rules/findings/azure/storage/azure-storage-account-smb-version-for-file-share-not-compliant.json
|
{
"provider": "Azure", "serviceType": "Storage Accounts", "serviceName": "Storage", "displayName": "Ensure 'SMB protocol version' is set to 'SMB 3.1.1' or higher for SMB file shares", "description": "Ensure that SMB file shares are configured to use the latest supported SMB protocol version. Keeping the SMB protocol updated helps mitigate risks associated with older SMB versions, which may contain vulnerabilities and lack essential security controls.", "rationale": "Using the latest supported SMB protocol version enhances the security of SMB file shares by preventing the exploitation of known vulnerabilities in outdated SMB versions.", "impact": "Using the latest SMB protocol version may impact client compatibility.", "remediation": { "text": "Remediate from Azure Portal 1. Go to Storage accounts. 2. Click the name of a storage account. 3. Under Data storage, click File shares. 4. Under File share settings, click the link next to Security. 5. If Profile is set to Maximum compatibility, click the drop-down menu and select Maximum security or Custom. 6. If selecting Custom, under SMB protocol versions, uncheck the boxes next to SMB 2.1 and SMB 3.0. 7. Click Save. 8. Repeat steps 1-7 for each storage account requiring remediation.", "code": { "powerShell": null, "iac": null, "terraform": null, "other": null } }, "recommendation": null, "references": [ "https://learn.microsoft.com/en-us/azure/well-architected/service-guides/azure-files#recommendations-for-smb-file-shares", "https://learn.microsoft.com/en-us/azure/storage/files/files-smb-protocol?tabs=azure-portal#smb-security-settings", "https://learn.microsoft.com/en-us/cli/azure/storage/account/file-service-properties?view=azure-cli-latest", "https://learn.microsoft.com/en-us/powershell/module/az.storage/get-azstoragefileserviceproperty?view=azps-15.4.0", "https://learn.microsoft.com/en-us/powershell/module/az.storage/update-azstoragefileserviceproperty?view=azps-15.4.0" ], "compliance": [ { "name": "CIS Microsoft Azure Foundations", "version": "5.0.0", "reference": "9.1.2", "profile": [ "Level 1" ] } ], "level": "low", "tags": [], "rule": { "path": "az_storage_accounts", "subPath": null, "selectCondition": { }, "query": [ { "filter": [ { "conditions": [ [ "dataStorage.fileShares.Count", "gt", "0" ], [ "fileProtection.properties.protocolSettings.smb.versions", "notmatch", "^(?:SMB3\\.1\\.1)(?:;SMB3\\.1\\.1)*$" ] ], "operator":"and" } ] } ], "shouldExist": null, "returnObject": null, "removeIfNotExists": null }, "output": { "html": { "data": { "properties": { "id": "id", "name": "name", "location": "Location", "fileProtection.properties.protocolSettings.smb.encryptionInTransit.required": "Encryption In Transit", "fileProtection.properties.protocolSettings.smb.versions": "SMB versions" }, "expandObject": null }, "table": "default", "decorate": [], "emphasis": [], "actions": { "objectData": { "properties": [ "id", "name", "fileProtection" ], "expandObject": null, "limit": null }, "showGoToButton": "True", "showModalButton": "True", "directLink": null } }, "text": { "data": { "properties": { "id": "id", "name": "name", "location": "Location", "fileProtection.properties.protocolSettings.smb.encryptionInTransit.required": "Encryption In Transit", "fileProtection.properties.protocolSettings.smb.versions": "SMB versions" }, "expandObject": null }, "status": { "keyName": ["name"], "message": "Ensure 'SMB protocol version' is set to 'SMB 3.1.1' or higher for {name} SMB file shares", "defaultMessage": "Ensure 'SMB protocol version' is set to 'SMB 3.1.1' or higher for SMB file shares" }, "properties": { "resourceName": "name", "resourceId": "id", "resourceType": "AzureStorageAccount" }, "onlyStatus": false } }, "idSuffix": "azure_storage_smb_version_file_share_not_compliant", "notes": [], "categories": [], "immutable_properties": [], "id": "azure_storage_002" } |