Description

Detects Azure Storage accounts that have infrastructure-level encryption disabled. Infrastructure encryption provides an additional layer of data protection by encrypting data at the infrastructure level, making it more resistant to unauthorized access and potential data breaches. When disabled, it reduces the overall security posture of storage data.

Detection Strategy

• Checks if a Storage account has the 'require_infrastructure_encryption' property set to false in its encryption configuration

• Examines each Storage account's encryption settings at path /encryption/require_infrastructure_encryption

• Reports a vulnerability when infrastructure encryption is not enabled (false) for any Storage account