Skip to content

Commit e1e9221

Browse files
james-zhou-inspire11james-zhou-inspire11
committed
Merge branch 'alpha' into feature/CG-1164-azure-pci-sql-server-auditing-enabled-check
2 parents a9e34a7 + 4ca4068 commit e1e9221

27 files changed

Lines changed: 3453 additions & 12 deletions

‎README.md‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -29,7 +29,11 @@ cg scan aws gcp azure
2929
| [CIS Amazon Web Services Foundations 1.2.0](https://www.npmjs.com/package/@cloudgraph/policy-pack-aws-cis-1.2.0) |
3030
| [CIS Amazon Web Services Foundations 1.3.0](https://www.npmjs.com/package/@cloudgraph/policy-pack-aws-cis-1.3.0) |
3131
| [CIS Amazon Web Services Foundations 1.4.0](https://www.npmjs.com/package/@cloudgraph/policy-pack-aws-cis-1.4.0) |
32-
| [CIS Google Cloud Platform Foundations 1.2.0](https://www.npmjs.com/package/@cloudgraph/policy-pack-gcp-cis-1.2.0) |
33-
| [CIS Microsoft Azure Foundations 1.3.1](https://www.npmjs.com/package/@cloudgraph/policy-pack-azure-cis-1.3.1) |
3432
| [AWS PCI Data Security Standard version 3.2.1](https://www.npmjs.com/package/@cloudgraph/policy-pack-aws-pci-dss-3.2.1) |
3533
| [NIST 800-53 Rev. 4 for Amazon Web Services](https://www.npmjs.com/package/@cloudgraph/policy-pack-aws-nist-800-53-rev4) |
34+
| [CIS Google Cloud Platform Foundations 1.2.0](https://www.npmjs.com/package/@cloudgraph/policy-pack-gcp-cis-1.2.0) |
35+
| [GCP PCI Data Security Standard version 3.2.1](https://www.npmjs.com/package/@cloudgraph/policy-pack-gcp-pci-dss-3.2.1) |
36+
| [NIST 800-53 Rev. 4 for Google Cloud Services](https://www.npmjs.com/package/@cloudgraph/policy-pack-gcp-nist-800-53-rev4) |
37+
| [CIS Microsoft Azure Foundations 1.3.1](https://www.npmjs.com/package/@cloudgraph/policy-pack-azure-cis-1.3.1) |
38+
| [Azure PCI Data Security Standard version 3.2.1](https://www.npmjs.com/package/@cloudgraph/policy-pack-azure-pci-dss-3.2.1) |
39+
| [NIST 800-53 Rev. 4 for Microsoft Azure Services](https://www.npmjs.com/package/@cloudgraph/policy-pack-azure-nist-800-53-rev4) |

‎src/azure/pci-dss-3.2.1/README.md‎

Lines changed: 29 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -53,13 +53,32 @@ Policy Pack based on the [PCI DSS version 3.2.1](https://www.pcisecuritystandard
5353

