Microsoft AzureOverview
The TLS (Transport Layer Security) protocol secures transmission of data over the internet using standard encryption technology. Encryption should be set with the latest version of TLS. App service allows TLS 1.2 by default, which is the recommended TLS level by industry standards such as PCI DSS.
Rationale
App service currently allows the web app to set TLS versions 1.0, 1.1 and 1.2. It is highly recommended to use the latest TLS 1.2 version for web app secure connections.
Default Value
By default, TLS Version feature will be set to 1.2 when a new app is created using the command-line tool or Azure Portal console.
Remediation guidance
Remediate from Azure Portal
- Open the web app using the
Open in Azurebutton. - Under
Settingsection, Click onSSL settings - Under the
Bindingspane, setMinimum TLS Versionto1.2underProtocol Settingssection
Remediate from Azure CLI
To set TLS Version for an existing app, run the following command:
az webapp config set --resource-group --name --min-tls-version 1.2
Remediate from PowerShell
Set-AzWebApp -ResourceGroupName -Name -MinTlsVersion 1.2
Service-wide remediation
Recommended when many resources are affected: fix the platform baseline first so new resources inherit the secure setting, then remediate the existing flagged resources in batches.
Azure
Use management group or subscription Azure Policy assignments, remediation tasks where supported, landing-zone standards, and IaC modules so drift is prevented at scale.
Operational rollout
- Fix the baseline first at the account, subscription, project, cluster, or tenant scope that owns this control.
- Remediate the currently affected resources in batches, starting with internet-exposed and production assets.
- Re-scan and track approved exceptions with an owner and expiry date.
Query logic
These are the stored checks tied to this control.
Azure app services allowing old TLS
Connectors
Covered asset types
Expected check: eq []
{
sites(where: { siteConfig: { NOT: { minTlsVersion_IN: ["1.2", "1.3"] } } }) {
...AssetFragment
}
}
