Add enterprise network and perimeter security controls

CHANGELOG.md

@@ -1,5 +1,9 @@
 # Changelog
 
+## Unreleased
+
+- Add all ten evidence-rich enterprise network and perimeter controls `AZ-NET-018` through `AZ-NET-027` for issue #253, preserving API failures and incomplete data as indeterminate.
+
 All notable changes to OpenShield are documented in this file.
 
 The format follows [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).

api/services/network_layer_assurance.py

@@ -20,7 +20,7 @@
 EXPECTED_DOMAIN_IDS = {f"NL-{number:02d}" for number in range(1, 21)}
 EXPECTED_SUBDOMAIN_IDS = {"ADDRESSING", "ROUTING", "TRANSIT", "PROTECTION", "OBSERVABILITY"}
 EXPECTED_CONTROL_IDS = {f"NL-C{number:02d}" for number in range(1, 21)}
-EXPECTED_RULE_IDS = {f"AZ-NET-{number:03d}" for number in range(1, 18)} | {"AZ-DL-001", "AZ-DL-002"}
+EXPECTED_RULE_IDS = {f"AZ-NET-{number:03d}" for number in range(1, 28)} | {"AZ-DL-001", "AZ-DL-002"}
 ALLOWED_RESPONSIBILITIES = {"Microsoft", "Customer", "Shared"}
 ALLOWED_APPLICABILITY = {"APPLICABLE", "NOT_APPLICABLE", "UNSUPPORTED"}
 ALLOWED_VERIFICATION = {
@@ -66,7 +66,7 @@ def validate_catalog(catalog: dict[str, Any]) -> None:
         raise CatalogValidationError("controls must contain the complete NL-C01 through NL-C20 set")
     if set(rules) != EXPECTED_RULE_IDS:
         raise CatalogValidationError(
-            "rule_classifications must contain AZ-NET-001 through AZ-NET-017 and both MACsec rules"
+            "rule_classifications must contain AZ-NET-001 through AZ-NET-027 and both MACsec rules"
         )
 
     for evidence_id, source in evidence.items():

