cis-azure-foundations-7-10

name	cis-azure-foundations-7.10
description	Ensure Azure Web Application Firewall (WAF) is enabled on Azure Application Gateway
category	cis-azure-foundations
version	5.0.0
author	cyberstrike-official
tags	["cis","azure","networking","waf","application-gateway"]
cis_id	7.10
cis_benchmark	CIS Microsoft Azure Foundations Benchmark v5.0.0
tech_stack	["azure"]
cwe_ids	[]
chains_with	["cis-azure-foundations-7.12","cis-azure-foundations-7.13","cis-azure-foundations-7.14","cis-azure-foundations-7.15"]
prerequisites	[]
severity_boost	{}

Ensure Azure Web Application Firewall (WAF) is enabled on Azure Application Gateway

Description

Azure Web Application Firewall helps protect applications from common exploits and attacks by inspecting and filtering incoming traffic.

Rationale

Using Azure Web Application Firewall with Azure Application Gateway reduces exposure to external threats by mitigating attacks on public facing applications.

Impact

The WAF V2 tier for Azure Application Gateways costs more than the Basic and Standard V2 tiers. Pricing includes a fixed hourly charge plus a charge per capacity-unit hour. Refer to https://azure.microsoft.com/en-gb/pricing/details/application-gateway/ for details.

Audit Procedure

Using Azure Portal

1. Go to Application gateways.
2. Click the name of an application gateway.
3. In the Overview, under Essentials, ensure Tier is set to WAF V2.
4. Repeat steps 1-3 for each application gateway.

Using Azure CLI

Run the following command to list application gateways:

az network application-gateway list

For each application gateway, run the following command to get the firewall policy id:

az network application-gateway show --resource-group <resource-group> --name <application-gateway> --query firewallPolicy.id

Ensure a firewall policy id is returned.

Using Azure Policy

• Policy ID: 564feb30-bf6a-4854-b4bb-0d2d2d1e6c66 - Name: 'Web Application Firewall (WAF) should be enabled for Application Gateway'

Expected Result

All Application Gateways should have Tier set to WAF V2 and have a firewall policy associated.

Remediation

Note: Basic tier application gateways cannot be upgraded to the WAF V2 tier. Create a new WAF V2 tier application gateway to replace a Basic tier application gateway.

Remediate from Azure Portal

To remediate a Standard V2 tier application gateway: