| name | cis-azure-compute-2.10 |
| description | Ensure App Service Environment has TLS cipher suite ordering configured |
| category | cis-azure-compute |
| version | 2.0.0 |
| author | cyberstrike-official |
| tags | ["cis","azure","app-service-environment","ase"] |
| cis_id | 2.10 |
| cis_benchmark | CIS Microsoft Azure Compute Services Benchmark v2.0.0 |
| tech_stack | ["azure"] |
| cwe_ids | [] |
| chains_with | [] |
| prerequisites | [] |
| severity_boost | {} |
Ensure App Service Environment has TLS cipher suite ordering configured
Description
App Service Environment supports changing the cipher suite from the default. The default set of ciphers is the same set that is used in the multi-tenant App Service. Changing the cipher suite is only possible with App Service Environment, the single-tenant offering, not the multi-tenant offering, because changing it affects the entire App Service deployment.
There are two cipher suites that are required for an App Service Environment: TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 and TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256. Additionally, you should include the following cipher suites, which are required for TLS 1.3: TLS_AES_256_GCM_SHA384 and TLS_AES_128_GCM_SHA256.
Rationale
Configuring your App Service Environment to use only the ciphers it requires helps to keep the environment secure.
Impact
If incorrect values are set for the cipher suite that SChannel cannot understand, all TLS communication to your server might stop functioning.
Audit Procedure
Using Azure Portal
- Go to
Resource Explorer.
- Locate an App Service Environment from the left pane.
- Ensure the
clusterSettings attribute includes:
{
"name": "FrontEndSSLCipherSuiteOrder",
"value": "TLS_AES_256_GCM_SHA384,TLS_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256"
}
- Repeat steps 1-3 for each App Service Environment.
Using Azure CLI
Run the following command to list App Service Environments:
az appservice ase list
For each App Service Environment, ensure that clusterSettings includes:
{
"name": "FrontEndSSLCipherSuiteOrder",
"value":
