cis-azure-storage-5-1-4

name	cis-azure-storage-5.1.4
description	Ensure 'Use infrastructure encryption for this vault' is enabled on Backup vaults
category	cis-azure-storage
version	1.0.0
author	cyberstrike-official
tags	["cis","azure","storage","backup","backup-vaults","encryption","infrastructure-encryption"]
cis_id	5.1.4
cis_benchmark	CIS Microsoft Azure Storage Services Benchmark v1.0.0
tech_stack	["azure"]
cwe_ids	[]
chains_with	[]
prerequisites	[]
severity_boost	{}

5.1.4 Ensure 'Use infrastructure encryption for this vault' is enabled on Backup vaults (Automated)

Description

In addition to using customer-managed keys for encryption at rest in the Backup vault, you can enable an additional layer of platform-managed infrastructure encryption. This dual-layer approach enhances the protection of your backup data.

Rationale

Enabling infrastructure encryption on a Backup vault adds a second layer of protection to backup data, enhancing security and ensuring compliance for sensitive data storage. This dual-layer strategy reduces the risk of unauthorized access by keeping data encrypted even if one layer is compromised.

Impact

Enabling infrastructure encryption on a backup vault does not incur additional costs; however, infrastructure encryption must be configured when creating the vault and requires customer-managed keys for encryption at rest. This recommendation is linked to Ensure backup data in Backup vaults is encrypted using customer-managed keys (CMK) and should be applied alongside it if you choose to implement this recommendation.

Audit Procedure

Audit from Azure Portal

1. Go to Backup vaults.
2. Click the name of a Backup vault.
3. Under Manage, click Properties.
4. Under Encryption Settings, click Update.
5. Under Infrastructure encryption, ensure the box next to Use infrastructure encryption for this vault is checked.
6. Repeat steps 1-5 for each Backup vault.

Audit from Azure CLI

Run the following command to list Backup vaults:

az dataprotection backup-vault list

For each Backup vault, run the following command:

az dataprotection backup-vault show --resource-group <resource-group> --vault-name <backup-vault>

Ensure that under properties > securitySettings > encryptionSettings, infrastructureEncryption is set to Enabled.

Audit from PowerShell

Run the following command to list Backup vaults:

Get-AzDataProtectionBackupVault

Run the following command to get the Backup vault in a resource group with a given name:

$vault = Get-AzDataProtectionBackupVault -ResourceGroupName <resource-group> -VaultName <backup-vault>