🛡️ Azure Network Security Group allows unrestricted database traffic🟢

• Contextual name: 🛡️ Network Security Group allows unrestricted database traffic🟢
• ID: /ce/ca/azure/virtual-network/security-group-allows-unrestricted-database-traffic
• Tags:
  • 🟢 Policy with categories
  • 🟢 Policy with type
  • 🟢 Production policy
• Policy Type: COMPLIANCE_POLICY
• Policy Categories: SECURITY

Stats

not available

Logic

• 🧠 prod.logic.yaml🟢
  • 📗 Azure Network Security Group
  • 🔌 Azure Network Security Group Rule - object.extracts.yaml
  • 🧪 test-data.json

Description

Open File

Description

Network security group inbound rules decide whether a database engine on a virtual machine accepts connections from the Internet. This policy covers the default ports of SQL Server, Oracle, MySQL, PostgreSQL, Redis, and MongoDB on virtual machines. Managed database services are outside its scope.

Rationale

A database port reachable from the Internet exposes the engine's authentication to password guessing and its listener to exploitation of unpatched vulnerabilities. An attacker who gets in can read, alter, or delete the data directly and use the virtual machine to reach other resources on the virtual network.

Audit

This policy marks an Azure Network Security Group as INCOMPLIANT if a current Allow/Inbound TCP, UDP, or Any rule permits Internet, wildcard, or a global IPv4/IPv6 source to destination ports 1433, 1434, 1521, 3306, 5432, 6379, 27017, any range containing them, or all ports.

No matching current rule is COMPLIANT within the collected rule scope.

Remediation

Open File

Remediation

Remove unrestricted inbound access to databases hosted on virtual machines on ports 1433, 1434, 1521, 3306, 5432, 6379, and 27017. Where database connectivity is required, restrict access to approved application and administrative source IP addresses or CIDR ranges.

Identify application, monitoring, backup, replication, and administrative clients before changing their NSG rules. Confirm that required clients can reach the database through an approved network path, such as the virtual network, a peered network, VPN, or ExpressRoute. Record the existing rule configuration and retain a working administrative path for rollback.

From Azure Portal

1. Go to Network security groups and select the affected NSG.
2. Under Settings, select Inbound security rules.
3. Identify Allow rules with protocol TCP, UDP, or Any that permit traffic from Any, Internet, 0.0.0.0/0, or ::/0 to any of the database ports listed above, Any port, or a range containing any of those ports. Review every entry in rules with multiple source prefixes or destination port ranges.

... see more

policy.yaml

Open File

Linked Framework Sections

Section	Sub Sections	Internal Rules	Policies	Flags	Compliance
💼 CIS Azure v7.0.0 → 💼 7.1.6 Ensure that Database Port Access from the Internet is Evaluated and Restricted (Automated)			1		no data
💼 Cloudaware Framework → 💼 Network Exposure			144		no data