Azure Disks Lacking Encryption

More Info:

Encrypting disks ensures that their entire content is fully unrecoverable without a key and thus protects the volume from unwarranted reads.

Risk Level

Critical

Address

Security

Compliance Standards

• APRA CPS 234 (Australia)
• BSI C5 (Germany)
• Brazil LGPD
• CCPA / CPRA (California)
• CIS Critical Security Controls v8
• CMMC 2.0
• CSA Cloud Controls Matrix v4
• DPDPA
• Digital Operational Resilience Act (EU)
• GDPR
• HIPAA
• HITRUST CSF
• ISO 27001
• ISO/IEC 27017
• ISO/IEC 27018
• ISO/IEC 27701
• KSA PDPL
• MAS Technology Risk Management (Singapore)
• MITRE ATT&CK (Cloud)
• NIS2 Directive
• NIST
• NIST CSF
• NIST SP 800-171
• NYDFS 23 NYCRR 500
• PCI
• Reserve Bank of India (RBI) Cyber Security Framework
• SOC2
• SWIFT Customer Security Controls Framework
• Sarbanes-Oxley IT General Controls
• Securities and Exchange Board of India (SEBI) - Cloud Security Adoption Framework
• UK NCSC Cyber Assessment Framework

Triage and Remediation

Remediation

Remediation

Using Console

Sure, here are the step-by-step instructions to remediate the issue of disks lacking encryption in Azure using the Azure console:

1. Login to your Azure portal (https://portal.azure.com/).

2. On the left-hand side of the portal, click on the "Virtual machines" option under the "Compute" section.

3. Select the virtual machine that has the unencrypted disk(s) that you want to encrypt.

4. In the virtual machine's "Overview" page, click on the "Disks" option in the left-hand menu.

5. Select the unencrypted disk that you want to encrypt, and then click on the "Disk encryption" option in the top menu.

6. In the "Disk encryption" page, click on the "Enable encryption" button.

7. In the "Enable encryption" page, select the Azure Key Vault where you want to store the disk encryption keys, or create a new one if you don't have one already.

8. Click on the "Select" button next to the "Key vault" field, and then select the key vault that you want to use or create a new one.

9. In the "Encryption settings" section, choose the encryption type that you want to use. Azure offers two types of encryption: "Azure managed keys" and "Customer managed keys".

10. If you choose "Azure managed keys", Azure will automatically generate and manage the encryption keys for you. If you choose "Customer managed keys", you will need to provide your own encryption keys.

11. Click on the "Review + create" button to review your settings.

12. If everything looks good, click on the "Create" button to enable encryption for the selected disk.

That's it! The selected disk will now be encrypted using the encryption settings that you specified. Repeat the above steps for any other unencrypted disks that you want to encrypt.

Using CLI

To remediate disks lacking encryption in Azure using Azure CLI, you can follow these steps:

1. Open Azure CLI and log in to your Azure account.

2. Run the following command to identify the disks that lack encryption:

   az disk list --query "[?encryptionSettingsCollection.enabled=='false']"

   This command will list all the disks that have encryption disabled.

3. Once you have identified the disks that lack encryption, you can enable encryption on them by running the following command:

   az disk encryption set --resource-group <resource-group-name> --name <disk-name> --encryption-type <encryption-type> --key-source <key-source>

   Replace <resource-group-name> with the name of the resource group that contains the disk, <disk-name> with the name of the disk, <encryption-type> with the encryption type you want to use (e.g. "EncryptionAtRestWithPlatformKey"), and <key-source> with the source of the encryption key (e.g. "Microsoft.Keyvault").

4. Verify that encryption has been enabled on the disk by running the following command:

   az disk show --resource-group <resource-group-name> --name <disk-name> --query "encryptionSettingsCollection.enabled"

   This command should return "true" if encryption has been enabled on the disk.

5. Repeat steps 3-4 for all the disks that lack encryption.

By following these steps, you can remediate disks lacking encryption in Azure using Azure CLI.

