Network misconfigurations

Network security group rule allows unrestricted incoming access to TCP and UDP port 53 (DNS)

Platform(s)
Compliance Frameworks

Description

An Azure Security Group acts as a virtual firewall for your instances to control inbound and outbound traffic. We identified the security group ""{AzureNetworkSecurityGroup}"" ({AzureNetworkSecurityGroup.NsgId}) is configured to allow inbound access to TCP and UDP port 53 (DNS) from any IP address (0.0.0.0/0 or ::/0).
  • Recommended Mitigation

    Ensure security groups in your account are configured to allow access to TCP and UDP port 53 (DNS) from specific IP addresses only. More details can be found in <a href="https://learn.microsoft.com/en-us/azure/virtual-network/network-security-groups-overview" target="_blank" rel="noopener noreferrer">https://learn.microsoft.com/en-us/azure/virtual-network/network-security-groups-overview</a>