Skip to content

Commit 4ca4068

Browse files
tyler-dunkeltyler-dunkel
authored
Merge pull request #94 from cloudgraphdev/feature/CG-1175-azure-pci-encription-check-rules
feat(CG-1175): add azure encryption transit rule check
2 parents 7474b76 + e0224fd commit 4ca4068

7 files changed

Lines changed: 480 additions & 0 deletions

‎src/azure/pci-dss-3.2.1/README.md‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -55,6 +55,10 @@ Policy Pack based on the [PCI DSS version 3.2.1](https://www.pcisecuritystandard
5555

5656
| Rule | Description |
5757
| ---------------------- | ------------------------------------------------------------------------------------------------------------------------------------ |
58+
| encryption-check-1 | App Service web apps should have 'HTTPS only' enabled |
59+
| encryption-check-2 | MySQL Database server 'enforce SSL connection' should be enabled |
60+
| encryption-check-3 | PostgreSQL Database server 'enforce SSL connection' should be enabled |
61+
| encryption-check-4 | Storage Accounts 'Secure transfer required' should be enabled |
5862
| monitoring-check-1 | Monitor audit profile should log all activities |
5963
| monitoring-check-2 | Monitor audit profile should log all activities |
6064
| monitoring-check-3 | Security Center default policy setting ‘Monitor Endpoint Protection’ should be enabled |

‎src/azure/pci-dss-3.2.1/rules/index.ts‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,7 @@
1+
import Azure_PCI_DSS_321_Encryption_1 from './pci-dss-3.2.1-encryption-check-1'
2+
import Azure_PCI_DSS_321_Encryption_2 from './pci-dss-3.2.1-encryption-check-2'
3+
import Azure_PCI_DSS_321_Encryption_3 from './pci-dss-3.2.1-encryption-check-3'
4+
import Azure_PCI_DSS_321_Encryption_4 from './pci-dss-3.2.1-encryption-check-4'
15
import Azure_PCI_DSS_321_Monitoring_1 from './pci-dss-3.2.1-monitoring-check-1'
26
import Azure_PCI_DSS_321_Monitoring_2 from './pci-dss-3.2.1-monitoring-check-2'
37
import Azure_PCI_DSS_321_Monitoring_3 from './pci-dss-3.2.1-monitoring-check-3'
@@ -22,6 +26,10 @@ import Azure_PCI_DSS_321_Policy_Version_1 from './pci-dss-3.2.1-policy-version-c
2226
import Azure_PCI_DSS_321_User_1 from './pci-dss-3.2.1-user-check-1'
2327

2428
export default [
29+
Azure_PCI_DSS_321_Encryption_1,
30+
Azure_PCI_DSS_321_Encryption_2,
31+
Azure_PCI_DSS_321_Encryption_3,
32+
Azure_PCI_DSS_321_Encryption_4,
2533
Azure_PCI_DSS_321_Monitoring_1,
2634
Azure_PCI_DSS_321_Monitoring_2,
2735
Azure_PCI_DSS_321_Monitoring_3,

‎src/azure/pci-dss-3.2.1/rules/pci-dss-3.2.1-encryption-check-1.ts‎

Lines changed: 55 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,55 @@
1+
// similar to CIS 9.2
2+
export default {
3+
id: 'pci-dss-3.2.1-encryption-check-1',
4+
title: 'Encryption Check 1: App Service web apps should have \'HTTPS only\' enabled',
5+
6+
description: 'Azure Web Apps allows sites to run under both HTTP and HTTPS by default. Web apps can be accessed by anyone using non-secure HTTP links by default. Non-secure HTTP requests can be restricted and all HTTP requests redirected to the secure HTTPS port. It is recommended to enforce HTTPS-only traffic.',
7+
8+
audit: `**From Azure Console**
9+
10+
1. Login to Azure Portal using https://portal.azure.com
11+
2. Go to App Services
12+
3. Click on each App
13+
4. Under Setting section, Click on SSL settings
14+
5. Ensure that HTTPS Only set to On under Protocol Settings
15+
16+
**Using Azure Command Line Interface**
17+
To check HTTPS-only traffic value for an existing app, run the following command,
18+
19+
az webapp show --resource-group <RESOURCE_GROUP_NAME> --name <APP_NAME> --query httpsOnly
20+
21+
The output should return true if HTTPS-only traffic value is set to On.`,
22+
23+
rationale: 'Enabling HTTPS-only traffic will redirect all non-secure HTTP request to HTTPS ports. HTTPS uses the SSL/TLS protocol to provide a secure connection, which is both encrypted and authenticated. So it is important to support HTTPS for the security benefits.',
24+
25+
remediation: `**From Azure Console**
26+
27+
1. Login to Azure Portal using https://portal.azure.com
28+
2. Go to App Services
29+
3. Click on each App
30+
4. Under Setting section, Click on SSL settings
31+
5. Set HTTPS Only to On under Protocol Settings section
32+
33+
Using Azure Command Line Interface To set HTTPS-only traffic value for an existing app, run the following command:
34+
35+
az webapp update --resource-group <RESOURCE_GROUP_NAME> --name <APP_NAME> --set httpsOnly=true`,
36+
37+
references: [
38+
'https://docs.microsoft.com/en-us/azure/app-service/app-service-web-tutorial-custom-ssl#enforce-https',
39+
'https://docs.microsoft.com/en-us/azure/security/benchmarks/security-controls-v2-data-protection#dp-4-encrypt-sensitive-information-in-transit',
40+
'https://docs.microsoft.com/en-us/azure/security/benchmarks/security-controls-v2-network-security#ns-1-implement-security-for-internal-traffic',
41+
],
42+
gql: `{
43+
queryazureAppServiceWebApp {
44+
id
45+
__typename
46+
httpsOnly
47+
}
48+
}`,
49+
resource: 'queryazureAppServiceWebApp[*]',
50+
severity: 'medium',
51+
conditions: {
52+
path: '@.httpsOnly',
53+
equal: true,
54+
},
55+
}

