auditing-cloud-with-cis-benchmarks

# Auditing Cloud with CIS Benchmarks — Azure Focused ## When to Use - When performing initial security audits of an Azure tenant against industry-standard benchmarks. - When preparing for SOC 2 or ISO 27001 audits that reference CIS controls. - When establishing a measurable security baseline for new Azure subscriptions. - When validating the configuration of Identity, Networking, and Storage against best practices. ## Key Concepts | Term | Definition | |------|------------| | CIS Benchmark | Prescriptive security configuration guidelines developed by the Center for Internet Security | | Level 1 Profile | Practical security controls implementable without significant performance impact | | Level 2 Profile | Defense-in-depth controls that may restrict functionality | | Foundations Benchmark | CIS benchmark specifically for cloud providers covering IAM, Logging, and Networking | ## OpenShield Compliance Rules OpenShield automates many of the CIS Azure Foundations Benchmark checks: - **Identity**: `AZ-IDN-001` through `AZ-IDN-009` - **Networking**: `AZ-NET-001` through `AZ-NET-014` - **Storage**: `AZ-STOR-001` through `AZ-STOR-005` ## Audit Workflow ### Step 1: Run Automated Assessment Use OpenShield or native Azure tools like Microsoft Defender for Cloud to run a full CIS scan. ### Step 2: Interpret Results Prioritize Level 1 controls first as they represent fundamental security hygiene. ### Step 3: Remediate High Impact Controls Address failed controls like unrestricted RDP/SSH access or missing MFA on admin accounts. ## Remediation Reference - **Use Azure Policy**: Assign the "CIS Microsoft Azure Foundations Benchmark" policy initiative for continuous auditing. - **Enable Defender**: Use Microsoft Defender for Cloud for real-time compliance tracking. - **Automate Fixes**: Use OpenShield playbooks to automatically remediate common CIS failures.