compliance/assurance/network_layer.json

@@ -245,7 +245,10 @@
         "AZ-NET-006",
         "AZ-NET-010",
         "AZ-NET-013",
-        "AZ-NET-017"
+        "AZ-NET-017",
+        "AZ-NET-018",
+        "AZ-NET-019",
+        "AZ-NET-022"
       ]
     },
     {
@@ -429,7 +432,11 @@
         "AZ-NET-013",
         "AZ-NET-014",
         "AZ-NET-016",
-        "AZ-NET-017"
+        "AZ-NET-017",
+        "AZ-NET-018",
+        "AZ-NET-019",
+        "AZ-NET-022",
+        "AZ-NET-023"
       ]
     },
     {
@@ -936,6 +943,89 @@
         "NL-10",
         "NL-19"
       ]
+    },
+    {
+      "id": "AZ-NET-018",
+      "name": "Private Endpoint target retaining public access",
+      "osi_classification": "Layer 3",
+      "classification_basis": "The control evaluates whether a PaaS resource retains a public IP network path alongside its private endpoint path.",
+      "layer_3_domain_ids": [
+        "NL-09",
+        "NL-10",
+        "NL-19"
+      ]
+    },
+    {
+      "id": "AZ-NET-019",
+      "name": "Private Endpoint connection not approved",
+      "osi_classification": "Layer 3",
+      "classification_basis": "Private Endpoint connection state determines whether the target has an operational private IP network path.",
+      "layer_3_domain_ids": [
+        "NL-01",
+        "NL-09",
+        "NL-19"
+      ]
+    },
+    {
+      "id": "AZ-NET-020",
+      "name": "Private Endpoint missing Private DNS zone association",
+      "osi_classification": "Layer 7",
+      "classification_basis": "The finding evaluates DNS naming configuration even though the resulting record identifies a private IP address.",
+      "layer_3_domain_ids": []
+    },
+    {
+      "id": "AZ-NET-021",
+      "name": "Private Endpoint DNS configuration reports only public addresses",
+      "osi_classification": "Layer 7",
+      "classification_basis": "DNS is an application-layer naming protocol; this rule evaluates ARM custom DNS configuration and does not claim effective resolver-path evidence.",
+      "layer_3_domain_ids": []
+    },
+    {
+      "id": "AZ-NET-022",
+      "name": "Critical PaaS resource publicly accessible without exception",
+      "osi_classification": "Layer 3",
+      "classification_basis": "The control evaluates whether a critical service retains an unapproved public IP network path.",
+      "layer_3_domain_ids": [
+        "NL-10",
+        "NL-19"
+      ]
+    },
+    {
+      "id": "AZ-NET-023",
+      "name": "Azure Firewall threat intelligence not enforcing deny",
+      "osi_classification": "Cross-layer",
+      "classification_basis": "Azure Firewall threat intelligence enforces the perimeter across IP addresses, domains, and URLs.",
+      "layer_3_domain_ids": [
+        "NL-19"
+      ]
+    },
+    {
+      "id": "AZ-NET-024",
+      "name": "Application Gateway WAF not in Prevention mode",
+      "osi_classification": "Layer 7",
+      "classification_basis": "Application Gateway WAF Prevention mode evaluates and blocks HTTP application requests.",
+      "layer_3_domain_ids": []
+    },
+    {
+      "id": "AZ-NET-025",
+      "name": "Application Gateway WAF diagnostic logging incomplete",
+      "osi_classification": "Layer 7",
+      "classification_basis": "The control evaluates the diagnostic log categories supported by the Application Gateway SKU; v2 performance telemetry is metric-based.",
+      "layer_3_domain_ids": []
+    },
+    {
+      "id": "AZ-NET-026",
+      "name": "WAF missing current managed rules or bot protection",
+      "osi_classification": "Layer 7",
+      "classification_basis": "Managed WAF rules inspect HTTP application requests and bot behavior.",
+      "layer_3_domain_ids": []
+    },
+    {
+      "id": "AZ-NET-027",
+      "name": "Public Application Gateway missing rate limiting",
+      "osi_classification": "Layer 7",
+      "classification_basis": "WAF RateLimitRule evaluates HTTP request volume and application-layer match conditions.",
+      "layer_3_domain_ids": []
     }
   ],
   "evidence_sources": [

compliance/frameworks/cis_azure_benchmark.json

@@ -373,6 +373,56 @@
       "control_name": "Direct Internet default route review (no direct CIS Azure Foundations 2.0.0 control)",
       "description": "Azure exposes and documents user-defined Internet next hops, but CIS Azure Foundations 2.0.0 does not assign this route check a direct recommendation number."
     },
+    "AZ-NET-018": {
+      "control_id": "N/A-NET-018",
+      "control_name": "Private Endpoint public access baseline (no direct CIS Azure Foundations 2.0.0 control)",
+      "description": "Private connectivity should replace unnecessary public PaaS exposure; CIS Azure Foundations 2.0.0 has no universal control covering every supported Private Link target."
+    },
+    "AZ-NET-019": {
+      "control_id": "N/A-NET-019",
+      "control_name": "Private Endpoint connection approval baseline (no direct CIS Azure Foundations 2.0.0 control)",
+      "description": "Private Endpoint connections must be approved to provide the intended private path; no universal CIS Azure Foundations 2.0.0 recommendation covers this state."
+    },
+    "AZ-NET-020": {
+      "control_id": "N/A-NET-020",
+      "control_name": "Private Endpoint DNS association baseline (no direct CIS Azure Foundations 2.0.0 control)",
+      "description": "Private Endpoints require service-appropriate private DNS integration; CIS Azure Foundations 2.0.0 has no universal recommendation for this association."
+    },
+    "AZ-NET-021": {
+      "control_id": "N/A-NET-021",
+      "control_name": "Private Endpoint custom DNS configuration baseline (no direct CIS Azure Foundations 2.0.0 control)",
+      "description": "Private Endpoint custom DNS configuration should associate service names with private addresses. This is ARM configuration evidence, not an effective-resolution probe; CIS Azure Foundations 2.0.0 has no universal recommendation for it."
+    },
+    "AZ-NET-022": {
+      "control_id": "N/A-NET-022",
+      "control_name": "Critical PaaS public exposure baseline (no universal CIS Azure Foundations 2.0.0 control)",
+      "description": "Critical PaaS resources should use private access or an approved exception; CIS Azure Foundations 2.0.0 provides service-specific rather than universal coverage."
+    },
+    "AZ-NET-023": {
+      "control_id": "N/A-NET-023",
+      "control_name": "Azure Firewall threat intelligence enforcement baseline (no direct CIS Azure Foundations 2.0.0 control)",
+      "description": "Deny mode blocks traffic involving known malicious addresses and domains; CIS Azure Foundations 2.0.0 has no direct recommendation for this mode."
+    },
+    "AZ-NET-024": {
+      "control_id": "N/A-NET-024",
+      "control_name": "Application Gateway WAF Prevention mode baseline (no direct CIS Azure Foundations 2.0.0 control)",
+      "description": "Prevention mode blocks matching application attacks; CIS Azure Foundations 2.0.0 has no direct recommendation for the gateway mode."
+    },
+    "AZ-NET-025": {
+      "control_id": "N/A-NET-025",
+      "control_name": "Application Gateway WAF diagnostic logging baseline (no direct CIS Azure Foundations 2.0.0 control)",
+      "description": "SKU-supported Application Gateway diagnostic logs support perimeter monitoring. Performance logging is required on v1; v2 exposes performance telemetry through metrics. CIS Azure Foundations 2.0.0 has no direct universal recommendation for these categories."
+    },
+    "AZ-NET-026": {
+      "control_id": "N/A-NET-026",
+      "control_name": "Current WAF managed rules and bot protection baseline (no direct CIS Azure Foundations 2.0.0 control)",
+      "description": "Current base and bot managed rule sets protect the application perimeter; CIS Azure Foundations 2.0.0 has no direct rule-set-version recommendation."
+    },
+    "AZ-NET-027": {
+      "control_id": "N/A-NET-027",
+      "control_name": "Internet-facing application rate limiting baseline (no direct CIS Azure Foundations 2.0.0 control)",
+      "description": "Rate limiting protects public applications from abusive request volume; CIS Azure Foundations 2.0.0 has no direct Application Gateway rate-rule recommendation."
+    },
     "AZ-SECOPS-001": {
       "control_id": "5.1.1",
