Security Control V2: Posture and Vulnerability Management

Note

The most up-to-date Azure Security Benchmark is available here.

Posture and Vulnerability Management focuses on controls for assessing and improving Azure security posture. This includes vulnerability scanning, penetration testing and remediation, as well as security configuration tracking, reporting, and correction in Azure resources.

To see the applicable built-in Azure Policy, see Details of the Azure Security Benchmark Regulatory Compliance built-in initiative: Posture and Vulnerability Management

PV-1: Establish secure configurations for Azure services

Azure ID	CIS Controls v7.1 ID(s)	NIST SP 800-53 r4 ID(s)
PV-1	5.1	CM-2, CM-6

Define security guardrails for infrastructure and DevOps teams by making it easy to securely configure the Azure services they use.

Start your security configuration of Azure services with the service baselines in the Azure Security Benchmark and customize as needed for your organization.

Use Azure Security Center to configure Azure Policy to audit and enforce configurations of your Azure resources.

You can use Azure Blueprints to automate deployment and configuration of services and application environments, including Azure Resource Manager templates, Azure RBAC controls, and policies, in a single blueprint definition.

• Illustration of guardrails implementation in enterprise-scale landing zone

• Working with security policies in Azure Security Center

• Create and manage policies to enforce compliance

• Azure Blueprints

Responsibility: Customer

Customer Security Stakeholders (Learn more):

• Posture management

• Infrastructure and endpoint security

• Application Security and DevOps

PV-2: Sustain secure configurations for Azure services

Azure ID	CIS Controls v7.1 ID(s)	NIST SP 800-53 r4 ID(s)
PV-2	5.2	CM-2, CM-6

Use Azure Security Center to monitor your configuration baseline and use Azure Policy [deny] and [deploy if not exist] rule to enforce secure configuration across Azure compute resources, including VMs, containers, and others.

• Understand Azure Policy effects

• Create and manage policies to enforce compliance

Responsibility: Customer

Customer Security Stakeholders (Learn more):

• Posture management

• Infrastructure and endpoint security

• Application Security and DevOps

PV-3: Establish secure configurations for compute resources

Azure ID	CIS Controls v7.1 ID(s)	NIST SP 800-53 r4 ID(s)
PV-3	5.1	CM-2, CM-6

Use Azure Security Center and Azure Policy to establish secure configurations on all compute resources, including VMs, containers, and others Additionally, you can use custom operating system images or Azure Automation State Configuration to establish the security configuration of the operating system required by your organization.

• How to monitor Azure Security Center recommendations

• Security recommendations - a reference guide

• Azure Automation State Configuration overview

• Upload a VHD and use it to create new Windows VMs in Azure

• Create a Linux VM from a custom disk with the Azure CLI

Responsibility: Customer

Customer Security Stakeholders (Learn more):

• Posture management

• Infrastructure and endpoint security

• Application Security and DevOps

PV-4: Sustain secure configurations for compute resources

Azure ID	CIS Controls v7.1 ID(s)	NIST SP 800-53 r4 ID(s)
PV-4	5.2	CM-2, CM-6

Use Azure Security Center and Azure Policy to regularly assess and remediate configuration risks on your Azure compute resources, including VMs, containers, and others. In addition, you can use Azure Resource Manager templates, custom operating system images, or Azure Automation State Configuration to maintain the security configuration of the operating system required by your organization. Microsoft VM templates in conjunction with Azure Automation State Configuration can assist in meeting and maintaining security requirements.

Also, note that Azure Marketplace VM images published by Microsoft are managed and maintained by Microsoft.

Azure Security Center can also scan vulnerabilities in container images and perform continuous monitoring of your Docker configuration in containers, based on the CIS Docker Benchmark. You can use the Azure Security Center recommendations page to view recommendations and remediate issues.

