Skip to content

Commit 39fade1

Browse files
v-albemiv-albemi
authored
Merge pull request #84962 from jomolesk/cis-azure
Add control mapping for CIS Azure initiative
2 parents eb18b55 + c1da7c3 commit 39fade1

File tree

4 files changed

+307
-1
lines changed

4 files changed

+307
-1
lines changed

‎articles/governance/blueprints/samples/cis-azure-1.1.0/control-mapping.md

Lines changed: 259 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,259 @@
1+
---
2+
title: Sample - CIS Microsoft Azure Foundations Benchmark blueprint - Recommendation mapping
3+
description: Recommendation mapping of the CIS Microsoft Azure Foundations Benchmark blueprint sample to Azure Policy.
4+
author: DCtheGeek
5+
ms.author: dacoulte
6+
ms.date: 08/09/2019
7+
ms.topic: sample
8+
ms.service: blueprints
9+
manager: carmonm
10+
---
11+
# Recommendation mapping of the CIS Microsoft Azure Foundations Benchmark blueprint sample
12+
13+
The following article details how the Azure Blueprints CIS Microsoft Azure Foundations Benchmark
14+
blueprint sample maps to the CIS Microsoft Azure Foundations Benchmark recommendations. For more
15+
information about the recommendations, see [CIS Microsoft Azure Foundations Benchmark](https://www.cisecurity.org/benchmark/azure/).
16+
17+
The following mappings are to the **CIS Microsoft Azure Foundations Benchmark v1.1.0**
18+
recommendations. Use the navigation on the right to jump directly to a specific recommendation mapping.
19+
Many of the mapped recommendations are implemented with an [Azure Policy](../../../policy/overview.md)
20+
initiative. To review the complete initiative, open **Policy** in the Azure portal and select the
21+
**Definitions** page. Then, find and select the **\[Preview\] Audit CIS Microsoft Azure Foundations
22+
Benchmark v1.1.0 recommendations and deploy specific VM Extensions to support audit requirements**
23+
built-in policy initiative.
24+
25+
> [!NOTE]
26+
> The full blueprint sample is coming soon. The associated Azure Policy initiative is available now.
27+
28+
## 1.1 Ensure that multi-factor authentication is enabled for all privileged users
29+
30+
This blueprint assigns [Azure Policy](../../../policy/overview.md) definitions that align with
31+
this CIS recommendation.
32+
33+
- MFA should be enabled on accounts with owner permissions on your subscription
34+
- MFA should be enabled on accounts with write permissions on your subscription
35+
36+
## 1.2 Ensure that multi-factor authentication is enabled for all non-privileged users
37+
38+
This blueprint assigns an [Azure Policy](../../../policy/overview.md) definition that aligns with
39+
this CIS recommendation.
40+
41+
- MFA should be enabled on accounts with read permissions on your subscription
42+
43+
## 1.3 Ensure that there are no guest users
44+
45+
This blueprint assigns [Azure Policy](../../../policy/overview.md) definitions that align with
46+
this CIS recommendation.
47+
48+
- External accounts with owner permissions should be removed from your subscription
49+
- External accounts with read permissions should be removed from your subscription
50+
- External accounts with write permissions should be removed from your subscription
51+
52+
## 2.3 Ensure ASC Default policy setting "Monitor System Updates" is not "Disabled"
53+
54+
This blueprint assigns an [Azure Policy](../../../policy/overview.md) definition that aligns with
55+
this CIS recommendation.
56+
57+
- System updates should be installed on your machines
58+
59+
## 2.4 Ensure ASC Default policy setting "Monitor OS Vulnerabilities" is not "Disabled"
60+
61+
This blueprint assigns an [Azure Policy](../../../policy/overview.md) definition that aligns with
62+
this CIS recommendation.
63+
64+
- Vulnerabilities in security configuration on your machines should be remediated
65+
66+
## 2.5 Ensure ASC Default policy setting "Monitor Endpoint Protection" is not "Disabled"
67+
68+
This blueprint assigns an [Azure Policy](../../../policy/overview.md) definition that aligns with
69+
this CIS recommendation.
70+
71+
- Monitor missing Endpoint Protection in Azure Security Center
72+
73+
## 2.6 Ensure ASC Default policy setting "Monitor Disk Encryption" is not "Disabled"
74+