Using Python

To remediate disks lacking encryption in Azure using Python, you can follow these steps:

1. Import the necessary libraries:

from azure.identity import DefaultAzureCredential
from azure.mgmt.compute import ComputeManagementClient
from azure.mgmt.storage import StorageManagementClient
from azure.mgmt.resource import ResourceManagementClient
from azure.mgmt.network import NetworkManagementClient

2. Authenticate with Azure using DefaultAzureCredential:

credential = DefaultAzureCredential()

3. Create clients for Compute, Storage, Resource and Network:

compute_client = ComputeManagementClient(credential, subscription_id)
storage_client = StorageManagementClient(credential, subscription_id)
resource_client = ResourceManagementClient(credential, subscription_id)
network_client = NetworkManagementClient(credential, subscription_id)

4. Get a list of all VMs in the subscription:

vms = compute_client.virtual_machines.list_all()

5. For each VM, check if any of its disks lack encryption. If a disk is found without encryption, enable encryption for that disk:

for vm in vms:
    vm_name = vm.name
    vm_rg = vm.id.split('/')[4]
    disks = compute_client.disks.list_by_resource_group(vm_rg)
    for disk in disks:
        disk_name = disk.name
        disk_rg = disk.id.split('/')[4]
        disk_encryption = compute_client.disks.get_encryption_status(disk_rg, disk_name)
        if not disk_encryption:
            encryption_settings = {
                "disk_encryption_key": {
                    "sourceVault": {
                        "id": "/subscriptions/" + subscription_id + "/resourceGroups/" + vault_rg + "/providers/Microsoft.KeyVault/vaults/" + vault_name
                    },
                    "secretUrl": secret_url
                },
                "keyEncryptionKey": {
                    "keyUrl": key_url,
                    "sourceVault": {
                        "id": "/subscriptions/" + subscription_id + "/resourceGroups/" + vault_rg + "/providers/Microsoft.KeyVault/vaults/" + vault_name
                    }
                }
            }
            compute_client.disks.enable_encryption(disk_rg, disk_name, encryption_settings)

Note that you will need to replace the variables subscription_id, vault_rg, vault_name, secret_url, and key_url with the appropriate values for your environment.

Using Terraform

# Customer-managed key for disk encryption
resource "azurerm_key_vault" "DISK_KV" {
  name                = "DISK_KEY_VAULT_NAME"            # substitute: globally-unique Key Vault name
  location            = "AZURE_REGION"                   # substitute: e.g. "eastus"
  resource_group_name = "RESOURCE_GROUP_NAME"            # substitute: existing resource group
  sku_name            = "standard"
  tenant_id           = "TENANT_ID"                      # substitute: Azure AD tenant ID

  soft_delete_retention_days = 7
  purge_protection_enabled   = true
}

resource "azurerm_key_vault_key" "DISK_CMK" {
  name         = "DISK_ENCRYPTION_KEY_NAME"              # substitute: key name
  key_vault_id = azurerm_key_vault.DISK_KV.id
  key_type     = "RSA"
  key_size     = 2048

  key_opts = [
    "decrypt",
    "encrypt",
    "wrapKey",
    "unwrapKey",
  ]
}

# Disk Encryption Set (DES) using the CMK above
resource "azurerm_disk_encryption_set" "DISK_DES" {
  name                = "DISK_ENCRYPTION_SET_NAME"       # substitute: DES name
  location            = azurerm_key_vault.DISK_KV.location
  resource_group_name = azurerm_key_vault.DISK_KV.resource_group_name

  key_vault_key_id = azurerm_key_vault_key.DISK_CMK.id

  identity {
    type = "SystemAssigned"
  }
}

# Grant the DES identity access to the CMK
resource "azurerm_key_vault_access_policy" "DISK_DES_POLICY" {
  key_vault_id = azurerm_key_vault.DISK_KV.id
  tenant_id    = azurerm_disk_encryption_set.DISK_DES.identity[0].tenant_id
  object_id    = azurerm_disk_encryption_set.DISK_DES.identity[0].principal_id

  key_permissions = [
    "get",
    "wrapKey",
    "unwrapKey",
  ]
}

# Managed disk with encryption enabled via Disk Encryption Set (CMK)
# NOTE: adding or changing disk_encryption_set_id on an existing disk forces replacement,
# which is an outage for any VM using this disk. Plan carefully.
resource "azurerm_managed_disk" "VM_DISK" {
  name                 = "VM_DISK_NAME"                  # substitute: disk name
  location             = "AZURE_REGION"                  # substitute: e.g. "eastus"
  resource_group_name  = "RESOURCE_GROUP_NAME"           # substitute: existing resource group
  storage_account_type = "Premium_LRS"
  create_option        = "Empty"
  disk_size_gb         = 128

  # This is the setting that remediates "Disks Lacking Encryption"
  disk_encryption_set_id = azurerm_disk_encryption_set.DISK_DES.id
}

Changing or adding disk_encryption_set_id on an existing azurerm_managed_disk will show in terraform plan as the disk being destroyed and recreated (-/+ or forces replacement on that resource), and any attached VM will show a change to point to the new disk.

Additional Reading:

• https://docs.microsoft.com/en-us/azure/security/azure-security-disk-encryption-overview
• https://docs.microsoft.com/en-us/azure/security-center/security-center-apply-disk-encryption