Profile Applicability:

  • Level 1

Description:
 SMB channel encryption secures data transmitted between clients and Azure SMB file shares by encrypting the SMB session. Setting the encryption algorithm to AES-256-GCM or higher provides strong confidentiality and integrity protections for data in transit, leveraging modern cryptographic standards.

Rationale:
 Using AES-256-GCM enhances protection against eavesdropping, man-in-the-middle attacks, and data tampering during SMB file transfers. It aligns with industry best practices for encryption strength, ensuring that sensitive data moving over the network is safeguarded.

Impact:

Pros:

  • Provides robust encryption and data integrity for SMB traffic.

  • Mitigates risks of interception and tampering.

  • Supports compliance with strict data protection regulations.

Cons:

  • May introduce slight performance overhead due to stronger encryption.

  • Requires client and server support for AES-256-GCM encryption.

Default Value:
 Azure SMB file shares use strong encryption by default, but the exact cipher should be verified and enforced.

Pre-requisites:

  • Azure Storage Account with SMB file shares enabled.

  • Clients capable of supporting AES-256-GCM encryption.

Remediation

Test Plan:

Using Azure Portal:

  1. Sign in to https://portal.azure.com.

  2. Navigate to the Storage Account hosting the SMB file shares.

  3. Under Configuration or Security, verify the SMB channel encryption settings.

  4. Confirm that AES-256-GCM or a stronger cipher is enforced.

Using Azure CLI:

Query SMB encryption settings:

az storage account show --name <storage-account-name> --resource-group <resource-group> --query "azureFilesIdentityBasedAuthentication.smbEncryption"

  1. Confirm the encryption algorithm is set to AES-256-GCM or higher.

Implementation Plan

Using Azure Portal:

  1. Navigate to the storage account’s SMB configuration.

  2. Set SMB channel encryption to AES-256-GCM or stronger cipher.

  3. Save changes and test SMB client connections.

Using Azure CLI:

Update SMB encryption settings:

az storage account update --name <storage-account-name> --resource-group <resource-group> --set azureFilesIdentityBasedAuthentication.smbEncryption=AES256GCM

  1. Verify the change.

Backout Plan

Using Azure Portal:

  1. Revert SMB encryption to previous settings if necessary.

  2. Communicate with users about any compatibility impacts.

Using Azure CLI:

Reset SMB encryption to prior value:

az storage account update --name <storage-account-name> --resource-group <resource-group> --set azureFilesIdentityBasedAuthentication.smbEncryption=<previous-encryption>

References: