Check for Unrestricted Netbios Access

More Info:

Ensure that no network security groups allow unrestricted inbound access on TCP port 139 and UDP ports 137 and 138 (NetBIOS).

Risk Level

High

Address

Security

Compliance Standards

• APRA CPS 234 (Australia)
• BSI C5 (Germany)
• Brazil LGPD
• CCPA / CPRA (California)
• CIS Critical Security Controls v8
• CMMC 2.0
• CSA Cloud Controls Matrix v4
• DPDPA
• Digital Operational Resilience Act (EU)
• FedRAMP
• GDPR
• HIPAA
• HITRUST CSF
• ISO/IEC 27017
• ISO/IEC 27018
• ISO/IEC 27701
• KSA PDPL
• MAS Technology Risk Management (Singapore)
• MITRE ATT&CK (Cloud)
• NIS2 Directive
• NIST
• NIST CSF
• NIST SP 800-171
• NYDFS 23 NYCRR 500
• PCI
• Reserve Bank of India (RBI) Cyber Security Framework
• Reserve Bank of India (RBI) Master Direction – Information Technology Framework
• SOC2
• SWIFT Customer Security Controls Framework
• Sarbanes-Oxley IT General Controls
• UK NCSC Cyber Assessment Framework

Triage and Remediation

Remediation

Remediation

Using Console

Here are the step-by-step instructions to remediate the Unrestricted Netbios Access misconfiguration in Azure:

1. Log in to the Azure portal.
2. Go to the “Virtual networks” page.
3. Select the virtual network that you want to remediate.
4. Click on the “Subnets” option in the left-hand menu.
5. Select the subnet that you want to remediate.
6. Click on the “Network security group” option in the left-hand menu.
7. Click on the “Edit” button to edit the network security group associated with the subnet.
8. Click on the “Inbound security rules” option in the left-hand menu.
9. Find the rule that allows unrestricted NetBIOS access.
10. Click on the rule to select it.
11. Click on the “Delete” button to delete the rule.
12. Click on the “Save” button to save the changes.

By following these steps, you have successfully remediated the Unrestricted Netbios Access misconfiguration in Azure.

Using CLI

To remediate Unrestricted NetBIOS Access in Azure using Azure CLI, follow the below steps:

Step 1: Open Azure CLI and login to your Azure account.

Step 2: Run the below command to list all the network security groups in your subscription:

az network nsg list

Step 3: Identify the NSG that is associated with your virtual machine or subnet that has Unrestricted NetBIOS Access.

Step 4: Run the below command to get the details of the NSG:

az network nsg show --name <nsg-name> --resource-group <resource-group-name>

Step 5: Identify the security rule that allows Unrestricted NetBIOS Access.

Step 6: Run the below command to delete the security rule:

az network nsg rule delete --name <rule-name> --nsg-name <nsg-name> --resource-group <resource-group-name>

Note: Replace <rule-name>, <nsg-name> and <resource-group-name> with the actual values.

Step 7: Verify that the security rule is deleted by running the below command:

az network nsg show --name <nsg-name> --resource-group <resource-group-name>

Step 8: Repeat the above steps for all the NSGs that have Unrestricted NetBIOS Access.

By following the above steps, you can remediate Unrestricted NetBIOS Access in Azure using Azure CLI.

Using Python

To remediate Unrestricted Netbios Access in Azure using Python, you can follow the below steps:

Step 1: Install the Azure SDK for Python using pip.

pip install azure

Step 2: Authenticate with Azure using the below code.

from azure.common.credentials import ServicePrincipalCredentials
from azure.mgmt.network import NetworkManagementClient

subscription_id = 'your_subscription_id'
credentials = ServicePrincipalCredentials(
    client_id='your_client_id',
    secret='your_secret',
    tenant='your_tenant_id'
)

network_client = NetworkManagementClient(
    credentials,
    subscription_id
)

Step 3: Get the Network Security Group (NSG) that has unrestricted Netbios access using the below code.

nsg_name = 'your_nsg_name'
resource_group_name = 'your_resource_group_name'

nsg = network_client.network_security_groups.get(
    resource_group_name,
    nsg_name
)

Step 4: Remove the rule that allows unrestricted Netbios access using the below code.

rule_name = 'your_rule_name'

for rule in nsg.security_rules:
    if rule.name == rule_name:
        nsg.security_rules.remove(rule)
        break

poller = network_client.network_security_groups.create_or_update(
    resource_group_name,
    nsg_name,
    nsg
)
poller.wait()

This code will remove the rule that allows unrestricted Netbios access from the NSG. You can replace the your_nsg_name, your_resource_group_name, and your_rule_name with your own values.

Using Terraform

resource "azurerm_network_security_group" "NETBIOS_SECURED_NSG" {
  name                = "NETBIOS_SECURED_NSG"
  location            = azurerm_resource_group.RG.location
  resource_group_name = azurerm_resource_group.RG.name
}

# Deny all inbound TCP NetBIOS (port 139) from the Internet
resource "azurerm_network_security_rule" "deny_netbios_tcp_139" {
  name                        = "deny-netbios-tcp-139"
  priority                    = 100                       # Must be lower (higher priority) than any existing allow on 139
  direction                   = "Inbound"
  access                      = "Deny"
  protocol                    = "Tcp"
  source_port_range           = "*"
  destination_port_range      = "139"
  source_address_prefix       = "*"
  destination_address_prefix  = "*"
  resource_group_name         = azurerm_resource_group.RG.name
  network_security_group_name = azurerm_network_security_group.NETBIOS_SECURED_NSG.name
}

# Deny all inbound UDP NetBIOS (ports 137–138) from the Internet
resource "azurerm_network_security_rule" "deny_netbios_udp_137_138" {
  name                        = "deny-netbios-udp-137-138"
  priority                    = 110                       # Also must be higher priority than any existing allow on these ports
  direction                   = "Inbound"
  access                      = "Deny"
  protocol                    = "Udp"
  source_port_range           = "*"
  destination_port_ranges     = ["137", "138"]
  source_address_prefix       = "*"
  destination_address_prefix  = "*"
  resource_group_name         = azurerm_resource_group.RG.name
  network_security_group_name = azurerm_network_security_group.NETBIOS_SECURED_NSG.name
}

Substitute:

• azurerm_resource_group.RG with your actual resource group resource or resource_group_name = "YOUR_RESOURCE_GROUP_NAME" and location = "YOUR_REGION".
• azurerm_network_security_group.NETBIOS_SECURED_NSG with your existing NSG if you already manage it in Terraform; in that case, remove the NSG resource above and reference the existing one.

This change is in-place for the NSG and does not force replacement of the NSG, but any conflicting existing “Allow” rules with a higher priority (lower number) on ports 137–139 must be removed or adjusted separately in Terraform.

For verification, terraform plan should show the creation of the new azurerm_network_security_rule.deny_netbios_tcp_139 and azurerm_network_security_rule.deny_netbios_udp_137_138 resources (or updates to existing rules if you changed them), with access = "Deny" on the specified ports.