• How to implement Azure Security Center vulnerability assessment recommendations

• How to create an Azure virtual machine from an ARM template

• Azure Automation State Configuration overview

• Create a Windows virtual machine in the Azure portal

• Information on how to download template for a VM

• Sample script to upload a VHD to Azure and create a new VM

• Container security in Azure Security Center

Responsibility: Shared

Customer Security Stakeholders (Learn more):

• Posture management

• Infrastructure and endpoint security

• Application Security and DevOps

PV-5: Securely store custom operating system and container images

Azure ID	CIS Controls v7.1 ID(s)	NIST SP 800-53 r4 ID(s)
PV-5	5.3	CM-2, CM-6

Use Azure role-based access control (Azure RBAC) to ensure that only authorized users can access your custom images. Use an Azure Shared Image Gallery to share your images to different users, service principals, or AD groups within your organization. Store container images in Azure Container Registry and use Azure RBAC to ensure that only authorized users have access.

• Understand Azure RBAC

• Understand Azure RBAC for Container Registry

• How to configure Azure RBAC

• Shared Image Gallery overview

Responsibility: Customer

Customer Security Stakeholders (Learn more):

• Posture management

• Infrastructure and endpoint security

• Application Security and DevOps

PV-6: Perform software vulnerability assessments

Azure ID	CIS Controls v7.1 ID(s)	NIST SP 800-53 r4 ID(s)
PV-6	3.1, 3.2, 3.3, 3.6	CA-2, RA-5

Follow recommendations from Azure Security Center for performing vulnerability assessments on your Azure virtual machines, container images, and SQL servers. Azure Security Center has a built-in vulnerability scanner to scan virtual machines.

Use a third-party solution for performing vulnerability assessments on network devices and web applications. When conducting remote scans, do not use a single, perpetual, administrative account. Consider implementing JIT (Just In Time) provisioning methodology for the scan account. Credentials for the scan account should be protected, monitored, and used only for vulnerability scanning.

Export scan results at consistent intervals and compare the results with previous scans to verify that vulnerabilities have been remediated. When using vulnerability management recommendations suggested by Azure Security Center, you can pivot into the selected scan solution's portal to view historical scan data.

• How to implement Azure Security Center vulnerability assessment recommendations

• Integrated vulnerability scanner for virtual machines

• Exporting Azure Security Center vulnerability scan results

Responsibility: Customer

Customer Security Stakeholders (Learn more):

• Posture management

• Infrastructure and endpoint security

• Application Security and DevOps

PV-7: Rapidly and automatically remediate software vulnerabilities

Azure ID	CIS Controls v7.1 ID(s)	NIST SP 800-53 r4 ID(s)
PV-7	3.7	CA-2, RA-5, SI-2

Rapidly deploy software updates to remediate software vulnerabilities in operating systems and applications.

Use a common risk scoring program (such as Common Vulnerability Scoring System) or the default risk ratings provided by your third-party scanning tool and tailor to your environment, taking into account which applications present a high security risk and which ones require high uptime.

Use Azure Automation Update Management or a third-party solution to ensure that the most recent security updates are installed on your Windows and Linux VMs. For Windows VMs, ensure Windows Update has been enabled and set to update automatically.

For third-party software, use a third-party patch management solution or System Center Updates Publisher for Configuration Manager.

• How to configure Update Management for virtual machines in Azure

• Manage updates and patches for your Azure VMs

Responsibility: Customer

Customer Security Stakeholders (Learn more):

• Posture management

• Infrastructure and endpoint security

• Application Security and DevOps

PV-8: Conduct regular attack simulation

Azure ID	CIS Controls v7.1 ID(s)	NIST SP 800-53 r4 ID(s)
PV-8	20	CA-8, CA-2, RA-5

As required, conduct penetration testing or red team activities on your Azure resources and ensure remediation of all critical security findings. Follow the Microsoft Cloud Penetration Testing Rules of Engagement to ensure your penetration tests are not in violation of Microsoft policies. Use Microsoft's strategy and execution of Red Teaming and live site penetration testing against Microsoft-managed cloud infrastructure, services, and applications.

• Penetration testing in Azure

• Penetration Testing Rules of Engagement

• Microsoft Cloud Red Teaming

Responsibility: Shared

Customer Security Stakeholders (Learn more):

• Posture management

• Infrastructure and endpoint security

• Application Security and DevOps