75+
This blueprint assigns an [Azure Policy](../../../policy/overview.md) definition that aligns with
76+
this CIS recommendation.
77+
78+
- Disk encryption should be applied on virtual machines
79+
80+
## 2.8 Ensure ASC Default policy setting "Monitor Web Application Firewall" is not "Disabled"
81+
82+
This blueprint assigns an [Azure Policy](../../../policy/overview.md) definition that aligns with
83+
this CIS recommendation.
84+
85+
- The NSGs rules for web applications on IaaS should be hardened
86+
87+
## 2.10 Ensure ASC Default policy setting "Monitor Vulnerability Assessment" is not "Disabled"
88+
89+
This blueprint assigns an [Azure Policy](../../../policy/overview.md) definition that aligns with
90+
this CIS recommendation.
91+
92+
- Vulnerabilities should be remediated by a Vulnerability Assessment solution
93+
94+
## 2.12 Ensure ASC Default policy setting "Monitor JIT Network Access" is not "Disabled"
95+
96+
This blueprint assigns an [Azure Policy](../../../policy/overview.md) definition that aligns with
97+
this CIS recommendation.
98+
99+
- Just-In-Time network access control should be applied on virtual machines
100+
101+
## 2.15 Ensure ASC Default policy setting "Monitor SQL Encryption" is not "Disabled"
102+
103+
This blueprint assigns an [Azure Policy](../../../policy/overview.md) definition that aligns with
104+
this CIS recommendation.
105+
106+
- Transparent Data Encryption on SQL databases should be enabled
107+
108+
## 3.1 Ensure that 'Secure transfer required' is set to 'Enabled'
109+
110+
This blueprint assigns an [Azure Policy](../../../policy/overview.md) definition that aligns with
111+
this CIS recommendation.
112+
113+
- Secure transfer to storage accounts should be enabled
114+
115+
## 3.7 Ensure default network access rule for Storage Accounts is set to deny
116+
117+
This blueprint assigns an [Azure Policy](../../../policy/overview.md) definition that aligns with
118+
this CIS recommendation.
119+
120+
- Audit unrestricted network access to storage accounts
121+
122+
## 4.1 Ensure that 'Auditing' is set to 'On'
123+
124+
This blueprint assigns an [Azure Policy](../../../policy/overview.md) definition that aligns with
125+
this CIS recommendation.
126+
127+
- Auditing should be enabled on advanced data security settings on SQL Server
128+
129+
## 4.2 Ensure that 'AuditActionGroups' in 'auditing' policy for a SQL server is set properly
130+
131+
This blueprint assigns an [Azure Policy](../../../policy/overview.md) definition that aligns with
132+
this CIS recommendation.
133+
134+
- SQL Auditing settings should have Action-Groups configured to capture critical activities
135+
136+
## 4.3 Ensure that 'Auditing' Retention is 'greater than 90 days'
137+
138+
This blueprint assigns an [Azure Policy](../../../policy/overview.md) definition that aligns with
139+
this CIS recommendation.
140+
141+
- SQL servers should be configured with auditing retention days greater than 90 days.
142+
143+
## 4.4 Ensure that 'Advanced Data Security' on a SQL server is set to 'On'
144+
145+
This blueprint assigns an [Azure Policy](../../../policy/overview.md) definition that aligns with
146+
this CIS recommendation.
147+
148+
- Advanced data security should be enabled on your SQL servers
149+
150+
## 4.5 Ensure that 'Threat Detection types' is set to 'All'
151+
152+
This blueprint assigns [Azure Policy](../../../policy/overview.md) definitions that align with
153+
this CIS recommendation.
154+
155+
- Advanced Threat Protection types should be set to 'All' in SQL server Advanced Data Security settings
156+
- Advanced Threat Protection types should be set to 'All' in SQL managed instance Advanced Data Security settings
157+
158+
## 4.6 Ensure that 'Send alerts to' is set
159+
160+
This blueprint assigns an [Azure Policy](../../../policy/overview.md) definition that aligns with
161+
this CIS recommendation.
162+
163+
- Advanced data security settings for SQL server should contain an email address to receive security alerts
164+
165+
## 4.7 Ensure that 'Email service and co-administrators' is 'Enabled'
166+
167+
This blueprint assigns an [Azure Policy](../../../policy/overview.md) definition that aligns with
