Ensure Storage Accounts use HTTPS-only transport
Description
All storage account traffic must use HTTPS encryption.
⚠️ Risk Impact
HTTP traffic can be intercepted and data can be read or modified in transit.
🔍 How EchelonGraph Detects This
EchelonGraph's Tier 1 Cloud Scanner automatically checks for this condition across all connected Azure accounts. Violations are flagged as high-severity findings with remediation guidance.
🔧 Remediation
Enable HTTPS-only: az storage account update --name ACCOUNT --https-only true
💀 Real-World Attack Scenario
An application was configured to access Azure Blob Storage over HTTP within a shared VNet. An attacker who compromised another VM in the VNet used ARP spoofing to intercept the unencrypted storage traffic, capturing customer PII including names, addresses, and payment information.
💰 Cost of Non-Compliance
PCI DSS Requirement 4.1: Strong cryptography for cardholder data in transit. Non-compliance: $5K-$100K/month. HIPAA §164.312(e)(1) requires transmission security for ePHI.
📋 Audit Questions
- 1.Which storage accounts allow HTTP access?
- 2.Is the minimum TLS version set to 1.2?
- 3.Are shared access signatures (SAS) configured to require HTTPS?
🎯 MITRE ATT&CK Mapping
⚡ Common Pitfalls
- ⛔Setting HTTPS-only but not enforcing minimum TLS 1.2
- ⛔SAS tokens generated without HTTPS-only constraint
- ⛔Legacy applications that don't support HTTPS for storage connections
📈 Business Value
HTTPS-only enforcement prevents data interception even within compromised networks. It's a zero-cost security control required by every compliance framework.
⏱️ Effort Estimate
30 minutes to update all storage accounts
EchelonGraph monitors HTTPS enforcement across all storage accounts
🔗 Cross-Framework References
Automate CIS Azure 3.2 compliance
EchelonGraph continuously monitors this control across all your cloud accounts.
Start Free →