lacework-global-551
4.4.1 Ensure 'Enforce SSL connection' is set to 'Enabled' for Standard MySQL Database Server (Automated)
Profile Applicability
• Level 1
Description
Enable SSL connection
on MYSQL
Servers.
Rationale
SSL connectivity helps to provide a new layer of security by connecting database server to client applications using Secure Sockets Layer (SSL). Enforcing SSL connections between database server and client applications helps protect against "man in the middle" attacks by encrypting the data stream between the server and application.
Audit
From Azure Portal
- Login to Azure Portal using https://portal.azure.com
- Go to
Azure Database for MySQL servers
- For each database, click on
Connection security
- In
SSL
settings, ensureEnforce SSL connection
is set toENABLED
.
From Azure CLI
Ensure the output of the below command returns ENABLED.
az mysql server show --resource-group <resourceGroupName> --name <serverName> --query sslEnforcement
Remediation
From Azure Portal
- Login to Azure Portal using https://portal.azure.com
- Go to
Azure Database for MySQL servers
- For each database, click on
Connection security
- In
SSL
settings, click onENABLED
toEnforce SSL connections
From Azure CLI
Use the below command to set MYSQL Databases to Enforce SSL connection.
az mysql server update --resource-group <resourceGroupName> --name <serverName> --ssl-enforcement Enabled
References
https://docs.microsoft.com/en-us/azure/mysql/single-server/concepts-ssl-connection-security
https://docs.microsoft.com/en-us/azure/mysql/single-server/how-to-configure-ssl
https://docs.microsoft.com/en-us/security/benchmark/azure/security-controls-v3-data-protection#dp-3-encrypt-sensitive-data-in-transit