📝 Azure Network Security Group allows unrestricted UDP access from the Internet 🟢

• Contextual name: 📝 Security Group allows unrestricted UDP access from the Internet 🟢
• ID: /ce/ca/azure/virtual-network/security-group-rule-disable-udp-access-from-internet
• Located in: 📁 Azure Virtual Network

Flags

• 🟢 Policy with categories
• 🟢 Policy with type
• 🟢 Production policy

Our Metadata

• Policy Type: COMPLIANCE_POLICY
• Policy Category:
  • SECURITY

Similar Policies

• Cloud Conformity
  • Check for Unrestricted UDP Access
• Internal
  • dec-x-e43fd12e

Similar Internal Rules

Rule	Policies	Flags
✉️ dec-x-e43fd12e	1

Logic

• 🧠 prod.logic.yaml 🟢
  • 📕 Azure Network Security Group
  • 🔌 Azure Network Security Group Rule - object.extracts.yaml
  • 🧪 test-data.json

Description

Open File

Description

Network security groups should be periodically evaluated for port misconfigurations. Where certain ports and protocols may be exposed to the Internet, they should be evaluated for necessity and restricted wherever they are not explicitly required.

Rationale

The potential security problem with broadly exposing UDP services over the Internet is that attackers can use DDoS amplification techniques to reflect spoofed UDP traffic from Azure Virtual Machines. The most common types of these attacks use exposed DNS, NTP, SSDP, SNMP, CLDAP and other UDP-based services as amplification sources for disrupting services of other machines on the Azure Virtual Network or even attack networked devices outside of Azure.

Audit

From Azure Portal

1. Open the Networking blade for the specific Virtual machine in Azure portal.
2. Verify that the INBOUND PORT RULES does not have a rule for HTTP(S) such as:
   • protocol = UDP.
   • Source = Any OR Internet.

From Azure CLI

List Network security groups with corresponding non-default Security rules:

... see more

Remediation

Open File

Remediation

Where UDP is not explicitly required and narrowly configured for resources attached to the Network Security Group, Internet-level access to your Azure resources should be restricted or eliminated.

For internal access to relevant resources, configure an encrypted network tunnel such as:

• ExpressRoute.
• Site-to-site VPN.
• Point-to-site VPN.

