# Cis Azure Compute 2.10

> Cis Azure Compute 2.10 is an Agent Skill for devops & security published in the CyberStrikeus/CyberStrike repository on GitHub: a SKILL.md instruction file an AI agent can load to do this task.

Ensure App Service Environment has TLS cipher suite ordering configured

- Skill name: `cis-azure-compute-2.10`
- Category: [DevOps & Security](https://www.openparable.com/skill/devops-security/1)
- Source: https://github.com/CyberStrikeus/CyberStrike/blob/HEAD/.cyberstrike/skill/CIS_benchmarks/Cloud_Providers/Microsoft_Azure/CIS_Microsoft_Azure_Compute_Services_Benchmark_v2.0.0/cis-azure-compute-2.10/SKILL.md
- Repository: CyberStrikeus/CyberStrike (1,211 GitHub stars when collected)

## SKILL.md

# Ensure App Service Environment has TLS cipher suite ordering configured

## Description

App Service Environment supports changing the cipher suite from the default. The default set of ciphers is the same set that is used in the multi-tenant App Service. Changing the cipher suite is only possible with App Service Environment, the single-tenant offering, not the multi-tenant offering, because changing it affects the entire App Service deployment.

There are two cipher suites that are required for an App Service Environment: `TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384` and `TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256`. Additionally, you should include the following cipher suites, which are required for TLS 1.3: `TLS_AES_256_GCM_SHA384` and `TLS_AES_128_GCM_SHA256`.

## Rationale

Configuring your App Service Environment to use only the ciphers it requires helps to keep the environment secure.

## Impact

If incorrect values are set for the cipher suite that SChannel cannot understand, all TLS communication to your server might stop functioning.

## Audit Procedure

### Using Azure Portal

1. Go to `Resource Explorer`.
2. Locate an App Service Environment from the left pane.
3. Ensure the `clusterSettings` attribute includes:

```json
{
  "name": "FrontEndSSLCipherSuiteOrder",
  "value": "TLS_AES_256_GCM_SHA384,TLS_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256"
}
```

4. Repeat steps 1-3 for each App Service Environment.

### Using Azure CLI

Run the following command to list App Service Environments:

```bash
az appservice ase list
```

For each App Service Environment, ensure that `clusterSettings` includes:

```json
{
  "name": "FrontEndSSLCipherSuiteOrder",
  "value": "TLS_AES_256_GCM_SHA384,TLS_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256"
}
```

## Expected Result

The `clusterSettings` should include a `FrontEndSSLCipherSuiteOrder` entry with the appropriate strong cipher suites listed.

## Remediation

### Using Azure Portal

1. Go to `Resource Explorer`.
2. Locate an App Service Environment from the left pane.
3. In the right pane, click `Read/Write` to allow editing.
4. Click `Edit` to edit the resource.
5. Update the `clusterSettings` attribute to include:

```json
{
  "name": "FrontEndSSLCipherSuiteOrder",
  "value": "TLS_AES_256_GCM_SHA384,TLS_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256"
}
```

6. Click `PUT` to commit the change.
7. Repeat steps 1-7 for each App Service Environment requiring remediation.

## Default Value

TLS cipher suite ordering is not configured by default.

## References

1. https://learn.microsoft.com/en-us/azure/app-service/environment/app-service-app-service-environment-custom-settings
2. https://learn.microsoft.com/en-us/cli/azure/appservice/ase

## Profile

Level 1 | Automated

---

Source: https://www.openparable.com/skill/devops-security/cis-azure-compute-2-10 (OpenParable). Cite the canonical URL above.