TMA-AZURE-7.11

Ensure Subnets Are Associated with Network Security Groups

높음레벨 1수동 검토azure

설명

Protect subnet resources by ensuring subnets are associated with network security groups, which can filter inbound and outbound traffic using security rules. Unprotected subnets can expose resources to unauthorized access.

점검 방법

감사 방식: 수동 검토

이 권장 사항은 자동으로 점검할 수 없습니다. --include-manual 옵션을 전달하면 스캔 결과에 이 지침과 함께 표시됩니다.

Audit from Azure Portal 1. Go to Virtual networks. 2. Click the name of a virtual network. 3. Under Settings, click Subnets. 4. Click the name of a subnet. 5. Under Security, ensure Network security group is not set to None. 6. Repeat steps 1-5 for each virtual network and subnet. Audit from Azure CLI Run the following command to list virtual networks: az network vnet list For each virtual network, run the following command to list subnets: az network vnet show --resource-group <resource-group> --name <virtual- network> --query subnets For each subnet, run the following command to get the network security group id: az network vnet subnet show --resource-group <resource-group> --vnet-name <virtual-network> --name <subnet> --query networkSecurityGroup.id Ensure a network security group id is returned. Audit from Azure Policy If referencing a digital copy of this Benchmark, clicking a Policy ID will open a link to the associated Policy definition in Azure. If referencing a printed copy, you can search Policy IDs from this URL: https://portal.azure.com/#view/Microsoft_Azure_Policy/PolicyMenuBlade/~/Definitions - Policy ID: e71308d3-144b-4262-b144-efdc3cc90517 - Name: 'Subnets should...

조치 방법

조치 방식: 가이드 또는 인프라 패치

Remediate from Azure Portal 1. Go to Virtual networks. 2. Click the name of a virtual network. 3. Under Settings, click Subnets. 4. Click the name of a subnet. 5. Under Security, next to Network security group, click None to display the drop-down menu. 6. Select a network security group. 7. Click Save. 8. Repeat steps 1-7 for each virtual network and subnet requiring remediation. Remediate from Azure CLI For each subnet requiring remediation, run the following command to associate it with a network security group: az network vnet subnet update --resource-group <resource-group> --vnet-name <virtual-network> --name <subnet> --network-security-group <network-security- group>

속성

운영 체제: 모두
태그: azurecloudnetwork
참고 자료: CIS Microsoft Azure Foundations Benchmark v6.0.0 - 7.11 Ensure Subnets Are Associated with Network Security Groups