Reino: Environment

Esta sección incluye todo lo que está fuera del código fuente pero aun así es importante para la seguridad del producto que se está creando. Dado que todas las cuestiones incluidas en esta sección no están directamente relacionadas con el código fuente, las hemos separado de las demás secciones.

Azure Terraform Misconfiguration: PostgreSQL Missing Infrastructure Encryption

Abstract

Un servicio de Azure no permite el cifrado de infraestructura.

Explanation

Los errores de implementación, las configuraciones incorrectas y las claves comprometidas son algunos de los problemas que impiden que el cifrado de una sola capa proteja por completo los datos muy sensibles. Las organizaciones deben adoptar un enfoque de defensa en profundidad para proteger los datos muy sensibles y evitar tener un punto único de fallo en su diseño de seguridad.

References

[1] Microsoft Double encryption

[2] Standards Mapping - CIS Microsoft Azure Foundations Benchmark Recommendation 4.3.8

[3] Standards Mapping - Common Weakness Enumeration CWE ID 311

[4] Standards Mapping - DISA Control Correlation Identifier Version 2 CCI-001350, CCI-002475

[5] Standards Mapping - FIPS200 MP

[6] Standards Mapping - General Data Protection Regulation (GDPR) Insufficient Data Protection

[7] Standards Mapping - NIST Special Publication 800-53 Revision 4 AU-9 Protection of Audit Information (P1), SC-28 Protection of Information at Rest (P1)

[8] Standards Mapping - NIST Special Publication 800-53 Revision 5 AU-9 Protection of Audit Information, SC-28 Protection of Information at Rest

[9] Standards Mapping - OWASP API 2023 API8 Security Misconfiguration

[10] Standards Mapping - OWASP Application Security Verification Standard 4.0 2.6.3 Look-up Secret Verifier Requirements (L2 L3), 6.2.1 Algorithms (L1 L2 L3), 8.1.6 General Data Protection (L3)

[11] Standards Mapping - OWASP Top 10 2017 A3 Sensitive Data Exposure

[12] Standards Mapping - OWASP Top 10 2021 A02 Cryptographic Failures

[13] Standards Mapping - Payment Card Industry Data Security Standard Version 3.2.1 Requirement 6.5.3

[14] Standards Mapping - Payment Card Industry Data Security Standard Version 4.0 Requirement 6.2.4, Requirement 3.5.1

[15] Standards Mapping - Payment Card Industry Data Security Standard Version 4.0.1 Requirement 3.3.2, Requirement 3.3.3, Requirement 3.5.1, Requirement 6.2.4

[16] Standards Mapping - Payment Card Industry Software Security Framework 1.0 Control Objective 7.1 - Use of Cryptography

[17] Standards Mapping - Payment Card Industry Software Security Framework 1.1 Control Objective 7.1 - Use of Cryptography

[18] Standards Mapping - Payment Card Industry Software Security Framework 1.2 Control Objective 7.2 - Use of Cryptography

[19] Standards Mapping - Security Technical Implementation Guide Version 4.11 APSC-DV-001350 CAT II, APSC-DV-002340 CAT II

[20] Standards Mapping - Security Technical Implementation Guide Version 5.1 APSC-DV-001350 CAT II, APSC-DV-002340 CAT II

[21] Standards Mapping - Security Technical Implementation Guide Version 5.2 APSC-DV-001350 CAT II, APSC-DV-002340 CAT II

[22] Standards Mapping - Security Technical Implementation Guide Version 5.3 APSC-DV-001350 CAT II, APSC-DV-002340 CAT II

[23] Standards Mapping - Security Technical Implementation Guide Version 6.1 APSC-DV-001350 CAT II, APSC-DV-002340 CAT II

desc.structural.iac.azure_misconfiguration_missing_infrastructure_encryption.base