Skip to main content

Description

In some cases, Azure Storage sets the minimum TLS version to be version 1.0 by default. TLS 1.0 is a legacy version and has known vulnerabilities. This minimum TLS version can be configured to be later protocols such as TLS 1.2.

Rationale​

TLS 1.0 has known vulnerabilities and has been replaced by later versions of the TLS protocol. Continued use of this legacy protocol affects the security of data in transit.

Impact​

When set to TLS 1.2 all requests must leverage this version of the protocol. Applications leveraging legacy versions of the protocol will fail.

Audit​

From Azure Console​

  1. Go to Storage Accounts.
  2. For each storage account, under Settings, click Configuration.
  3. Ensure that the Minimum TLS version is set to Version 1.2.

From Azure CLI​

Get a list of all storage accounts and their resource groups:

az storage account list | jq '.[] | {name, resourceGroup}'

Then query the minimumTLSVersion field:

az storage account show \ 
    --name <storage-account> \ 
    --resource-group <resource-group> \ 
    --query minimumTlsVersion \ 
    --output tsv

From Azure PowerShell​

To get the minimum TLS version, run the following command:

(Get-AzStorageAccount -Name <STORAGEACCOUNTNAME> -ResourceGroupName <RESOURCEGROUPNAME>).MinimumTlsVersion

From Azure Policy​

If referencing a digital copy of this Benchmark, clicking a Policy ID will open a link to the associated Policy definition in Azure.

Default Value​

If a storage account is created through the portal, the MinimumTlsVersion property for that storage account will be set to TLS 1.2.

If a storage account is created through PowerShell or CLI, the MinimumTlsVersion property for that storage account will not be set, and defaults to TLS 1.0.

References​

  1. https://docs.microsoft.com/en-us/azure/storage/common/transport-layer-security-configure-minimum-version?tabs=portal
  2. https://learn.microsoft.com/en-us/security/benchmark/azure/mcsb-data-protection#dp-3-encrypt-sensitive-data-in-transit