OpenParable
Skip to content
← Back to skills

Cis Azure Compute 15.5

DevOps & Security
cis-azure-compute-15.5

Cis Azure Compute 15.5 is an Agent Skill for devops & security published in the CyberStrikeus/CyberStrike repository on GitHub: a SKILL.md instruction file an AI agent can load to do this task.

Ensure public network access is disabled for Batch accounts

View on GitHub ↗
QUICK START

How to use this skill

Bring this guide into your coding agent with a prompt tailored to the tool you use.

  1. Open your project in Codex.
  2. Copy and paste the prompt below.
  3. Review files and risks before approving any action.
Prompt to paste
Inspect the Agent Skill at https://github.com/CyberStrikeus/CyberStrike/blob/HEAD/.cyberstrike/skill/CIS_benchmarks/Cloud_Providers/Microsoft_Azure/CIS_Microsoft_Azure_Compute_Services_Benchmark_v2.0.0/cis-azure-compute-15.5/SKILL.md and all supporting files. Report provenance, permissions, scripts, dependencies, and security risks. Propose an exact installation into .agents/skills/cis-azure-compute-15-5, but wait for my approval before writing files or running scripts.

Copying this prompt does not install or run the skill. Review third-party files before use.

Ensure public network access is disabled for Batch accounts

Description

Disabling public network access ensures all connectivity occurs through private endpoints or approved virtual networks.

Rationale

Public network access exposes Batch accounts to internet threats like DDoS attacks and unauthorized access, violating Zero Trust principles and compliance requirements for secure data processing environments.

Impact

A virtual network or private endpoint should be implemented for the Batch account prior to disabling public network access.

Audit Procedure

Using Azure Portal

  1. Login to https://portal.azure.com
  2. For each Batch Account, click on the Batch account name
  3. Navigate to the Settings drop-down, then click Networking.
  4. Under the Public access tab, ensure that Public Network Access is set to Disabled.

Repeat for each Batch account in scope.

Using Azure CLI

az batch account show \
  --name <batch-account-name> \
  --resource-group <resource-group> \
  --query "publicNetworkAccess"

Using Azure PowerShell

(Get-AzBatchAccount -Name "<batch-account-name>").PublicNetworkAccess

Expected Output: Disabled

Expected Result

The publicNetworkAccess setting should be Disabled for all Batch accounts.

Remediation

Using Azure Portal

  1. Login to https://portal.azure.com
  2. For each Batch Account, click on the Batch account name
  3. Navigate to the Settings drop-down, then click Networking.
  4. Under the Public access tab, ensure that Public Network Access is set to Disabled.
  5. Click Save

Repeat for each Batch account in scope.

Using Azure CLI

az batch account update \
  --name <account-name> \
  --resource-group <rg-name> \
  --public-network-access Disabled

Using Azure PowerShell

Update-AzBatchAccount -Name <account-name> -ResourceGroupName <rg-name> -PublicNetworkAccess Disabled

Default Value

Public network access is enabled by default for new Batch accounts.

References

  1. https://learn.microsoft.com/en-us/security/benchmark/azure/baselines/batch-security-baseline#ns-4
  2. https://learn.microsoft.com/en-us/azure/batch/private-connectivity

Profile

Level 1 | Automated