Default Security Group
Ensures that default security groups block all traffic by default
The default security group is often used for resources launched without a defined security group. For this reason, the default rules should be set to block all traffic to prevent an accidental exposure.
Recommended Actions
Follow the appropriate remediation steps below to resolve the issue.
-
Log into the Microsoft Azure Management Console.
-
Select the “Search resources, services, and docs” option at the top and search for Network security groups.
-
Select the “Network security group” that needs to be verified.
-
Scroll down the left navigation panel and select the “Inbound security rules” under “Settings.”
-
Under the “Inbound security rules” please make sure traffic is “Deny” for all ports for the best practice. If not, then the selected “Default security group” is not as per the best practices recommended by Azure.
-
Repeat step number 5 for the “Outbound security rules” as well.
-
Repeat steps number 2 - 6 to verify other “Default security groups” in the resources.
-
Navigate to the “Network security group” and select the security group that needs to modify to deny all traffic by default.
-
Scroll down the left navigation panel and choose “Inbound security rules” under “Settings.”
-
Select the protocol which is having traffic access by default and then click on the option to delete the specific protocol.
-
Repeat step number 10 for “Outbound security rules.”
-
Repeat steps number 8 - 11 to update the rules for the default security group to deny all traffic by default.