Azure Audit Networksecurity Security Group Unrestricted

Triage and Remediation

Remediation

Remediation

Using Console

To remediate the "Unrestricted CIFS Access" misconfiguration in Azure, you can follow these steps:

1. Login to the Azure portal (https://portal.azure.com/).
2. Navigate to the storage account that has the misconfiguration.
3. Click on the "Firewalls and virtual networks" tab from the left-hand menu.
4. Under the "Allow access from" section, select "Selected networks".
5. In the "Selected networks" section, click on the "Add existing virtual network" button.
6. Select the virtual network that is associated with the resource that needs access to the storage account.
7. Click on the "Add" button.
8. Under the "Allow trusted Microsoft services" section, select "Yes".
9. Click on the "Save" button to apply the changes.

By following these steps, you have restricted the access to the storage account to only the selected virtual network and allowed trusted Microsoft services to access it. This should remediate the "Unrestricted CIFS Access" misconfiguration.

Using CLI

To remediate unrestricted CIFS access in Azure using Azure CLI, follow these steps:

1. Open the Azure CLI and connect to your Azure account.

2. Identify the storage account that has unrestricted CIFS access. You can do this by running the following command:

   az storage account list --query "[?networkAcls.defaultAction=='Allow'].name"

   This command will list all the storage accounts that have their default network access set to "Allow".

3. Once you have identified the storage account, you can update its network access rules to restrict CIFS access. You can do this by running the following command:

   az storage account update --name <storage-account-name> --resource-group <resource-group-name> --default-action Deny

   Replace <storage-account-name> with the name of the storage account that you want to update and <resource-group-name> with the name of the resource group that the storage account belongs to.

4. After running the above command, you can verify that the update was successful by running the following command:

   az storage account show --name <storage-account-name> --resource-group <resource-group-name> --query "networkAcls.defaultAction"

   This command will return the default network access rule for the storage account. It should now be set to "Deny".

By following these steps, you have successfully remediated unrestricted CIFS access in Azure using Azure CLI.

Using Python

To remediate unrestricted CIFS access in AZURE using python, follow the below steps:

1. Import the necessary libraries:

import os
from azure.identity import DefaultAzureCredential
from azure.mgmt.storage import StorageManagementClient

2. Set the subscription ID, resource group name, and storage account name:

subscription_id = 'your_subscription_id'
resource_group_name = 'your_resource_group_name'
storage_account_name = 'your_storage_account_name'

3. Create a credential object to authenticate the programmatic access:

credential = DefaultAzureCredential()

4. Create a storage management client object:

storage_client = StorageManagementClient(credential, subscription_id)

5. Get the storage account properties:

storage_account = storage_client.storage_accounts.get_properties(resource_group_name, storage_account_name)

6. Check if CIFS access is allowed:

if storage_account.network_rules is not None and storage_account.network_rules.default_action == 'Allow':
    for ip_rule in storage_account.network_rules.ip_rules:
        if ip_rule.action == 'Allow' and ip_rule.protocol == 'TCP' and ip_rule.port_range == '445':
            print('Unrestricted CIFS access is allowed')
            break
else:
    print('No network rules found')

7. If CIFS access is allowed, update the network rules to deny CIFS access:

if storage_account.network_rules is not None and storage_account.network_rules.default_action == 'Allow':
    for ip_rule in storage_account.network_rules.ip_rules:
        if ip_rule.action == 'Allow' and ip_rule.protocol == 'TCP' and ip_rule.port_range == '445':
            ip_rule.action = 'Deny'
            network_rules = storage_client.storage_accounts.update_network_rules(resource_group_name, storage_account_name, storage_account.network_rules)
            print('CIFS access has been remediated')
            break
else:
    print('No network rules found')

These steps will remediate unrestricted CIFS access in Azure using Python.

Using Terraform

resource "azurerm_network_security_group" "example" {
  name                = "EXISTING_NSG_NAME"          # replace with your NSG name
  location            = azurerm_resource_group.rg.location
  resource_group_name = azurerm_resource_group.rg.name

  # REMOVE or update any existing rule that currently allows:
  # access on destination_port_range = "445" from source_address_prefix = "*" or "0.0.0.0/0"

  # Example: restrict CIFS (TCP/445) to a known safe CIDR instead of the entire internet
  security_rule {
    name                                       = "allow_cifs_restricted"
    priority                                   = 100                         # choose an unused priority
    direction                                  = "Inbound"
    access                                     = "Allow"
    protocol                                   = "Tcp"
    source_port_range                          = "*"
    destination_port_range                     = "445"
    source_address_prefix                      = "ALLOWED_CIDR"             # e.g. "10.0.0.0/24"
    destination_address_prefix                 = "*"                         # or a specific subnet/host
    source_application_security_group_ids      = []
    destination_application_security_group_ids = []
  }

  # Optional: if you must hard-block CIFS from everywhere, add an explicit Deny
  # with a higher priority (lower number) than any broad allow rule:
  security_rule {
    name                                       = "deny_cifs_internet"
    priority                                   = 90                          # lower number = higher priority
    direction                                  = "Inbound"
    access                                     = "Deny"
    protocol                                   = "Tcp"
    source_port_range                          = "*"
    destination_port_range                     = "445"
    source_address_prefix                      = "0.0.0.0/0"
    destination_address_prefix                 = "*"
    source_application_security_group_ids      = []
    destination_application_security_group_ids = []
  }
}

Changing or removing a security_rule is in-place and does not force replacement of the azurerm_network_security_group itself, but it will immediately alter live traffic filtering once applied.

Verification: terraform plan should show the existing rule that allowed Tcp on port 445 from * / 0.0.0.0/0 being removed or modified, and the new/updated security_rule blocks as additions/changes on the azurerm_network_security_group resource.