168+
this CIS recommendation.
169+
170+
- Advanced data security settings for SQL managed instance should contain an email address to receive security alerts
171+
172+
## 4.8 Ensure that Azure Active Directory Admin is configured
173+
174+
This blueprint assigns an [Azure Policy](../../../policy/overview.md) definition that aligns with
175+
this CIS recommendation.
176+
177+
- An Azure Active Directory administrator should be provisioned for SQL servers
178+
179+
## 4.9 Ensure that 'Data encryption' is set to 'On' on a SQL Database
180+
181+
This blueprint assigns an [Azure Policy](../../../policy/overview.md) definition that aligns with
182+
this CIS recommendation.
183+
184+
- Transparent Data Encryption on SQL databases should be enabled
185+
186+
## 4.10 Ensure SQL server's TDE protector is encrypted with BYOK (Use your own key)
187+
188+
This blueprint assigns [Azure Policy](../../../policy/overview.md) definitions that align with
189+
this CIS recommendation.
190+
191+
- SQL server TDE protector should be encrypted with your own key
192+
- SQL managed instance TDE protector should be encrypted with your own key
193+
194+
## 5.1.7 Ensure that logging for Azure KeyVault is 'Enabled'
195+
196+
This blueprint assigns an [Azure Policy](../../../policy/overview.md) definition that aligns with
197+
this CIS recommendation.
198+
199+
- Diagnostic logs in Key Vault should be enabled
200+
201+
## 7.1 Ensure that 'OS disk' are encrypted
202+
203+
This blueprint assigns an [Azure Policy](../../../policy/overview.md) definition that aligns with
204+
this CIS recommendation.
205+
206+
- Disk encryption should be applied on virtual machines
207+
208+
## 7.2 Ensure that 'Data disks' are encrypted
209+
210+
This blueprint assigns an [Azure Policy](../../../policy/overview.md) definition that aligns with
211+
this CIS recommendation.
212+
213+
- Disk encryption should be applied on virtual machines
214+
215+
## 7.5 Ensure that the latest OS Patches for all Virtual Machines are applied
216+
217+
This blueprint assigns an [Azure Policy](../../../policy/overview.md) definition that aligns with
218+
this CIS recommendation.
219+
220+
- System updates should be installed on your machines
221+
222+
## 7.6 Ensure that the endpoint protection for all Virtual Machines is installed
223+
224+
This blueprint assigns an [Azure Policy](../../../policy/overview.md) definition that aligns with
225+
this CIS recommendation.
226+
227+
- Monitor missing Endpoint Protection in Azure Security Center
228+
229+
## 8.5 Enable role-based access control (RBAC) within Azure Kubernetes Services
230+
231+
This blueprint assigns an [Azure Policy](../../../policy/overview.md) definition that aligns with
232+
this CIS recommendation.
233+
234+
- \[Preview\]: Role-Based Access Control (RBAC) should be used on Kubernetes Services
235+
236+
## 9.2 Ensure web app redirects all HTTP traffic to HTTPS in Azure App Service
237+
238+
This blueprint assigns an [Azure Policy](../../../policy/overview.md) definition that aligns with
239+
this CIS recommendation.
240+
241+
- Web Application should only be accessible over HTTPS
242+
243+
## Next steps
244+
245+
Now that you've reviewed the control mapping of the CIS Microsoft Azure Foundations Benchmark
246+
blueprint, visit the following article to learn about the blueprint or visit Azure Policy in the
247+
Azure portal to assign the initiative:
248+
249+
> [!div class="nextstepaction"]
250+
> [CIS Microsoft Azure Foundations Benchmark blueprint - Overview](./index.md)
251+
> [Azure portal](https://portal.azure.com/#blade/Microsoft_Azure_Policy/PolicyMenuBlade/Definitions)
252+
253+
Addition articles about blueprints and how to use them:
254+
255+
- Learn about the [blueprint life-cycle](../../concepts/lifecycle.md).
256+
- Understand how to use [static and dynamic parameters](../../concepts/parameters.md).
257+
- Learn to customize the [blueprint sequencing order](../../concepts/sequencing-order.md).
258+
- Find out how to make use of [blueprint resource locking](../../concepts/resource-locking.md).
259+
- Learn how to [update existing assignments](../../how-to/update-existing-assignments.md).

