| name | cis-azure-foundations-9.1.3 |
| description | Ensure 'SMB channel encryption' is set to 'AES-256-GCM' or higher for SMB file shares |
| category | cis-azure-foundations |
| version | 5.0.0 |
| author | cyberstrike-official |
| tags | ["cis","azure","azure-files","storage","smb","channel-encryption","aes-256"] |
| cis_id | 9.1.3 |
| cis_benchmark | CIS Microsoft Azure Foundations Benchmark v5.0.0 |
| tech_stack | ["azure"] |
| cwe_ids | [] |
| chains_with | [] |
| prerequisites | [] |
| severity_boost | {} |
Ensure 'SMB channel encryption' is set to 'AES-256-GCM' or higher for SMB file shares
Description
Implement SMB channel encryption with AES-256-GCM for SMB file shares to ensure data confidentiality and integrity in transit. This method offers strong protection against eavesdropping and man-in-the-middle attacks, safeguarding sensitive information.
Rationale
AES-256-GCM encryption enhances the security of data transmitted over SMB channels by safeguarding it from unauthorized interception and tampering.
Impact
Using the AES-256-GCM SMB channel encryption may impact client compatibility.
Audit Procedure
Audit from Azure Portal
- Go to
Storage accounts.
- Click the name of a storage account.
- Under
Data storage, click File shares.
- Under
File share settings, click the link next to Security.
- Under
SMB channel encryption, ensure that AES-256-GCM, or higher, is the only checked SMB channel encryption setting.
- Repeat steps 1-5 for each storage account.
Audit from Azure CLI
Run the following command to list storage accounts:
az storage account list
For each storage account, run the following command:
az storage account file-service-properties show --resource-group <resource-group> --account-name <storage-account>
Ensure that under protocolSettings > smb, channelEncryption is set to AES-256-GCM;, or higher, only.
Audit from PowerShell
Run the following command to list storage accounts:
Get-AzStorageAccount
Run the following command to get the file service properties for a storage account in a resource group with a given name:
$storageaccountfileservice = Get-AzStorageFileServiceProperty -ResourceGroupName <resource-group> -AccountName <storage-account>
Run the following command to get the SMB channel encryption setting:
$storageaccountfileservice.ProtocolSettings.Smb.ChannelEncryption
Ensure that the command returns AES-256-GCM, or higher, only.
Expected Result
