Skip to main content

🛡️ Azure Storage Account Public Network Access is not disabled🟢

Stats​

not available

Logic​

Similar Policies​

Similar Internal Rules​

RulePoliciesFlags
✉️ dec-x-d127f4072

Description​

Open File

Description​

Disallowing public network access for a storage account overrides the public access settings for individual containers in that storage account for Azure Resource Manager Deployment Model storage accounts. Azure Storage accounts that use the classic deployment model will be retired on August 31, 2024.

Rationale​

Disabling public network access improves security by ensuring that a storage account is not exposed on the public internet. If public network access is required for a storage account, it should be restricted to selected networks by setting the default network access rule to Deny, and the trusted Azure services exception should be enabled where those services require access.

The default network configuration for a storage account permits a user with appropriate permissions to configure public network access to containers and blobs in a storage account. Keep in mind that public access to a container is always turned off by default and must be explicitly configured to permit anonymous requests. It grants read-only access to these resources without sharing the account key, and without requiring a shared access signature. It is recommended not to provide public network access to storage accounts until, and unless, it is strongly desired. A shared access signature token or Azure AD RBAC should be used for providing controlled and timed access to blob containers.

... see more

Remediation​

Open File

Remediation​

From Azure Portal​

First, follow Microsoft documentation and create shared access signature tokens for your blob containers. Then disable public network access:

  1. Go to Storage Accounts.
  2. For each storage account, under the Security + networking section, click Networking.
  3. Set Public Network Access to Disabled.
  4. Click Save.

If public network access is required, set Public network access to Enabled from selected virtual networks and IP addresses, set the default network access rule to Deny, add the required network rules, and enable the trusted Azure services exception where those services need access.

From Azure CLI​

Set Public Network Access to Disabled on the storage account:

az storage account update \
    --name {{storage-account-name}} \
    --resource-group {{resource-group-name}} \
    --public-network-access Disabled

If public network access is required, restrict access to selected networks and enable the trusted Azure services exception:

az storage account update \

... [see more](remediation.md)

policy.yaml​

Open File

Linked Framework Sections​

SectionSub SectionsInternal RulesPoliciesFlagsCompliance
💼 APRA CPG 234 → 💼 36d access management controls —only authorised users, software and hardware are able to access information assets (refer to Attachment B for further guidance);4161no data
💼 APRA CPG 234 → 💼 36e hardware and software asset controls —appropriate authorisation to prevent security compromises from unauthorised hardware and software assets;4464no data
💼 APRA CPG 234 → 💼 36f network design — to ensure authorised network traffic flows and to reduce the impact of security compromises;76107no data
💼 APRA CPG 234 → 💼 45 An understanding of plausible worst case scenarios can help regulated entities identify and implement additional controls to prevent or reduce the impact of such scenarios. One example is malware that infects computers and encrypts data, both on the infected computer and any connected storage, including (corporate) networks and cloud storage. Such attacks reinforce the importance of protecting the backup environment in the event that the production environment is compromised. Common techniques to achieve this include network segmentation, highly restricted and segregated access controls and network traffic flow restrictions.83115no data
💼 APRA CPG 234 → 💼 52d appropriate segmentation of data, based on sensitivity and access needs;2634no data
💼 APRA CPG 234 → 💼 53 Wholesale access to sensitive data (e.g. contents of customer databases or intellectual property that can be exploited for personal gain) would be highly restricted to reduce the risk exposure to significant data leakage events. Industry experience of actual data leakage incidents include the unauthorised extraction of debit/credit card details, theft of personally identifiable information, loss of unencrypted backup media and the sale/trade or exploitation of customer identity data.2634no data
💼 CIS Azure v5.0.0 → 💼 9.3.2.2 Ensure that 'Public Network Access' is 'Disabled' for storage accounts (Automated)1no data
💼 CIS Azure v6.0.0 → 💼 9.3.2.2 Ensure that 'Public Network Access' is 'Disabled' for Storage Accounts (Automated)1no data
💼 Cloudaware Framework → 💼 Network Exposure137no data
💼 FedRAMP High Security Controls → 💼 AC-4(21) Physical or Logical Separation of Information Flows (M)(H)18141no data
💼 FedRAMP Moderate Security Controls → 💼 AC-4(21) Physical or Logical Separation of Information Flows (M)(H)141no data
💼 NIST SP 800-53 Revision 5 → 💼 AC-4(21) Information Flow Enforcement _ Physical or Logical Separation of Information Flows83141no data
💼 UK Cyber Essentials → 💼 1.2 Prevent access to the administrative interface from the internet85119no data