You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
<th class="tg-cly1"><b>Security control, score, and description</b><br></th>
133
+
<th class="tg-cly1"><b>Recommendations</b></th>
134
+
</tr>
129
135
</thead>
130
136
<tbody>
131
-
<tr>
132
-
<td>cell1_1</td>
133
-
<td>cell2_1</td>
134
-
</tr>
135
-
<tr>
136
-
<td>cell1_2</td>
137
-
<td>cell2_2</td>
138
-
</tr>
139
-
<tr>
140
-
<td>cell1_3</td>
141
-
<td>cell2_3</td>
142
-
</tr>
143
-
<tr>
144
-
<td>cell1_4</td>
145
-
<td>cell2_4</td>
146
-
</tr>
147
-
<tr>
148
-
<td>cell1_5</td>
149
-
<td>cell2_5</td>
150
-
</tr>
151
-
<tr>
152
-
<td>cell1_6</td>
153
-
<td>cell2_6</td>
154
-
</tr>
155
-
<tr>
156
-
<td>cell1_7</td>
157
-
<td>cell2_7</td>
158
-
</tr>
137
+
<tr>
138
+
<td class="tg-lboi"><strong><p style="font-size: 16px">Enable MFA (max score 10)</p></strong>If you only use a password to authenticate a user, it leaves an attack vector open. If the password is weak or has been exposed elsewhere, is it really the user signing in with the username and password?<br>With <a href=https://www.microsoft.com/security/business/identity/mfa>MFA</a> enabled, your accounts are more secure, and users can still authenticate to almost any application with single sign-on.</td>
139
+
<td class="tg-lboi"; width=55%>- MFA should be enabled on accounts with owner permissions on your subscription<br>- MFA should be enabled accounts with write permissions on your subscription</td>
140
+
</tr>
141
+
<tr>
142
+
<td class="tg-lboi"><strong><p style="font-size: 16px">Secure management ports (max score 8)</p></strong>Brute force attacks target management ports to gain access to a VM. Since the ports don’t always need to be open, one mitigation strategy is to reduce exposure to the ports using just-in-time network access controls, network security groups, and virtual machine port management.<br>Since many IT do not block SSH communications outbound from their network, attackers can create encrypted tunnels that allow RDP ports on infected systems to communicate back to the attacker command to control servers. Attackers can use the Windows Remote Management subsystem to move laterally across your environment and use stolen credentials to access other resources on a network.</td>
143
+
<td class="tg-lboi"; width=55%>- Just-In-Time network access control should be applied on virtual machines<br>- Virtual machines should be associated with a Network Security Group<br>- Management ports should be closed on your virtual machines</td>
144
+
</tr>
145
+
<tr>
146
+
<td class="tg-lboi"><strong><p style="font-size: 16px">Apply system updates (max score 6)</p></strong>System updates provide organizations with the ability to maintain operational efficiency, reduce security vulnerabilities, and provide a more stable environment for end-users. Not applying updates can render environments susceptible to attacks due to unpatched vulnerabilities. These vulnerabilities can be exploited and lead to data loss, data exfiltration, ransomware, and resource abuse. To deploy system updates you can use the [Update Management solution to manage patches and updates](https://docs.microsoft.com/azure/automation/automation-update-management) for your virtual machines. Update management is the process of controlling the deployment and maintenance of software releases.</td>
147
+
<td class="tg-lboi"; width=55%>- Monitoring agent health issues should be resolved on your machines<br>- Monitoring agent should be installed on virtual machine scale sets<br>- Monitoring agent should be installed on your machines<br>- OS version should be updated for your cloud service roles<br>- System updates on virtual machine scale sets should be installed<br>- System updates should be installed on your machines<br>- Your machines should be restarted to apply system updates<br>- Kubernetes Services should be upgraded to a non-vulnerable Kubernetes version<br>- Monitoring agent should be installed on your virtual machines</td>
148
+
</tr>
149
+
<tr>
150
+
<td class="tg-lboi"><strong><p style="font-size: 16px">Remediate vulnerabilities (max score 6)</p></strong>A vulnerability is a weakness that a threat actor could leverage, to compromise the confidentiality, availability, or integrity of a resource. <a href=https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/next-gen-threat-and-vuln-mgt>Managing vulnerabilities</a> reduces organizational exposure, hardens endpoint surface area, increases organizational resilience, and reduces the attack surface of your resources. Threat and Vulnerability Management provides visibility into software and security misconfigurations and provide recommendations for mitigations.</td>
151
+
<td class="tg-lboi"; width=55%>- Advanced data security should be enabled on your SQL servers<br>- Vulnerabilities in Azure Container Registry images should be remediated<br>- Vulnerabilities on your SQL databases should be remediated<br>- Vulnerabilities should be remediated by a Vulnerability Assessment solution<br>- Vulnerability assessment should be enabled on your SQL managed instances<br>- Vulnerability assessment should be enabled on your SQL servers<br>- Vulnerability assessment solution should be installed on your virtual machines</td>
