Description:

None of the settings offered by ASC Default policy should be set to effect "Disabled".


Rationale:

A security policy defines the desired configuration of your workloads and helps ensure compliance with company or regulatory security requirements. ASC Default policy is associated with every subscription by default. ASC default policy assignment is set of security recommendations based on best practices. Enabling recommendations in ASC default policy ensures that the Azure security center provides the ability to monitor all of the supported recommendations and allow automated action optionally for a few of the supported recommendations.


Audit:

  1. Go to Azure Security Center

  2. Click On the security policy to Open Policy Management Blade.

  3. Click Subscription View

  4. Click on Subscription Name to open Security Policy Blade for the Subscription.

  5. Expand All the available sections Compute And Apps, Data, Identity

  6. Ensure that any of the settings is not set to Disabled

    The 'View effective Policy' button can be used to see all effects of policies even if they have not been modified.


Using Azure Command-Line Interface 2.0

Ensure the output of the below command does not contain any setting which is set to Disable or Empty

az account get-access-token --query 
"{subscription:subscription,accessToken:accessToken}" --out tsv | xargs -L1 bash -c 'curl -X GET -H "Authorization: Bearer $1" -H "Content-Type: application/json" 
https://management.azure.com/subscriptions/$0/providers/Microsoft.Authorizati on/policyAssignments/SecurityCenterBuiltIn?api-version=2018-05-01'


Remediation:

Pre-Requisite:

  1. An Azure account

  2. An Azure Defender plan for Enhanced security plan (Azure Defender is free for the first 30 days. At the end of 30 days, if you choose to continue using the service, you’ll automatically charged for usage).

Implementation Steps:

  1. Navigate to Azure Policy

  2. On Policy "Overview" blade, Click on Policy ASC Default (Subscription: Subscription_ID)

  3. On "ASC Default" blade, Click on Edit Assignments

  4. In section PARAMETERS, configure the impacted setting to any other available value than Disabled or empty

  5. Click Save

Backout Plan:

  1. Go to Azure Security Center

  2. Click On the security policy to Open Policy Management Blade.

  3. Click Subscription View

  4. Click on Subscription Name to open Security Policy Blade for the Subscription.

  5. Expand All the available sections Compute And Apps, Data, Identity

  6. Ensure that any of the settings is not set to Disabled(how we can revoke the changes)

Note:

Policies that have not been modified will not be listed in this output

References:

  1. Working with security policies 

  2. https://docs.microsoft.com/en-us/azure/security-center/security-center-enable- transparent-data-encryption

  3. https://msdn.microsoft.com/en-us/library/mt704062.aspx 

  4. https://msdn.microsoft.com/en-us/library/mt704063.aspx