Detections
Analytics

9.1.3 Ensure 'SMB channel encryption' is Set to 'AES-256-GCM' or Higher for SMB file shares

Information

Implement SMB channel encryption with AES-256-GCM for SMB file shares to ensure data confidentiality and integrity in transit. This method offers strong protection against eavesdropping and man-in-the-middle attacks, safeguarding sensitive information.

AES-256-GCM encryption enhances the security of data transmitted over SMB channels by safeguarding it from unauthorized interception and tampering.

NOTE: Nessus has provided the target output to assist in reviewing the benchmark to ensure target compliance.

Solution

Remediate from Azure Portal

 - Go to Storage accounts.
 - Click the name of a storage account.
 - Under Data storage, click File shares.
 - Under File share settings, click the link next to Security.
 - If Profile is set to Maximum compatibility, click the drop-down menu and select Maximum security or Custom.
 - If selecting Custom, under SMB channel encryption, uncheck the boxes next to AES-128-CCM and AES-128-GCM.
 - Click Save.
 - Repeat steps 1-7 for each storage account requiring remediation.

Remediate from Azure CLI

For each storage account requiring remediation, run the following command to set the SMB channel encryption:

az storage account file-service-properties update --resource-group <resource-group> --account-name <storage-account> --channel-encryption AES-256-GCM

Remediate from PowerShell

For each storage account requiring remediation, run the following command to set the SMB channel encryption:

Update-AzStorageFileServiceProperty -ResourceGroupName <resource-group> -StorageAccountName <storage-account> -SmbChannelEncryption AES-256-GCM

Impact:

Using the AES-256-GCM SMB channel encryption may impact client compatibility.

See Also

https://workbench.cisecurity.org/benchmarks/24282

Item Details

Category: ACCESS CONTROL, IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION

References: 800-53|AC-17(2), 800-53|IA-5, 800-53|IA-5(1), 800-53|SC-8, 800-53|SC-8(1), CSCv7|14.4

Plugin: microsoft_azure

Control ID: 8d06a9b7e8c265ead6b53d92845a9e29ff66e08af801e984c7a692bfb287bc51