‎src/azure/pci-dss-3.2.1/rules/pci-dss-3.2.1-encryption-check-2.ts‎

Lines changed: 61 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,61 @@
1+
// similar to CIS 4.3.2
2+
export default {
3+
id: 'pci-dss-3.2.1-encryption-check-2',
4+
title: 'Encryption Check 2: MySQL Database server \'enforce SSL connection\' should be enabled',
5+
6+
description: 'Enable SSL connection on MYSQL Servers.',
7+
8+
audit: `**From Azure Console:**
9+
10+
1. Login to Azure Portal using https://portal.azure- list text here.com
11+
2. Go to Azure Database for MySQL server
12+
3. For each database, click on Connection security
13+
4. In SSL settings
14+
5. Ensure Enforce SSL connection is set to ENABLED.
15+
16+
**Using Azure Command Line Interface 2.0**
17+
Ensure the output of the below command returns ENABLED.
18+
19+
az mysql server show --resource-group myresourcegroup --name <resourceGroupName> --query sslEnforcement`,
20+
21+
rationale: `SSL connectivity helps to provide a new layer of security, by connecting database server to
22+
client applications using Secure Sockets Layer (SSL). Enforcing SSL connections between
23+
database server and client applications helps protect against "man in the middle" attacks
24+
by encrypting the data stream between the server and application.`,
25+
26+
remediation: `**From Azure Console:**
27+
28+
1. Login to Azure Portal using https://portal.azure.com
29+
2. Go to Azure Database for MySQL server
30+
3. For each database, click on Connection security
31+
4. In SSL settings
32+
5. Click on ENABLED for Enforce SSL connection
33+
34+
**Using Azure Command Line Interface 2.0**
35+
Use the below command to set MYSQL Databases to Enforce SSL connection.
36+
37+
az mysql server update --resource-group <resourceGroupName> --name <serverName> --ssl-enforcement Enabled`,
38+
39+
references: [
40+
'https://docs.microsoft.com/en-us/azure/mysql/concepts-ssl-connection-security',
41+
'https://docs.microsoft.com/en-us/azure/mysql/howto-configure-ssl',
42+
'https://docs.microsoft.com/en-us/azure/security/benchmarks/security-controls-v2-data-protection#dp-4-encrypt-sensitive-information-in-transit',
43+
],
44+
gql: `{
45+
queryazureMySqlServer {
46+
id
47+
__typename
48+
sslEnforcement
49+
}
50+
}`,
51+
resource: 'queryazureMySqlServer[*]',
52+
severity: 'medium',
53+
conditions: {
54+
and: [
55+
{
56+
path: '@.sslEnforcement',
57+
equal: 'Enabled',
58+
},
59+
],
60+
},
61+
}

