Checks

Flow logs are the source of truth for all network activity in your cloud environment.

To enable analysis in security event that was detected late, you need to have the logs available.

Setting an retention policy will help ensure as much information is available for review.

SSH access can be configured on either the network security group or in the network security group rule. SSH access should not be permitted from the internet (*, 0.0.0.0, /0, internet, any)

Opening up ports to connect out to the public internet is generally to be avoided. You should restrict access to IP addresses or ranges that are explicitly required where possible.

Allowing custom roles to include 'roleDefinitions/write' enables privilege escalation. A user could define or alter roles to gain excessive permissions.

Blob soft delete protects blob data from being accidentally or erroneously modified or deleted. When blob soft delete is enabled, deleted blobs are retained in the system for a specified retention period. During the retention period, you can restore a soft-deleted blob to its state at the time it was deleted.

Storage Analytics logs detailed information about successful and failed requests to a storage service. This information can be used to monitor individual requests and to diagnose issues with a storage service. Logging should be enabled for at least one storage service type.

Geo-redundant storage (GRS) replicates your data to a secondary region that is hundreds of miles away from the primary region. This provides an additional level of durability for your data in the event of a complete regional outage or a disaster. Options include GRS, RAGRS, GZRS, and RAGZRS for geo-redundancy.

Storage accounts should enforce HTTPS for secure data transfer and use a minimum TLS version of 1.2 or higher. This ensures that logs and data stored in the storage account are encrypted in transit. Azure Storage encrypts all data at rest by default, but transport encryption is also critical.

Storage accounts should use customer-managed keys (CMK) for encryption to provide additional control over the encryption keys. Customer-managed keys allow you to create, rotate, disable, and revoke access controls. They also provide greater flexibility to audit the encryption keys that are used to protect your data.

Infrastructure encryption provides an additional layer of encryption at the infrastructure level. When infrastructure encryption is enabled, data in the storage account is encrypted twice - once at the service level and once at the infrastructure level with two different encryption algorithms. This provides double encryption for enhanced security.

Without a configured security contact email, critical alerts from Microsoft Defender for Cloud may go unnoticed, delaying incident response.

Microsoft will notify the security contact directly in the event of a security incident and will look to use email for notifications.

If Defender for Cloud email alerts are disabled, high-severity issues may go unnoticed.

Email notifications should be enabled to ensure security contacts are notified of critical security alerts and incidents in a timely manner.

If a security contact is disabled, critical alerts from Microsoft Defender for Cloud will not be delivered to that contact, potentially causing security incidents to go unnoticed.

Security contacts should be enabled to ensure that designated personnel receive timely notifications about security threats and incidents.

A public AKS API server endpoint increases exposure to unauthorized access or attack. Enable private cluster to ensure the API server endpoint is only accessible from within the virtual network.

Azure Kubernetes Service should enable Azure Policy Add-On to enforce compliance and governance policies on the cluster. The add-on extends Gatekeeper v3, an admission controller webhook for Open Policy Agent (OPA).

Azure Kubernetes clusters should define a disk encryption set ID to ensure encrypted storage for OS and data disks. This provides an additional layer of security by encrypting data at rest.

VMs without NSGs are exposed without traffic control or inspection.

Using an unsupported PHP runtime in Azure App Service may expose applications to security vulnerabilities as these versions no longer receive security patches. This check ensures PHP versions are still supported.

Using an unsupported Python runtime in Azure App Service may expose applications to security vulnerabilities as these versions no longer receive security patches. This check ensures Python versions are still supported by the Python Foundation.

Allowing plain FTP risks credentials and data being transmitted unencrypted.

Allowing HTTP undermines transport encryption and exposes user data.

Without NSG flow logs, network activity is not auditable, hindering incident investigation.

Sensitive legacy ports like Telnet or POP3 should not be open to broad networks.

IP forwarding should be disabled on network interfaces unless specifically required.