Ensure that your Azure MySQL flexible database servers are using the latest version of TLS encryption protocol (i.e. TLS version 1.2 or TLS version 1.3) in order to secure the connection between your MySQL database servers and their clients/applications.
This rule resolution is part of the Conformity Security & Compliance tool for Azure.
When working with production data, it is strongly recommended to enable in-transit encryption by enforcing Transport Layer Security (TLS) connections between MySQL database servers and database applications. However, using an outdated version of the TLS protocol such as TLS version 1.0, known to be susceptible to certain Common Vulnerabilities and Exposures (CVE) weaknesses, can expose your database to different types of attacks. To protect your data against cyber attacks such as Man-In-the-Middle (MITM) attacks and fulfill compliance requirements for in-transit encryption within your organization, ensure that the 'tls_version' parameter is set to 'TLSV1.2' or 'TLSV1.3' for all your MySQL flexible database servers.
Audit
To determine the TLS version configured for your Azure MySQL flexible database servers, perform the following operations:
Remediation / Resolution
To update the "tls_version" parameter value for your MySQL flexible database servers in order to enable the latest version of the TLS protocol (i.e. TLS 1.2 or TLS 1.3), perform the following operations:
References
- Azure Official Documentation
- SSL/TLS connectivity in Azure Database for MySQL
- Configure SSL connectivity in your application to securely connect to Azure Database for MySQL
- Security Control V2: Data Protection
- CIS Security Documentation
- Securing Microsoft Azure
- Azure Command Line Interface (CLI) Documentation
- az mysql flexible-server list
- az mysql flexible-server parameter show
- az mysql flexible-server parameter set
Unlock the Remediation Steps
Free 30-day Trial
Automatically audit your configurations with Conformity
and gain access to our cloud security platform.
You are auditing:
Configure TLS Version for MySQL Flexible Database Servers
Risk Level: Medium