🛡️ Azure App Service Minimum TLS Version is not set to TLS 1.2 or higher🟢

• Contextual name: 🛡️ Minimum TLS Version is not set to TLS 1.2 or higher🟢
• ID: /ce/ca/azure/app-service/minimum-tls-version
• Tags:
  • 🟢 Policy with categories
  • 🟢 Policy with type
  • 🟢 Production policy
• Policy Type: COMPLIANCE_POLICY
• Policy Categories: SECURITY

Logic

• 🧠 prod.logic.yaml🟢
  • 📗 Azure App Service
  • 🔌 Azure App Service - object.extracts.yaml
  • 🧪 test-data.json

Similar Policies

• Cloud Conformity: Check for TLS Protocol Latest Version
• Internal: dec-x-2ace1952

Similar Internal Rules

Rule	Policies	Flags
✉️ dec-x-2ace1952	1

Description

Open File

Description

The TLS (Transport Layer Security) protocol secures transmission of data over the internet using standard encryption technology. Encryption should be set with the latest version of TLS. App service allows TLS 1.2 by default, which is the recommended TLS level by industry standards such as PCI DSS.

Rationale

App service currently allows the web app to set TLS versions 1.0, 1.1 and 1.2. It is highly recommended to use the latest TLS 1.2 version for web app secure connections.

Audit

From Azure Portal

1. Login to Azure Portal using https://portal.azure.com.
2. Go to App Services.
3. Click on each App.
4. Under Setting section, Click on TLS/SSL settings.
5. Under the Bindings pane, ensure that Minimum TLS Version set to 1.2 under Protocol Settings.

From Azure CLI

To check TLS Version for an existing app, run the following command:

az webapp config show --resource-group <RESOURCE_GROUP_NAME> --name <APP_NAME> --query minTlsVersion

The output should return 1.2 if TLS Version is set to 1.2 (Which is currently the latest version).

... see more

Remediation

Open File

Remediation

From Azure Portal

1. Login to Azure Portal using https://portal.azure.com.
2. Go to App Services.
3. Click on each App.
4. Under Setting section, Click on SSL settings.
5. Under the Bindings pane, set Minimum TLS Version to 1.2 under Protocol Settings section.

From Azure CLI

To set TLS Version for an existing app, run the following command:

az webapp config set --resource-group <RESOURCE_GROUP_NAME> --name <APP_NAME> --min-tls-version 1.2

From PowerShell

Set-AzWebApp -ResourceGroupName <RESOURCE_GROUP_NAME> -Name <APP_NAME> -MinTlsVersion 1.2

policy.yaml

Open File

Linked Framework Sections

Section	Sub Sections	Internal Rules	Policies	Flags	Compliance
💼 APRA CPG 234 → 💼 54 Cryptographic techniques can be used to control access to sensitive data, both in storage and in transit. The strength of the cryptographic techniques deployed would be commensurate with the sensitivity and criticality of the data as well as other supplementary or compensating controls (refer to Attachment E for further guidance).		21	22		no data
💼 CIS Azure v2.1.0 → 💼 9.3 Ensure Web App is using the latest version of TLS encryption - Level 1 (Automated)			1		no data
💼 CIS Azure v3.0.0 → 💼 9.4 Ensure Web App is using the latest version of TLS encryption (Automated)			1		no data
💼 Cloudaware Framework → 💼 Data Encryption			44		no data
💼 FedRAMP High Security Controls → 💼 AC-4(4) Flow Control of Encrypted Information (H)		25	26		no data
💼 FedRAMP High Security Controls → 💼 AC-17(2) Protection of Confidentiality and Integrity Using Encryption (M)(H)			17		no data
💼 FedRAMP Moderate Security Controls → 💼 AC-17(2) Protection of Confidentiality and Integrity Using Encryption (M)(H)			17		no data
💼 NIST SP 800-53 Revision 5 → 💼 AC-4(2) Information Flow Enforcement _ Processing Domains		30	32		no data
💼 NIST SP 800-53 Revision 5 → 💼 AC-17(2) Remote Access _ Protection of Confidentiality and Integrity Using Encryption		12	17		no data