‎src/azure/pci-dss-3.2.1/rules/pci-dss-3.2.1-encryption-check-3.ts‎

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
// similar to CIS 4.3.1
2+
export default {
3+
id: 'pci-dss-3.2.1-encryption-check-3',
4+
title: 'Encryption Check 3: PostgreSQL Database server \'enforce SSL connection\' should be enabled',
5+
6+
description: 'Enable SSL connection on PostgreSQL Servers.',
7+
8+
audit: `**From Azure Console:**
9+
10+
1. Login to Azure Portal using https://portal.azure.com
11+
2. Go to Azure Database for PostgreSQL server
12+
3. For each database, click on Connection security
13+
4. In SSL settings
14+
5. Ensure Enforce SSL connection is set to ENABLED.
15+
16+
**Using Azure Command Line Interface 2.0**
17+
Ensure the output of the below command returns ENABLED.
18+
19+
az postgres server show --resource-group myresourcegroup --name <resourceGroupName> --query sslEnforcement`,
20+
21+
rationale: `SSL connectivity helps to provide a new layer of security, by connecting database server
22+
to client applications using Secure Sockets Layer (SSL). Enforcing SSL connections between
23+
database server and client applications helps protect against "man in the middle" attacks
24+
by encrypting the data stream between the server and application.`,
25+
26+
remediation: `**From Azure Console:**
27+
28+
1. Login to Azure Portal using https://portal.azure.com
29+
2. Go to Azure Database for PostgreSQL server
30+
3. For each database, click on Connection security
31+
4. In SSL settings.
32+
5. Click on ENABLED to Enforce SSL connection
33+
34+
**Using Azure Command Line Interface 2.0**
35+
Use the below command to enforce ssl connection for PostgreSQL Database.
36+
37+
az postgres server update --resource-group <resourceGroupName> --name <serverName> --ssl-enforcement Enabled`,
38+
39+
references: [
40+
'https://docs.microsoft.com/en-us/azure/postgresql/concepts-ssl-connection-security',
41+
'https://docs.microsoft.com/en-us/azure/security/benchmarks/security-controls-v2-data-protection#dp-4-encrypt-sensitive-information-in-transit',
42+
],
43+
gql: `{
44+
queryazurePostgreSqlServer {
45+
id
46+
__typename
47+
sslEnforcement
48+
}
49+
}`,
50+
resource: 'queryazurePostgreSqlServer[*]',
51+
severity: 'medium',
52+
conditions: {
53+
and: [
54+
{
55+
path: '@.sslEnforcement',
56+
equal: 'Enabled',
57+
},
58+
],
59+
},
60+
}

‎src/azure/pci-dss-3.2.1/rules/pci-dss-3.2.1-encryption-check-4.ts‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
// similar to CIS 3.1
2+
export default {
3+
id: 'pci-dss-3.2.1-encryption-check-4',
4+
title: "Encryption Check 4: Storage Accounts 'Secure transfer required' should be enabled",
5+
6+
description: 'Enable Storage Accounts data encryption in transit.',
7+
8+
audit: `**From Azure Console**
9+
10+
1. Go to Storage Accounts
11+
2. For each storage account, go to Configuration
12+
3. Ensure that Secure transfer required is set to Enabled
13+
14+
**Using Azure Command Line Interface 2.0**
15+
Use the below command to ensure the Secure transfer required is enabled for all the Storage Accounts by ensuring the output contains true for each of the Storage Accounts.
16+
17+
z storage account list --query [*].[name,enableHttpsTrafficOnly]`,
18+
19+
rationale:
20+
"The secure transfer option enhances the security of a storage account by only allowing requests to the storage account by a secure connection. For example, when calling REST APIs to access storage accounts, the connection must use HTTPS. Any requests using HTTP will be rejected when 'secure transfer required' is enabled. When using the Azure files service, connection without encryption will fail, including scenarios using SMB 2.1, SMB 3.0 without encryption, and some flavors of the Linux SMB client. Because Azure storage doesn’t support HTTPS for custom domain names, this option is not applied when using a custom domain name.",
21+
22+
remediation: `**From Azure Console**
23+
24+
1. Go to Storage Accounts
25+
2. For each storage account, go to Configuration
26+
3. Set Secure transfer required to Enabled
27+
28+
**Using Azure Command Line Interface 2.0**
29+
Use the below command to enable Secure transfer required for a Storage Account
30+
31+
az storage account update --name <storageAccountName> --resource-group <resourceGroupName> --https-only true`,
32+
33+
references: [
34+
'https://docs.microsoft.com/en-us/azure/storage/blobs/security-recommendations#encryption-in-transit',
35+
'https://docs.microsoft.com/en-us/cli/azure/storage/account?view=azure-cli-latest#az_storage_account_list',
36+
'https://docs.microsoft.com/en-us/cli/azure/storage/account?view=azure-cli-latest#az_storage_account_update',
37+
'https://docs.microsoft.com/en-us/azure/security/benchmarks/security-controls-v2-data-protection#dp-4-encrypt-sensitive-information-in-transit',
38+
],
39+
gql: `{
40+
queryazureStorageAccount {
41+
id
42+
__typename
43+
enableHttpsTrafficOnly
44+
}
45+
}`,
46+
resource: 'queryazureStorageAccount[*]',
47+
severity: 'medium',
48+
conditions: {
49+
path: '@.enableHttpsTrafficOnly',
50+
equal: 'Yes',
51+
},
52+
}

0 commit comments

Comments
 (0)