5454
## Available Ruleset
5555

56-
| Rule | Description |
57-
| ------------------- | ------------------------------------------------------------------------------------------------------------------------------------ |
58-
| monitoring-check-1 | Monitor audit profile should log all activities |
59-
| monitoring-check-2 | Monitor audit profile should log all activities |
60-
| monitoring-check-3 | Security Center default policy setting ‘Monitor Endpoint Protection’ should be enabled |
61-
| monitoring-check-4 | Monitor log profile should be created |
62-
| monitoring-check-14 | SQL Server auditing should be enabled |
63-
| networking-check-1 | Virtual Network security groups should not permit ingress from ‘0.0.0.0/0’ to TCP port 3389 (RDP) |
64-
| networking-check-2 | Virtual Network security groups attached to SQL Server instances should not permit ingress from 0.0.0.0/0 to all ports and protocols |
65-
| networking-check-3 | Virtual Network security groups should not permit ingress from '0.0.0.0/0' to TCP/UDP port 22 (SSH) |
56+
| Rule | Description |
57+
| ---------------------- | ------------------------------------------------------------------------------------------------------------------------------------ |
58+
| encryption-check-1 | App Service web apps should have 'HTTPS only' enabled |
59+
| encryption-check-2 | MySQL Database server 'enforce SSL connection' should be enabled |
60+
| encryption-check-3 | PostgreSQL Database server 'enforce SSL connection' should be enabled |
61+
| encryption-check-4 | Storage Accounts 'Secure transfer required' should be enabled |
62+
| monitoring-check-1 | Monitor audit profile should log all activities |
63+
| monitoring-check-2 | Monitor audit profile should log all activities |
64+
| monitoring-check-3 | Security Center default policy setting ‘Monitor Endpoint Protection’ should be enabled |
65+
| monitoring-check-4 | Monitor log profile should be created |
66+
| monitoring-check-5 | Monitor Activity Log Alert should exist for Create or Update Network Security Group |
67+
| monitoring-check-6 | Monitor Activity Log Alert should exist for Create or Update Network Security Group Rule |
68+
| monitoring-check-7 | Monitor Activity Log Alert should exist for Create or Update or Delete SQL Server Firewall Rule |
69+
| monitoring-check-8 | Monitor Activity Log Alert should exist for Create or Update Security Solution |
70+
| monitoring-check-9 | Monitor Activity Log Alert should exist for Create Policy Assignment |
71+
| monitoring-check-10 | Monitor Activity Log Alert should exist for Delete Network Security Group |
72+
| monitoring-check-11 | Monitor Activity Log Alert should exist for Delete Network Security Group Rule |
73+
| monitoring-check-12 | Monitor Activity Log Alert should exist for Delete Security Solution |
74+
| monitoring-check-13 | Monitor log profile should have activity logs for global services and all regions |
75+
| monitoring-check-14 | SQL Server auditing should be enabled |
76+
| network-access-check-1 | MySQL Database server firewall rules should not permit start and end IP addresses to be 0.0.0.0 |
77+
| network-access-check-2 | PostgreSQL Database server firewall rules should not permit start and end IP addresses to be 0.0.0.0 |
78+
| network-access-check-3 | SQL Server firewall rules should not permit start and end IP addresses to be 0.0.0.0 |
79+
| network-access-check-4 | Ensure default network access rule for Storage Accounts is set to deny |
80+
| networking-check-1 | Virtual Network security groups should not permit ingress from ‘0.0.0.0/0’ to TCP port 3389 (RDP) |
81+
| networking-check-2 | Virtual Network security groups attached to SQL Server instances should not permit ingress from 0.0.0.0/0 to all ports and protocols |
82+
| networking-check-3 | Virtual Network security groups should not permit ingress from '0.0.0.0/0' to TCP/UDP port 22 (SSH) |
83+
| policy-version-check-1 | App Service web apps should have 'Minimum TLS Version' set to '1.2' |
84+
| user-check-1 | Active Directory custom subscription owner roles should not be created |