       "control_name": "Ensure that a 'Diagnostic Setting' exists",
@@ -422,6 +472,56 @@
       "control_id": "2.1.20",
       "control_name": "Ensure That 'Notify about alerts with the following severity' is Set to 'High'",
       "description": "No enabled Azure Monitor action group with a notification receiver exists, and no Sentinel automation rule routes incidents onward. CIS 2.1.20 requires Defender security alerts to notify a monitored destination; this rule generalizes that requirement to the concrete Azure notification primitive (action groups) and the Sentinel-native incident routing mechanism (automation rules)."
+    },
+    "AZ-NET-018": {
+      "control_id": "N/A-NET-018",
+      "control_name": "Private Endpoint public access baseline (no direct CIS Azure Foundations 2.0.0 control)",
+      "description": "Private connectivity should replace unnecessary public PaaS exposure; CIS Azure Foundations 2.0.0 has no universal control covering every supported Private Link target."
+    },
+    "AZ-NET-019": {
+      "control_id": "N/A-NET-019",
+      "control_name": "Private Endpoint connection approval baseline (no direct CIS Azure Foundations 2.0.0 control)",
+      "description": "Private Endpoint connections must be approved to provide the intended private path; no universal CIS Azure Foundations 2.0.0 recommendation covers this state."
+    },
+    "AZ-NET-020": {
+      "control_id": "N/A-NET-020",
+      "control_name": "Private Endpoint DNS association baseline (no direct CIS Azure Foundations 2.0.0 control)",
+      "description": "Private Endpoints require service-appropriate private DNS integration; CIS Azure Foundations 2.0.0 has no universal recommendation for this association."
+    },
+    "AZ-NET-021": {
+      "control_id": "N/A-NET-021",
+      "control_name": "Private Endpoint FQDN resolution baseline (no direct CIS Azure Foundations 2.0.0 control)",
+      "description": "Private Endpoint names should resolve to private addresses; CIS Azure Foundations 2.0.0 has no universal recommendation for this resolution evidence."
+    },
+    "AZ-NET-022": {
+      "control_id": "N/A-NET-022",
+      "control_name": "Critical PaaS public exposure baseline (no universal CIS Azure Foundations 2.0.0 control)",
+      "description": "Critical PaaS resources should use private access or an approved exception; CIS Azure Foundations 2.0.0 provides service-specific rather than universal coverage."
+    },
+    "AZ-NET-023": {
+      "control_id": "N/A-NET-023",
+      "control_name": "Azure Firewall threat intelligence enforcement baseline (no direct CIS Azure Foundations 2.0.0 control)",
+      "description": "AlertAndDeny blocks traffic involving known malicious addresses and domains; CIS Azure Foundations 2.0.0 has no direct recommendation for this mode."
+    },
+    "AZ-NET-024": {
+      "control_id": "N/A-NET-024",
+      "control_name": "Application Gateway WAF Prevention mode baseline (no direct CIS Azure Foundations 2.0.0 control)",
+      "description": "Prevention mode blocks matching application attacks; CIS Azure Foundations 2.0.0 has no direct recommendation for the gateway mode."
+    },
+    "AZ-NET-025": {
+      "control_id": "N/A-NET-025",
+      "control_name": "Application Gateway WAF diagnostic logging baseline (no direct CIS Azure Foundations 2.0.0 control)",
+      "description": "Access, performance, and firewall logs support perimeter monitoring; CIS Azure Foundations 2.0.0 has no direct universal recommendation for all categories."
+    },
+    "AZ-NET-026": {
+      "control_id": "N/A-NET-026",
+      "control_name": "Current WAF managed rules and bot protection baseline (no direct CIS Azure Foundations 2.0.0 control)",
+      "description": "Current base and bot managed rule sets protect the application perimeter; CIS Azure Foundations 2.0.0 has no direct rule-set-version recommendation."
+    },
+    "AZ-NET-027": {
+      "control_id": "N/A-NET-027",
+      "control_name": "Internet-facing application rate limiting baseline (no direct CIS Azure Foundations 2.0.0 control)",
+      "description": "Rate limiting protects public applications from abusive request volume; CIS Azure Foundations 2.0.0 has no direct Application Gateway rate-rule recommendation."
     }
   }
 }

