Skip to main content

๐Ÿ›ก๏ธ Azure Storage Account Secure Transfer Required is not enabled๐ŸŸข

  • Contextual name: ๐Ÿ›ก๏ธ Secure Transfer Required is not enabled๐ŸŸข
  • ID: /ce/ca/azure/storage/secure-transfer-required
  • Tags:
  • Policy Type: COMPLIANCE_POLICY
  • Policy Categories: SECURITY

Statsโ€‹

not available

Logicโ€‹

Similar Policiesโ€‹

Similar Internal Rulesโ€‹

RulePoliciesFlags
โœ‰๏ธ dec-x-d95ea48b1

Descriptionโ€‹

Open File

Descriptionโ€‹

Enable data encryption in transit.

Rationaleโ€‹

The secure transfer option enhances the security of a storage account by only allowing requests to the storage account by a secure connection. For example, when calling REST APIs to access storage accounts, the connection must use HTTPS. Any requests using HTTP will be rejected when 'secure transfer required' is enabled. When using the Azure files service, connection without encryption will fail, including scenarios using SMB 2.1, SMB 3.0 without encryption, and some flavors of the Linux SMB client. Because Azure storage doesnโ€™t support HTTPS for custom domain names, this option is not applied when using a custom domain name.

Auditโ€‹

This policy flags an Azure Storage Account as INCOMPLIANT if its Secure Transfer Required is set to false.

Default Valueโ€‹

By default, Secure transfer required is set to Disabled.

Referencesโ€‹

  1. https://docs.microsoft.com/en-us/azure/storage/blobs/security-recommendations#encryption-in-transit
  2. https://docs.microsoft.com/en-us/cli/azure/storage/account?view=azure-cli-latest#az_storage_account_list

... see more

Remediationโ€‹

Open File

Remediationโ€‹

From Azure Portalโ€‹

  1. Go to Storage Accounts.
  2. For each storage account, under Settings, click Configuration.
  3. Set Secure transfer required to Enabled.
  4. Click Save.

From Azure CLIโ€‹

Use the following command to enable Secure transfer required for a storage account:

az storage account update \
    --name {{storage-account-name}} \
    --resource-group {{resource-group-name}} \
    --https-only true

policy.yamlโ€‹

Open File

Linked Framework Sectionsโ€‹

SectionSub SectionsInternal RulesPoliciesFlagsCompliance
๐Ÿ’ผ APRA CPG 234 โ†’ ๐Ÿ’ผ 54 Cryptographic techniques can be used to control access to sensitive data, both in storage and in transit. The strength of the cryptographic techniques deployed would be commensurate with the sensitivity and criticality of the data as well as other supplementary or compensating controls (refer to Attachment E for further guidance).2526no data
๐Ÿ’ผ CIS Azure v1.1.0 โ†’ ๐Ÿ’ผ 3.1 Ensure that 'Secure transfer required' is set to 'Enabled'11no data
๐Ÿ’ผ CIS Azure v1.3.0 โ†’ ๐Ÿ’ผ 3.1 Ensure that 'Secure transfer required' is set to 'Enabled' - Level 1 (Automated)11no data
๐Ÿ’ผ CIS Azure v1.4.0 โ†’ ๐Ÿ’ผ 3.1 Ensure that 'Secure transfer required' is set to 'Enabled' - Level 1 (Automated)11no data
๐Ÿ’ผ CIS Azure v1.5.0 โ†’ ๐Ÿ’ผ 3.1 Ensure that 'Secure transfer required' is set to 'Enabled' - Level 1 (Automated)11no data
๐Ÿ’ผ CIS Azure v2.0.0 โ†’ ๐Ÿ’ผ 3.1 Ensure that 'Secure transfer required' is set to 'Enabled' - Level 1 (Automated)11no data
๐Ÿ’ผ CIS Azure v2.1.0 โ†’ ๐Ÿ’ผ 3.1 Ensure that 'Secure transfer required' is set to 'Enabled' - Level 1 (Automated)11no data
๐Ÿ’ผ CIS Azure v3.0.0 โ†’ ๐Ÿ’ผ 4.1 Ensure that 'Secure transfer required' is set to 'Enabled' (Automated)1no data
๐Ÿ’ผ CIS Azure v4.0.0 โ†’ ๐Ÿ’ผ 10.3.4 Ensure that 'Secure transfer required' is set to 'Enabled' (Automated)1no data
๐Ÿ’ผ CIS Azure v5.0.0 โ†’ ๐Ÿ’ผ 9.3.4 Ensure that 'Secure transfer required' is set to 'Enabled' (Automated)1no data
๐Ÿ’ผ CIS Azure v6.0.0 โ†’ ๐Ÿ’ผ 9.3.4 Ensure that 'Secure transfer required' is Set to 'Enabled' (Automated)1no data
๐Ÿ’ผ Cloudaware Framework โ†’ ๐Ÿ’ผ Data Encryption65no data
๐Ÿ’ผ FedRAMP High Security Controls โ†’ ๐Ÿ’ผ AC-3 Access Enforcement (L)(M)(H)49103no data
๐Ÿ’ผ FedRAMP High Security Controls โ†’ ๐Ÿ’ผ AC-4 Information Flow Enforcement (M)(H)248188no data
๐Ÿ’ผ FedRAMP High Security Controls โ†’ ๐Ÿ’ผ AC-4(4) Flow Control of Encrypted Information (H)3031no data
๐Ÿ’ผ FedRAMP High Security Controls โ†’ ๐Ÿ’ผ AC-17(2) Protection of Confidentiality and Integrity Using Encryption (M)(H)22no data
๐Ÿ’ผ FedRAMP High Security Controls โ†’ ๐Ÿ’ผ AU-3(1) Additional Audit Information (M)(H)15no data
๐Ÿ’ผ FedRAMP High Security Controls โ†’ ๐Ÿ’ผ SC-7 Boundary Protection (L)(M)(H)10999no data
๐Ÿ’ผ FedRAMP High Security Controls โ†’ ๐Ÿ’ผ SC-8 Transmission Confidentiality and Integrity (L)(M)(H)1926no data
๐Ÿ’ผ FedRAMP High Security Controls โ†’ ๐Ÿ’ผ SC-8(1) Cryptographic Protection (L)(M)(H)925no data
๐Ÿ’ผ FedRAMP High Security Controls โ†’ ๐Ÿ’ผ SC-13 Cryptographic Protection (L)(M)(H)1844no data
๐Ÿ’ผ FedRAMP Low Security Controls โ†’ ๐Ÿ’ผ AC-3 Access Enforcement (L)(M)(H)103no data
๐Ÿ’ผ FedRAMP Low Security Controls โ†’ ๐Ÿ’ผ SC-7 Boundary Protection (L)(M)(H)50no data
๐Ÿ’ผ FedRAMP Low Security Controls โ†’ ๐Ÿ’ผ SC-8 Transmission Confidentiality and Integrity (L)(M)(H)126no data
๐Ÿ’ผ FedRAMP Low Security Controls โ†’ ๐Ÿ’ผ SC-8(1) Cryptographic Protection (L)(M)(H)25no data
๐Ÿ’ผ FedRAMP Low Security Controls โ†’ ๐Ÿ’ผ SC-13 Cryptographic Protection (L)(M)(H)44no data
๐Ÿ’ผ FedRAMP Moderate Security Controls โ†’ ๐Ÿ’ผ AC-3 Access Enforcement (L)(M)(H)103no data
๐Ÿ’ผ FedRAMP Moderate Security Controls โ†’ ๐Ÿ’ผ AC-4 Information Flow Enforcement (M)(H)1169no data
๐Ÿ’ผ FedRAMP Moderate Security Controls โ†’ ๐Ÿ’ผ AC-17(2) Protection of Confidentiality and Integrity Using Encryption (M)(H)22no data
๐Ÿ’ผ FedRAMP Moderate Security Controls โ†’ ๐Ÿ’ผ AU-3(1) Additional Audit Information (M)(H)15no data
๐Ÿ’ผ FedRAMP Moderate Security Controls โ†’ ๐Ÿ’ผ SC-7 Boundary Protection (L)(M)(H)783no data
๐Ÿ’ผ FedRAMP Moderate Security Controls โ†’ ๐Ÿ’ผ SC-8 Transmission Confidentiality and Integrity (L)(M)(H)126no data
๐Ÿ’ผ FedRAMP Moderate Security Controls โ†’ ๐Ÿ’ผ SC-8(1) Cryptographic Protection (L)(M)(H)25no data
๐Ÿ’ผ FedRAMP Moderate Security Controls โ†’ ๐Ÿ’ผ SC-13 Cryptographic Protection (L)(M)(H)44no data
