cis-azure-database-2-6

name	cis-azure-database-2.6
description	Ensure that 'Public Network Access' is 'Disabled'
category	cis-azure-database
version	2.0.0
author	cyberstrike-official
tags	["cis","azure","redis","cache"]
cis_id	2.6
cis_benchmark	CIS Microsoft Azure Database Services Benchmark v2.0.0
tech_stack	["azure"]
cwe_ids	[]
chains_with	[]
prerequisites	[]
severity_boost	{}

2.6 Ensure that 'Public Network Access' is 'Disabled' (Manual)

Profile Applicability

• Level 2

Description

Disabling public network access restricts the service from accessing public networks.

Rationale

A secure network architecture requires carefully constructed network segmentation. Public Network Access tends to be overly permissive and introduces unintended vectors for threat activity.

Impact

Disabling 'Public Network Access' forces the requirement of the use of Private Endpoints for network connectivity which will require some additional consideration from a network architecture perspective and will introduce cost based on the inbound/outbound data being processed by the Private Endpoint.

IMPORTANT NOTE: If Azure Cache for Redis has been deployed in a VNet, this recommendation cannot be implemented. See additional information below for more detail.

Audit Procedure

Audit From Azure Portal

NOTE: This procedure applies only to instances that are not using VNets.

1. Search for and open the Azure Cache for Redis service
2. For each instance, repeat the remaining steps
3. Click on the name of the instance
4. In the blade menu on the left, click on Private Endpoint
5. Review the button to the right of + Private Endpoint

If the button is titled enable public network access, the configuration for that instance is currently disabled and compliant.

Audit From Azure Policy

• Policy ID: 470baccb-7e51-4549-8b1a-3e5be069f663 - Name: 'Azure Cache for Redis should disable public network access'

Expected Result

The button next to + Private Endpoint should display enable public network access, indicating public network access is currently disabled.

Remediation

Remediate From Azure Portal

NOTE: A Private Endpoint must exist before the "Disable public network access" button allows the configuration change to be performed via Portal.

1. Search for and open the Azure Cache for Redis service
2. For each instance, repeat the remaining steps
3. Click on the name of the instance
4. In the blade menu on the left, click on Private Endpoint
5. Click the Disable public network access button.