lacework-global-529
Enable 'Enable key rotation reminders' for each Storage Account (Manual)
Profile Applicability
• Level 1
Description
Access Keys authenticate application access requests to data contained in Storage Accounts. Best practices recommend a periodic rotation of these keys to ensure that potentially compromised keys cannot result in a long-term exploitable credential. The "Rotation Reminder" is an automatic reminder feature for a manual procedure.
Rationale
Reminders such as those generated by this recommendation will help maintain a regular and healthy cadence for activities which improve the overall efficacy of a security program.
Cryptographic key rotation periods will vary depending on your organization's security requirements and the type of data which is being stored in the Storage Account. For example, PCI DSS mandates that cryptographic keys be replaced or rotated 'regularly,' and advises that keys for static data stores be rotated every 'few months.'
For the purposes of this recommendation, 90 days will prescribed for the reminder. Review and adjustment of the 90 day period is recommended, and may even be necessary. Your organization's security requirements should dictate the appropriate setting.
Impact
This recommendation only creates a periodic reminder to regenerate access keys. Regenerating access keys can affect services in Azure as well as the organization's applications that are dependent on the storage account. All clients that use the access key to access the storage account must be updated to use the new key.
Audit
From Azure Portal
- Go to
Storage Accounts
- For each Storage Account, go to
Access keys
- Click
Set rotation reminder
If the checkbox for Enable key rotation reminders
is already checked, that Storage Account is compliant. Review the Remind me every
field for a desirable periodic setting that fits your security program's needs.
Remediation
From Azure Portal
- Go to
Storage Accounts
. - For each Storage Account that is not compliant, go to
Access keys
. - Click
Set rotation reminder
. - Check
Enable key rotation reminders
. - In the
Send reminders
field selectCustom
, then set theRemind me every
field to90
and theperiod
drop down toDays
. - Click
Save
.
References
https://docs.microsoft.com/en-us/azure/storage/common/storage-create-storage-account#regenerate-storage-access-keys
https://docs.microsoft.com/en-us/security/benchmark/azure/security-controls-v3-privileged-access#pa-1-protect-and-limit-highly-privileged-users
https://docs.microsoft.com/en-us/security/benchmark/azure/security-controls-v3-privileged-access#pa-2-restrict-administrative-access-to-business-critical-systems
https://docs.microsoft.com/en-us/security/benchmark/azure/security-controls-v3-identity-management#im-2-manage-application-identities-securely-and-automatically
https://docs.microsoft.com/en-us/security/benchmark/azure/security-controls-v3-governance-strategy#gs-6-define-identity-and-privileged-access-strategy
https://docs.microsoft.com/en-us/security/benchmark/azure/security-controls-v3-identity-management#im-8-restrict-the-exposure-of-credential-and-secrets
https://www.pcidssguide.com/pci-dss-key-rotation-requirements/
https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-57pt1r5.pdf