๐Ÿ’ผ ISO/IEC 27001:2013 โ†’ ๐Ÿ’ผ A.10.1.1 Policy on the use of cryptographic controls2122no data
๐Ÿ’ผ ISO/IEC 27001:2013 โ†’ ๐Ÿ’ผ A.14.1.3 Protecting application services transactions1115no data
๐Ÿ’ผ ISO/IEC 27001:2022 โ†’ ๐Ÿ’ผ 5.14 Information transfer916no data
๐Ÿ’ผ ISO/IEC 27001:2022 โ†’ ๐Ÿ’ผ 5.28 Collection of evidence1622no data
๐Ÿ’ผ ISO/IEC 27001:2022 โ†’ ๐Ÿ’ผ 8.15 Logging2035no data
๐Ÿ’ผ NIST CSF v1.1 โ†’ ๐Ÿ’ผ DE.AE-1: A baseline of network operations and expected data flows for users and systems is established and managed1179no data
๐Ÿ’ผ NIST CSF v1.1 โ†’ ๐Ÿ’ผ ID.AM-3: Organizational communication and data flows are mapped48no data
๐Ÿ’ผ NIST CSF v1.1 โ†’ ๐Ÿ’ผ PR.AC-5: Network integrity is protected (e.g., network segregation, network segmentation)1184no data
๐Ÿ’ผ NIST CSF v1.1 โ†’ ๐Ÿ’ผ PR.DS-2: Data-in-transit is protected1797no data
๐Ÿ’ผ NIST CSF v1.1 โ†’ ๐Ÿ’ผ PR.DS-5: Protections against data leaks are implemented89152no data
๐Ÿ’ผ NIST CSF v1.1 โ†’ ๐Ÿ’ผ PR.DS-6: Integrity checking mechanisms are used to verify software, firmware, and information integrity2327no data
๐Ÿ’ผ NIST CSF v1.1 โ†’ ๐Ÿ’ผ PR.PT-4: Communications and control networks are protected1184no data
๐Ÿ’ผ NIST CSF v2.0 โ†’ ๐Ÿ’ผ DE.CM-09: Computing hardware and software, runtime environments, and their data are monitored to find potentially adverse events185no data
๐Ÿ’ผ NIST CSF v2.0 โ†’ ๐Ÿ’ผ ID.AM-03: Representations of the organization's authorized network communication and internal and external network data flows are maintained128no data
๐Ÿ’ผ NIST CSF v2.0 โ†’ ๐Ÿ’ผ PR.AA-06: Physical access to assets is managed, monitored, and enforced commensurate with risk84no data
๐Ÿ’ผ NIST CSF v2.0 โ†’ ๐Ÿ’ผ PR.DS-01: The confidentiality, integrity, and availability of data-at-rest are protected248no data
๐Ÿ’ผ NIST CSF v2.0 โ†’ ๐Ÿ’ผ PR.DS-02: The confidentiality, integrity, and availability of data-in-transit are protected219no data
๐Ÿ’ผ NIST CSF v2.0 โ†’ ๐Ÿ’ผ PR.DS-10: The confidentiality, integrity, and availability of data-in-use are protected249no data
๐Ÿ’ผ NIST CSF v2.0 โ†’ ๐Ÿ’ผ PR.IR-01: Networks and environments are protected from unauthorized logical access and usage165no data
๐Ÿ’ผ NIST SP 800-53 Revision 5 โ†’ ๐Ÿ’ผ AC-4(2) Information Flow Enforcement _ Processing Domains3638no data
๐Ÿ’ผ NIST SP 800-53 Revision 5 โ†’ ๐Ÿ’ผ AC-4(14) Information Flow Enforcement _ Security or Privacy Policy Filter Constraints33no data
๐Ÿ’ผ NIST SP 800-53 Revision 5 โ†’ ๐Ÿ’ผ AC-17(2) Remote Access _ Protection of Confidentiality and Integrity Using Encryption1322no data
๐Ÿ’ผ NIST SP 800-53 Revision 5 โ†’ ๐Ÿ’ผ AU-3(1) Content of Audit Records _ Additional Audit Information1515no data
๐Ÿ’ผ NIST SP 800-53 Revision 5 โ†’ ๐Ÿ’ผ SC-8(1) Transmission Confidentiality and Integrity _ Cryptographic Protection924no data
๐Ÿ’ผ PCI DSS v3.2.1 โ†’ ๐Ÿ’ผ 4.1 Use strong cryptography and security protocols to safeguard sensitive cardholder data during transmission over open, public networks.1928no data
๐Ÿ’ผ PCI DSS v3.2.1 โ†’ ๐Ÿ’ผ 8.2.1 Using strong cryptography, render all authentication credentials unreadable during transmission and storage on all system components.15no data
๐Ÿ’ผ PCI DSS v4.0.1 โ†’ ๐Ÿ’ผ 4.2.1 Strong cryptography and security protocols are implemented to safeguard PAN during transmission over open, public networks.228no data
๐Ÿ’ผ PCI DSS v4.0.1 โ†’ ๐Ÿ’ผ 8.3.2 Strong cryptography is used to render all authentication factors unreadable during transmission and storage on all system components.15no data
๐Ÿ’ผ PCI DSS v4.0 โ†’ ๐Ÿ’ผ 4.2.1 Strong cryptography and security protocols are implemented to safeguard PAN during transmission over open, public networks.2928no data
๐Ÿ’ผ PCI DSS v4.0 โ†’ ๐Ÿ’ผ 8.3.2 Strong cryptography is used to render all authentication factors unreadable during transmission and storage on all system components.715no data
๐Ÿ’ผ SOC 2 โ†’ ๐Ÿ’ผ CC6.7-2 Uses Encryption Technologies or Secure Communication Channels to Protect Data79no data