Cis Azure Storage 2.2.1.2

2.2.1.2 Ensure Network Access Rules are set to Deny-by-default (Automated)

Description

Restricting default network access provides a foundational level of security to networked resources. To limit access to selected networks, the default action must be changed.

Rationale

Resources using Virtual Network interfaces should be configured to deny-by-default all access from all networks (including internet traffic). Access can be granted to traffic from specific Azure Virtual networks, allowing a secure network boundary for specific applications to be built. If necessary, access can also be granted to public internet IP address ranges to enable connections from specific internet or on-premises clients.

For all traffic inbound from- and outbound to- the internet, a NAT Gateway is recommended at minimum, and ideally all traffic flows through a security gateway device such as a firewall. Security gateway devices will provide an additional level of visibility to inbound and outbound traffic and usually perform advanced monitoring and response activity such as intrusion detection and prevention (IDP), and deep packet inspection (DPI) which help detect activity indicating vulnerabilities and threats.

Impact

All allowed networks and protocols will need to be allow-listed which creates some administrative overhead.

Implementing a deny-by-default rule may result in a loss of network connectivity. Careful planning and a scheduled implementation window allowing for downtime is highly recommended.

Audit Procedure

This is a Common Reference Recommendation. Audit and remediation procedures with full details will be found in the section dedicated to each specific service where this recommendation applies:

• Storage Services > Storage Accounts > Networking > "Ensure Default Network Access Rule for Storage Accounts is Set to Deny"

Expected Result

The default network access rule for the service should be set to Deny, with only explicitly allowed networks and IP ranges having access.

Remediation

This is a Common Reference Recommendation. Audit and remediation procedures with full details will be found in the section dedicated to each specific service where this recommendation applies:

• Storage Services > Storage Accounts > Networking > "Ensure Default Network Access Rule for Storage Accounts is Set to Deny"

Default Value

By default, interfaces attached to virtual networks will accept connections from clients on any network and have a default outbound access rule which allows access to the internet.

The default outbound access rule is scheduled for retirement on September 30th, 2025: https://azure.microsoft.com/en-us/updates?id=default-outbound-access-for-vms-in-azure-will-be-retired-transition-to-a-new-method-of-internet-access

References

1. https://docs.microsoft.com/en-us/azure/storage/common/storage-network-security
2. https://learn.microsoft.com/en-us/security/benchmark/azure/mcsb-governance-strategy#gs-2-define-and-implement-enterprise-segmentationseparation-of-duties-strategy
3. https://learn.microsoft.com/en-us/security/benchmark/azure/mcsb-network-security#ns-2-secure-cloud-native-services-with-network-controls

Additional Information

This Common Reference Recommendation is referenced in the following Service Recommendations:

• Storage Services > Storage Accounts > Networking > "Ensure Default Network Access Rule for Storage Accounts is Set to Deny"

A NAT gateway is the recommended solution for outbound internet access.

CIS Controls

Profile

Level 1 | Automated