policy.yaml

Open File

Linked Framework Sections

Section	Sub Sections	Internal Rules	Policies	Flags
💼 APRA CPG 234 → 💼 36f network design — to ensure authorised network traffic flows and to reduce the impact of security compromises;		28	29
💼 APRA CPG 234 → 💼 45 An understanding of plausible worst case scenarios can help regulated entities identify and implement additional controls to prevent or reduce the impact of such scenarios. One example is malware that infects computers and encrypts data, both on the infected computer and any connected storage, including (corporate) networks and cloud storage. Such attacks reinforce the importance of protecting the backup environment in the event that the production environment is compromised. Common techniques to achieve this include network segmentation, highly restricted and segregated access controls and network traffic flow restrictions.		34	36
💼 CIS Azure v1.3.0 → 💼 6.6 Ensure that UDP Services are restricted from the Internet - Level 1 (Automated)		1	1
💼 CIS Azure v1.4.0 → 💼 6.6 Ensure that UDP Services are restricted from the Internet - Level 1 (Automated)		1	1
💼 CIS Azure v1.5.0 → 💼 6.3 Ensure that UDP access from the Internet is evaluated and restricted - Level 1 (Automated)		1	1
💼 CIS Azure v2.0.0 → 💼 6.3 Ensure that UDP access from the Internet is evaluated and restricted - Level 1 (Automated)		1	1
💼 CIS Azure v2.1.0 → 💼 6.3 Ensure that UDP access from the Internet is evaluated and restricted - Level 1 (Automated)		1	1
💼 CIS Azure v3.0.0 → 💼 7.3 Ensure that UDP access from the Internet is evaluated and restricted (Automated)			1
💼 Cloudaware Framework → 💼 Public and Anonymous Access			24
💼 FedRAMP High Security Controls → 💼 AC-3 Access Enforcement (L)(M)(H)		37	47
💼 FedRAMP High Security Controls → 💼 AC-4(21) Physical or Logical Separation of Information Flows (M)(H)		11	39
💼 FedRAMP High Security Controls → 💼 CM-7 Least Functionality (L)(M)(H)	3	18	21
💼 FedRAMP High Security Controls → 💼 SC-7(5) Deny by Default — Allow by Exception (M)(H)			19
💼 FedRAMP Low Security Controls → 💼 AC-3 Access Enforcement (L)(M)(H)			47
💼 FedRAMP Low Security Controls → 💼 CM-7 Least Functionality (L)(M)(H)			18
💼 FedRAMP Moderate Security Controls → 💼 AC-3 Access Enforcement (L)(M)(H)			47
💼 FedRAMP Moderate Security Controls → 💼 AC-4(21) Physical or Logical Separation of Information Flows (M)(H)			39
💼 FedRAMP Moderate Security Controls → 💼 CM-7 Least Functionality (L)(M)(H)	3		21
💼 FedRAMP Moderate Security Controls → 💼 SC-7(5) Deny by Default — Allow by Exception (M)(H)			19
💼 ISO/IEC 27001:2013 → 💼 A.9.4.1 Information access restriction		19	20
💼 ISO/IEC 27001:2022 → 💼 6.7 Remote working		5	5
💼 ISO/IEC 27001:2022 → 💼 8.1 User end point devices		9	11
💼 ISO/IEC 27001:2022 → 💼 8.16 Monitoring activities		6	6
💼 ISO/IEC 27001:2022 → 💼 8.22 Segregation of networks		5	5
💼 NIST CSF v1.1 → 💼 PR.AC-4: Access permissions and authorizations are managed, incorporating the principles of least privilege and separation of duties		17	35
💼 NIST CSF v1.1 → 💼 PR.DS-5: Protections against data leaks are implemented		43	51
💼 NIST CSF v1.1 → 💼 PR.IP-1: A baseline configuration of information technology/industrial control systems is created and maintained incorporating security principles (e.g. concept of least functionality)		4	14
💼 NIST CSF v2.0 → 💼 PR.AA-05: Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties			58
💼 NIST CSF v2.0 → 💼 PR.DS-01: The confidentiality, integrity, and availability of data-at-rest are protected			82
💼 NIST CSF v2.0 → 💼 PR.DS-02: The confidentiality, integrity, and availability of data-in-transit are protected			69
💼 NIST CSF v2.0 → 💼 PR.DS-10: The confidentiality, integrity, and availability of data-in-use are protected			67
💼 NIST SP 800-53 Revision 5 → 💼 AC-4(21) Information Flow Enforcement _ Physical or Logical Separation of Information Flows		35	39
💼 NIST SP 800-53 Revision 5 → 💼 SC-7(5) Boundary Protection _ Deny by Default — Allow by Exception		5	19
💼 PCI DSS v3.2.1 → 💼 1.3 Prohibit direct public access between the Internet and any system component in the cardholder data environment.	7	9	11
💼 PCI DSS v3.2.1 → 💼 1.3.1 Implement a DMZ to limit inbound traffic to only system components that provide authorized publicly accessible services, protocols, and ports.		7	8
💼 PCI DSS v3.2.1 → 💼 1.3.2 Limit inbound Internet traffic to IP addresses within the DMZ.			8
💼 PCI DSS v3.2.1 → 💼 1.3.5 Permit only “established” connections into the network.			8
💼 PCI DSS v4.0.1 → 💼 1.4.1 NSCs are implemented between trusted and untrusted networks.			10
💼 PCI DSS v4.0.1 → 💼 1.4.2 Inbound traffic from untrusted networks to trusted networks is restricted.			8
💼 PCI DSS v4.0 → 💼 1.4.1 NSCs are implemented between trusted and untrusted networks.			10
💼 PCI DSS v4.0 → 💼 1.4.2 Inbound traffic from untrusted networks to trusted networks is restricted.			8
💼 UK Cyber Essentials → 💼 1.2 Prevent access to the administrative interface from the internet		35	37