Skip to content

Commit a9e34a7

Browse files
james-zhou-inspire11james-zhou-inspire11
committed
feat(CG-1164): add azure pci sql server auditing enabled check
1 parent e9e5c27 commit a9e34a7

4 files changed

Lines changed: 120 additions & 10 deletions

File tree

‎src/azure/pci-dss-3.2.1/README.md‎

Lines changed: 10 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -53,12 +53,13 @@ Policy Pack based on the [PCI DSS version 3.2.1](https://www.pcisecuritystandard
5353

5454
## Available Ruleset
5555

56-
| Rule | Description |
57-
| ------------------ | ------------------------------------------------------------------------------------------------------------------------------------ |
58-
| monitoring-check-1 | Monitor audit profile should log all activities |
59-
| monitoring-check-2 | Monitor audit profile should log all activities |
60-
| monitoring-check-3 | Security Center default policy setting ‘Monitor Endpoint Protection’ should be enabled |
61-
| monitoring-check-4 | Monitor log profile should be created |
62-
| networking-check-1 | Virtual Network security groups should not permit ingress from ‘0.0.0.0/0’ to TCP port 3389 (RDP) |
63-
| networking-check-2 | Virtual Network security groups attached to SQL Server instances should not permit ingress from 0.0.0.0/0 to all ports and protocols |
64-
| networking-check-3 | Virtual Network security groups should not permit ingress from '0.0.0.0/0' to TCP/UDP port 22 (SSH) |
56+
| Rule | Description |
57+
| ------------------- | ------------------------------------------------------------------------------------------------------------------------------------ |
58+
| monitoring-check-1 | Monitor audit profile should log all activities |
59+
| monitoring-check-2 | Monitor audit profile should log all activities |
60+
| monitoring-check-3 | Security Center default policy setting ‘Monitor Endpoint Protection’ should be enabled |
61+
| monitoring-check-4 | Monitor log profile should be created |
62+
| monitoring-check-14 | SQL Server auditing should be enabled |
63+
| networking-check-1 | Virtual Network security groups should not permit ingress from ‘0.0.0.0/0’ to TCP port 3389 (RDP) |
64+
| networking-check-2 | Virtual Network security groups attached to SQL Server instances should not permit ingress from 0.0.0.0/0 to all ports and protocols |
65+
| networking-check-3 | Virtual Network security groups should not permit ingress from '0.0.0.0/0' to TCP/UDP port 22 (SSH) |

‎src/azure/pci-dss-3.2.1/rules/index.ts‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,17 @@
11
import Azure_PCI_DSS_321_Monitoring_1 from './pci-dss-3.2.1-monitoring-check-1'
22
import Azure_PCI_DSS_321_Monitoring_2 from './pci-dss-3.2.1-monitoring-check-2'
33
import Azure_PCI_DSS_321_Monitoring_3 from './pci-dss-3.2.1-monitoring-check-3'
4+
import Azure_PCI_DSS_321_Monitoring_4 from './pci-dss-3.2.1-monitoring-check-4'
5+
import Azure_PCI_DSS_321_Monitoring_14 from './pci-dss-3.2.1-monitoring-check-14'
46
import Azure_PCI_DSS_321_Networking_1 from './pci-dss-3.2.1-networking-check-1'
57
import Azure_PCI_DSS_321_Networking_2 from './pci-dss-3.2.1-networking-check-2'
68

79
export default [
810
Azure_PCI_DSS_321_Monitoring_1,
911
Azure_PCI_DSS_321_Monitoring_2,
1012
Azure_PCI_DSS_321_Monitoring_3,
13+
Azure_PCI_DSS_321_Monitoring_4,
14+
Azure_PCI_DSS_321_Monitoring_14,
1115
Azure_PCI_DSS_321_Networking_1,
1216
Azure_PCI_DSS_321_Networking_2,
1317
]

