> ## Documentation Index > Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt > Use this file to discover all available pages before exploring further. # Unrestricted CIFS Access ### More Info: Ensure that no network security groups allow unrestricted inbound access on TCP port 445 (Common Internet File System – CIFS). ### Risk Level High ### Address Security ### Compliance Standards * APRA CPS 234 (Australia) * BSI C5 (Germany) * Brazil LGPD * CCPA / CPRA (California) * CIS Critical Security Controls v8 * CMMC 2.0 * CSA Cloud Controls Matrix v4 * DPDPA * Digital Operational Resilience Act (EU) * Essential 8 * FedRAMP * GDPR * HITRUST CSF * ISO/IEC 27017 * ISO/IEC 27018 * ISO/IEC 27701 * KSA PDPL * MAS Technology Risk Management (Singapore) * MITRE ATT\&CK (Cloud) * NIS2 Directive * NIST CSF * NIST SP 800-171 * NYDFS 23 NYCRR 500 * PCI * Reserve Bank of India (RBI) Cyber Security Framework * Reserve Bank of India (RBI) Master Direction – Information Technology Framework * SOC2 * SWIFT Customer Security Controls Framework * Sarbanes-Oxley IT General Controls * UK NCSC Cyber Assessment Framework ### Triage and Remediation ### Remediation To remediate the "Unrestricted CIFS Access" misconfiguration in Azure, you can follow these steps: 1. Login to the Azure portal ([https://portal.azure.com/](https://portal.azure.com/)). 2. Navigate to the storage account that has the misconfiguration. 3. Click on the "Firewalls and virtual networks" tab from the left-hand menu. 4. Under the "Allow access from" section, select "Selected networks". 5. In the "Selected networks" section, click on the "Add existing virtual network" button. 6. Select the virtual network that is associated with the resource that needs access to the storage account. 7. Click on the "Add" button. 8. Under the "Allow trusted Microsoft services" section, select "Yes". 9. Click on the "Save" button to apply the changes. By following these steps, you have restricted the access to the storage account to only the selected virtual network and allowed trusted Microsoft services to access it. This should remediate the "Unrestricted CIFS Access" misconfiguration. # To remediate unrestricted CIFS access in Azure using Azure CLI, follow these steps: 1. Open the Azure CLI and connect to your Azure account. 2. Identify the storage account that has unrestricted CIFS access. You can do this by running the following command: ``` az storage account list --query "[?networkAcls.defaultAction=='Allow'].name" ``` This command will list all the storage accounts that have their default network access set to "Allow". 3. Once you have identified the storage account, you can update its network access rules to restrict CIFS access. You can do this by running the following command: ``` az storage account update --name --resource-group --default-action Deny ``` Replace `` with the name of the storage account that you want to update and `` with the name of the resource group that the storage account belongs to. 4. After running the above command, you can verify that the update was successful by running the following command: ``` az storage account show --name --resource-group --query "networkAcls.defaultAction" ``` This command will return the default network access rule for the storage account. It should now be set to "Deny". By following these steps, you have successfully remediated unrestricted CIFS access in Azure using Azure CLI. To remediate unrestricted CIFS access in AZURE using python, follow the below steps: 1. Import the necessary libraries: ``` import os from azure.identity import DefaultAzureCredential from azure.mgmt.storage import StorageManagementClient ``` 2. Set the subscription ID, resource group name, and storage account name: ``` subscription_id = 'your_subscription_id' resource_group_name = 'your_resource_group_name' storage_account_name = 'your_storage_account_name' ``` 3. Create a credential object to authenticate the programmatic access: ``` credential = DefaultAzureCredential() ``` 4. Create a storage management client object: ``` storage_client = StorageManagementClient(credential, subscription_id) ``` 5. Get the storage account properties: ``` storage_account = storage_client.storage_accounts.get_properties(resource_group_name, storage_account_name) ``` 6. Check if CIFS access is allowed: ``` if storage_account.network_rules is not None and storage_account.network_rules.default_action == 'Allow': for ip_rule in storage_account.network_rules.ip_rules: if ip_rule.action == 'Allow' and ip_rule.protocol == 'TCP' and ip_rule.port_range == '445': print('Unrestricted CIFS access is allowed') break else: print('No network rules found') ``` 7. If CIFS access is allowed, update the network rules to deny CIFS access: ``` if storage_account.network_rules is not None and storage_account.network_rules.default_action == 'Allow': for ip_rule in storage_account.network_rules.ip_rules: if ip_rule.action == 'Allow' and ip_rule.protocol == 'TCP' and ip_rule.port_range == '445': ip_rule.action = 'Deny' network_rules = storage_client.storage_accounts.update_network_rules(resource_group_name, storage_account_name, storage_account.network_rules) print('CIFS access has been remediated') break else: print('No network rules found') ``` These steps will remediate unrestricted CIFS access in Azure using Python. ```hcl theme={null} resource "azurerm_network_security_group" "example" { name = "EXISTING_NSG_NAME" # replace with your NSG name location = azurerm_resource_group.rg.location resource_group_name = azurerm_resource_group.rg.name # REMOVE or update any existing rule that currently allows: # access on destination_port_range = "445" from source_address_prefix = "*" or "0.0.0.0/0" # Example: restrict CIFS (TCP/445) to a known safe CIDR instead of the entire internet security_rule { name = "allow_cifs_restricted" priority = 100 # choose an unused priority direction = "Inbound" access = "Allow" protocol = "Tcp" source_port_range = "*" destination_port_range = "445" source_address_prefix = "ALLOWED_CIDR" # e.g. "10.0.0.0/24" destination_address_prefix = "*" # or a specific subnet/host source_application_security_group_ids = [] destination_application_security_group_ids = [] } # Optional: if you must hard-block CIFS from everywhere, add an explicit Deny # with a higher priority (lower number) than any broad allow rule: security_rule { name = "deny_cifs_internet" priority = 90 # lower number = higher priority direction = "Inbound" access = "Deny" protocol = "Tcp" source_port_range = "*" destination_port_range = "445" source_address_prefix = "0.0.0.0/0" destination_address_prefix = "*" source_application_security_group_ids = [] destination_application_security_group_ids = [] } } ``` Changing or removing a `security_rule` is in-place and does not force replacement of the `azurerm_network_security_group` itself, but it will immediately alter live traffic filtering once applied. Verification: `terraform plan` should show the existing rule that allowed `Tcp` on port `445` from `*` / `0.0.0.0/0` being removed or modified, and the new/updated `security_rule` blocks as additions/changes on the `azurerm_network_security_group` resource.