🛡️ Azure Network Subnet without Network Security Group🟢

• Contextual name: 🛡️ Network Subnet without Network Security Group🟢
• ID: /ce/ca/azure/virtual-network/subnet-without-security-group
• Tags:
  • 🟢 Policy with categories
  • 🟢 Policy with type
  • 🟢 Production policy
• Policy Type: COMPLIANCE_POLICY
• Policy Categories: SECURITY

Stats

not available

Logic

• 🧠 prod.logic.yaml🟠🟢
  • 📗 Azure Network Subnet
  • 🧪 test-data.json

Similar Policies

• Internal: dec-x-3653594a

Similar Internal Rules

Rule	Policies	Flags
✉️ dec-x-3653594a	1

Description

Open File

Description

This policy identifies Azure Network Subnets that do not have any associated network security groups. Protect subnet resources by ensuring subnets are associated with NSGs, which can filter inbound and outbound traffic using security rules.

Rationale

Unprotected subnets can expose resources to unauthorized access.

Impact

Minor administrative effort is required to ensure subnets are associated with network security groups. There is no cost to create or use network security groups.

Audit

This policy flags an Azure Network Subnet as INCOMPLIANT if it has no associated Network Security Group.

Default Value

By default, a subnet is not associated with a network security group.

References

1. https://learn.microsoft.com/en-us/azure/virtual-network/network-security-groups-overview
2. https://learn.microsoft.com/en-us/cli/azure/network/vnet

Remediation

Open File

Remediation

From Azure Portal

1. Go to Virtual networks.
2. Click the name of a virtual network.
3. Under Settings, click Subnets.
4. Click the name of a subnet.
5. Under Security, next to Network security group, click None to display the drop-down menu.
6. Select a network security group.
7. Click Save.
8. Repeat steps 1-7 for each virtual network and subnet requiring remediation.

From Azure CLI

For each subnet requiring remediation, run the following command to associate it with a network security group:

az network vnet subnet update \
    --resource-group {{resource-group-name}} \
    --vnet-name {{virtual-network-name}} \
    --name {{subnet-name}} \
    --network-security-group {{network-security-group-name}}

policy.yaml

Open File

Linked Framework Sections

Section	Sub Sections	Internal Rules	Policies	Flags	Compliance
💼 APRA CPG 234 → 💼 16d secure design, architecture and consultation;		2	2		no data
💼 APRA CPG 234 → 💼 45 An understanding of plausible worst case scenarios can help regulated entities identify and implement additional controls to prevent or reduce the impact of such scenarios. One example is malware that infects computers and encrypts data, both on the infected computer and any connected storage, including (corporate) networks and cloud storage. Such attacks reinforce the importance of protecting the backup environment in the event that the production environment is compromised. Common techniques to achieve this include network segmentation, highly restricted and segregated access controls and network traffic flow restrictions.		83	115		no data
💼 CIS Azure v5.0.0 → 💼 7.11 Ensure subnets are associated with network security groups (Automated)			1		no data
💼 CIS Azure v6.0.0 → 💼 7.11 Ensure Subnets Are Associated with Network Security Groups (Automated)			1		no data
💼 Cloudaware Framework → 💼 Network Exposure			137		no data
💼 FedRAMP High Security Controls → 💼 AC-4 Information Flow Enforcement (M)(H)	2	48	188		no data
💼 FedRAMP Moderate Security Controls → 💼 AC-4 Information Flow Enforcement (M)(H)	1		169		no data
💼 NIST CSF v2.0 → 💼 DE.CM-09: Computing hardware and software, runtime environments, and their data are monitored to find potentially adverse events			185		no data
💼 NIST CSF v2.0 → 💼 ID.AM-03: Representations of the organization's authorized network communication and internal and external network data flows are maintained			128		no data
💼 NIST CSF v2.0 → 💼 PR.DS-10: The confidentiality, integrity, and availability of data-in-use are protected			249		no data
💼 NIST CSF v2.0 → 💼 PR.IR-01: Networks and environments are protected from unauthorized logical access and usage			165		no data
💼 NIST SP 800-53 Revision 5 → 💼 AC-4 Information Flow Enforcement	32	120	207		no data
💼 NIST SP 800-53 Revision 5 → 💼 AC-4(2) Information Flow Enforcement _ Processing Domains		36	38		no data
💼 NIST SP 800-53 Revision 5 → 💼 AC-4(15) Information Flow Enforcement _ Detection of Unsanctioned Information		10	11		no data