cis-azure-foundations-7-11

name	cis-azure-foundations-7.11
description	Ensure subnets are associated with network security groups
category	cis-azure-foundations
version	5.0.0
author	cyberstrike-official
tags	["cis","azure","networking","nsg"]
cis_id	7.11
cis_benchmark	CIS Microsoft Azure Foundations Benchmark v5.0.0
tech_stack	["azure"]
cwe_ids	[]
chains_with	["cis-azure-foundations-7.1","cis-azure-foundations-7.2","cis-azure-foundations-7.3","cis-azure-foundations-7.4"]
prerequisites	[]
severity_boost	{}

Ensure subnets are associated with network security groups

Description

Protect subnet resources by ensuring subnets are associated with network security groups, which can filter inbound and outbound traffic using security rules.

Rationale

Unprotected subnets can expose resources to unauthorized access.

Impact

Minor administrative effort is required to ensure subnets are associated with network security groups. There is no cost to create or use network security groups.

Audit Procedure

Using Azure Portal

1. Go to Virtual networks.
2. Click the name of a virtual network.
3. Under Settings, click Subnets.
4. Click the name of a subnet.
5. Under Security, ensure Network security group is not set to None.
6. Repeat steps 1-5 for each virtual network and subnet.

Using Azure CLI

Run the following command to list virtual networks:

az network vnet list

For each virtual network, run the following command to list subnets:

az network vnet show --resource-group <resource-group> --name <virtual-network> --query subnets

For each subnet, run the following command to get the network security group id:

az network vnet subnet show --resource-group <resource-group> --vnet-name <virtual-network> --name <subnet> --query networkSecurityGroup.id

Ensure a network security group id is returned.

Using Azure Policy

• Policy ID: e71308d3-144b-4262-b144-efdc3cc90517 - Name: 'Subnets should be associated with a Network Security Group'

Expected Result

All subnets should have an associated network security group. The networkSecurityGroup.id field should not be null or empty for any subnet.

Remediation

Remediate from Azure Portal

1. Go to Virtual networks.
2. Click the name of a virtual network.
3. Under Settings, click Subnets.
4. Click the name of a subnet.
5. Under Security, next to Network security group, click to display the drop-down menu.