Control: 2.1.14 Ensure Any of the ASC Default Policy Settings are Not Set to 'Disabled'

Description

None of the settings offered by ASC Default policy should be set to effect Disabled.

A security policy defines the desired configuration of your workloads and helps ensure compliance with company or regulatory security requirements. ASC Default policy is associated with every subscription by default. ASC default policy assignment is a set of security recommendations based on best practices. Enabling recommendations in ASC default policy ensures that Azure security center provides the ability to monitor all of the supported recommendations and optionally allow automated action for a few of the supported recommendations.

Remediation

From Azure Portal

From Azure Home select the Portal Menu.
Select Microsoft Defender for Cloud.
Select Environment Settings.
Click on a subscription.
Select Security Policy in the left column.
Click on ASC Default under Default initiative.
Ensure Policy Enforcement is Enabled.
Click on the Parameters tab and uncheck Only show parameters that need input or review.
For any parameters set to Disabled or empty, update to a valid value for the organization.
Click Save.

Usage

Run the control in your terminal:

powerpipe control run azure_compliance.control.cis_v200_2_1_14

Snapshot and share results via Turbot Pipes:

powerpipe login
powerpipe control run azure_compliance.control.cis_v200_2_1_14 --share

SQL

This control uses a named query:

with policy_assignment_parameters as (
  select
    id,
    name,
    key,
    parameters -> key ->> 'value' as value,
    subscription_id
  from
    azure_policy_assignment,
    jsonb_object_keys(parameters) as key
  where
    name = 'SecurityCenterBuiltIn'
)
select
  sub.id as resource,
  case
    when count(value = 'Disabled') > 0 then 'alarm'
    else 'ok'
  end as status,
  case
    when count(value = 'Disabled') > 0 then 'Settings disabled for ' || count(*) filter (where value = 'Disabled') || ' parameters.'
    else 'Settings enabled for all the parameters.'
  end as reason
  
  , sub.display_name as subscription
from
  policy_assignment_parameters pol_assignment
  right join azure_subscription sub on pol_assignment.subscription_id = sub.subscription_id
group by
  sub.id,
  pol_assignment.id,
  sub._ctx,
  sub.subscription_id,
  pol_assignment.subscription_id,
  sub.display_name;

Control: 2.1.14 Ensure Any of the ASC Default Policy Settings are Not Set to 'Disabled'

Description

Remediation

From Azure Portal

Usage

SQL

Tags