| Source | Azure Portal | ||
| Display name | Microsoft Managed Control 1547 - Vulnerability Scanning | ||
| Id | 58abf9b8-c6d4-4b4b-bfb9-fe98fe295f52 | ||
| Version | 1.0.0 Details on versioning |
||
| Category | Regulatory Compliance Microsoft Learn |
||
| Description | Microsoft implements this Risk Assessment control | ||
| Additional metadata |
Name/Id: ACF1547 / Microsoft Managed Control 1547 Category: Risk Assessment Title: Vulnerability Scanning - Automate Parts of Management Process Ownership: Customer, Microsoft Description: The organization: Employs vulnerability scanning tools and techniques that facilitate interoperability among tools and automate parts of the vulnerability management process by using standards for: Enumerating platforms, software flaws, and improper configurations; Formatting checklists and test procedures; and Measuring vulnerability impact; Requirements: Azure employs automated vulnerability scanning tools to scan the Azure operating systems, databases, and web applications. The vulnerability scanning tools provide reporting data based on a number of existing, well-used, open standards that itemize software flaws, security configurations, and various product names, including the Common Vulnerabilities and Exposures (CVE) and Common Vulnerability Scoring System (CVSS). The following sections address the scanning tools and techniques used for each applicable Azure asset type. Azure utilizes a variety of well-known knowledge-based scan tools with the applicable plugins to run authenticated vulnerability scans on a predetermined number of servers depending on the asset type. Scan tool plugins are updated prior to scanning any hosts. Azure employs the following predetermined scanning methodologies to perform authenticated scans: Physical Servers 100% of Azure physical server operating systems are scanned with credentials using Qualys off-node, including database and web application hosts. All scans are authenticated. Physical Database Instances 100% of all physical databases are scanned with credentials using Qualys. Virtual Servers Authenticated scans are performed on 100% of Azure service team servers. Azure scans virtual servers using the Microsoft-specific Qualys off-node scanner. Virtual Database Instances Azure uses a SKU-based sampling methodology for authenticated databases instances. These scans are executed for database compliance checks. Azure databases are scanned with the VA Scan Tool. Web Applications 100% of all Azure web applications have authenticated scans run against each URL. Scans of all web applications are performed using Rapid7 AppSpider with applicable web application plug-ins enabled. This is referred to as WebScout internally. Network Devices 85% of Azure network devices are scanned with authenticated scans using Qualys. |
||
| Mode | Indexed | ||
| Type | Static | ||
| Preview | False | ||
| Deprecated | False | ||
| Effect | Fixed audit |
||
| RBAC role(s) | none | ||
| Rule aliases | none | ||
| Rule resource types | IF (2) Microsoft.Resources/subscriptions Microsoft.Resources/subscriptions/resourceGroups |
||
| Compliance | Not a Compliance control | ||
| Initiatives usage | none | ||
| History | none | ||
| JSON compare | n/a | ||
| JSON |
|