MONARC ISO 27005 Risk Assessment on Ubuntu 24.04 on Azure User Guide

Overview

MONARC (Optimised Risk Analysis Method) is the open source risk assessment and governance, risk and compliance platform built by CASES and the Luxembourg House of Cybersecurity. It implements a repeatable ISO 27005 method whose central idea is capitalisation: rather than starting every analysis from a blank page, MONARC reuses risk models built for comparable contexts, because most organisations run the same kinds of assets and face the same recurring threats.

This cloudimg image ships MONARC v2.14.1 exactly as its authors released it, on Ubuntu 24.04 LTS with Apache 2.4, PHP 8.3 and MariaDB, all from the Ubuntu noble archive. The bundled CASES knowledge base is already loaded, so the platform arrives with 42 asset types, 30 threats and 706 vulnerabilities available for modelling, together with the referentials MONARC ships.

Because a risk register holds sensitive material, this image is hardened for that role. There is no default administrator login: the image contains no application account and no database password at all. A unique administrator password and a unique database password are generated on the first boot of every virtual machine, and Apache will not serve until that has completed. MariaDB listens only on the loopback interface.

What is included:

• MONARC v2.14.1 from the upstream release tarball, installed at /var/lib/monarc/fo
• Apache 2.4 with mod_php, serving /var/lib/monarc/fo/public
• PHP 8.3 with the mysql, zip, gd, mbstring, curl, xml, bcmath, intl and imagick extensions
• MariaDB with the monarc_common (CASES knowledge base) and monarc_cli (your analyses) databases, bound to loopback only
• monarc-firstboot.service, which generates this machine's administrator and database passwords before Apache serves
• A /healthz endpoint that checks PHP and the database, not merely that the web server is listening
• Apache, MariaDB and the first boot service enabled and starting on boot
• 24/7 cloudimg support

cloudimg is not affiliated with CIRCL, CASES Luxembourg or the MONARC project. MONARC is licensed under the GNU Affero General Public License v3.0 and is shipped here unmodified.

Prerequisites

An active Azure subscription, an SSH key, and a VNet with a subnet. Standard_B2s (2 vCPU, 4 GB RAM) is a comfortable size for a small to mid sized risk programme; move to a larger burstable or a D series size if many analysts work concurrently. On the network security group open port 80 (and 443 once you add TLS) and port 22 for SSH, and restrict the source ranges to trusted addresses — a risk register should never be published to the whole internet.

Step 1 to 3: Deploy and connect

Create the VM from the cloudimg MONARC image, choosing your VNet, subnet and network security group, and your SSH public key. The admin username is azureuser.

Once the VM is running, connect over SSH:

ssh azureuser@<your-vm-public-ip>

Step 4: Verify the services

MONARC runs as three units: Apache serving the application, MariaDB holding the data, and the one shot first boot service that provisioned this machine's credentials.

sudo systemctl is-active apache2 mariadb monarc-firstboot.service
curl -s http://127.0.0.1/healthz

Expected output:

active
active
active
ok

/healthz is deliberately not a static file. It executes PHP, reads the configuration written at first boot, and opens a real connection to the database with this machine's own credentials, so ok means the whole stack is genuinely serving rather than merely listening.

Step 5: Retrieve your per instance credentials

The image ships with no MONARC account. On this machine's first boot, a unique administrator password and a unique database password were generated and written to a root only file:

sudo cat /root/monarc-credentials.txt

The file is mode 0600, owned by root, and lists the web address, the administrator sign in, and the database credentials. These values exist only on this virtual machine — they were generated here and are not held by cloudimg.

Step 6: Sign in to MONARC

Browse to http://<your-vm-public-ip>/ and sign in with the username and password from that file.

Change the administrator password after your first sign in, from the user menu at the top right.

Step 7: Create your first risk analysis

MONARC organises work as analyses. From the home screen, choose Create a risk analysis, give it a name, pick a language, and base it on one of the bundled models — the CASES model brings in the full knowledge base of assets, threats and vulnerabilities, while the blank model starts empty.

