Quick Info
| Plugin Title | Default Security Group |
| Cloud | AZURE |
| Category | Network Security Groups |
| Description | Ensures that default security groups block all traffic by default |
| More Info | The default security group is often used for resources launched without a defined security group. For this reason, the default rules should be set to block all traffic to prevent an accidental exposure. |
| AZURE Link | https://docs.microsoft.com/en-us/azure/virtual-network/manage-network-security-group |
| Recommended Action | Update the rules for the default security group to deny all traffic by default |
Detailed Remediation Steps
- Log into the Microsoft Azure Management Console.
- Select the “Search resources, services, and docs” option at the top and search for Network security groups.
- Select the “Network security group” that needs to be verified.
- Scroll down the left navigation panel and select the “Inbound security rules” under “Settings.”
- Under the “Inbound security rules” please make sure traffic is “Deny” for all ports for the best practice. If not, then the selected “Default security group” is not as per the best practices recommended by Azure.
- Repeat step number 5 for the “Outbound security rules” as well.
- Repeat steps number 2 - 6 to verify other “Default security groups” in the resources.
- Navigate to the “Network security group” and select the security group that needs to modify to deny all traffic by default.
- Scroll down the left navigation panel and choose “Inbound security rules” under “Settings."
- Select the protocol which is having traffic access by default and then click on the option to delete the specific protocol.
- Repeat step number 10 for “Outbound security rules."
- Repeat steps number 8 - 11 to update the rules for the default security group to deny all traffic by default.