> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Unrestricted HTTP Access

### More Info:

Ensure that no network security groups allow unrestricted inbound access on TCP port 80.

### Risk Level

Critical

### Address

Security

### Compliance Standards

* APRA CPS 234 (Australia)
* BSI C5 (Germany)
* Brazil LGPD
* CCPA / CPRA (California)
* CIS Critical Security Controls v8
* CMMC 2.0
* CSA Cloud Controls Matrix v4
* DPDPA
* Digital Operational Resilience Act (EU)
* Essential 8
* HITRUST CSF
* ISO/IEC 27017
* ISO/IEC 27018
* ISO/IEC 27701
* KSA PDPL
* MAS Technology Risk Management (Singapore)
* MITRE ATT\&CK (Cloud)
* NIS2 Directive
* NIST SP 800-171
* NYDFS 23 NYCRR 500
* SWIFT Customer Security Controls Framework
* Sarbanes-Oxley IT General Controls
* UK NCSC Cyber Assessment Framework

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Using Console" defaultOpen="true">
        The remediation steps for Unrestricted HTTP Access in AZURE are:

        1. Login to the AZURE portal ([https://portal.azure.com/](https://portal.azure.com/))
        2. Navigate to the Virtual Machine that has unrestricted HTTP access.
        3. Click on the "Networking" tab on the left-hand side of the Virtual Machine page.
        4. Under the "Inbound port rules" section, click on "Add inbound port rule".
        5. In the "Add inbound security rule" page, provide the following details:
           * Name: A name for the new rule
           * Priority: A number that specifies the priority of the rule. A lower number indicates a higher priority.
           * Protocol: Select "TCP" from the dropdown.
           * Port range: Specify the port range that you want to restrict. For example, if you want to restrict port 80, enter "80" in both the "Start port" and "End port" fields.
           * Action: Select "Deny" from the dropdown.
           * Source: Select "Any" from the dropdown.
           * Destination: Select "Any" from the dropdown.
        6. Click on "Add" to create the new rule.
        7. Repeat steps 4-6 for all the ports that you want to restrict.
        8. Once all the necessary rules have been created, click on "Save" to apply the changes.

        After completing these steps, the unrestricted HTTP access should be remediated for the Virtual Machine in AZURE.

        #
      </Accordion>

      <Accordion title="Using CLI">
        To remediate unrestricted HTTP access in AZURE using AZURE CLI, follow the below steps:

        1. Login to Azure CLI using the command "az login". Enter your Azure credentials when prompted.

        2. Run the command "az network nsg list" to list all the network security groups (NSGs) in your subscription.

        3. Identify the NSG that is associated with the virtual machine or the subnet that has unrestricted HTTP access.

        4. Run the command `az network nsg rule list --nsg-name <NSG-Name>` to list all the rules in the NSG.

        5. Identify the rule that allows unrestricted HTTP access.

        6. Run the command "az network nsg rule delete --nsg-name `<NSG-Name>` --name `<Rule-Name>`" to delete the rule that allows unrestricted HTTP access.

        7. Confirm the deletion by running the command `az network nsg rule list --nsg-name <NSG-Name>` again and verifying that the rule is no longer present.

        8. Repeat the above steps for all the NSGs that have unrestricted HTTP access.

        9. Once all the rules have been deleted, the unrestricted HTTP access issue should be resolved.

        Note: It is recommended to restrict access to HTTP and allow access only through HTTPS to ensure secure communication.
      </Accordion>

      <Accordion title="Using Python">
        To remediate unrestricted HTTP access in Azure using Python, you can use the Azure Python SDK to create a Network Security Group (NSG) and apply it to the virtual network. The NSG will contain a rule that blocks all inbound traffic on port 80.

        Here are the step-by-step instructions:

        1. Install the Azure Python SDK using pip:

        ```python theme={null}
        pip install azure-mgmt-network
        ```

        2. Import the necessary modules:

        ```python theme={null}
        from azure.common.credentials import ServicePrincipalCredentials
        from azure.mgmt.network import NetworkManagementClient
        from azure.mgmt.network.models import (
            NetworkSecurityGroup,
            SecurityRule,
            SecurityRuleAccess,
            SecurityRuleDirection,
            SecurityRuleProtocol,
        )
        ```

        3. Create a Service Principal for authentication:

        ```python theme={null}
        credentials = ServicePrincipalCredentials(
            client_id='<client_id>',
            secret='<client_secret>',
            tenant='<tenant_id>',
        )
        ```

        Replace `<client_id>`, `<client_secret>`, and `<tenant_id>` with your Azure AD credentials.