‎src/azure/pci-dss-3.2.1/rules/pci-dss-3.2.1-monitoring-check-14.ts‎

Lines changed: 53 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,53 @@
1+
// similar to NIST 2.5
2+
export default {
3+
id: 'pci-dss-3.2.1-monitoring-check-14',
4+
title: 'Monitoring Check 14: SQL Server auditing should be enabled',
5+
6+
description: 'The Azure platform allows a SQL server to be created as a service. Enabling auditing at the server level ensures that all existing and newly created databases on the SQL server instance are audited. Auditing policy applied on the SQL database does not override auditing policy and settings applied on the particular SQL server where the database is hosted.',
7+
8+
audit: '',
9+
10+
rationale: '',
11+
12+
remediation: `**From Azure Console**
13+
14+
- Navigate to [SQL Servers](https://portal.azure.com/#blade/HubsExtension/BrowseResource/resourceType/Microsoft.Sql%2Fservers).
15+
- Select the SQL server.
16+
- In the left navigation in the Security section, select Auditing.
17+
- Set Auditing to On.
18+
19+
**Using PowerShell:**
20+
21+
- To enable auditing for SQL Server, get a list of all SQL servers:
22+
23+
Get-AzureRmSqlServer
24+
25+
- Enable auditing for each server:
26+
27+
Set-AzureRmSqlServerAuditingPolicy -ResourceGroupName <resource group name> -ServerName <server name> -AuditType <audit type> -StorageAccountName <storage account name>`,
28+
29+
references: [
30+
'https://docs.microsoft.com/en-us/azure/security-center/security-center-sql-service-recommendations',
31+
'https://docs.microsoft.com/en-us/powershell/module/azurerm.sql/get-azurermsqlserverauditing?view=azurermps-6.13.0&viewFallbackFrom=azurermps-5.2.0',
32+
'https://docs.microsoft.com/en-us/powershell/module/azurerm.sql/set-azurermsqlserverauditingpolicy?view=azurermps-6.13.0&viewFallbackFrom=azurermps-5.2.0',
33+
'https://docs.microsoft.com/en-us/azure/azure-sql/database/auditing-overview',
34+
],
35+
gql: `{
36+
queryazureSqlServer {
37+
id
38+
__typename
39+
serverBlobAuditingPolicies {
40+
state
41+
}
42+
}
43+
}`,
44+
resource: 'queryazureSqlServer[*]',
45+
severity: 'medium',
46+
conditions: {
47+
path: '@.serverBlobAuditingPolicies',
48+
array_any: {
49+
path: '[*].state',
50+
equal: 'Enabled'
51+
},
52+
},
53+
}

‎src/azure/pci-dss-3.2.1/tests/pci-dss-3.2.1-monitoring-checks.test.ts‎

Lines changed: 53 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,7 @@ import Azure_PCI_DSS_321_Monitoring_1 from '../rules/pci-dss-3.2.1-monitoring-ch
66
import Azure_PCI_DSS_321_Monitoring_2 from '../rules/pci-dss-3.2.1-monitoring-check-2'
77
import Azure_PCI_DSS_321_Monitoring_3 from '../rules/pci-dss-3.2.1-monitoring-check-3'
88
import Azure_PCI_DSS_321_Monitoring_4 from '../rules/pci-dss-3.2.1-monitoring-check-4'
9+
import Azure_PCI_DSS_321_Monitoring_14 from '../rules/pci-dss-3.2.1-monitoring-check-14'
910

1011
export interface azureActivityLogAlertLeafCondition {
1112
id: string
@@ -54,11 +55,18 @@ export interface QueryazurePolicyAssignment {
5455
displayName: string
5556
parameters: Parameter[]
5657
}
57-
58+
export interface ServerBlobAuditingPolicy {
59+
state: string
60+
}
61+
export interface QueryazureSqlServer {
62+
id: string
63+
serverBlobAuditingPolicies: ServerBlobAuditingPolicy[]
64+
}
5865
export interface PCIQueryResponse {
5966
queryazureLogProfile?: QueryazureLogProfile[]
6067
queryazureSubscription?: QueryazureSubscription[]
6168
queryazurePolicyAssignment?: QueryazurePolicyAssignment[]
69+
queryazureSqlServer?: QueryazureSqlServer[]
6270
}
6371

6472
describe('PCI Data Security Standard: 3.2.1', () => {
@@ -397,4 +405,48 @@ describe('PCI Data Security Standard: 3.2.1', () => {
397405
await testRule(data, Result.FAIL)
398406
})
399407
})
408+
409+
describe('Monitoring Check 14: SQL Server auditing should be enabled', () => {
410+
const getTestRuleFixture = (
411+
state: string
412+
): PCIQueryResponse => {
413+
return {
414+
queryazureSqlServer: [
415+
{
416+
id: cuid(),
417+
serverBlobAuditingPolicies: [
418+
{
419+
state
420+
}
421+
]
422+
},
423+
],
424+
}
425+
}
426+
427+
// Act
428+
const testRule = async (
429+
data: PCIQueryResponse,
430+
expectedResult: Result
431+
): Promise<void> => {
432+
// Act
433+
const [processedRule] = await rulesEngine.processRule(
434+
Azure_PCI_DSS_321_Monitoring_14 as Rule,
435+
{ ...data }
436+
)
437+
438+
// Asserts
439+
expect(processedRule.result).toBe(expectedResult)
440+
}
441+
442+
test('No Security Issue when SQL Server auditing is enabled', async () => {
443+
const data: PCIQueryResponse = getTestRuleFixture('Enabled')
444+
await testRule(data, Result.PASS)
445+
})
446+
447+
test('Security Issue when SQL Server auditing is disabled', async () => {
448+
const data: PCIQueryResponse = getTestRuleFixture('Disabled')
449+
await testRule(data, Result.FAIL)
450+
})
451+
})
400452
})

0 commit comments

Comments
 (0)