GR7 | Validation 1 | Storage Accounts TLS 1.2 (M)

[MathesonSho]

TLS/ HTTPS Policy Checks

Description: The following are some new controls for the CaC Solution's Guardrail 7. The goal is to determine if TLS1.2+ or HTTPS encryption is being used for all cloud services including publicly accessible sites and external communications. The first check will focus on Storage Accounts while the second will look at Other Cloud Apps. The final check will consider firewall configurations. These are built-in policies provided by MS. Note: we will not be able to achieve this check entirely due to the limits in seeing configurations of non-native tools or virtual machines to host websites etc.,

ItemName: Storage Accounts TLS 1.2 (M)

1. This check parses through existing storage accounts. Determine whether every storage account is using a minimum of TLS 1.2. If all storage accounts have TLS 1.2+ than pass. If one of more storage accounts have TLS 1.1 or below the check will be non-compliant and return the list of storage accounts that do not meet this requirement. Enforce a minimum required version of Transport Layer Security (TLS) for incoming requests - Azure Storage | Microsoft Learn

ItemName: App Service HTTPS Configuration (M)
2. This check uses built-in Azure Policies and their evaluation to determine compliance. The following check is inside the Canada Federal PBMM:

• App Service apps should only be accessible over HTTPS

If the PBMM initiative has been applied to the subscription, and the following policy has not been excluded, and the policy compliance results show all compliant resources then check is compliant. If there are no applicable resources in the environment default pass.

ItemName: Function App HTTPS Configuration (M)
3. This check uses built-in Azure Policies and their evaluation to determine compliance. The following check is inside the Canada Federal PBMM:

• Function apps should only be accessible over HTTPS

If the PBMM initiative has been applied to the subscription, and the following policy has not been excluded, and the policy compliance results show all compliant resources then check is compliant. If there are no applicable resources in the environment default pass.

[dutt0]

Created another ticket with all the recommended controls from here.

[dutt0]

Created another ticket with the app HTTPS configuration controls from here.