services / Azure / Network security group

A Network Security Group (NSG) is a stateful packet filter that contains ordered allow/deny rules applied to the network interfaces and subnets it is associated with, controlling inbound and outbound traffic for the resources behind it.

An NSG is a perimeter/segmentation control, not a data store itself, but it gates network access to every resource attached to it; misconfiguring one can expose or cut off an entire subnet's worth of workloads, so scope is rated on par with other perimeter-control assets in this provider (traffic-mirroring taps, traffic routing profiles) rather than CRITICAL, which is reserved for tenant-wide IAM/policy objects.

Microsoft.​Network/​networkSecurityGroups/​write

Creating or updating an NSG's rule set lets an attacker open ingress/egress to internal resources that were previously firewalled off, or close rules to disrupt legitimate traffic; opening access to attacker-reachable resources also enables lateral/network escalation into the segment the NSG protects.

Risks

1. Policy destruction (CRITICAL)
2. Network movement (BOOST)

Scope: HIGH

This privilege may grant access to sensitive data from a single organizational function, or allow interruption of a service supporting a single organizational function.

Links