NSG must have security rules configured to restrict inbound traffic

Critical Azure General nsg-nsg-security-rules-configured

Applies to

Microsoft.Network/networkSecurityGroups

What CGPulse checks

A resource passes this rule when securityRules must be set true. Anything else is reported as a finding with the evaluated property value attached as evidence.

How to fix it

Configure NSG inbound rules to restrict traffic to only necessary ports and sources. In Azure Portal: NSG > Inbound security rules > add rules per CDE requirements. See: https://learn.microsoft.com/en-us/azure/virtual-network/network-security-groups-overview

CLI

az network nsg rule list --nsg-name "{name}" -g "{rg}"

Terraform

# Review and configure NSG rules for your environment
resource "azurerm_network_security_rule" "{name}" {
  network_security_group_name = "{name}"
  resource_group_name         = "{rg}"
  # Define specific allow/deny rules
}

Compliance frameworks

PCI DSS v4.01.3.1

Is your environment compliant with this rule?

CGPulse checks it — and 621 others — against your Azure and AWS accounts with read-only access.

Run a free scan