Benchmark: PCI DSS requirement 3.2
Description
Do not store sensitive authentication data after authorization (even if it is encrypted). Render all sensitive authentication data unrecoverable upon completion of the authorization process. Issuers and related entities may store sensitive authentication data if there is a business justification, and the data is stored securely.
Usage
Install the mod:
mkdir dashboardscd dashboardspowerpipe mod initpowerpipe mod install github.com/turbot/steampipe-mod-azure-complianceStart the Powerpipe server:
steampipe service startpowerpipe serverOpen http://localhost:9033 in your browser and select PCI DSS requirement 3.2.
Run this benchmark in your terminal:
powerpipe benchmark run azure_compliance.benchmark.pci_dss_v321_requirement_3_2Snapshot and share results via Turbot Pipes:
powerpipe benchmark run azure_compliance.benchmark.pci_dss_v321_requirement_3_2 --shareControls
- Guest accounts with owner permissions on Azure resources should be removed
- Guest accounts with read permissions on Azure resources should be removed
- Guest accounts with write permissions on Azure resources should be removed
- Audit usage of custom RBAC roles
- Accounts with owner permissions on Azure resources should be MFA enabled
- Accounts with write permissions on Azure resources should be MFA enabled
- An Azure Active Directory administrator should be provisioned for SQL servers