AZIAM-006: Network Security Group rules audit
- Plataforma
- Entra ID / M365
- Categoría
- Azure IAM & Resource Security
- Severidad
- High
- Pilar de Zero Trust
- Identity (peso 3)
- Fixtures de referencia
- 4
- Cobertura de ramas
- Observada: los fixtures prueban los veredictos que ejercitan
- Procedencia
- baseline
Qué comprueba
Network Security Groups control inbound and outbound traffic flow to Azure resources and are a primary network segmentation mechanism. Overly permissive NSG rules, such as allowing unrestricted inbound access from the internet on management ports, expose resources to brute-force attacks and exploitation. Regular audits of NSG rules are essential to maintain a secure network perimeter.
Valor recomendado
Deny all inbound internet traffic by default; allow only required ports from specific source IP ranges
Remediación
Review all NSG rules for overly permissive entries, particularly any rules allowing inbound traffic from 0.0.0.0/0 or Any on ports such as 22, 3389, 445, or 1433. Replace broad allow rules with specific source IP ranges or service tags and remove unused rules. Enable NSG flow logs and integrate with Azure Network Watcher for continuous monitoring of traffic patterns and anomaly detection.
Veredictos probados con fixtures
Cada veredicto de esta tabla está probado por un fixture de referencia en la suite de pruebas que valida el módulo. La tabla se deriva de la última ejecución en verde; no puede editarse a mano.
| Escenario | Veredicto esperado |
|---|---|
| clean | PASS |
| known-bad | FAIL |
| no-data | Not Assessed |
| partial-collection | Not Assessed |
Mapeos a marcos de referencia
- NIST SP 800-53
- SC-7
- CIS Azure
- 6.1