services / Azure / Network security group

A Network Security Group (NSG) is a stateful packet filter that contains ordered allow/deny rules applied to the network interfaces and subnets it is associated with, controlling inbound and outbound traffic for the resources behind it.

An NSG is a perimeter/segmentation control, not a data store itself, but it gates network access to every resource attached to it; misconfiguring one can expose or cut off an entire subnet's worth of workloads, so scope is rated on par with other perimeter-control assets in this provider (traffic-mirroring taps, traffic routing profiles) rather than CRITICAL, which is reserved for tenant-wide IAM/policy objects.

Microsoft.​Network/​networkSecurityGroups/​delete

Deleting an NSG removes all its filter rules at once, stripping the associated interfaces/subnets of their access controls (opening them up) or breaking connectivity that depended on an allow rule (denial of service).

Risks

1. Policy destruction (CRITICAL)
2. Denial-of-service (HIGH)

Scope: HIGH

This privilege may grant access to sensitive data from a single organizational function, or allow interruption of a service supporting a single organizational function.

Links