We’ve released our newest Azure blueprint that maps to another key industry-standard, the Center for Internet Security (CIS) Microsoft Azure Foundations Benchmark. This follows the recent announcement of our Azure blueprint for FedRAMP moderate and adds to the growing list of Azure blueprints for regulatory compliance, which now includes ISO 27001, NIST SP 800-53, PCI-DSS, UK OFFICIAL, UK NHS, and IRS 1075.
Azure Blueprints is a free service that enables cloud architects and central information technology groups to define a set of Azure resources that implements and adheres to an organization's standards, patterns, and requirements. Azure Blueprints makes it possible for development teams to rapidly build and stand up new trusted environments within organizational compliance requirements. Customers can apply the new CIS Microsoft Azure Foundations Benchmark blueprint to new subscriptions as well as existing environments.
CIS benchmarks are configuration baselines and best practices for securely configuring a system developed by CIS, a nonprofit entity whose mission is to ”identify, develop, validate, promote, and sustain best practice solutions for cyber defense.” A global community collaborates in a consensus-based process to develop these internationally recognized security standards for defending IT systems and data against cyberattacks. Used by thousands of businesses, they offer prescriptive guidance for establishing a secure baseline system configuration. System and application administrators, security specialists, and others who develop solutions using Microsoft products and services can use these best practices to assess and improve the security of their applications.
Each of the CIS Microsoft Azure Foundations Benchmark recommendations are mapped to one or more of the 20 CIS Controls that were developed to help organizations improve their cyber defense. The blueprint assigns Azure Policy definitions to help customers assess their compliance with the recommendations. Major elements of all nine sections of the recommendations from the CIS Microsoft Azure Foundation Benchmark v1.1.0 include:
Identity and Access Management (1.0)
- Assigns Azure Policy definitions that help you monitor when multi-factor authentication isn't enabled on privileged Azure Active Directory accounts.
- Assigns an Azure Policy definition that helps you monitor when multi-factor authentication isn't enabled on non-privileged Azure Active Directory accounts.
- Assigns Azure Policy definitions that help you monitor for guest accounts and custom subscription roles that may need to be removed.
Security Center (2.0)
- Assigns Azure Policy definitions that help you monitor networks and virtual machines where the Security Center standard tier isn't enabled.
- Assigns Azure Policy definitions that helps you ensure that virtual machines are monitored for vulnerabilities and remediated, endpoint protection is enabled, system updates are installed on virtual machines.
- Assigns an Azure Policy definition that helps you ensure virtual machine disks are encrypted.
Storage Accounts (3.0)
- Assigns an Azure Policy definition that helps you monitor storage accounts that allow insecure connections.
- Assigns an Azure Policy definition that helps you monitor storage accounts that allow unrestricted access.
- Assigns an Azure Policy definition that helps you monitor storage accounts that don't allow access from trusted Microsoft services.
Database Services (4.0)
- Assigns an Azure Policy definition that helps ensure SQL Server auditing is enabled as well as properly configured, and logs are retained for at least 90 days.
- Assigns an Azure Policy definition that helps you ensure advanced data security notifications are properly enabled.
- Assigns an Azure Policy definition that helps you ensure that SQL Servers are configured for encryption and other security settings.
Logging and Monitoring (5.0)
- Assigns Azure Policy definitions that help you ensure a log profile exists and is properly configured for all Azure subscriptions, and activity logs are retained for at least one year.
Networking (6.0)
- Assigns an Azure Policy definition that helps you ensure Network Watcher is enabled for all regions where resources are deployed.
Virtual Machines (7.0)
- Assigns an Azure Policy definition that helps you ensure disk encryption is enabled on virtual machines.
- Assigns an Azure Policy definition that helps you ensure that only approved virtual machine extensions are installed.
- Assigns Azure Policy definitions that help you ensure that system updates are installed, and endpoint protection is enabled on virtual machines.
Other Security Considerations (8.0)
- Assigns an Azure Policy definition that helps you ensure that key vault objects are recoverable in the case of accidental deletion.
- Assigns an Azure Policy definition that helps you ensure role-based access control is used to managed permissions in Kubernetes service clusters
AppService (9.0)
- Assigns an Azure Policy definition that helps you ensure web applications are accessible only over secure connections.
- Assigns Azure Policy definitions that help you ensure web applications are only accessible using HTTPS, use the latest version of TLS encryption, and are only reachable by clients with valid certificates.
- Assigns Azure Policy definitions to ensure that .Net Framework, PHP, Python, Java, and HTTP versions are the latest.
Azure customers seeking to implement compliance with CIS Benchmarks should note that although this Azure Blueprint may help customers assess compliance with particular configuration recommendations, it does not ensure full compliance with all requirements of the CIS Benchmark and CIS Controls. In addition, recommendations are associated with one or more Azure Policy definitions, and the compliance standard includes recommendations that aren't addressed by any Azure Policy definitions in blueprints at this time. Therefore, compliance in Azure Policy will only consist of a partial view of your overall compliance status. Customers are ultimately responsible for meeting the compliance requirements applicable to their environments and must determine for themselves whether particular information helps meet their compliance needs.
Learn more about the CIS Microsoft Azure Foundation Benchmark blueprint in our documentation.