Key Expiration Disabled

Risk Level: Low

Description

The plugin checks whether or not the expiration time is set for keys in the Azure key vault to ensure that the keys are changing after a certain time period. This restricts unused and forgotten keys to be reused. 

About the Service

Key Vaults: Azure provides a facility to store and manage sensitive data such as certificates, user ids and passwords through key vaults service. The keys are embedded in the URL which reduces the accidental or intentional exposure of the keys. 

Impact

Setting up an expiration period for the keys ensures that the key gets changed from time to time which is considered to be in accordance with cyber hygiene. The timely update in the keys will avoid the reuse of forgotten or unused keys. 

Steps to Reproduce

1. Log in to the Azure portal.
2. Click on Key vaults under Services or type “Key vaults” in the search box.
   
3. Select a subscription to examine the issue.
   
4. From the navigation bar, go to keys under Settings.
   
5. On the overview board, for the provided keys, if the Expiration date column is set to blank for any of the keys, visit the Steps to Remediation section.
   
6. Repeat for other keys as well.

Steps for Remediation

1. Log in to the Azure portal.
2. Click on Key vaults under Services or type “Key vaults” in the search box.
   
3. Select a subscription to examine the issue.
4. From the navigation bar, go to keys under Settings.
   
5. Select the encrypted key to enable the expiration and set a date. 
   
6. Click on the check box given in front of Set Expiration date, mention the expiry date and time and set the time zone as required in front of the Expiration date. Click on Save.
   
7. Repeat for other keys as well.

Please feel free to reach out to support@pingsafe.ai with any questions that you may have.

Thanks

PingSafe Support