Cis Azure Database 2.2

2.2 Ensure that 'Allow access only via SSL' is set to 'Yes' (Automated)

Profile Applicability

• Level 1

Description

Setting 'Allow access only via SSL' to 'Yes' ensures that data in transit to and from Azure Cache for Redis is encrypted using TLS.

Rationale

Data in transit which is not encrypted is vulnerable to attacks including adversary-in-the-middle (AITM or MITM), eavesdropping, or session hijack. These attacks can result in the compromise and exfiltration of data.

Impact

No additional cost is required to implement this recommendation. Aside from expected network changes (no unencrypted communications), performance should not be impacted.

Audit Procedure

Audit From Azure Portal

1. Search for and open the Azure Cache for Redis service
2. For each instance, repeat the remaining steps
3. Click on the name of the instance
4. In the blade menu on the left, under Settings, click on Advanced Settings
5. Review the setting under Allow access only via SSL

If Yes is selected, the configuration for that instance is compliant.

Audit From Azure Policy

• Policy ID: 22bee202-a82f-4305-9a2a-6d7f44d4dedb - Name: 'Only secure connections to your Azure Cache for Redis should be enabled'
• Policy ID: 766f5de3-c6c0-4327-9f4d-042ab8ae846c - Name: 'Configure Azure Cache for Redis to disable non SSL ports'

Expected Result

The Allow access only via SSL setting should be set to Yes for each Azure Cache for Redis instance.

Remediation

Remediate From Azure Portal

1. Search for and open the Azure Cache for Redis service
2. For each instance, repeat the remaining steps
3. Click on the name of the instance
4. In the blade menu on the left, under Settings, click on Advanced Settings
5. Select Yes under Allow access only via SSL heading

Default Value

By default, 'Allow access only via SSL' is set to 'Yes'.

References

1. https://learn.microsoft.com/en-us/azure/azure-cache-for-redis/cache-best-practices-development
2. https://learn.microsoft.com/en-us/security/benchmark/azure/baselines/azure-cache-for-redis-security-baseline#microsoft-defender-for-cloud-monitoring-1

CIS Controls