Ensure that Network Security Groups are Configured for Databricks Subnets

高等級 1人工審核azure

說明

Network Security Groups (NSGs) should be implemented to control inbound and outbound traffic to Azure Databricks subnets, ensuring only authorized communication. NSGs operate using a rule-based model that includes both explicit allow/deny rules and an implicit deny at the end of the rule list. This means that any traffic not explicitly allowed is automatically denied. To ensure secure and predictable behavior, NSGs should be configured with explicit deny rules for known unwanted traffic, in addition to the default implicit deny, to improve visibility and auditability of blocked traffic. This approach helps enforce least privilege and minimizes the risk of unauthorized access to Databricks resources. Using NSGs with both explicit allow and deny rules provides clear documentation and control over permitted and prohibited traffic. While Azure NSGs implicitly deny all traffic not explicit...

檢查方式

稽核方法: 人工審核

此項建議無法自動檢查。當您傳入 --include-manual 時，掃描結果會列出此項目並附帶這些說明。

Audit from Azure Portal 1. Navigate to Virtual Networks > Subnets, and review NSG assignments. Audit from Azure CLI az network nsg list --query "[].{Name:name, Rules:securityRules}" Audit from PowerShell Get-AzNetworkSecurityGroup -ResourceGroupName <resource-group-name>

修補方式

修補方法: 操作指南或基礎設施修補檔

Remediate from Azure Portal 1. Assign NSG to Databricks subnets under Networking > NSG Settings.

屬性

作業系統: 不限
標籤: azurecloudnetwork
參考資料: CIS Microsoft Azure Foundations Benchmark v6.0.0 - 2.1.2 Ensure that Network Security Groups are Configured for Databricks Subnets