📝 [LEGACY] Azure Subscription Microsoft Defender For DNS is not set to On 🟢

• Contextual name: 📝 Microsoft Defender For DNS is not set to On 🟢
• ID: /ce/ca/azure/subscription/LEGACY-microsoft-defender-for-dns
• Located in: 📁 Azure Subscription

Flags

• 🟢 Policy with categories
• 🟢 Policy with type
• 🟢 Production policy

Our Metadata

• Policy Type: COMPLIANCE_POLICY
• Policy Category:
  • SECURITY

Similar Policies

• Internal
  • dec-x-7bde497d

Similar Internal Rules

Rule	Policies	Flags
✉️ dec-x-7bde497d	1

Logic

• 🧠 prod.logic.yaml 🟢
  • 📕 Azure Subscription
  • 🔌 Azure Defender Plan - object.extracts.yaml
  • 🧪 test-data.json

Description

Open File

Description

[NOTE: As of August 1, 2023 customers with an existing subscription to Defender for DNS can continue to use the service, but new subscribers will receive alerts about suspicious DNS activity as part of Defender for Servers P2.]

Microsoft Defender for DNS scans all network traffic exiting from within a subscription.

Rationale

DNS lookups within a subscription are scanned and compared to a dynamic list of websites that might be potential security threats. These threats could be a result of a security breach within your services, thus scanning for them could prevent a potential security threat from being introduced.

Impact

Enabling Microsoft Defender for DNS requires enabling Microsoft Defender for your subscription. Both will incur additional charges, with Defender for DNS being a small amount per million queries.

Audit

From Azure Portal

1. Go to Microsoft Defender for Cloud.
2. Under Management, select Environment Settings
3. Click on the subscription name
4. Select the Defender plans blade

... see more

Remediation

Open File

Remediation

From Azure Portal

1. Go to Microsoft Defender for Cloud.
2. Under Management, select Environment Settings.
3. Click on the subscription name.
4. Select the Defender plans blade.
5. Select On under Status for DNS.
6. Select Save.

From Powershell

Enable Standard pricing tier for DNS:

az security pricing create -n 'DNS' --tier 'Standard'

From PowerShell

Enable Standard pricing tier for DNS:

Set-AzSecurityPricing -Name 'DNS' -PricingTier 'Standard'

policy.yaml

Open File

Linked Framework Sections

Section	Sub Sections	Internal Rules	Policies	Flags
💼 APRA CPG 234 → 💼 16a vulnerability and threat management;		11	11
💼 APRA CPG 234 → 💼 16e security testing, including penetration testing;		10	10
💼 APRA CPG 234 → 💼 36g vulnerability management controls — which identify and address information security vulnerabilities in a timely manner;		11	11
💼 APRA CPG 234 → 💼 36k response controls — to manage information security incidents and feedback mechanisms to address control deficiencies;		10	10
💼 APRA CPG 234 → 💼 39a implement mechanisms that access and analyse timely threat intelligence regarding vulnerabilities, threats, methods of attack and countermeasures;		11	11
💼 APRA CPG 234 → 💼 39d implement mechanisms to disrupt the various phases of an attack. Example phases include reconnaissance, vulnerability exploitation, malware installation, privilege escalation, and unauthorised access		11	11
💼 APRA CPG 234 → 💼 52e monitoring for unauthorised software and hardware (e.g. key loggers, password cracking software, wireless access points, business implemented technology solutions);		10	10
💼 APRA CPG 234 → 💼 66 Under CPS 234, an APRA-regulated entity is required to have robust mechanisms in place to detect and respond to actual or potential compromises of information security in a timely manner. The term ‘potential’ is used to highlight that information security incidents are commonly identified when an event occurs (e.g. unauthorised access notification, customer complaint) requiring further investigation in order to ascertain whether an actual security compromise has occurred.		10	10
💼 APRA CPG 234 → 💼 67c sensors that provide an alert when a measure breaches a defined threshold(s) (e.g. device, server and network activity);		10	10
💼 APRA CPG 234 → 💼 68 Monitoring processes and tools remain in step with the evolving nature of threats and contemporary industry practices.		10	10
💼 APRA CPG 234 → 💼 73a detection of an information security event through the use of automated sensors and manual review;		10	10
💼 APRA CPG 234 → 💼 73b identification and analysis to determine if it is an incident or an event;		10	10
💼 APRA CPG 234 → 💼 73d containment to minimise the damage caused, and reduce the possibility of further damage;		10	10
💼 APRA CPG 234 → 💼 73e eradication which involves the removal of the source of the information security compromise (typically malware);		10	10
💼 CIS Azure v1.5.0 → 💼 2.1.11 Ensure That Microsoft Defender for DNS Is Set To 'On' - Level 2 (Manual)		1	1
💼 CIS Azure v2.0.0 → 💼 2.1.11 Ensure That Microsoft Defender for DNS Is Set To 'On' - Level 2 (Manual)		1	1
💼 CIS Azure v2.1.0 → 💼 2.1.10 [LEGACY] Ensure That Microsoft Defender for DNS Is Set To 'On' - Level 2 (Automated)		1	1
💼 CIS Azure v3.0.0 → 💼 3.1.16 [LEGACY] Ensure That Microsoft Defender for DNS Is Set To 'On' (Automated)			1
💼 Cloudaware Framework → 💼 Microsoft Defender Configuration			26
💼 FedRAMP High Security Controls → 💼 SI-4(4) Inbound and Outbound Communications Traffic (M)(H)		7	9
💼 FedRAMP Moderate Security Controls → 💼 SI-4(4) Inbound and Outbound Communications Traffic (M)(H)			9
💼 ISO/IEC 27001:2022 → 💼 8.8 Management of technical vulnerabilities		9	9
💼 ISO/IEC 27001:2022 → 💼 8.15 Logging		19	20
💼 ISO/IEC 27001:2022 → 💼 8.16 Monitoring activities		6	6
💼 NIST SP 800-53 Revision 5 → 💼 SI-4(4) System Monitoring _ Inbound and Outbound Communications Traffic		2	2
💼 NIST SP 800-53 Revision 5 → 💼 SI-7(12) Software, Firmware, and Information Integrity _ Integrity Verification		18	20