Cis Azure Foundations 7.10

Ensure Azure Web Application Firewall (WAF) is enabled on Azure Application Gateway

Description

Azure Web Application Firewall helps protect applications from common exploits and attacks by inspecting and filtering incoming traffic.

Rationale

Using Azure Web Application Firewall with Azure Application Gateway reduces exposure to external threats by mitigating attacks on public facing applications.

Impact

The WAF V2 tier for Azure Application Gateways costs more than the Basic and Standard V2 tiers. Pricing includes a fixed hourly charge plus a charge per capacity-unit hour. Refer to https://azure.microsoft.com/en-gb/pricing/details/application-gateway/ for details.

Audit Procedure

Using Azure Portal

1. Go to Application gateways.
2. Click the name of an application gateway.
3. In the Overview, under Essentials, ensure Tier is set to WAF V2.
4. Repeat steps 1-3 for each application gateway.

Using Azure CLI

Run the following command to list application gateways:

az network application-gateway list

For each application gateway, run the following command to get the firewall policy id:

az network application-gateway show --resource-group <resource-group> --name <application-gateway> --query firewallPolicy.id

Ensure a firewall policy id is returned.

Using Azure Policy

• Policy ID: 564feb30-bf6a-4854-b4bb-0d2d2d1e6c66 - Name: 'Web Application Firewall (WAF) should be enabled for Application Gateway'

Expected Result

All Application Gateways should have Tier set to WAF V2 and have a firewall policy associated.

Remediation

Note: Basic tier application gateways cannot be upgraded to the WAF V2 tier. Create a new WAF V2 tier application gateway to replace a Basic tier application gateway.

Remediate from Azure Portal

To remediate a Standard V2 tier application gateway:

1. Go to Application gateways.
2. Click Add filter.
3. From the Filter drop-down menu, select SKU size.
4. Check the box next to Standard_v2 only.
5. Click Apply.
6. Click the name of an application gateway.
7. Under Settings, click Web application firewall.
8. Under Configure, next to Tier, click WAF V2.
9. Select an existing or create a new WAF policy.
10. Click Save.
11. Repeat steps 1-10 for each Standard V2 tier application gateway requiring remediation.

Default Value

Azure Web Application Firewall is enabled by default for the WAF V2 tier of Azure Application Gateway. It is not available in the Basic tier. Application gateways deployed using the Standard V2 tier can be upgraded to the WAF V2 tier to enable Azure Web Application Firewall.

References

1. https://learn.microsoft.com/en-us/azure/application-gateway/features
2. https://learn.microsoft.com/en-us/cli/azure/network/application-gateway
3. https://azure.microsoft.com/en-us/pricing/details/application-gateway

CIS Controls

MITRE ATT&CK Mappings

Profile

Level 2 | Automated