Network misconfigurations

Azure basic Load Balancer with public IP

Platform(s)
Compliance Frameworks
  • CCM-CSA
  • ,
  • HITRUST
  • ,
  • iso_27001_2022
  • ,
  • iso_27002_2022
  • ,
  • Mitre ATT&CK
  • ,
  • mpa
  • ,
  • New Zealand Information Security Manual
  • ,
  • NIST 800-53
  • ,
  • Orca Best Practices

Description

Load balancer is a service which distributes inbound flows that arrive at the load balancer's front end to backend pool instances (Azure Virtual Machines or instances in a virtual machine scale set), according to the configured load balancing rules. Azure load balancer supports both Standard and Basic SKUs (Stock Keeping Unit) - for more information - https://docs.microsoft.com/en-us/azure/load-balancer/skus. Basic load balancer is open to the internet by default and the Network security group is optional, therefore it is not recommended by Microsoft. Standard load balancer is built on the zero trust network security model and closed to inbound connections unless opened by Network Security Groups on a subnet or NIC of your virtual machine resource. The load balancer - {AzureLoadBalancer} is a basic load balancer associated with a public ip(s) named - {AzureLoadBalancer.PublicIps}, this configuration makes the load balancer directly exposed and does not follow best practices.