cis-azure-storage-8-4

name	cis-azure-storage-8.4
description	Ensure 'SMB channel encryption' is set to 'AES-256-GCM' or higher for SMB file shares
category	cis-azure-storage
version	1.0.0
author	cyberstrike-official
tags	["cis","azure","storage","azure-files","smb","encryption"]
cis_id	8.4
cis_benchmark	CIS Microsoft Azure Storage Services Benchmark v1.0.0
tech_stack	["azure"]
cwe_ids	[]
chains_with	[]
prerequisites	[]
severity_boost	{}

8.4 Ensure 'SMB channel encryption' is set to 'AES-256-GCM' or higher for SMB file shares (Automated)

Description

Implement SMB channel encryption with AES-256-GCM for SMB file shares to ensure data confidentiality and integrity in transit. This method offers strong protection against eavesdropping and man-in-the-middle attacks, safeguarding sensitive information.

Rationale

AES-256-GCM encryption enhances the security of data transmitted over SMB channels by safeguarding it from unauthorized interception and tampering.

Impact

Using the AES-256-GCM SMB channel encryption may impact client compatibility.

Audit Procedure

Audit from Azure Portal

1. Go to Storage accounts.
2. Click the name of a storage account.
3. Under Data storage, click File shares.
4. Under File share settings, click the link next to Security.
5. Under SMB channel encryption, ensure that AES-256-GCM, or higher, is the only checked SMB channel encryption setting.
6. Repeat steps 1-5 for each storage account.

Audit from Azure CLI

Run the following command to list storage accounts:

az storage account list

For each storage account, run the following command:

az storage account file-service-properties show --resource-group <resource-group> --account-name <storage-account>

Ensure that under protocolSettings > smb, channelEncryption is set to AES-256-GCM;, or higher, only.

Audit from PowerShell

Run the following command to list storage accounts:

Get-AzStorageAccount

Run the following command to get the file service properties for a storage account in a resource group with a given name:

$storageaccountfileservice = Get-AzStorageFileServiceProperty -ResourceGroupName <resource-group> -AccountName <storage-account>

Run the following command to get the SMB channel encryption setting:

$storageaccountfileservice.ProtocolSettings.Smb.ChannelEncryption

Ensure that the command returns AES-256-GCM, or higher, only. Repeat for each storage account.