AZURE / CDN / Detect Insecure Custom Origin | ||
|
|
||
| ## Quick Info | ||
|
|
||
| | | | | ||
| |-|-| | ||
| | **Plugin Title** | Detect Insecure Custom Origin | | ||
| | **Cloud** | AZURE | | ||
| | **Category** | CDN | | ||
| | **Description** | Ensure that HTTPS is enabled when creating a new CDN endpoint with a Custom Origin. | | ||
| | **More Info** | Detects if HTTPS is disabled for CDN endpoint of custom origins. | | ||
| | **AZURE Link** | https://docs.microsoft.com/en-us/azure/cdn/cdn-create-endpoint-how-to | | ||
| | **Recommended Action** | 1. Navigate to CDN profiles. 2. Select a profile. 3. Select an endpoint. 4. Select Settings > Origin. 5. Turn off HTTP and make sure HTTPS is turned on. | | ||
|
|
||
| ## Detailed Remediation Steps | ||
|
|
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,18 @@ | ||
| [](https://cloudsploit.com) | ||
|
|
||
| # AZURE / Key Vault / Key Expiration Enabled | ||
|
|
||
| ## Quick Info | ||
|
|
||
| | | | | ||
| |-|-| | ||
| | **Plugin Title** | Key Expiration Enabled | | ||
| | **Cloud** | AZURE | | ||
| | **Category** | Key Vault | | ||
| | **Description** | Ensure that all Keys in Azure Key Vault have an expiry time set. | | ||
| | **More Info** | Setting an expiry time on all keys forces key rotation and removes unused and forgotten keys from being used. | | ||
| | **AZURE Link** | https://docs.microsoft.com/en-us/azure/key-vault/about-keys-secrets-and-certificates | | ||
| | **Recommended Action** | 1. Go to Key vaults. 2. For each Key vault, click on Keys. 3. Ensure that each key in the vault has EXPIRATION DATE set as appropriate. | | ||
|
|
||
| ## Detailed Remediation Steps | ||
|
|
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,18 @@ | ||
| [](https://cloudsploit.com) | ||
|
|
||
| # AZURE / Kubernetes Service / RBAC Enabled | ||
|
|
||
| ## Quick Info | ||
|
|
||
| | | | | ||
| |-|-| | ||
| | **Plugin Title** | RBAC Enabled | | ||
| | **Cloud** | AZURE | | ||
| | **Category** | Kubernetes Service | | ||
| | **Description** | Ensures that RBAC is enabled on all Azure Kubernetes Services Instances | | ||
| | **More Info** | Role Based Access Control(RBAC) provides greater control and security for Kubernetes clusters. | | ||
| | **AZURE Link** | https://docs.microsoft.com/en-us/azure/aks/aad-integration | | ||
| | **Recommended Action** | When creating a new Kubernetes Cluster, ensure that RBAC is enabled under the Authentication tab during creation. | | ||
|
|
||
| ## Detailed Remediation Steps | ||
|
|
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,18 @@ | ||
| [](https://cloudsploit.com) | ||
|
|
||
| # AZURE / Monitor / Autoscale Enabled | ||
|
|
||
| ## Quick Info | ||
|
|
||
| | | | | ||
| |-|-| | ||
| | **Plugin Title** | Autoscale Enabled | | ||
| | **Cloud** | AZURE | | ||
| | **Category** | Monitor | | ||
| | **Description** | Ensure Autoscaling is enabled on Resource Groups. | | ||
| | **More Info** | Enabling Autoscale increases efficency and improves cost management for resources. | | ||
| | **AZURE Link** | https://docs.microsoft.com/en-us/azure/virtual-machine-scale-sets/virtual-machine-scale-sets-use-availability-zones | | ||
| | **Recommended Action** | 1. Navigate to the Monitor category. 2. Select the autoscale blade under settings. 3. Choose the resource group. 4. Configure autoscaling. | | ||
|
|
||
| ## Detailed Remediation Steps | ||
|
|
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,18 @@ | ||
| [](https://cloudsploit.com) | ||
|
|
||
| # AZURE / Monitor / Log Profile Archive Data | ||
|
|
||
| ## Quick Info | ||
|
|
||
| | | | | ||
| |-|-| | ||
| | **Plugin Title** | Log Profile Archive Data | | ||
| | **Cloud** | AZURE | | ||
| | **Category** | Monitor | | ||
| | **Description** | The Log Profile should be configured to export all activities from the control/management plane in all active locations. | | ||
| | **More Info** | Enabling logging of all activities in a log profile ensures that cloud security best practices, as well as compliance and monitoring standards are followed. | | ||
| | **AZURE Link** | https://docs.microsoft.com/en-us/azure/azure-monitor/platform/archive-activity-log | | ||
