Skip to main content

⭐ Repository → 📁 Compliance Engine → 📁 CloudAware → 📁 Azure → 📁 Virtual Network

🛡️ Azure Network Security Group allows public access to Oracle DBMS ports🟢

  • Contextual name: 🛡️ Security Group allows public access to Oracle DBMS ports🟢
  • ID: /ce/ca/azure/virtual-network/security-group-allows-unrestricted-traffic-to-oracle-dbms
  • Tags:
  • Policy Type: COMPLIANCE_POLICY
  • Policy Categories: SECURITY

Logic​

Description​

Open File

Description​

Ensure that Azure Network Security Groups hosting Oracle DBMS instances are not configured to allow unrestricted inbound traffic to Oracle DBMS ports (1521, 1830, 2483, 2484). Network Security Group rules should be audited and modified to restrict inbound access to these ports, allowing traffic only from trusted IP addresses or internal systems to minimize exposure and secure sensitive data.

Rational​

Unrestricted access to Oracle DBMS ports significantly increases the risk of unauthorized access, brute-force attacks, data theft, and exploitation of known or unknown vulnerabilities within the Oracle database. As high-value assets, Oracle DBMS instances are frequently targeted by malicious actors seeking to exploit weaknesses. Exposing these instances to the public internet without appropriate access controls can lead to severe security breaches. By restricting access to trusted networks or IP address ranges, the attack surface is minimized, thereby enhancing the security posture of the Oracle DBMS and safeguarding sensitive data from unauthorized access or modification.

... see more

Remediation​

Open File

Remediation​

Modify or Remove Insecure NSG Rule​

Review the security rules associated with the relevant Network Security Group (NSG) and determine whether they are required. Take appropriate action based on necessity and scope:

  • If the rule is not required: Remove the rule entirely.

  • If the rule is required but overly permissive: Update the rule to narrowly scope access, restricting the source IP range to only what is strictly necessary.

Azure CLI​

  1. Delete the rule:

    az network nsg rule delete \
      --resource-group {{resource-group-name}} \
      --nsg-name {{nsg-name}} \
      --name {{rule-name}}

  2. Restrict the rule:

    az network nsg rule update \
        --resource-group {{resource-group-name}} \
        --nsg-name {{nsg-name}} \
        --name {{rule-name}} \
        --source-address-prefixes {{trusted-cidr}}

    Replace placeholders with the appropriate values. Use space-separated values for multiple source prefixes or destination ports (e.g., --source-address-prefixes "1.2.3.4/32 5.6.7.8/32").

... see more

policy.yaml​

Open File

Linked Framework Sections​

SectionSub SectionsInternal RulesPoliciesFlagsCompliance
💼 Cloudaware Framework → 💼 Public and Anonymous Access80no data