‎src/azure/pci-dss-3.2.1/rules/index.ts‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,17 +1,57 @@
1+
import Azure_PCI_DSS_321_Encryption_1 from './pci-dss-3.2.1-encryption-check-1'
2+
import Azure_PCI_DSS_321_Encryption_2 from './pci-dss-3.2.1-encryption-check-2'
3+
import Azure_PCI_DSS_321_Encryption_3 from './pci-dss-3.2.1-encryption-check-3'
4+
import Azure_PCI_DSS_321_Encryption_4 from './pci-dss-3.2.1-encryption-check-4'
15
import Azure_PCI_DSS_321_Monitoring_1 from './pci-dss-3.2.1-monitoring-check-1'
26
import Azure_PCI_DSS_321_Monitoring_2 from './pci-dss-3.2.1-monitoring-check-2'
37
import Azure_PCI_DSS_321_Monitoring_3 from './pci-dss-3.2.1-monitoring-check-3'
48
import Azure_PCI_DSS_321_Monitoring_4 from './pci-dss-3.2.1-monitoring-check-4'
9+
import Azure_PCI_DSS_321_Monitoring_5 from './pci-dss-3.2.1-monitoring-check-5'
10+
import Azure_PCI_DSS_321_Monitoring_6 from './pci-dss-3.2.1-monitoring-check-6'
11+
import Azure_PCI_DSS_321_Monitoring_7 from './pci-dss-3.2.1-monitoring-check-7'
12+
import Azure_PCI_DSS_321_Monitoring_8 from './pci-dss-3.2.1-monitoring-check-8'
13+
import Azure_PCI_DSS_321_Monitoring_9 from './pci-dss-3.2.1-monitoring-check-9'
14+
import Azure_PCI_DSS_321_Monitoring_10 from './pci-dss-3.2.1-monitoring-check-10'
15+
import Azure_PCI_DSS_321_Monitoring_11 from './pci-dss-3.2.1-monitoring-check-11'
16+
import Azure_PCI_DSS_321_Monitoring_12 from './pci-dss-3.2.1-monitoring-check-12'
17+
import Azure_PCI_DSS_321_Monitoring_13 from './pci-dss-3.2.1-monitoring-check-13'
518
import Azure_PCI_DSS_321_Monitoring_14 from './pci-dss-3.2.1-monitoring-check-14'
19+
import Azure_PCI_DSS_321_Network_Access_1 from './pci-dss-3.2.1-network-access-check-1'
20+
import Azure_PCI_DSS_321_Network_Access_2 from './pci-dss-3.2.1-network-access-check-2'
21+
import Azure_PCI_DSS_321_Network_Access_3 from './pci-dss-3.2.1-network-access-check-3'
22+
import Azure_PCI_DSS_321_Network_Access_4 from './pci-dss-3.2.1-network-access-check-4'
623
import Azure_PCI_DSS_321_Networking_1 from './pci-dss-3.2.1-networking-check-1'
724
import Azure_PCI_DSS_321_Networking_2 from './pci-dss-3.2.1-networking-check-2'
25+
import Azure_PCI_DSS_321_Networking_3 from './pci-dss-3.2.1-networking-check-3'
26+
import Azure_PCI_DSS_321_Policy_Version_1 from './pci-dss-3.2.1-policy-version-check-1'
27+
import Azure_PCI_DSS_321_User_1 from './pci-dss-3.2.1-user-check-1'
828

929
export default [
30+
Azure_PCI_DSS_321_Encryption_1,
31+
Azure_PCI_DSS_321_Encryption_2,
32+
Azure_PCI_DSS_321_Encryption_3,
33+
Azure_PCI_DSS_321_Encryption_4,
1034
Azure_PCI_DSS_321_Monitoring_1,
1135
Azure_PCI_DSS_321_Monitoring_2,
1236
Azure_PCI_DSS_321_Monitoring_3,
1337
Azure_PCI_DSS_321_Monitoring_4,
38+
Azure_PCI_DSS_321_Monitoring_5,
39+
Azure_PCI_DSS_321_Monitoring_6,
40+
Azure_PCI_DSS_321_Monitoring_7,
41+
Azure_PCI_DSS_321_Monitoring_8,
42+
Azure_PCI_DSS_321_Monitoring_9,
43+
Azure_PCI_DSS_321_Monitoring_10,
44+
Azure_PCI_DSS_321_Monitoring_11,
45+
Azure_PCI_DSS_321_Monitoring_12,
46+
Azure_PCI_DSS_321_Monitoring_13,
1447
Azure_PCI_DSS_321_Monitoring_14,
48+
Azure_PCI_DSS_321_Network_Access_1,
49+
Azure_PCI_DSS_321_Network_Access_2,
50+
Azure_PCI_DSS_321_Network_Access_3,
51+
Azure_PCI_DSS_321_Network_Access_4,
1552
Azure_PCI_DSS_321_Networking_1,
1653
Azure_PCI_DSS_321_Networking_2,
54+
Azure_PCI_DSS_321_Networking_3,
55+
Azure_PCI_DSS_321_Policy_Version_1,
56+
Azure_PCI_DSS_321_User_1,
1757
]

