Azure encryption, keys & secrets security checks
Encryption at rest and in transit, key rotation, and the API keys, tokens and credentials that outlive the people who created them.
On Azure, Black Cat runs 3 checks in this area on every scan. Each one below lists its severity, how to fix it, and the compliance controls it satisfies where a control applies. See what access the Azure connector needs.
Checks (3)
severity: high Storage Key Not Rotated fix difficulty: medium #
Rotate storage account access keys that are older than 90 days
- Navigate to the Azure Portal and open Storage accounts
- Select the flagged storage account and click Access keys
- Click Show keys and review the Last rotated date for both key1 and key2
- For any key older than 90 days, click Rotate key next to it
- Confirm the rotation in the dialog — this invalidates the old key immediately
- Update all applications and connection strings that use the rotated key
Satisfies: ISO 27001:2022 A.8.24 SOC 2 Type II CC6.1 CIS Controls v8 CIS-03.10 NIST CSF 2.0 PR.DS-01 GDPR (SaaS Security) GDPR-32.1a HIPAA (SaaS Security) HIPAA-312.c NIS2 Directive NIS2-21.h DORA (SaaS Security) DORA-9.8
severity: high Key Vault Key No Expiry fix difficulty: easy #
Set an expiration date on all Key Vault keys to enforce key rotation
- Navigate to the Azure Portal and open Key vaults
- Select the vault containing the flagged key and click Keys
- Click the key name and then click the current version
- Click Edit expiration date
- Set an expiration date no more than one year from today
- Click Save and create a new key version before the expiration date arrives
Satisfies: ISO 27001:2022 A.8.24 SOC 2 Type II CC6.1 CIS Controls v8 CIS-03.10 NIST CSF 2.0 PR.DS-01 GDPR (SaaS Security) GDPR-32.1a HIPAA (SaaS Security) HIPAA-312.c NIS2 Directive NIS2-21.h DORA (SaaS Security) DORA-9.8
severity: high Key Vault Secret No Expiry fix difficulty: easy #
Set an expiration date on all Key Vault secrets to enforce secret rotation
- Navigate to the Azure Portal and open Key vaults
- Select the vault containing the flagged secret and click Secrets
- Click the secret name and then click the current version
- Click Edit expiration date
- Set an expiration date appropriate to the secret type (e.g. 90 or 365 days)
- Click Save and ensure an automated rotation or renewal process is in place
Satisfies: ISO 27001:2022 A.8.24 SOC 2 Type II CC6.1 CIS Controls v8 CIS-03.10 NIST CSF 2.0 PR.DS-01 GDPR (SaaS Security) GDPR-32.1a HIPAA (SaaS Security) HIPAA-312.c NIS2 Directive NIS2-21.h DORA (SaaS Security) DORA-9.8