@@ -37,9 +37,6 @@ definitions that audit insecure connections to storage accounts and Redis Cache.
37
37
- Secure transfer to storage accounts should be enabled
38
38
- Show audit results from Windows web servers that are not using secure communication protocols
39
39
- Deploy prerequisites to audit Windows web servers that are not using secure communication protocols
40
- - Latest TLS version should be used in your API App
41
- - Latest TLS version should be used in your Web App
42
- - Latest TLS version should be used in your Function App
43
40
44
41
## 2.3 Data at rest protection
45
42
@@ -172,8 +169,8 @@ help you take corrective actions to ensure access Azure resources is restricted
172
169
173
170
- \[ Preview\] : Deploy requirements to audit Linux VMs that have accounts without passwords
174
171
- \[ Preview\] : Deploy requirements to audit Linux VMs that allow remote connections from accounts without passwords
175
- - \[ Preview\] : Audit Linux VMs that have accounts without passwords
176
- - \[ Preview\] : Audit Linux VMs that allow remote connections from accounts without passwords
172
+ - \[ Preview\] : Show audit results from Linux VMs that have accounts without passwords
173
+ - \[ Preview\] : Show audit results from Linux VMs that allow remote connections from accounts without passwords
177
174
- Storage accounts should be migrated to new Azure Resource Manager resources
178
175
- Virtual machines should be migrated to new Azure Resource Manager resources
179
176
- Audit VMs that do not use managed disks
@@ -188,12 +185,10 @@ also assigns a policy that enables adaptive application controls on virtual mach
188
185
189
186
- Audit unrestricted network access to storage accounts
190
187
- Adaptive Application Controls should be enabled on virtual machines
191
- - The NSGs rules for web applications on IaaS should be hardened
192
188
- Access through Internet facing endpoint should be restricted
193
- - Network Security Group Rules for Internet facing virtual machines should be hardened
189
+ - Adaptive Network Hardening recommendations should be applied on internet facing virtual machines
194
190
- Endpoint protection solution should be installed on virtual machine scale sets
195
191
- Just-In-Time network access control should be applied on virtual machines
196
- - Audit unrestricted network access to storage accounts
197
192
- Remote debugging should be turned off for Function App
198
193
- Remote debugging should be turned off for Web Application
199
194
- Remote debugging should be turned off for API App
@@ -246,15 +241,15 @@ This blueprint also assigns an Azure Policy definition that audits Linux VM pass
246
241
permissions to alert if they're set incorrectly. This design enables you to take corrective action
247
242
to ensure authenticators aren't compromised.
248
243
249
- - \[ Preview\] : Audit Linux VM /etc/ passwd file permissions are set to 0644
244
+ - \[ Preview\] : Show audit results from Linux VMs that do not have the passwd file permissions set to 0644
250
245
251
246
## 13 Audit Information for Users
252
247
253
248
This blueprint helps you ensure system events are logged by assigning [ Azure Policy] ( ../../../policy/overview.md )
254
249
definitions that audit log settings on Azure resources. An assigned policy also audits if virtual
255
250
machines aren't sending logs to a specified log analytics workspace.
256
251
257
- - Auditing should be enabled on advanced data security settings on SQL Server
252
+ - Advanced data security should be enabled on your SQL servers
258
253
- Audit diagnostic setting
259
254
- \[ Preview\] : Deploy Log Analytics Agent for Linux VMs
260
255
- \[ Preview\] : Deploy Log Analytics Agent for Windows VMs
0 commit comments