aquasecurity / aquasecurity/cloudsploit

Azure Security Center: Monitor plugins broken

Open
#614 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
JavaScript
Stars
3.8k
Forks
751
Avg merge
11d 9h
Merged PRs (30d)
3

Description

All of the Azure Security Center plugins which audit for monitoring of various vulnerable configurations are broken. The reasons are varied, but right now these tests appear to be just generating noise. They should be fixed or removed (preferably the latter).

- **Monitor Blob Encryption**
Deprecated as blob encryption is now enabled by default and cannot be disabled. Plugin can probably be removed.
- **Monitor Disk Encryption**
Appears to be replaced by the "_Disk encryption should be applied on virtual machines_" policy.
- **Monitor Endpoint Protection**
Appears to be replaced by the "_Endpoint protection solution should be installed on virtual machine scale sets_" and "_Monitor missing Endpoint Protection in Azure Security Center_" policies.
- **Monitor JIT Network Access**
Appears to be replaced by the "_Management ports of virtual machines should be protected with just-in-time network access control_" policy.
- **Monitor NSG Enabled**
This policy appears to have been replaced with several more granular policies.
- **Monitor SQL Auditing**
Replaced by the "_Auditing should be enabled on advanced data security settings on SQL Server_" policy.
- **Monitor SQL Encryption**
Replaced by the "_Transparent Data Encryption on SQL databases should be enabled_" policy.
- **Monitor System Updates**
Appears to be replaced by the "_System updates should be installed on your machines_" policy.
- **Monitor VM Vulnerability**
Appears to be replaced by the "_A vulnerability assessment solution should be enabled on your virtual machines_" policy.

I think there's a strong argument that the general approach of these plugins needs a rethink, as they're ultimately auditing a small subset of the broader controls the built-in Azure policy sets provide. If that's the case, these plugins I'd suggest should still be removed until such an overhaul is implemented, as right now they're just generating alerts which effectively can't be actioned.

Contributor guide

Open the contributing guide

Research direction

Locate the Azure Security Center monitoring plugin implementations and any related tests, then review each listed plugin against the replacement Azure policies named in the issue. Done means removing obsolete checks or fixing them so they no longer generate unactionable noise, with coverage for the resulting behavior.

Written by the indexing model from the issue text.

Assessment

Tech stack
azure, javascript
Domain
cloud, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.