AzPolicyAdvertizer

last sync: 2024-Nov-25 18:54:24 UTC

Microsoft Managed Control 1547 - Vulnerability Scanning | Regulatory Compliance - Risk Assessment

Azure BuiltIn Policy definition

Source Azure Portal
Display name Microsoft Managed Control 1547 - Vulnerability Scanning
Id 58abf9b8-c6d4-4b4b-bfb9-fe98fe295f52
Version 1.0.0
Details on versioning
Versioning Versions supported for Versioning: 0
Built-in Versioning [Preview]
Category Regulatory Compliance
Microsoft Learn
Description Microsoft implements this Risk Assessment control
Additional metadata Name/Id: ACF1547 / Microsoft Managed Control 1547
Category: Risk Assessment
Title: Vulnerability Scanning - Automate Parts of Management Process
Ownership: Customer, Microsoft
Description: The organization: Employs vulnerability scanning tools and techniques that facilitate interoperability among tools and automate parts of the vulnerability management process by using standards for: Enumerating platforms, software flaws, and improper configurations; Formatting checklists and test procedures; and Measuring vulnerability impact;
Requirements: Azure employs automated vulnerability scanning tools to scan the Azure operating systems, databases, and web applications. The vulnerability scanning tools provide reporting data based on a number of existing, well-used, open standards that itemize software flaws, security configurations, and various product names, including the Common Vulnerabilities and Exposures (CVE) and Common Vulnerability Scoring System (CVSS). The following sections address the scanning tools and techniques used for each applicable Azure asset type. Azure utilizes a variety of well-known knowledge-based scan tools with the applicable plugins to run authenticated vulnerability scans on a predetermined number of servers depending on the asset type. Scan tool plugins are updated prior to scanning any hosts. Azure employs the following predetermined scanning methodologies to perform authenticated scans: Physical Servers 100% of Azure physical server operating systems are scanned with credentials using Qualys off-node, including database and web application hosts. All scans are authenticated. Physical Database Instances 100% of all physical databases are scanned with credentials using Qualys. Virtual Servers Authenticated scans are performed on 100% of Azure service team servers. Azure scans virtual servers using the Microsoft-specific Qualys off-node scanner. Virtual Database Instances Azure uses a SKU-based sampling methodology for authenticated databases instances. These scans are executed for database compliance checks. Azure databases are scanned with the VA Scan Tool. Web Applications 100% of all Azure web applications have authenticated scans run against each URL. Scans of all web applications are performed using Rapid7 AppSpider with applicable web application plug-ins enabled. This is referred to as WebScout internally. Network Devices 85% of Azure network devices are scanned with authenticated scans using Qualys.
Mode Indexed
Type Static
Preview False
Deprecated False
Effect Fixed
audit
RBAC role(s) none
Rule aliases none
Rule resource types IF (2)
Microsoft.Resources/subscriptions
Microsoft.Resources/subscriptions/resourceGroups
Compliance
The following 6 compliance controls are associated with this Policy definition 'Microsoft Managed Control 1547 - Vulnerability Scanning' (58abf9b8-c6d4-4b4b-bfb9-fe98fe295f52)
Control Domain Control Name MetadataId Category Title Owner Requirements Description Info Policy#
op.exp.2 Security configuration op.exp.2 Security configuration 404 not found n/a n/a 112
op.exp.3 Security configuration management op.exp.3 Security configuration management 404 not found n/a n/a 123
op.exp.4 Security maintenance and updates op.exp.4 Security maintenance and updates 404 not found n/a n/a 78
op.exp.5 Change management op.exp.5 Change management 404 not found n/a n/a 71
op.mon.3 Monitoring op.mon.3 Monitoring 404 not found n/a n/a 51
op.pl.1 Risk analysis op.pl.1 Risk analysis 404 not found n/a n/a 70
Initiatives usage
Initiative DisplayName Initiative Id Initiative Category State Type
Spain ENS 175daf90-21e1-4fec-b745-7b4c909aa94c Regulatory Compliance GA BuiltIn
History none
JSON compare n/a
JSON
api-version=2021-06-01
EPAC