AZIAM-005: Storage account security settings
- Plataforma
- Entra ID / M365
- Categoría
- Azure IAM & Resource Security
- Severidad
- High
- Pilar de Zero Trust
- Identity (peso 3)
- Fixtures de referencia
- 4
- Cobertura de ramas
- Observada: los fixtures prueban los veredictos que ejercitan
- Procedencia
- baseline
Qué comprueba
Azure Storage accounts often contain sensitive business data, backups, and application state that must be protected at rest and in transit. Misconfigured settings such as allowing public blob access, disabling HTTPS enforcement, or using legacy TLS versions create significant data exposure risks. Storage account security settings must be hardened to prevent unauthorized access and data leakage.
Valor recomendado
Enforce HTTPS-only transfer, disable public blob access, require TLS 1.2 minimum, enable infrastructure encryption
Remediación
Set the minimum TLS version to 1.2, enable HTTPS-only transfer, and disable public blob access on all storage accounts. Enable infrastructure encryption for double encryption at rest and configure private endpoints to restrict network access. Review shared access signatures and access keys, rotate keys on a regular schedule, and prefer Azure AD authentication over key-based access.
Veredictos probados con fixtures
Cada veredicto de esta tabla está probado por un fixture de referencia en la suite de pruebas que valida el módulo. La tabla se deriva de la última ejecución en verde; no puede editarse a mano.
| Escenario | Veredicto esperado |
|---|---|
| clean | PASS |
| known-bad | FAIL |
| no-data | Not Assessed |
| partial-collection | Not Assessed |
Mapeos a marcos de referencia
- NIST SP 800-53
- SC-8, SC-28
- CIS Azure
- 3.1