‎src/azure/pci-dss-3.2.1/rules/pci-dss-3.2.1-encryption-check-1.ts‎

Lines changed: 55 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,55 @@
1+
// similar to CIS 9.2
2+
export default {
3+
id: 'pci-dss-3.2.1-encryption-check-1',
4+
title: 'Encryption Check 1: App Service web apps should have \'HTTPS only\' enabled',
5+
6+
description: 'Azure Web Apps allows sites to run under both HTTP and HTTPS by default. Web apps can be accessed by anyone using non-secure HTTP links by default. Non-secure HTTP requests can be restricted and all HTTP requests redirected to the secure HTTPS port. It is recommended to enforce HTTPS-only traffic.',
7+
8+
audit: `**From Azure Console**
9+
10+
1. Login to Azure Portal using https://portal.azure.com
11+
2. Go to App Services
12+
3. Click on each App
13+
4. Under Setting section, Click on SSL settings
14+
5. Ensure that HTTPS Only set to On under Protocol Settings
15+
16+
**Using Azure Command Line Interface**
17+
To check HTTPS-only traffic value for an existing app, run the following command,
18+
19+
az webapp show --resource-group <RESOURCE_GROUP_NAME> --name <APP_NAME> --query httpsOnly
20+
21+
The output should return true if HTTPS-only traffic value is set to On.`,
22+
23+
rationale: 'Enabling HTTPS-only traffic will redirect all non-secure HTTP request to HTTPS ports. HTTPS uses the SSL/TLS protocol to provide a secure connection, which is both encrypted and authenticated. So it is important to support HTTPS for the security benefits.',
24+
25+
remediation: `**From Azure Console**
26+
27+
1. Login to Azure Portal using https://portal.azure.com
28+
2. Go to App Services
29+
3. Click on each App
30+
4. Under Setting section, Click on SSL settings
31+
5. Set HTTPS Only to On under Protocol Settings section
32+
33+
Using Azure Command Line Interface To set HTTPS-only traffic value for an existing app, run the following command:
34+
35+
az webapp update --resource-group <RESOURCE_GROUP_NAME> --name <APP_NAME> --set httpsOnly=true`,
36+
37+
references: [
38+
'https://docs.microsoft.com/en-us/azure/app-service/app-service-web-tutorial-custom-ssl#enforce-https',
39+
'https://docs.microsoft.com/en-us/azure/security/benchmarks/security-controls-v2-data-protection#dp-4-encrypt-sensitive-information-in-transit',
40+
'https://docs.microsoft.com/en-us/azure/security/benchmarks/security-controls-v2-network-security#ns-1-implement-security-for-internal-traffic',
41+
],
42+
gql: `{
43+
queryazureAppServiceWebApp {
44+
id
45+
__typename
46+
httpsOnly
47+
}
48+
}`,
49+
resource: 'queryazureAppServiceWebApp[*]',
50+
severity: 'medium',
51+
conditions: {
52+
path: '@.httpsOnly',
53+
equal: true,
54+
},
55+
}

