用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
直接命令不会经过审查 Prompt；运行前请先检查来源。
npx skills add https://github.com/CyberStrikeus/CyberStrike --skill cis-azure-storage-5-1-4命令会保持在同一行。复制前请横向滚动并检查完整内容。
想先保存到本地？可下载 SkillsMP 当前能够提供的文件。
正在显示 SKILL.md
macOS post-exploitation for credential harvesting, DTrace monitoring, TCC bypass, and stealth operations via native tools
Windows userland post-exploitation for credential harvesting, monitoring, AMSI/ETW bypass, and stealth operations
Kubernetes post-exploitation for container escape, secret extraction, RBAC abuse, and cluster persistence
基于 SOC 职业分类
| name | cis-azure-storage-5.1.4 |
| description | Ensure 'Use infrastructure encryption for this vault' is enabled on Backup vaults |
| category | cis-azure-storage |
| version | 1.0.0 |
| author | cyberstrike-official |
| tags | ["cis","azure","storage","backup","backup-vaults","encryption","infrastructure-encryption"] |
| cis_id | 5.1.4 |
| cis_benchmark | CIS Microsoft Azure Storage Services Benchmark v1.0.0 |
| tech_stack | ["azure"] |
| cwe_ids | [] |
| chains_with | [] |
| prerequisites | [] |
| severity_boost | {} |
In addition to using customer-managed keys for encryption at rest in the Backup vault, you can enable an additional layer of platform-managed infrastructure encryption. This dual-layer approach enhances the protection of your backup data.
Enabling infrastructure encryption on a Backup vault adds a second layer of protection to backup data, enhancing security and ensuring compliance for sensitive data storage. This dual-layer strategy reduces the risk of unauthorized access by keeping data encrypted even if one layer is compromised.
Enabling infrastructure encryption on a backup vault does not incur additional costs; however, infrastructure encryption must be configured when creating the vault and requires customer-managed keys for encryption at rest. This recommendation is linked to Ensure backup data in Backup vaults is encrypted using customer-managed keys (CMK) and should be applied alongside it if you choose to implement this recommendation.
Backup vaults.Manage, click Properties.Encryption Settings, click Update.Infrastructure encryption, ensure the box next to Use infrastructure encryption for this vault is checked.Run the following command to list Backup vaults:
az dataprotection backup-vault list
For each Backup vault, run the following command:
az dataprotection backup-vault show --resource-group <resource-group> --vault-name <backup-vault>
Ensure that under properties > securitySettings > encryptionSettings, infrastructureEncryption is set to Enabled.
Run the following command to list Backup vaults:
Get-AzDataProtectionBackupVault
Run the following command to get the Backup vault in a resource group with a given name:
$vault = Get-AzDataProtectionBackupVault -ResourceGroupName <resource-group> -VaultName <backup-vault>
Run the following command to get the infrastructure encryption setting for the Backup vault:
$vault.EncryptionSetting.CmkInfrastructureEncryption
Ensure that the command returns Enabled.
Repeat for each Backup vault.
If referencing a digital copy of this Benchmark, clicking a Policy ID will open a link to the associated Policy definition in Azure. If referencing a printed copy, you can search Policy IDs from this URL: https://portal.azure.com/#view/Microsoft_Azure_Policy/PolicyMenuBlade/~/Definitions
d6588149-9f06-462c-a076-56aece45b5baInfrastructure encryption should be checked/enabled in the Azure Portal, or properties.securitySettings.encryptionSettings.infrastructureEncryption should be Enabled in CLI output, or $vault.EncryptionSetting.CmkInfrastructureEncryption should return Enabled in PowerShell.
Run the following command to create a locally redundant Backup vault with a customer-managed encryption key and infrastructure encryption enabled:
az dataprotection backup-vault create --resource-group <resource-group> --vault-name <backup-vault> --location <location> --storage-setting "[{type:'LocallyRedundant',datastore-type:'VaultStore'}]" --type "UserAssigned" --user-assigned-identities '{"<user-assigned-identity-id>":{}}' --cmk-encryption-key-uri <cmk-uri> --cmk-encryption-state Enabled --cmk-identity-type "UserAssigned" --cmk-user-assigned-identity-id <cmk-user-assigned-identity-id> --cmk-infrastructure-encryption Enabled
Run the following commands to create a locally redundant Backup vault with a customer-managed encryption key and infrastructure encryption enabled:
$sub = "<subscription-id>"
$storagesetting = New-AzDataProtectionBackupVaultStorageSettingObject -DataStoreType VaultStore -Type LocallyRedundant
$userAssignedIdentity = @{
"<user-assigned-identity-id>" = @{
clientId = "<user-assigned-identity-client-id>"
principalId = "<user-assigned-identity-principal-id>"
}
}
$cmkIdentityId = "<cmk-user-assigned-identity-id>"
$cmkKeyUri = "<cmk-uri>"
New-AzDataProtectionBackupVault -SubscriptionId $sub -ResourceGroupName <resource-group> -VaultName <backup-vault> -Location <location> -StorageSetting $storagesetting -IdentityType UserAssigned -UserAssignedIdentity $userAssignedIdentity -CmkEncryptionState Enabled -CmkIdentityType UserAssigned -CmkUserAssignedIdentityId $cmkIdentityId -CmkEncryptionKeyUri $cmkKeyUri -CmkInfrastructureEncryption Enabled
Infrastructure encryption is disabled by default on Backup vaults.
Backup vaults use user-assigned managed identities to authenticate the Backup vault to access encryption keys stored in Azure Key Vault when creating the vault with a customer-managed encryption key and infrastructure encryption enabled. Refer to the following guides for details:
| Controls Version | Control | IG 1 | IG 2 | IG 3 |
|---|---|---|---|---|
| v8 | 3.11 Encrypt Sensitive Data at Rest | X | X | |
| v7 | 14.8 Encrypt Sensitive Information at Rest | X |
Level 2 | Automated