Open the analysis and build the scope by dragging objects from the Assets library on the left into the analysis tree — a building, a business database, administrator workstations, and so on. MONARC generates the applicable information risks for each asset automatically from its asset–threat–vulnerability links, and lists them under Information risks. Set the impact for each asset, then the threat probability and vulnerability level for each risk, and MONARC computes and colours the resulting risk levels.

Step 8: Work through the ISO 27005 method

The numbered steps across the top of the analysis follow the MONARC method: establishing the context, modelling the assets, assessing and treating the risks, and finally implementing and monitoring the treatment plan. Each step names the deliverable it produces, so the tool doubles as a checklist for the method itself.

Security posture

No default login. MONARC upstream documents an initial account of admin@admin.localhost with the password admin, and upstream's own virtual machine build ships with it live. This image does not. The captured image contains no user row and no database password whatsoever; the account is created on your machine's first boot with a generated password, and the published default is refused.

You can verify that yourself. The upstream default returns no token, while the credentials from your own machine do:

# The credential MONARC upstream publishes
curl -s -X POST http://127.0.0.1/auth -H 'Content-Type: application/json' \
  --data '{"login":"admin@admin.localhost","password":"admin"}'

# The per instance credential generated on this machine
sudo /usr/local/sbin/monarc-cred-roundtrip.sh

Apache will not serve before provisioning. The Apache unit carries a condition on a marker file that the first boot service only creates after it has written this machine's credentials. If provisioning has not completed, the web server does not start at all, so there is no window in which MONARC is reachable without a password.

Only two ports are open. The appliance exposes SSH and HTTP and nothing else. MariaDB is bound to 127.0.0.1 and is reachable only from the machine itself:

sudo ss -tlnp | grep -vE '127\.0\.0\.|\[::1\]'
grep bind-address /etc/mysql/mariadb.conf.d/50-server.cnf

Your analyses start empty. The CASES knowledge base in monarc_common is shipped reference data and is present from the start. The monarc_cli database, which holds client risk analyses, is empty on a new machine: any analysis used while building and testing the image is destroyed before capture.

Database privileges are scoped. The application database user holds privileges only on the two MONARC databases, not globally, and the MariaDB administrative account uses socket authentication, so there is no database root password stored anywhere in the image.

Enabling HTTPS

The image serves plain HTTP so it can come up on a bare IP address with no certificate. For any real deployment, put MONARC behind TLS. Point a DNS name at the VM, then:

sudo a2enmod ssl
sudo apt-get update && sudo apt-get install -y certbot python3-certbot-apache
sudo certbot --apache -d your-domain.example.com

Certbot writes the TLS virtual host and the renewal timer. Once HTTPS is working, remove port 80 from the network security group, or leave it open only for the HTTP to HTTPS redirect certbot installs.

On box database maintenance

Both databases are local. To take a backup:

sudo mysqldump --protocol=socket -uroot --no-tablespaces monarc_cli \
  | gzip > ~/monarc_cli-$(date +%F).sql.gz

monarc_cli holds your analyses and accounts and is the database worth backing up regularly. monarc_common holds the shipped CASES knowledge base and changes only when you import new models.

Optional: the global dashboard Stats Service

MONARC can feed anonymised statistics to a separate Stats Service that powers its global dashboard. That service is a separate application which upstream runs under Docker, and it is not included in this image, which keeps the appliance to a single web stack with no container runtime. The application is configured with a local Stats Service address so the feature is inert; if you want the global dashboard, install the Stats Service from the MONARC project and point statsApi.baseUrl in /var/lib/monarc/fo/config/autoload/local.php at it.

Support

cloudimg provides 24/7 technical support for this image by email at support@cloudimg.co.uk, covering deployment, first boot credentials and configuration of the image itself. Questions about the MONARC application and the risk methodology are best taken to the MONARC project at https://www.monarc.lu.