compliance/frameworks/iso27001.json

@@ -433,6 +433,56 @@
       "control_name": "Network controls",
       "description": "Default routes must preserve the approved controlled egress boundary."
     },
+    "AZ-NET-018": {
+      "control_id": "A.13.1.1",
+      "control_name": "Network controls",
+      "description": "PaaS resources using Private Link should not retain unnecessary public network exposure."
+    },
+    "AZ-NET-019": {
+      "control_id": "A.13.1.1",
+      "control_name": "Network controls",
+      "description": "Private Endpoint connections must be approved and operational."
+    },
+    "AZ-NET-020": {
+      "control_id": "A.13.1.1",
+      "control_name": "Network controls",
+      "description": "Private Endpoints require an associated service-appropriate Private DNS zone."
+    },
+    "AZ-NET-021": {
+      "control_id": "A.13.1.1",
+      "control_name": "Network controls",
+      "description": "Private Endpoint ARM DNS configuration must associate service names with private addresses; effective resolver-path validation remains separate evidence."
+    },
+    "AZ-NET-022": {
+      "control_id": "A.13.1.1",
+      "control_name": "Network controls",
+      "description": "Critical PaaS resources restrict public exposure unless an approved exception exists."
+    },
+    "AZ-NET-023": {
+      "control_id": "A.13.1.1",
+      "control_name": "Network controls",
+      "description": "Azure Firewall denies traffic identified by Microsoft threat intelligence."
+    },
+    "AZ-NET-024": {
+      "control_id": "A.13.1.1",
+      "control_name": "Network controls",
+      "description": "Application Gateway WAF operates in Prevention mode at the application boundary."
+    },
+    "AZ-NET-025": {
+      "control_id": "A.12.4.1",
+      "control_name": "Event logging",
+      "description": "Application Gateway WAF diagnostic categories supported by its SKU are exported to an approved monitoring destination."
+    },
+    "AZ-NET-026": {
+      "control_id": "A.14.2.5",
+      "control_name": "Secure system engineering principles",
+      "description": "Current managed application and bot rules are maintained at the web perimeter."
+    },
+    "AZ-NET-027": {
+      "control_id": "A.13.1.1",
+      "control_name": "Network controls",
+      "description": "Rate limiting protects internet-facing application entry points."
+    },
     "AZ-SECOPS-001": {
       "control_id": "A.12.4.1",
       "control_name": "Event logging",
@@ -482,6 +532,56 @@
       "control_id": "A.16.1.2",
       "control_name": "Reporting information security events",
       "description": "No monitored destination exists for security alerts or Sentinel incidents. A.16.1.2 requires information security events to be reported through appropriate management channels as quickly as possible; an alert with no notified recipient cannot be reported or acted on."
+    },
+    "AZ-NET-018": {
+      "control_id": "A.13.1.1",
+      "control_name": "Network controls",
+      "description": "PaaS resources using Private Link should not retain unnecessary public network exposure."
+    },
+    "AZ-NET-019": {
+      "control_id": "A.13.1.1",
+      "control_name": "Network controls",
+      "description": "Private Endpoint connections must be approved and operational."
+    },
+    "AZ-NET-020": {
+      "control_id": "A.13.1.1",
+      "control_name": "Network controls",
+      "description": "Private Endpoints require an associated service-appropriate Private DNS zone."
+    },
+    "AZ-NET-021": {
+      "control_id": "A.13.1.1",
+      "control_name": "Network controls",
+      "description": "Private Endpoint FQDNs must resolve to private addresses through the controlled network path."
+    },
+    "AZ-NET-022": {
+      "control_id": "A.13.1.1",
+      "control_name": "Network controls",
+      "description": "Critical PaaS resources restrict public exposure unless an approved exception exists."
+    },
+    "AZ-NET-023": {
+      "control_id": "A.13.1.1",
+      "control_name": "Network controls",
+      "description": "Azure Firewall denies traffic identified by Microsoft threat intelligence."
+    },
+    "AZ-NET-024": {
+      "control_id": "A.13.1.1",
+      "control_name": "Network controls",
+      "description": "Application Gateway WAF operates in Prevention mode at the application boundary."
+    },
+    "AZ-NET-025": {
+      "control_id": "A.12.4.1",
+      "control_name": "Event logging",
+      "description": "Application Gateway WAF diagnostic categories are exported to an approved monitoring destination."
+    },
+    "AZ-NET-026": {
+      "control_id": "A.14.2.5",
+      "control_name": "Secure system engineering principles",
+      "description": "Current managed application and bot rules are maintained at the web perimeter."
+    },
+    "AZ-NET-027": {
+      "control_id": "A.13.1.1",
+      "control_name": "Network controls",
+      "description": "Rate limiting protects internet-facing application entry points."
     }
   }
 }