Enable In-Transit Encryption for Redis Cache Servers

More Info:

Ensure that in-transit encryption is enabled for all Microsoft Azure Redis Cache servers.

Risk Level

High

Address

Security

Compliance Standards

APRA CPS 234 (Australia)
BSI C5 (Germany)
Brazil LGPD
CCPA / CPRA (California)
CIS Critical Security Controls v8
CMMC 2.0
CSA Cloud Controls Matrix v4
DPDPA
Digital Operational Resilience Act (EU)
FedRAMP
GDPR
HIPAA
ISO 27001
ISO/IEC 27017
ISO/IEC 27018
ISO/IEC 27701
KSA PDPL
MAS Technology Risk Management (Singapore)
MITRE ATT&CK (Cloud)
NIS2 Directive
NIST CSF
NIST SP 800-171
NYDFS 23 NYCRR 500
PCI
SOC2
SWIFT Customer Security Controls Framework
Sarbanes-Oxley IT General Controls
Securities and Exchange Board of India (SEBI) - Cloud Security Adoption Framework
UK NCSC Cyber Assessment Framework

Triage and Remediation

Remediation

Remediation

Using Console

Sure, here are the step-by-step instructions to remediate the misconfiguration of enabling in-transit encryption for Redis Cache Servers in Azure:

Login to your Azure portal and navigate to the Redis Cache Server that needs to be remediated.
Click on the "Configuration" tab from the left-hand side menu.
Scroll down to the "Security" section and click on the "Edit" button.
Under the "Transport Security Settings" section, select the "Enable SSL" option.
Click on the "Save" button to save the changes.
Once the changes are saved, the Redis Cache Server will be configured to use in-transit encryption using SSL.
Verify the changes by connecting to the Redis Cache Server using a Redis client and checking if the connection is encrypted using SSL.

That's it! You have successfully remediated the misconfiguration of enabling in-transit encryption for Redis Cache Servers in Azure using the Azure console.

Using CLI

To enable In-Transit Encryption for Redis Cache Servers in AZURE using AZURE CLI, follow these steps:

Open the Azure CLI on your local machine or Azure Cloud Shell.
Login to your Azure account using the command:
```
az login
```
Select the subscription you want to work with using the command:
```
az account set --subscription <subscription_id>
```
Check the current encryption status of your Redis Cache Server using the command:
```
az redis show --name <redis_server_name> --resource-group <resource_group_name> --query 'enableNonSslPort'
```
If the output is "true", it means that In-Transit Encryption is not enabled.
Enable In-Transit Encryption for Redis Cache Server using the command:
```
az redis update --name <redis_server_name> --resource-group <resource_group_name> --enable-non-ssl-port false
```
This will disable non-SSL port and enable In-Transit Encryption for Redis Cache Server.
Verify the encryption status again using the command:
```
az redis show --name <redis_server_name> --resource-group <resource_group_name> --query 'enableNonSslPort'
```
The output should be "false", indicating that In-Transit Encryption is now enabled for Redis Cache Server.

That's it! You have successfully remediated the misconfiguration by enabling In-Transit Encryption for Redis Cache Server in AZURE using AZURE CLI.

Using Python

To enable in-transit encryption for Redis Cache servers in AZURE using Python, you can follow the below steps:

Import the required libraries:

from azure.identity import DefaultAzureCredential
from azure.mgmt.redis import RedisManagementClient
from azure.mgmt.redis.models import RedisAccessKeys, RedisUpdateParameters

Authenticate and create a Redis Cache Management Client:

credential = DefaultAzureCredential()
redis_client = RedisManagementClient(credential, subscription_id)

Get the Redis Cache instance:

redis_instance = redis_client.redis.get(resource_group_name, redis_cache_name)

Update the Redis Cache instance to enable in-transit encryption:

redis_instance.enable_non_ssl_port = False
redis_instance.minimum_tls_version = '1.2'
redis_instance.tls_port = 6380
redis_instance.redis_configuration['requirepass'] = 'your_redis_password'
redis_update_params = RedisUpdateParameters(enable_non_ssl_port=False, minimum_tls_version='1.2', tls_port=6380, redis_configuration={'requirepass': 'your_redis_password'})
redis_client.redis.update(resource_group_name, redis_cache_name, redis_update_params)

Note: Replace subscription_id, resource_group_name, redis_cache_name, and your_redis_password with the actual values.

This will enable in-transit encryption for the Redis Cache instance in AZURE.

Using Terraform

resource "azurerm_redis_cache" "redis_secure" {
  name                = "REDIS_CACHE_NAME"          # e.g. "prod-redis-cache"
  location            = azurerm_resource_group.rg.location
  resource_group_name = azurerm_resource_group.rg.name
  sku_name            = "SKU_FAMILY"                # e.g. "Basic"
  capacity            = REDIS_CAPACITY              # e.g. 1
  family              = "C"
  shard_count         = 0

  # Enable in-transit encryption by allowing only TLS/SSL connections
  enable_non_ssl_port = false

  # (Recommended) enforce modern TLS
  minimum_tls_version = "1.2"

  # ...any other required arguments (subnet_id, redis_configuration, etc.)
}

Setting enable_non_ssl_port = false may force replacement of the Redis cache instance, causing a brief outage; plan and schedule accordingly.

To verify, terraform plan should show the Redis resource being created or updated with enable_non_ssl_port = false (and optionally minimum_tls_version = "1.2") and no remaining diff for in‑transit encryption.

More Info:​

Risk Level​

Address​

Compliance Standards​

Triage and Remediation​

Remediation​