768
However, the empty string under RequireInfrastructureEncryption indicates this service was not
enabled at the time of creation, because the -RequireInfrastructureEncryption argument was not
specified in the command.
Including the -RequireInfrastructureEncryption argument addresses the issue:
Example Language: Shell (Good)
New-AzStorageEncryptionScope -ResourceGroupName "MyResourceGroup" -AccountName "MyStorageAccount" -
EncryptionScopeName testscope -StorageEncryption -RequireInfrastructureEncryption
This produces the report:
Example Language: Other (Result)
ResourceGroupName: MyResourceGroup, StorageAccountName: MyStorageAccount
In a scenario where both software and hardware layer encryption is required ("double encryption"),
Azure's infrastructure encryption setting can be enabled via the CLI or Portal. An important note
is that infrastructure hardware encryption cannot be enabled or disabled after a blob is created.
Furthermore, the default value for infrastructure encryption is disabled in blob creations.
Observed Examples
Reference Description
CVE-2022-30275 Remote Terminal Unit (RTU) uses a driver that relies on a password stored in
plaintext.
https://www.cve.org/CVERecord?id=CVE-2022-30275
CVE-2009-2272 password and username stored in cleartext in a cookie
https://www.cve.org/CVERecord?id=CVE-2009-2272
CVE-2009-1466 password stored in cleartext in a file with insecure permissions
https://www.cve.org/CVERecord?id=CVE-2009-1466
CVE-2009-0152 chat program disables SSL in some circumstances even when the user says to
use SSL.
https://www.cve.org/CVERecord?id=CVE-2009-0152
CVE-2009-1603 Chain: product uses an incorrect public exponent when generating an RSA
key, which effectively disables the encryption
https://www.cve.org/CVERecord?id=CVE-2009-1603
CVE-2009-0964 storage of unencrypted passwords in a database
https://www.cve.org/CVERecord?id=CVE-2009-0964
CVE-2008-6157 storage of unencrypted passwords in a database
https://www.cve.org/CVERecord?id=CVE-2008-6157
CVE-2008-6828 product stores a password in cleartext in memory
https://www.cve.org/CVERecord?id=CVE-2008-6828
CVE-2008-1567 storage of a secret key in cleartext in a temporary file
https://www.cve.org/CVERecord?id=CVE-2008-1567
CVE-2008-0174 SCADA product uses HTTP Basic Authentication, which is not encrypted
https://www.cve.org/CVERecord?id=CVE-2008-0174
CVE-2007-5778 login credentials stored unencrypted in a registry key
https://www.cve.org/CVERecord?id=CVE-2007-5778
CVE-2001-1481 Plaintext credentials in world-readable file.
https://www.cve.org/CVERecord?id=CVE-2001-1481
CVE-2005-1828 Password in cleartext in config file.
https://www.cve.org/CVERecord?id=CVE-2005-1828
CVE-2005-2209 Password in cleartext in config file.
https://www.cve.org/CVERecord?id=CVE-2005-2209
CWE Version 4.14
CWE-312: Cleartext Storage of Sensitive Information
CWE-312: Cleartext Storage of Sensitive Information