152
+
</tr>
153
+
<tr>
154
+
<td class="tg-lboi"><strong><p style="font-size: 16px">Enable encryption at rest (max score 4)</p></strong><a href=https://docs.microsoft.com/azure/security/fundamentals/encryption-atrest>Encryption at rest</a> provides data protection for stored data. Attacks against data at rest include attempts to gain physical access to the hardware on which the data is stored. Azures use symmetric encryption to encrypt and decrypt large amounts of data at rest. A symmetric encryption key is used to encrypt data as it is written to storage. That encryption key is also used to decrypt that data as it is readied for use in memory. Keys must be stored in a secure location with identity-based access control and audit policies. One such secure location is Azure Key Vault. If an attacker obtains the encrypted data but not the encryption keys, the attacker cannot access the data without breaking the encryption.</td>
155
+
<td class="tg-lboi"; width=55%>- Disk encryption should be applied on virtual machines<br>- Transparent Data Encryption on SQL databases should be enabled<br>- Automation account variables should be encrypted<br>- Service Fabric clusters should have the ClusterProtectionLevel property set to EncryptAndSign<br>- SQL server TDE protector should be encrypted with your own key</td>
156
+
</tr>
157
+
<tr>
158
+
<td class="tg-lboi"><strong><p style="font-size: 16px">Encrypt data in transit (max score 4)</p></strong>Data transmitted between components, locations, or programs is “in transit”. Organizations that fail to protect data in transit are susceptible to man-in-the-middle attacks, eavesdropping, and session hijacking. SSL/TLS protocols should be used to exchange data and a VPN is recommended. When sending encrypted data between an Azure virtual machine and an on-premise location, over the internet, you can use a virtual network gateway such as <a href=https://docs.microsoft.com/azure/vpn-gateway/vpn-gateway-about-vpngateways>Azure VPN Gateway</a> to send encrypted traffic.</td>
159
+
<td class="tg-lboi"; width=55%>- API App should only be accessible over HTTPS<br>- Function App should only be accessible over HTTPS<br>- Only secure connections to your Redis Cache should be enabled<br>- Secure transfer to storage accounts should be enabled<br>- Web Application should only be accessible over HTTPS</td>
160
+
</tr>
161
+
<tr>
162
+
<td class="tg-lboi"><strong><p style="font-size: 16px">Manage access and permissions (max score 4)</p></strong>A core part of a security program is ensuring your users have the necessary access to perform their jobs but no more than that: the <a href=https://docs.microsoft.com/windows-server/identity/ad-ds/plan/security-best-practices/implementing-least-privilege-administrative-models>least privilege access model</a>.<br>Control access to your resources by creating role assignments with <a href=https://docs.microsoft.com/azure/role-based-access-control/overview>role-based access control (RBAC)</a>. A role assignment consists of three elements: security principal, role definition, and scope. These represent the object the user is requesting to access, the permissions they have, and the set of resources to which the permissions apply.</td>
163
+
<td class="tg-lboi"; width=55%>- Deprecated accounts should be removed from your subscription (Preview)<br>- Deprecated accounts with owner permissions should be removed from your subscription (Preview)<br>- External accounts with owner permissions should be removed from your subscription (Preview)<br>- External accounts with write permissions should be removed from your subscription (Preview)<br>- There should be more than one owner assigned to your subscription<br>- Role-Based Access Control (RBAC) should be used on Kubernetes Services (Preview)<br>- Service Fabric clusters should only use Azure Active Directory for client authentication</td>
<td class="tg-lboi"; width=55%>- Pod Security Policies should be defined on Kubernetes Services<br>- Vulnerabilities in container security configurations should be remediated<br>- Vulnerabilities in security configuration on your machines should be remediated<br>- Vulnerabilities in security configuration on your virtual machine scale sets should be remediated<br>- Monitoring agent should be installed on your virtual machines<br>- Monitoring agent should be installed on your machines<br>- Monitoring agent should be installed on virtual machine scale sets<br>- Monitoring agent health issues should be resolved on your machines</td>
