Disks Lacking Encryption
More Info:
Encrypting disks ensures that their entire content is fully unrecoverable without a key and thus protects the volume from unwarranted reads.Risk Level
CriticalAddress
SecurityCompliance Standards
SOC2, ISO27001, GDPR, NIST, HIPAA, HITRUST, NISTCSF, PCIDSSTriage and Remediation
Remediation
Using Console
Using Console
Sure, here are the step-by-step instructions to remediate the issue of disks lacking encryption in Azure using the Azure console:
- Login to your Azure portal (https://portal.azure.com/).
- On the left-hand side of the portal, click on the “Virtual machines” option under the “Compute” section.
- Select the virtual machine that has the unencrypted disk(s) that you want to encrypt.
- In the virtual machine’s “Overview” page, click on the “Disks” option in the left-hand menu.
- Select the unencrypted disk that you want to encrypt, and then click on the “Disk encryption” option in the top menu.
- In the “Disk encryption” page, click on the “Enable encryption” button.
- In the “Enable encryption” page, select the Azure Key Vault where you want to store the disk encryption keys, or create a new one if you don’t have one already.
- Click on the “Select” button next to the “Key vault” field, and then select the key vault that you want to use or create a new one.
- In the “Encryption settings” section, choose the encryption type that you want to use. Azure offers two types of encryption: “Azure managed keys” and “Customer managed keys”.
- If you choose “Azure managed keys”, Azure will automatically generate and manage the encryption keys for you. If you choose “Customer managed keys”, you will need to provide your own encryption keys.
- Click on the “Review + create” button to review your settings.
- If everything looks good, click on the “Create” button to enable encryption for the selected disk.
Using CLI
Using CLI
To remediate disks lacking encryption in Azure using Azure CLI, you can follow these steps:
- Open Azure CLI and log in to your Azure account.
-
Run the following command to identify the disks that lack encryption:
This command will list all the disks that have encryption disabled.
-
Once you have identified the disks that lack encryption, you can enable encryption on them by running the following command:
Replace
<resource-group-name>with the name of the resource group that contains the disk,<disk-name>with the name of the disk,<encryption-type>with the encryption type you want to use (e.g. “EncryptionAtRestWithPlatformKey”), and<key-source>with the source of the encryption key (e.g. “Microsoft.Keyvault”). -
Verify that encryption has been enabled on the disk by running the following command:
This command should return “true” if encryption has been enabled on the disk.
- Repeat steps 3-4 for all the disks that lack encryption.
Using Python
Using Python
To remediate disks lacking encryption in Azure using Python, you can follow these steps:Note that you will need to replace the variables
- Import the necessary libraries:
- Authenticate with Azure using DefaultAzureCredential:
- Create clients for Compute, Storage, Resource and Network:
- Get a list of all VMs in the subscription:
- For each VM, check if any of its disks lack encryption. If a disk is found without encryption, enable encryption for that disk:
subscription_id, vault_rg, vault_name, secret_url, and key_url with the appropriate values for your environment.