| | **Recommended Action** | 1. Enter the Monitor category. 2. Select Activity Log from the left hand menu. 3. On the top of activity log select Export to Event Hub to enable activity log archiving and select the storage account or event hub to send the data to. | | ||
|
|
||
| ## Detailed Remediation Steps | ||
|
|
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,18 @@ | ||
| [](https://cloudsploit.com) | ||
|
|
||
| # AZURE / Monitor / NSG Log Analytics Enabled | ||
|
|
||
| ## Quick Info | ||
|
|
||
| | | | | ||
| |-|-| | ||
| | **Plugin Title** | NSG Log Analytics Enabled | | ||
| | **Cloud** | AZURE | | ||
| | **Category** | Monitor | | ||
| | **Description** | Ensures Network Security Groups logs are sent to the Log Analytics workspace. | | ||
| | **More Info** | Enabling Log Analytics ensures that logs are shipped to a central repository that can be queried and audited, following cloud security best practices. | | ||
| | **AZURE Link** | https://docs.microsoft.com/en-us/azure/azure-monitor/platform/collect-activity-logs | | ||
| | **Recommended Action** | 1. Go to Azure Monitor. 2. Select Diagnostic setting from the settings tab on the list to the left. 3. Choose the resource. 4. If no diagnostic setting defined, add diagnostic setting and enable Send to Log Analytics, if diagnostic setting are defined, edit the setting to enable Send to Log Analytics. | | ||
|
|
||
| ## Detailed Remediation Steps | ||
|
|
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,18 @@ | ||
| [](https://cloudsploit.com) | ||
|
|
||
| # AZURE / MySQL Server / Enforce SSL Connection Enabled | ||
|
|
||
| ## Quick Info | ||
|
|
||
| | | | | ||
| |-|-| | ||
| | **Plugin Title** | Enforce SSL Connection Enabled | | ||
| | **Cloud** | AZURE | | ||
| | **Category** | MySQL Server | | ||
| | **Description** | Ensures SSL connection is set on MySQL Servers. | | ||
| | **More Info** | SSL prevents infiltration attacks by encrypting the data stream between the server and app. By ensuring that SSL is enabled, security best practices are followed. | | ||
| | **AZURE Link** | https://docs.microsoft.com/en-us/azure/mysql/concepts-ssl-connection-security | | ||
| | **Recommended Action** | 1. Login to Azure Portal. 2. Go to Azure Database for MySQL server. 3. For each database, click on Connection security. 4. In SSL settings, Ensure Enforce SSL connection is set to Enabled. | | ||
|
|
||
| ## Detailed Remediation Steps | ||
|
|
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,18 @@ | ||
| [](https://cloudsploit.com) | ||
|
|
||
| # AZURE / Network Security Groups / Default Security Group | ||
|
|
||
| ## Quick Info | ||
|
|
||
| | | | | ||
| |-|-| | ||
| | **Plugin Title** | Default Security Group | | ||
| | **Cloud** | AZURE | | ||
| | **Category** | Network Security Groups | | ||
| | **Description** | Ensure the default security groups block all traffic by default. | | ||
| | **More Info** | The default security group is often used for resources launched without a defined security group. For this reason, the default rules should be to block all traffic to prevent an accidental exposure. | | ||
| | **AZURE Link** | https://docs.microsoft.com/en-us/azure/virtual-network/manage-network-security-group | | ||
| | **Recommended Action** | Update the rules for the default security group to deny all traffic by default. | | ||
|
|
||
| ## Detailed Remediation Steps | ||
|
|
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,18 @@ | ||
| [](https://cloudsploit.com) | ||
|
|
||
| # AZURE / Network Security Groups / Open All Ports | ||
|
|
||
| ## Quick Info | ||
|
|
||
| | | | | ||
| |-|-| | ||
| | **Plugin Title** | Open All Ports | | ||
| | **Cloud** | AZURE | | ||
| | **Category** | Network Security Groups | | ||
| | **Description** | Determine if all ports are open to the public | | ||
| | **More Info** | While some ports such as HTTP and HTTPS are required to be open to the public to function properly, services should be restricted to known IP addresses. | | ||
| | **AZURE Link** | https://docs.microsoft.com/en-us/azure/virtual-network/manage-network-security-group | | ||
| | **Recommended Action** | Restrict ports to known IP addresses | | ||
|
|
||
| ## Detailed Remediation Steps | ||
|
|
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.