Default Network Access should be restricted
More Info:
Ensure that your Microsoft Azure Key Vaults are configured to deny access to traffic from all networks (including the public Internet). This adds an important layer of security.Risk Level
CriticalAddress
SecurityCompliance Standards
CISAZURE, CBPTriage and Remediation
Remediation
Using Console
Using Console
To remediate the misconfiguration of Default Network Access being unrestricted in Azure, follow these steps:
- Log in to the Azure portal (https://portal.azure.com/).
- Navigate to the resource group that contains the resources you want to secure.
- Select the Virtual Network that you want to secure.
- Click on the “Firewalls and virtual networks” tab.
- Under the “Firewalls and virtual networks” tab, select “Selected networks” to restrict access to the virtual network.
- Under the “Selected networks” option, select “Add existing virtual network”.
- Select the virtual network that you want to allow access to and click “Add”.
- Under the “Firewalls and virtual networks” tab, select “Selected IP addresses” to restrict access to specific IP addresses.
- Under the “Selected IP addresses” option, select “Add IP address range”.
- Enter the IP address range that you want to allow access to and click “Add”.
- Click “Save” to apply the changes.
Using CLI
Using CLI
To remediate the misconfiguration of Default Network Access being unrestricted in Azure, you can follow these steps using Azure CLI:
-
Open the Azure CLI and login to your account using the command:
-
Once you have successfully logged in, set the scope to the subscription level using the command:
Replace
<subscription-id>with the ID of the subscription you want to work with. -
Next, create a Network Security Group (NSG) using the command:
Replace
<nsg-name>with a unique name for the NSG and<resource-group-name>with the name of the resource group where you want to create the NSG. -
Once the NSG is created, you can define inbound and outbound rules to restrict network access. For example, you can create a rule to allow traffic only from a specific IP address using the command:
Replace
<rule-name>with a unique name for the rule,<nsg-name>with the name of the NSG you created in step 3,<resource-group-name>with the name of the resource group where the NSG is located, and<ip-address>with the IP address you want to allow traffic from. You can also create additional rules to allow traffic for specific ports and protocols. -
Finally, associate the NSG with the appropriate subnet or network interface using the command:
Replace
<subnet-name>with the name of the subnet you want to associate the NSG with,<vnet-name>with the name of the virtual network where the subnet is located,<resource-group-name>with the name of the resource group where the virtual network is located, and<nsg-name>with the name of the NSG you created in step 3.
Using Python
Using Python
To remediate the misconfiguration of default network access being unrestricted in Azure using Python, you can follow the below steps:The above code will remove the default allow-all inbound rule from the NSG and add a new rule to allow only necessary traffic. You can modify the rule parameters as per your requirements. Finally, the NSG is updated using the
- Import the required libraries:
- Authenticate to Azure using DefaultAzureCredential:
- Get the Network Security Group (NSG) resource:
- Update the NSG rules to restrict default network access:
begin_create_or_update method.