cis-aks-v180-5-1-1

name	cis-aks-v180-5.1.1
description	Ensure Image Vulnerability Scanning using Microsoft Defender for Cloud (MDC) image scanning or a third party provider (Automated)
category	cis-aks
version	1.8.0
author	cyberstrike-official
tags	["cis","aks","kubernetes","azure","acr","image-scanning","vulnerability-scanning","microsoft-defender"]
cis_id	5.1.1
cis_benchmark	CIS Azure Kubernetes Service (AKS) Benchmark v1.8.0
tech_stack	["kubernetes","azure","aks"]
cwe_ids	[]
chains_with	[]
prerequisites	[]
severity_boost	{}

5.1.1 Ensure Image Vulnerability Scanning using Microsoft Defender for Cloud (MDC) image scanning or a third party provider (Automated)

Profile Applicability

• Level 1

Description

Scan images being deployed to Azure (AKS) for vulnerabilities.

Vulnerability scanning for images stored in Microsoft Defender for Cloud (MDC). This capability is powered by Microsoft Defender for Endpoint's MDVM, a leading provider of information security.

When you push an image to Container Registry, MDC automatically scans it, then checks for known vulnerabilities in packages or dependencies defined in the file.

When the scan completes (after about 10 minutes), MDC provides details and a security classification for each vulnerability detected, along with guidance on how to remediate issues and protect vulnerable attack surfaces.

Rationale

Vulnerabilities in software packages can be exploited by hackers or malicious users to obtain unauthorized access to local cloud resources.

Impact

When using an MDC, you might occasionally encounter problems. For example, you might not be able to pull a container image because of an issue with Docker in your local environment. Or, a network issue might prevent you from connecting to the registry.

Audit

Check MDC for Container Registries: This command shows whether container registries is enabled, which includes the image scanning feature. To have image scanning, you must have Defender for Container Registries (or broader Defender for Containers) enabled in your subscription. Often that means the Microsoft.Security/pricings entry for ContainerRegistry is set to "Standard".

az aks show --resource-group ${RESOURCE_GROUP} --name ${CLUSTER_NAME} --output json --query "sku.tier" -o tsv

or

az security pricing list --query "[type=='Microsoft.ContainerRegistry/registries'].{Name:name, Status:properties.status}" -o table

Remediation

Enable MDC for Container Registries: If you find that container registries is not enabled and you wish to enable it, you can do so using the following command:

az security pricing create --name ContainerRegistry --tier Standard

or

az resource update --ids /subscriptions/{subscription-id}/resourceGroups/{resource-group-name}/providers/Microsoft.ContainerRegistry/registries/{registry-name} --set properties.enabled=true