Cis Azure Foundations 7.12

Ensure the SSL policy's 'Min protocol version' is set to 'TLSv1_2' or higher on Azure Application Gateway

Description

The TLS (Transport Layer Security) protocol secures the transmission of data over the internet using standard encryption technology. Application gateways use TLS 1.2 for the Min protocol version by default and allow for the use of TLS versions 1.0, 1.1, and 1.3. NIST strongly suggests the use of TLS 1.2 and recommends the adoption of TLS 1.3.

Rationale

TLS 1.0 and 1.1 are outdated and vulnerable to security risks. Since TLS 1.2 and TLS 1.3 provide enhanced security and improved performance, it is highly recommended to use TLS 1.2 or higher whenever possible.

Impact

Using the latest TLS version may affect compatibility with clients and backend services.

Audit Procedure

Using Azure Portal

1. Go to Application gateways.
2. Click the name of an application gateway.
3. Under Settings, click Listeners.
4. Under SSL Policy, ensure Min protocol version is set to TLSv1_2 or higher.
5. Repeat steps 1-4 for each application gateway.

Using Azure CLI

Run the following command to list application gateways:

az network application-gateway list

For each application gateway, run the following command to get the SSL policy:

az network application-gateway ssl-policy show --resource-group <resource-group> --gateway-name <application-gateway>

For each SSL policy, run the following command to get the minProtocolVersion:

az network application-gateway ssl-policy predefined show --name <ssl-policy> --query minProtocolVersion

Ensure "TLSv1_2" or higher is returned.

Expected Result

All Application Gateways should have Min protocol version set to TLSv1_2 or higher in their SSL policy configuration.

Remediation

Remediate from Azure Portal

1. Go to Application gateways.
2. Click the name of an application gateway.
3. Under Settings, click Listeners.
4. Under SSL Policy, next to the Selected SSL Policy name, click change.
5. Select an appropriate SSL policy with a Min protocol version of TLSv1_2 or higher.
6. Click Save.
7. Repeat steps 1-6 for each application gateway requiring remediation.

Remediate from Azure CLI

Run the following command to list available SSL policy options:

az network application-gateway ssl-policy list-options

Run the following command to list available predefined SSL policies:

az network application-gateway ssl-policy predefined list

For each application gateway requiring remediation, run the following command to set a predefined SSL policy:

az network application-gateway ssl-policy set --resource-group <resource-group> --gateway-name <application-gateway> --name <ssl-policy> --policy-type Predefined

Alternatively, run the following command to set a custom SSL policy:

az network application-gateway ssl-policy set --resource-group <resource-group> --gateway-name <application-gateway> --policy-type Custom --min-protocol-version <min-protocol-version> --cipher-suites <cipher-suites>

Default Value

Min protocol version is set to TLSv1_2 by default.

References

1. https://learn.microsoft.com/en-us/azure/application-gateway/application-gateway-ssl-policy-overview
2. https://learn.microsoft.com/en-us/cli/azure/network/application-gateway

CIS Controls

MITRE ATT&CK Mappings

Profile

Level 1 | Automated