> ## Documentation Index > Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt > Use this file to discover all available pages before exploring further. # Check for Unrestricted Netbios Access ### More Info: Ensure that no network security groups allow unrestricted inbound access on TCP port 139 and UDP ports 137 and 138 (NetBIOS). ### Risk Level High ### Address Security ### Compliance Standards * APRA CPS 234 (Australia) * BSI C5 (Germany) * Brazil LGPD * CCPA / CPRA (California) * CIS Critical Security Controls v8 * CMMC 2.0 * CSA Cloud Controls Matrix v4 * DPDPA * Digital Operational Resilience Act (EU) * FedRAMP * GDPR * HIPAA * HITRUST CSF * ISO/IEC 27017 * ISO/IEC 27018 * ISO/IEC 27701 * KSA PDPL * MAS Technology Risk Management (Singapore) * MITRE ATT\&CK (Cloud) * NIS2 Directive * NIST * NIST CSF * NIST SP 800-171 * NYDFS 23 NYCRR 500 * PCI * Reserve Bank of India (RBI) Cyber Security Framework * Reserve Bank of India (RBI) Master Direction – Information Technology Framework * SOC2 * SWIFT Customer Security Controls Framework * Sarbanes-Oxley IT General Controls * UK NCSC Cyber Assessment Framework ### Triage and Remediation ### Remediation Here are the step-by-step instructions to remediate the Unrestricted Netbios Access misconfiguration in Azure: 1. Log in to the Azure portal. 2. Go to the "Virtual networks" page. 3. Select the virtual network that you want to remediate. 4. Click on the "Subnets" option in the left-hand menu. 5. Select the subnet that you want to remediate. 6. Click on the "Network security group" option in the left-hand menu. 7. Click on the "Edit" button to edit the network security group associated with the subnet. 8. Click on the "Inbound security rules" option in the left-hand menu. 9. Find the rule that allows unrestricted NetBIOS access. 10. Click on the rule to select it. 11. Click on the "Delete" button to delete the rule. 12. Click on the "Save" button to save the changes. By following these steps, you have successfully remediated the Unrestricted Netbios Access misconfiguration in Azure. # To remediate Unrestricted NetBIOS Access in Azure using Azure CLI, follow the below steps: Step 1: Open Azure CLI and login to your Azure account. Step 2: Run the below command to list all the network security groups in your subscription: ``` az network nsg list ``` Step 3: Identify the NSG that is associated with your virtual machine or subnet that has Unrestricted NetBIOS Access. Step 4: Run the below command to get the details of the NSG: ``` az network nsg show --name --resource-group ``` Step 5: Identify the security rule that allows Unrestricted NetBIOS Access. Step 6: Run the below command to delete the security rule: ``` az network nsg rule delete --name --nsg-name --resource-group ``` Note: Replace ``, `` and `` with the actual values. Step 7: Verify that the security rule is deleted by running the below command: ``` az network nsg show --name --resource-group ``` Step 8: Repeat the above steps for all the NSGs that have Unrestricted NetBIOS Access. By following the above steps, you can remediate Unrestricted NetBIOS Access in Azure using Azure CLI. To remediate Unrestricted Netbios Access in Azure using Python, you can follow the below steps: Step 1: Install the Azure SDK for Python using pip. ``` pip install azure ``` Step 2: Authenticate with Azure using the below code. ```python theme={null} from azure.common.credentials import ServicePrincipalCredentials from azure.mgmt.network import NetworkManagementClient subscription_id = 'your_subscription_id' credentials = ServicePrincipalCredentials( client_id='your_client_id', secret='your_secret', tenant='your_tenant_id' ) network_client = NetworkManagementClient( credentials, subscription_id ) ``` Step 3: Get the Network Security Group (NSG) that has unrestricted Netbios access using the below code. ```python theme={null} nsg_name = 'your_nsg_name' resource_group_name = 'your_resource_group_name' nsg = network_client.network_security_groups.get( resource_group_name, nsg_name ) ``` Step 4: Remove the rule that allows unrestricted Netbios access using the below code. ```python theme={null} rule_name = 'your_rule_name' for rule in nsg.security_rules: if rule.name == rule_name: nsg.security_rules.remove(rule) break poller = network_client.network_security_groups.create_or_update( resource_group_name, nsg_name, nsg ) poller.wait() ``` This code will remove the rule that allows unrestricted Netbios access from the NSG. You can replace the `your_nsg_name`, `your_resource_group_name`, and `your_rule_name` with your own values. ```hcl theme={null} resource "azurerm_network_security_group" "NETBIOS_SECURED_NSG" { name = "NETBIOS_SECURED_NSG" location = azurerm_resource_group.RG.location resource_group_name = azurerm_resource_group.RG.name } # Deny all inbound TCP NetBIOS (port 139) from the Internet resource "azurerm_network_security_rule" "deny_netbios_tcp_139" { name = "deny-netbios-tcp-139" priority = 100 # Must be lower (higher priority) than any existing allow on 139 direction = "Inbound" access = "Deny" protocol = "Tcp" source_port_range = "*" destination_port_range = "139" source_address_prefix = "*" destination_address_prefix = "*" resource_group_name = azurerm_resource_group.RG.name network_security_group_name = azurerm_network_security_group.NETBIOS_SECURED_NSG.name } # Deny all inbound UDP NetBIOS (ports 137–138) from the Internet resource "azurerm_network_security_rule" "deny_netbios_udp_137_138" { name = "deny-netbios-udp-137-138" priority = 110 # Also must be higher priority than any existing allow on these ports direction = "Inbound" access = "Deny" protocol = "Udp" source_port_range = "*" destination_port_ranges = ["137", "138"] source_address_prefix = "*" destination_address_prefix = "*" resource_group_name = azurerm_resource_group.RG.name network_security_group_name = azurerm_network_security_group.NETBIOS_SECURED_NSG.name } ``` Substitute: * `azurerm_resource_group.RG` with your actual resource group resource or `resource_group_name = "YOUR_RESOURCE_GROUP_NAME"` and `location = "YOUR_REGION"`. * `azurerm_network_security_group.NETBIOS_SECURED_NSG` with your existing NSG if you already manage it in Terraform; in that case, remove the NSG resource above and reference the existing one. This change is in-place for the NSG and does not force replacement of the NSG, but any conflicting existing “Allow” rules with a higher priority (lower number) on ports 137–139 must be removed or adjusted separately in Terraform. For verification, `terraform plan` should show the creation of the new `azurerm_network_security_rule.deny_netbios_tcp_139` and `azurerm_network_security_rule.deny_netbios_udp_137_138` resources (or updates to existing rules if you changed them), with `access = "Deny"` on the specified ports.