feat(query): implements "Beta - Storage Account Not Using Latest SMB Protocol Version"

[cx-andre-pereira]

Reason for Proposed Changes

• Currently there is no query to ensure that resources of type "azurerm_storage_account" has the "share_properties.smb.versions" array set to ["SMB3.1.1"].

• Quoting CIS_Microsoft_Azure_Foundations_Benchmark_v5.0.0 page 479:

  • "Ensure that SMB file shares are configured to use the latest supported SMB protocol version. Keeping the SMB protocol updated helps mitigate risks associated with older SMB versions, which may contain vulnerabilities and lack essential security controls."
  • "Using the latest supported SMB protocol version enhances the security of SMB file shares by preventing the exploitation of known vulnerabilities in outdated SMB versions."

• In the CIS Benchmark it is also stated that, by default, "all SMB versions are allowed".

Proposed Changes

• Implemented the missing query.

• The query will flag a "azurerm_storage_account" resource given any one of these 6 scenarios :

  • Undefined "share_properties" block
  • Undefined "share_properties.smb" block
  • Undefined "share_properties.smb.versions" field
  • Having its "share_properties.smb.versions" field set to []
  • Having its "share_properties.smb.versions" field not include the "SMB3.1.1" value
  • Having its "share_properties.smb.versions" include the "SMB3.1.1" value together with other, outdated, SMB protocol versions.

• Note the "issueType" will be "MissingAttribute" for the first 3 scenarios and "IncorrectValue" for the last 3.

I submit this contribution under the Apache-2.0 license.

[github-actions]

KICS version: v2.1.17

Category Results CRITICAL 0 HIGH 0 MEDIUM 0 LOW 0 INFO 0 TRACE 0 TOTAL 0	Metric Values Files scanned 1 Files parsed 1 Files failed to scan 0 Total executed queries 47 Queries failed to execute 0 Execution time 0

[cx-eduardo-semanas]

LGTM

[cx-eduardo-semanas]

LGTM