Skip to main content

lacework-global-523

2.6 Ensure Any of the ASC Default Policy Settings are Not Set to 'Disabled' (Manual)​

Profile Applicability​

• Level 1

Description​

None of the settings offered by ASC Default policy should be set to effect Disabled.

Rationale​

A security policy defines the desired configuration of your workloads and helps ensure compliance with company or regulatory security requirements. ASC Default policy is associated with every subscription by default. ASC default policy assignment is a set of security recommendations based on best practices. Enabling recommendations in ASC default policy ensures that Azure security center provides the ability to monitor all of the supported recommendations and optionally allow automated action for a few of the supported recommendations.

Audit​

From Azure Portal​

  1. From Azure Home select the Portal Menu
  2. Select Microsoft Defender for Cloud
  3. Then Environment Settings
  4. Select subscription
  5. Then on Security Policy in the left column.
  6. Followed by on ASC Default under Default initiative
  7. Scroll down to Policy Enforcement and ensure it is set to Enabled
  8. Click on the Parameters tab and uncheck Only show parameters that need input or review
  9. Review the Parameters to ensure none of the items are set to Disabled.

The View effective Policy button can be used to see all effects of policies even if they have not been modified.

From Azure CLI​

Ensure the properties.enforcementMode in the output of the below command is set to Default. If properties.enforcementMode is set to DoNotEnforce, the default policies are disabled and therefore out of compliance.

az account get-access-token --query "{<subscription:subscription>,<accessToken:accessToken>}" --out tsv | xargs -L1 bash -c 'curl -X GET -H "Authorization: Bearer $1" -H "Content-Type: application/json" https://management.azure.com/subscriptions/<subscriptionID>/providers/Microsoft.Authorization/policyAssignments/SecurityCenterBuiltIn?api-version=2021-06-01'

Note: policies that have not been modified will not be listed in this output

From Azure PowerShell​

Get-AzPolicyAssignment | Where-Object {$_.Name -eq 'SecurityCenterBuiltIn' | Select-Object -ExpandProperty Properties

If the EnforcementMode value equals Default the ASC Default Policies are enabled. Because several of the policies are in the Disabled state by default, check to see if the Parameters attribute in the output of the above command contains policies with the value of Disabled or if it's empty altogether. If so, these settings are out of compliance. If none of the values in the Parameters attribute show Disabled, these settings are in compliance. If the EnforcementMode parameter equals DoNotEnforce the ASC Default Policies are all disabled and thus out of compliance.

Remediation​

From Azure Portal​

  1. From Azure Home select the Portal Menu
  2. Select Microsoft Defender for Cloud
  3. Then Environment Settings
  4. Click on a subscription
  5. Select Security Policy in the left column.
  6. Click on ASC Default under Default initiative
  7. Scroll down to Policy Enforcement and ensure it is set to Enabled
  8. Click on the Parameters tab and uncheck Only show parameters that need input or review
  9. In section PARAMETERS, configure the impacted setting to any other available value than Disabled or empty
  10. Click Save

References​

https://docs.microsoft.com/en-us/azure/security-center/security-center-policies
https://docs.microsoft.com/en-us/azure/security-center/security-center-enable-transparent-data-encryption
https://msdn.microsoft.com/en-us/library/mt704062.aspx
https://msdn.microsoft.com/en-us/library/mt704063.aspx
https://docs.microsoft.com/en-us/rest/api/policy/policy-assignments/get
https://docs.microsoft.com/en-us/rest/api/policy/policy-assignments/create
https://docs.microsoft.com/en-in/azure/security-center/tutorial-security-policy
https://docs.microsoft.com/en-us/security/benchmark/azure/security-controls-v3-governance-strategy#gs-7-define-and-implement-logging-threat-detection-and-incident-response-strategy