<td class="tg-lboi"; width=55%>- IP forwarding on your virtual machine should be disabled<br>- Authorized IP ranges should be defined on Kubernetes Services (Preview)<br>- (DEPRECATED) Access to App Services should be restricted (Preview)<br>- (DEPRECATED) The rules for web applications on IaaS NSGs should be hardened<br>- Virtual machines should be associated with a Network Security Group<br>- CORS should not allow every resource to access your API App<br>- CORS should not allow every resource to access your Function App<br>- CORS should not allow every resource to access your Web Application<br>- Remote debugging should be turned off for API App<br>- Remote debugging should be turned off for Function App<br>- Remote debugging should be turned off for Web Application<br>- Access should be restricted for permissive Network Security Groups with Internet-facing VMs<br>- Network Security Group Rules for Internet facing virtual machines should be hardened</td>
172
+
</tr>
173
+
<tr>
174
+
<td class="tg-lboi"><strong><p style="font-size: 16px">Apply adaptive application control (max score 3)</p></strong></td>
175
+
<td class="tg-lboi"; width=55%>- Adaptive Application Controls should be enabled on virtual machines<br>- Monitoring agent should be installed on your virtual machines<br>- Monitoring agent should be installed on your machines<br>- Monitoring agent health issues should be resolved on your machines</td>
176
+
</tr>
177
+
<tr>
178
+
<td class="tg-lboi"><strong><p style="font-size: 16px">Apply data classification (max score 2)</p></strong></td>
179
+
<td class="tg-lboi"; width=55%>- Sensitive data in your SQL databases should be classified (Preview)</td>
<td class="tg-lboi"; width=55%>- Endpoint protection health failures should be remediated on virtual machine scale sets<br>- Endpoint protection health issues should be resolved on your machines<br>- Endpoint protection solution should be installed on virtual machine scale sets<br>- Install endpoint protection solution on virtual machines<br>- Monitoring agent health issues should be resolved on your machines<br>- Monitoring agent should be installed on virtual machine scale sets<br>- Monitoring agent should be installed on your machines<br>- Monitoring agent should be installed on your virtual machines<br>- Install endpoint protection solution on your machines</td>
188
+
</tr>
189
+
<tr>
190
+
<td class="tg-lboi"><strong><p style="font-size: 16px">Enable auditing and logging (max score 1)</p></strong></td>
191
+
<td class="tg-lboi"; width=55%>- Auditing on SQL server should be enabled<br>- Diagnostic logs in App Services should be enabled<br>- Diagnostic logs in Azure Data Lake Store should be enabled<br>- Diagnostic logs in Azure Stream Analytics should be enabled<br>- Diagnostic logs in Batch accounts should be enabled<br>- Diagnostic logs in Data Lake Analytics should be enabled<br>- Diagnostic logs in Event Hub should be enabled<br>- Diagnostic logs in IoT Hub should be enabled<br>- Diagnostic logs in Key Vault should be enabled<br>- Diagnostic logs in Logic Apps should be enabled<br>- Diagnostic logs in Search service should be enabled<br>- Diagnostic logs in Service Bus should be enabled<br>- Diagnostic logs in Virtual Machine Scale Sets should be enabled<br>- Metric alert rules should be configured on Batch accounts<br>- SQL Auditing settings should have Action-Groups configured to capture critical activities<br>- SQL servers should be configured with auditing retention days greater than 90 days.</td>
192
+
</tr>
193
+
<tr>
194
+
<td class="tg-lboi"><strong><p style="font-size: 16px">Implement security best practices (max score 0)</p></strong></td>
195
+
<td class="tg-lboi"; width=55%>- A maximum of 3 owners should be designated for your subscription<br>- External accounts with read permissions should be removed from your subscription<br>- MFA should be enabled on accounts with read permissions on your subscription<br>- Access to storage accounts with firewall and virtual network configurations should be restricted<br>- All authorization rules except RootManageSharedAccessKey should be removed from Event Hub namespace<br>- An Azure Active Directory administrator should be provisioned for SQL servers<br>- Authorization rules on the Event Hub instance should be defined<br>- Storage accounts should be migrated to new Azure Resource Manager resources<br>- Virtual machines should be migrated to new Azure Resource Manager resources<br>- Advanced data security settings for SQL server should contain an email address to receive security alerts<br>- Advanced data security should be enabled on your managed instances<br>- All advanced threat protection types should be enabled in SQL managed instance advanced data security settings<br>- Email notifications to admins and subscription owners should be enabled in SQL server advanced data security settings<br>- Advanced Threat Protection types should be set to 'All' in SQL server Advanced Data Security settings<br>- Subnets should be associated with a Network Security Group<br>- All advanced threat protection types should be enabled in SQL server advanced data security settings<br>- [Preview] Windows exploit guard should be enabled <br>- [Preview] Guest configuration agent should be installed</td>
0 commit comments