🛡️ Azure Network Security Group default VirtualNetwork allow rules are not overridden🟢⚪

• Contextual name: 🛡️ Network Security Group default VirtualNetwork allow rules are not overridden🟢⚪
• ID: /ce/ca/azure/virtual-network/security-group-default-virtual-network-rules
• Tags:
  • ⚪ Impossible policy
  • 🟢 Policy with categories
  • 🟢 Policy with type
• Policy Type: COMPLIANCE_POLICY
• Policy Categories: SECURITY

Stats

not available

Description

Open File

Description

A network security group filters traffic by security rules evaluated in priority order until the first match. By default, the AllowVnetInBound and AllowVnetOutBound rules permit all traffic identified with the VirtualNetwork service tag. A default-deny posture adds an explicit rule, evaluated after every allow rule, that denies all other traffic. Prerequisites: Identify every required inbound and outbound path, including Azure platform traffic such as load balancer health probes, and create narrowly scoped higher-priority allow rules before adding the deny rule.

Rationale

The VirtualNetwork service tag spans more than the local subnet: Microsoft includes peered virtual networks, on-premises ranges reached over VPN or ExpressRoute, and gateway-connected networks. The default rules also permit unrestricted outbound access to the internet. Relying on them grants lateral reachability across that trust boundary and an open egress path a compromised workload can use for exfiltration or command-and-control.

... see more

Remediation

Open File

Remediation

A network security group filters traffic by security rules evaluated in priority order until the first match. By default, the AllowVnetInBound and AllowVnetOutBound rules permit all traffic identified with the VirtualNetwork service tag. A default-deny posture adds an explicit rule, evaluated after every allow rule, that denies all other traffic. Prerequisites: Identify every required inbound and outbound path, including Azure platform traffic such as load balancer health probes, and create narrowly scoped higher-priority allow rules before adding the deny rule.

After testing the required allow rules, add explicit inbound and outbound deny-all rules using unused priority numbers greater than those of the required allow rules and at or below 4096. Apply these rules to each in-scope NSG. Follow service-specific guidance for subnets where outbound restriction is prohibited or discouraged, including Application Gateway v2 without Network Isolation and Microsoft Entra Domain Services. Test required traffic and confirm that other traffic is denied.

... see more

policy.yaml

Open File

Linked Framework Sections

Section	Sub Sections	Internal Rules	Policies	Flags	Compliance
💼 CIS Azure v7.0.0 → 💼 7.8 Ensure that Network Security Groups override the default 'VirtualNetwork' allow rules (Automated)			1		no data
💼 Cloudaware Framework → 💼 Network Exposure			144		no data