        4. Create an instance of the `NetworkManagementClient`:

        ```python theme={null}
        subscription_id = '<subscription_id>'
        resource_group_name = '<resource_group_name>'
        location = '<location>'

        network_client = NetworkManagementClient(
            credentials,
            subscription_id,
        )
        ```

        Replace `<subscription_id>`, `<resource_group_name>`, and `<location>` with your Azure subscription ID, resource group name, and location.

        5. Create a Network Security Group:

        ```python theme={null}
        nsg_name = '<nsg_name>'

        nsg_params = NetworkSecurityGroup(
            location=location,
        )

        nsg_result = network_client.network_security_groups.create_or_update(
            resource_group_name,
            nsg_name,
            nsg_params,
        )
        ```

        Replace `<nsg_name>` with a name for your Network Security Group.

        6. Create a Security Rule to block inbound traffic on port 80:

        ```python theme={null}
        rule_name = '<rule_name>'

        rule_params = SecurityRule(
            protocol=SecurityRuleProtocol.tcp,
            source_port_range='*',
            destination_port_range='80',
            source_address_prefix='*',
            destination_address_prefix='*',
            access=SecurityRuleAccess.deny,
            direction=SecurityRuleDirection.inbound,
            priority=1000,
        )

        rule_result = network_client.security_rules.create_or_update(
            resource_group_name,
            nsg_name,
            rule_name,
            rule_params,
        )
        ```

        Replace `<rule_name>` with a name for your Security Rule.

        7. Apply the Network Security Group to your virtual network:

        ```python theme={null}
        vnet_name = '<vnet_name>'

        vnet_params = network_client.virtual_networks.get(
            resource_group_name,
            vnet_name,
        )

        vnet_params.network_security_group = nsg_result

        vnet_result = network_client.virtual_networks.create_or_update(
            resource_group_name,
            vnet_name,
            vnet_params,
        )
        ```

        Replace `<vnet_name>` with the name of your virtual network.

        That's it! The Network Security Group will now block all inbound traffic on port 80, remedying the unrestricted HTTP access misconfiguration.
      </Accordion>

      <Accordion title="Using Terraform">
        ```hcl theme={null}
        # Existing NSG
        resource "azurerm_network_security_group" "web_nsg" {
          name                = "WEB_NSG"
          location            = azurerm_resource_group.RG.location
          resource_group_name = azurerm_resource_group.RG.name
        }

        # Replace any existing "allow from * to port 80" rule with a restricted one.
        # Ensure there is NO rule here with source_address_prefix = "*" (or "0.0.0.0/0") on port 80.
        resource "azurerm_network_security_rule" "web_http_inbound" {
          name                        = "allow-http-from-trusted"
          priority                    = 100
          direction                   = "Inbound"
          access                      = "Allow"
          protocol                    = "Tcp"
          source_port_range           = "*"
          destination_port_ranges     = ["80"]
          destination_address_prefix  = "*"

          # Replace TRUSTED_CIDR_BLOCK with the specific CIDR(s) that should be allowed,
          # for example "10.0.0.0/16" or your office IP, but NOT "*" or "0.0.0.0/0".
          source_address_prefixes     = ["TRUSTED_CIDR_BLOCK"]

          resource_group_name         = azurerm_resource_group.RG.name
          network_security_group_name = azurerm_network_security_group.web_nsg.name
        }
        ```

        Changing an `azurerm_network_security_rule` like this does not force replacement of the NSG itself; the rule is updated in place, but traffic behavior changes immediately after apply, which may impact existing HTTP clients not in `TRUSTED_CIDR_BLOCK`.

        For verification, `terraform plan` should show the existing port 80 rule either being destroyed and replaced, or updated so that `source_address_prefix`/`source_address_prefixes` is no longer `"*"` or `"0.0.0.0/0"` for inbound TCP on port 80.
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>