Skip to main content

🛡️ Azure Storage Blob Soft Delete is not enabled🟢

Logic​

Similar Policies​

Similar Internal Rules​

RulePoliciesFlags
✉️ dec-x-a8281d052

Description​

Open File

Description​

Azure Storage blobs can contain data such as ePHI or financial records, which can be sensitive or personal. Data that is modified or deleted in error by an application or other storage account user can cause data loss or unavailability.

It is recommended that Azure Storage blobs be made recoverable by enabling the soft delete for blobs configuration. This saves and recovers data when blobs or blob snapshots are deleted.

Rationale​

Blobs can be deleted incorrectly. An attacker or malicious user may do this deliberately to cause disruption. Deleting a blob causes immediate data loss. Enabling this configuration for Azure Storage ensures that deleted blobs and blob snapshots are recoverable for a defined retention period.

Impact​

Additional storage costs may be incurred as deleted blobs and snapshots are retained.

Audit​

This policy flags an Azure Storage Account as INCOMPLIANT if the Blob Retention Policy State is not set to Enabled, or if Blob Retention Policy Days is empty.

Default Value​

... see more

Remediation​

Open File

Remediation​

From Azure Portal​

  1. Go to Storage Accounts.
  2. For each Storage Account, under Data management, go to Data protection.
  3. Check the box next to Enable soft delete for blobs.
  4. Set the retention period to a sufficient length for your organization.
  5. Click Save.

From Azure CLI​

Update blob retention with the following command:

az storage account blob-service-properties update \
    --enable-delete-retention true \
    --delete-retention-days {{retention-days}} \
    --account-name {{storage-account-name}} \
    --resource-group {{resource-group-name}}

policy.yaml​

Open File

Linked Framework Sections​

SectionSub SectionsInternal RulesPoliciesFlagsCompliance
💼 APRA CPG 234 → 💼 44b deletion or corruption of both production and backup data, either through malicious intent, user error or system malfunction;67no data
💼 APRA CPG 234 → 💼 73f response and recovery which involves a mixture of system restoration (where integrity and availability have been compromised) and managing sensitive data loss where confidentiality has been compromised. This allows for a return to businessas-usual processing;45no data
💼 CIS Azure v4.0.0 → 💼 10.2.1 Ensure that soft delete for blobs on Azure Blob Storage storage accounts is Enabled (Automated)1no data
💼 CIS Azure v5.0.0 → 💼 9.2.1 Ensure that soft delete for blobs on Azure Blob Storage storage accounts is Enabled (Automated)1no data
💼 CIS Azure v6.0.0 → 💼 9.2.1 Ensure That Soft Delete for Blobs on Azure Blob Storage Storage Accounts is Enabled (Automated)1no data
💼 Cloudaware Framework → 💼 Data Protection and Recovery25no data
💼 Cloudaware Framework → 💼 System Configuration61no data
💼 FedRAMP High Security Controls → 💼 CP-9 System Backup (L)(M)(H)5416no data
💼 FedRAMP Low Security Controls → 💼 CP-9 System Backup (L)(M)(H)14no data
💼 FedRAMP Moderate Security Controls → 💼 CP-9 System Backup (L)(M)(H)216no data
💼 ISO/IEC 27001:2013 → 💼 A.17.1.2 Implementing information security continuity34no data
💼 ISO/IEC 27001:2022 → 💼 8.13 Information backup13no data
💼 NIST CSF v1.1 → 💼 ID.BE-4: Dependencies and critical functions for delivery of critical services are established4no data
💼 NIST CSF v1.1 → 💼 ID.BE-5: Resilience requirements to support delivery of critical services are established for all operating states (e.g. under duress/attack, during recovery, normal operations)34no data
💼 NIST CSF v1.1 → 💼 PR.IP-4: Backups of information are conducted, maintained, and tested510no data
💼 NIST CSF v1.1 → 💼 PR.IP-9: Response plans (Incident Response and Business Continuity) and recovery plans (Incident Recovery and Disaster Recovery) are in place and managed45no data
💼 NIST CSF v1.1 → 💼 PR.PT-5: Mechanisms (e.g., failsafe, load balancing, hot swap) are implemented to achieve resilience requirements in normal and adverse situations34no data
💼 NIST CSF v2.0 → 💼 GV.OC-04: Critical objectives, capabilities, and services that external stakeholders depend on or expect from the organization are understood and communicated4no data
💼 NIST CSF v2.0 → 💼 GV.OC-05: Outcomes, capabilities, and services that the organization depends on are understood and communicated4no data
💼 NIST CSF v2.0 → 💼 ID.IM-04: Incident response plans and other cybersecurity plans that affect operations are established, communicated, maintained, and improved5no data
💼 NIST CSF v2.0 → 💼 PR.DS-11: Backups of data are created, protected, maintained, and tested18no data
💼 NIST CSF v2.0 → 💼 PR.IR-03: Mechanisms are implemented to achieve resilience requirements in normal and adverse situations22no data
💼 SOC 2 → 💼 CC6.1-8 Manages Identification and Authentication1825no data