‎articles/governance/blueprints/samples/cis-azure-1.1.0/index.md

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
---
2+
title: Samples - CIS Microsoft Azure Foundations Benchmark blueprint - Overview
3+
description: Overview of the CIS Microsoft Azure Foundations Benchmark blueprint sample.
4+
author: DCtheGeek
5+
ms.author: dacoulte
6+
ms.date: 08/09/2019
7+
ms.topic: sample
8+
ms.service: blueprints
9+
manager: carmonm
10+
---
11+
# Overview of the CIS Microsoft Azure Foundations Benchmark blueprint sample
12+
13+
The CIS Microsoft Azure Foundations Benchmark blueprint sample provides governance guard-rails using
14+
[Azure Policy](../../../policy/overview.md) that help you assess specific CIS Microsoft Azure
15+
Foundations Benchmark recommendations. This blueprint helps customers deploy a core set of policies
16+
for any Azure-deployed architecture that must implement CIS Microsoft Azure Foundations Benchmark
17+
recommendations.
18+
19+
## Recommendation mapping
20+
21+
The recommendation mapping section provides details on policies included within this blueprint and
22+
how these policies address various recommendations in the CIS Microsoft Azure Foundations Benchmark.
23+
When assigned to an architecture, resources are evaluated by Azure Policy for non-compliance with
24+
assigned policies. For more information, see [Azure Policy](../../../policy/overview.md).
25+
26+
## Next steps
27+
28+
You've reviewed the overview and of the CIS Microsoft Azure Foundations Benchmark blueprint sample.
29+
Next, visit the following article to learn about the recommendation mapping:
30+
31+
> [!div class="nextstepaction"]
32+
> [CIS Microsoft Azure Foundations Benchmark blueprint - Recommendation mapping](./control-mapping.md)
33+
34+
Addition articles about blueprints and how to use them:
35+
36+
- Learn about the [blueprint life-cycle](../../concepts/lifecycle.md).
37+
- Understand how to use [static and dynamic parameters](../../concepts/parameters.md).
38+
- Learn to customize the [blueprint sequencing order](../../concepts/sequencing-order.md).
39+
- Find out how to make use of [blueprint resource locking](../../concepts/resource-locking.md).
40+
- Learn how to [update existing assignments](../../how-to/update-existing-assignments.md).

‎articles/governance/blueprints/samples/index.md

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,8 @@ quality and ready to deploy today to assist you in meeting your various complian
1818

1919
| | |
2020
|---------|---------|
21-
| [IRS 1075](./irs-1075/index.md) | Provides guardrails for compliance to IRS 1075.|
21+
| [CIS Microsoft Azure Foundations Benchmark](./cis-azure-1.1.0/index.md)| Provides a set of policies to help comply with CIS Microsoft Azure Foundations Benchmark recommendations. |
22+
| [IRS 1075](./irs-1075/index.md)| Provides guardrails for compliance to IRS 1075.|
2223
| [ISO 27001](./iso27001/index.md) | Provides guardrails for compliance with ISO 27001. |
2324
| [ISO 27001 Shared Services](./iso27001-shared/index.md) | Provides a set of compliant infrastructure patterns and policy guard-rails that help towards ISO 27001 attestation. |
2425
| [ISO 27001 App Service Environment/SQL Database workload](./iso27001-ase-sql-workload/index.md) | Provides additional infrastructure to the [ISO 27001 Shared Services](./iso27001-shared/index.md) blueprint sample. |

‎articles/governance/blueprints/toc.yml

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -27,6 +27,12 @@
2727
- name: Index
2828
displayName: list, examples
2929
href: ./samples/index.md
30+
- name: CIS Microsoft Azure Foundations Benchmark
31+
items:
32+
- name: Overview
33+
href: ./samples/cis-azure-1.1.0/index.md
34+
- name: Recommendation mapping
35+
href: ./samples/cis-azure-1.1.0/control-mapping.md
3036
- name: IRS 1075
3137
items:
3238
- name: Overview

0 commit comments

Comments
 (0)