🛡️ Azure App Service Minimum TLS Version is not set to TLS 1.2 or higher🟢

• Contextual name: 🛡️ Minimum TLS Version is not set to TLS 1.2 or higher🟢
• ID: /ce/ca/azure/app-service/minimum-tls-version
• Tags:
  • 🟢 Policy with categories
  • 🟢 Policy with type
  • 🟢 Production policy
• Policy Type: COMPLIANCE_POLICY
• Policy Categories: SECURITY

Logic

• 🧠 prod.logic.yaml🟢
  • 📗 Azure App Service
  • 🔌 Azure App Service - object.extracts.yaml
  • 🧪 test-data.json

Similar Policies

• Cloud Conformity: Check for TLS Protocol Latest Version
• Internal: dec-x-2ace1952

Similar Internal Rules

Rule	Policies	Flags
✉️ dec-x-2ace1952	1

Description

Open File

Description

The TLS (Transport Layer Security) protocol secures transmission of data over the internet using standard encryption technology. Encryption should be set to the latest version of TLS. App Service allows TLS 1.2 by default, which is the recommended TLS level by industry standards such as PCI DSS.

Rationale

App Service currently allows the web app to set TLS versions 1.0, 1.1, and 1.2. It is highly recommended to use the latest TLS 1.2 version for web app secure connections.

Audit

From Azure Portal

1. Log in to the Azure portal using https://portal.azure.com.
2. Go to App Services.
3. Select each app.
4. Under Settings, select TLS/SSL settings.
5. Under the Bindings pane, ensure Minimum TLS Version is set to 1.2 under Protocol Settings.

From Azure CLI

To check the TLS version for an existing app, run the following command:

az webapp config show \
    --resource-group {{resource-group-name}} \
    --name {{app-name}} \
    --query minTlsVersion

The output should return 1.2 if the TLS version is set to 1.2 (which is currently the latest version).

... see more

Remediation

Open File

Remediation

From Azure Portal

1. Log in to the Azure portal using https://portal.azure.com.
2. Go to App Services.
3. Select each app.
4. Under Settings, select SSL settings.
5. Under the Bindings pane, set Minimum TLS Version to 1.2 under Protocol Settings section.

From Azure CLI

To set the TLS version for an existing app, run the following command:

az webapp config set \
    --resource-group {{resource-group-name}} \
    --name {{app-name}} \
    --min-tls-version 1.2

From PowerShell

Set-AzWebApp `
    -ResourceGroupName {{resource-group-name}} `
    -Name {{app-name}} `
    -MinTlsVersion 1.2

policy.yaml

Open File

Linked Framework Sections

Section	Sub Sections	Internal Rules	Policies	Flags	Compliance
💼 APRA CPG 234 → 💼 54 Cryptographic techniques can be used to control access to sensitive data, both in storage and in transit. The strength of the cryptographic techniques deployed would be commensurate with the sensitivity and criticality of the data as well as other supplementary or compensating controls (refer to Attachment E for further guidance).		21	22		no data
💼 CIS Azure v2.1.0 → 💼 9.3 Ensure Web App is using the latest version of TLS encryption - Level 1 (Automated)			1		no data
💼 CIS Azure v3.0.0 → 💼 9.4 Ensure Web App is using the latest version of TLS encryption (Automated)			1		no data
💼 Cloudaware Framework → 💼 Cryptographic Configuration			18		no data
💼 FedRAMP High Security Controls → 💼 AC-4(4) Flow Control of Encrypted Information (H)		26	27		no data
💼 FedRAMP High Security Controls → 💼 AC-17(2) Protection of Confidentiality and Integrity Using Encryption (M)(H)			21		no data
💼 FedRAMP Moderate Security Controls → 💼 AC-17(2) Protection of Confidentiality and Integrity Using Encryption (M)(H)			21		no data
💼 NIST SP 800-53 Revision 5 → 💼 AC-4(2) Information Flow Enforcement _ Processing Domains		31	33		no data
💼 NIST SP 800-53 Revision 5 → 💼 AC-17(2) Remote Access _ Protection of Confidentiality and Integrity Using Encryption		12	21		no data