Skip to main content

📝 Azure Storage Account Default Network Access Rule is not set to Deny 🟢

  • Contextual name: 📝 Default Network Access Rule is not set to Deny 🟢
  • ID: /ce/ca/azure/storage/deny-default-network-access
  • Located in: 📁 Azure Storage

Flags​

Our Metadata​

  • Policy Type: COMPLIANCE_POLICY
  • Policy Category:
    • SECURITY

Similar Policies​

Similar Internal Rules​

RulePoliciesFlags
✉️ dec-x-d127f4071

Logic​

Description​

Open File

Description​

Restricting default network access helps to provide a new layer of security, since storage accounts accept connections from clients on any network. To limit access to selected networks, the default action must be changed.

Rationale​

Storage accounts should be configured to deny access to traffic from all networks (including internet traffic). Access can be granted to traffic from specific Azure Virtual networks, allowing a secure network boundary for specific applications to be built. Access can also be granted to public internet IP address ranges to enable connections from specific internet or on-premises clients. When network rules are configured, only applications from allowed networks can access a storage account. When calling from an allowed network, applications continue to require proper authorization (a valid access key or SAS token) to access the storage account.

Impact​

All allowed networks will need to be whitelisted on each specific network, creating administrative overhead. This may result in loss of network connectivity, so do not turn on for critical resources during business hours.

... see more

Remediation​

Open File

Remediation​

From Azure Console​

  1. Go to Storage Accounts.
  2. For each storage account, under Security + networking, click Networking.
  3. Click the Firewalls and virtual networks heading.
  4. Set Public network access to Enabled from selected virtual networks and IP addresses.
  5. Add rules to allow traffic from specific networks and IP addresses.
  6. Click Save.

From Azure CLI​

Use the below command to update default-action to Deny:

az storage account update --name <StorageAccountName> --resource-group <resourceGroupName> --default-action Deny

policy.yaml​

Open File

Linked Framework Sections​

SectionSub SectionsInternal RulesPoliciesFlags
💼 APRA CPG 234 → 💼 36d access management controls —only authorised users, software and hardware are able to access information assets (refer to Attachment B for further guidance);1313
💼 APRA CPG 234 → 💼 36e hardware and software asset controls —appropriate authorisation to prevent security compromises from unauthorised hardware and software assets;1515
💼 APRA CPG 234 → 💼 36f network design — to ensure authorised network traffic flows and to reduce the impact of security compromises;2829
💼 APRA CPG 234 → 💼 45 An understanding of plausible worst case scenarios can help regulated entities identify and implement additional controls to prevent or reduce the impact of such scenarios. One example is malware that infects computers and encrypts data, both on the infected computer and any connected storage, including (corporate) networks and cloud storage. Such attacks reinforce the importance of protecting the backup environment in the event that the production environment is compromised. Common techniques to achieve this include network segmentation, highly restricted and segregated access controls and network traffic flow restrictions.3436
💼 APRA CPG 234 → 💼 52d appropriate segmentation of data, based on sensitivity and access needs;1010
💼 APRA CPG 234 → 💼 53 Wholesale access to sensitive data (e.g. contents of customer databases or intellectual property that can be exploited for personal gain) would be highly restricted to reduce the risk exposure to significant data leakage events. Industry experience of actual data leakage incidents include the unauthorised extraction of debit/credit card details, theft of personally identifiable information, loss of unencrypted backup media and the sale/trade or exploitation of customer identity data.1010
💼 CIS Azure v2.1.0 → 💼 3.8 Ensure Default Network Access Rule for Storage Accounts is Set to Deny - Level 1 (Automated)1
💼 CIS Azure v3.0.0 → 💼 4.7 Ensure Default Network Access Rule for Storage Accounts is Set to Deny (Automated)1
💼 Cloudaware Framework → 💼 Public and Anonymous Access24
💼 FedRAMP High Security Controls → 💼 AC-4(21) Physical or Logical Separation of Information Flows (M)(H)1139
💼 FedRAMP Moderate Security Controls → 💼 AC-4(21) Physical or Logical Separation of Information Flows (M)(H)39
💼 NIST SP 800-53 Revision 5 → 💼 AC-4(21) Information Flow Enforcement _ Physical or Logical Separation of Information Flows3539
💼 UK Cyber Essentials → 💼 1.2 Prevent access to the administrative interface from the internet3537