‎src/azure/pci-dss-3.2.1/rules/pci-dss-3.2.1-encryption-check-2.ts‎

Lines changed: 61 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,61 @@
1+
// similar to CIS 4.3.2
2+
export default {
3+
id: 'pci-dss-3.2.1-encryption-check-2',
4+
title: 'Encryption Check 2: MySQL Database server \'enforce SSL connection\' should be enabled',
5+
6+
description: 'Enable SSL connection on MYSQL Servers.',
7+
8+
audit: `**From Azure Console:**
9+
10+
1. Login to Azure Portal using https://portal.azure- list text here.com
11+
2. Go to Azure Database for MySQL server
12+
3. For each database, click on Connection security
13+
4. In SSL settings
14+
5. Ensure Enforce SSL connection is set to ENABLED.
15+
16+
**Using Azure Command Line Interface 2.0**
17+
Ensure the output of the below command returns ENABLED.
18+
19+
az mysql server show --resource-group myresourcegroup --name <resourceGroupName> --query sslEnforcement`,
20+
21+
rationale: `SSL connectivity helps to provide a new layer of security, by connecting database server to
22+
client applications using Secure Sockets Layer (SSL). Enforcing SSL connections between
23+
database server and client applications helps protect against "man in the middle" attacks
24+
by encrypting the data stream between the server and application.`,
25+
26+
remediation: `**From Azure Console:**
27+
28+
1. Login to Azure Portal using https://portal.azure.com
29+
2. Go to Azure Database for MySQL server
30+
3. For each database, click on Connection security
31+
4. In SSL settings
32+
5. Click on ENABLED for Enforce SSL connection
33+
34+
**Using Azure Command Line Interface 2.0**
35+
Use the below command to set MYSQL Databases to Enforce SSL connection.
36+
37+
az mysql server update --resource-group <resourceGroupName> --name <serverName> --ssl-enforcement Enabled`,
38+
39+
references: [
40+
'https://docs.microsoft.com/en-us/azure/mysql/concepts-ssl-connection-security',
41+
'https://docs.microsoft.com/en-us/azure/mysql/howto-configure-ssl',
42+
'https://docs.microsoft.com/en-us/azure/security/benchmarks/security-controls-v2-data-protection#dp-4-encrypt-sensitive-information-in-transit',
43+
],
44+
gql: `{
45+
queryazureMySqlServer {
46+
id
47+
__typename
48+
sslEnforcement
49+
}
50+
}`,
51+
resource: 'queryazureMySqlServer[*]',
52+
severity: 'medium',
53+
conditions: {
54+
and: [
55+
{
56+
path: '@.sslEnforcement',
57+
equal: 'Enabled',
58+
},
59+
],
60+
},
61+
}

‎src/azure/pci-dss-3.2.1/rules/pci-dss-3.2.1-encryption-check-3.ts‎

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
// similar to CIS 4.3.1
2+
export default {
3+
id: 'pci-dss-3.2.1-encryption-check-3',
4+
title: 'Encryption Check 3: PostgreSQL Database server \'enforce SSL connection\' should be enabled',
5+
6+
description: 'Enable SSL connection on PostgreSQL Servers.',
7+
8+
audit: `**From Azure Console:**
9+
10+
1. Login to Azure Portal using https://portal.azure.com
11+
2. Go to Azure Database for PostgreSQL server
12+
3. For each database, click on Connection security
13+
4. In SSL settings
14+
5. Ensure Enforce SSL connection is set to ENABLED.
15+
16+
**Using Azure Command Line Interface 2.0**
17+
Ensure the output of the below command returns ENABLED.
18+
19+
az postgres server show --resource-group myresourcegroup --name <resourceGroupName> --query sslEnforcement`,
20+
21+
rationale: `SSL connectivity helps to provide a new layer of security, by connecting database server
22+
to client applications using Secure Sockets Layer (SSL). Enforcing SSL connections between
23+
database server and client applications helps protect against "man in the middle" attacks
24+
by encrypting the data stream between the server and application.`,
25+
26+
remediation: `**From Azure Console:**
27+
28+
1. Login to Azure Portal using https://portal.azure.com
29+
2. Go to Azure Database for PostgreSQL server
30+
3. For each database, click on Connection security
31+
4. In SSL settings.
32+
5. Click on ENABLED to Enforce SSL connection
33+
34+
**Using Azure Command Line Interface 2.0**
35+
Use the below command to enforce ssl connection for PostgreSQL Database.
36+
37+
az postgres server update --resource-group <resourceGroupName> --name <serverName> --ssl-enforcement Enabled`,
38+
39+
references: [
40+
'https://docs.microsoft.com/en-us/azure/postgresql/concepts-ssl-connection-security',
41+
'https://docs.microsoft.com/en-us/azure/security/benchmarks/security-controls-v2-data-protection#dp-4-encrypt-sensitive-information-in-transit',
42+
],
43+
gql: `{
44+
queryazurePostgreSqlServer {
45+
id
46+
__typename
47+
sslEnforcement
48+
}
49+
}`,
50+
resource: 'queryazurePostgreSqlServer[*]',
51+
severity: 'medium',
52+
conditions: {
53+
and: [
54+
{
55+
path: '@.sslEnforcement',
56+
equal: 'Enabled',
57+
},
58+
],
59+
},
60+
}

0 commit comments

Comments
 (0)