Ensure that non-deprecated Microsoft Cloud Security Benchmark policies are not set to 'Disabled'

ÉlevéeNiveau 1Revue manuelleazure

Description

The Microsoft Cloud Security Benchmark (MCSB) is an Azure Policy initiative automatically assigned to all subscriptions that evaluates resource configurations against Microsoft security best practice recommendations. Policies set to a Disabled effect are not evaluated, removing visibility into the associated recommendation. Microsoft deprecates policies when controls are superseded or no longer applicable; deprecated policies are set to Disabled by default and require no corrective action. Non-deprecated policies should not be set to Disabled without a documented organizational exception. Note: A policy is considered deprecated when its definition name is prefixed with [Deprecated]: in the Azure Policy portal and its policyDeprecated metadata property is true. Disabling a non-deprecated MCSB policy prevents Microsoft Defender for Cloud from evaluating the associated control and surfac...

Méthode de vérification

Méthode d'audit: Revue manuelle

Cette recommandation ne peut pas être vérifiée automatiquement. Une analyse la liste avec ces instructions lorsque vous passez --include-manual.

Audit from Azure Portal Perform the following steps for each Management Group or Subscription: 1. From Azure Home, select the Portal Menu. 2. Select Microsoft Defender for Cloud. 3. Under Management, select Environment settings. 4. Click on the appropriate Management Group or Subscription. 5. Click Security policies in the left column. 6. Click Microsoft cloud security benchmark. 7. Click Add filter, select Effect, check the Disabled box, and click Apply. 8. For each policy returned, confirm whether the definition is deprecated: o Deprecated definitions display a [Deprecated]: name prefix. o Deprecated policies set to Disabled are expected and compliant. 9. Verify that no non-deprecated policies are displayed with a Disabled effect. 10. Repeat steps 1–9 for each Management Group or Subscription. Cross-reference each overridden policy against current documented exceptions and the Azure Policy definitions list to confirm deprecation status before treating the result as a finding.

Méthode de correction

Méthode de correction: Recommandation ou correctif d'infrastructure

No remediation is required for deprecated MCSB policies set to Disabled. For non-deprecated policies found to be set to Disabled, restore the effect to its default value or document an approved organizational exception. Remediate from Azure Portal 1. From Azure Home, select the Portal Menu. 2. Select Microsoft Defender for Cloud. 3. Under Management, select Environment settings. 4. Click on the appropriate Management Group or Subscription. 5. Click Security policies in the left column. 6. Click Microsoft cloud security benchmark. 7. Click Add filter, select Effect, check Disabled, and click Apply. 8. Confirm the displayed policy is not deprecated before proceeding. 9. Click the blue ellipsis ... to the right of the policy name and select Manage effect and parameters. 10. Under Policy effect, select Audit. 11. Click Save, then click Refresh. 12. Repeat steps 8–11 for each non-deprecated disabled policy. 13. Repeat steps 1–12 for each Management Group or Subscription requiring remediation.

Propriétés

Systèmes d'exploitation: Tous
Étiquettes: azurecloud
Référence: CIS Microsoft Azure Foundations Benchmark v6.0.0 - 8.1.11 Ensure that non-deprecated Microsoft Cloud Security Benchmark policies are not set to 'Disabled'