OS Disks Lacking Encryption

Using Console

Here are the steps to remediate the OS Disks Lacking Encryption misconfiguration in AZURE using the AZURE console:

Log in to the AZURE portal.
Navigate to the Virtual Machines blade.
Select the virtual machine that has the OS Disks Lacking Encryption misconfiguration.
Click on the “Disks” option under the Settings section.
Select the OS disk that you want to encrypt.
Click on the “Disk Encryption” option under the “Settings” section.
Click on the “Enable” button to enable the disk encryption.
Choose the encryption type and the encryption key.
Click on the “Save” button to save the changes.

Once the encryption is enabled, the OS disk will be encrypted, and the misconfiguration will be remediated. It is important to note that the encryption process may take some time to complete, depending on the size of the disk.

Using CLI

To remediate the misconfiguration of OS Disks lacking encryption in AZURE using AZURE CLI, you can follow the below steps:

Open the Azure CLI on your local machine or Azure Cloud Shell.
Run the following command to check if the encryption is enabled on the VM: az vm encryption show --resource-group <resource-group-name> --name <vm-name> Replace <resource-group-name> with the name of the resource group in which the VM is located, and <vm-name> with the name of the VM.
If encryption is not enabled on the VM, run the following command to enable encryption: az vm encryption enable --resource-group <resource-group-name> --name <vm-name> --disk-encryption-keyvault <key-vault-name> --key-encryption-keyvault <key-vault-name> --volume-type ALL Replace <resource-group-name> with the name of the resource group in which the VM is located, <vm-name> with the name of the VM, and <key-vault-name> with the name of the key vault where encryption keys are stored.
Once the command is executed successfully, the encryption process will start, and it may take some time depending on the size of the VM.
After the encryption process is complete, run the following command to verify that encryption is enabled: az vm encryption show --resource-group <resource-group-name> --name <vm-name> This command will display the encryption status of the VM.
Finally, confirm that the OS disks are encrypted by logging into the VM and checking the disk properties.

By following these steps, you can remediate the misconfiguration of OS disks lacking encryption in Azure using Azure CLI.

Using Python

To remediate the misconfiguration of OS Disks Lacking Encryption in AZURE using python, follow these steps:

Install the Azure SDK for Python using the following command:

pip install azure-mgmt-compute

Import the necessary modules:

from azure.identity import DefaultAzureCredential
from azure.mgmt.compute import ComputeManagementClient

Authenticate to the Azure account using the DefaultAzureCredential class:

credential = DefaultAzureCredential()
subscription_id = 'your-subscription-id'
compute_client = ComputeManagementClient(credential, subscription_id)

Get a list of all the virtual machines in the subscription:

vm_list = compute_client.virtual_machines.list_all()

For each virtual machine, check if the OS disk is encrypted or not:

for vm in vm_list:
    os_disk = vm.storage_profile.os_disk
    if not os_disk.encryption_settings:
        # Encrypt the OS disk
        encryption_settings = compute_client.disks.create_or_update_encryption_settings(
            resource_group_name=vm.id.split('/')[4],
            disk_name=os_disk.name,
            encryption_settings={
                "enabled": True
            }
        )

Save the script and run it to remediate the misconfiguration.

Note: This script assumes that the virtual machines are using managed disks. If the virtual machines are using unmanaged disks, you will need to modify the script accordingly.

Using Terraform

resource "azurerm_resource_group" "RG_NAME" {
  name     = "RG_NAME"          # replace with your resource group name
  location = "AZURE_REGION"     # e.g. "eastus"
}

resource "azurerm_key_vault" "OS_DISK_KV" {
  name                        = "KEY_VAULT_NAME"          # must be globally unique
  location                    = azurerm_resource_group.RG_NAME.location
  resource_group_name         = azurerm_resource_group.RG_NAME.name
  tenant_id                   = "TENANT_ID"               # replace with your AAD tenant ID
  sku_name                    = "standard"
  purge_protection_enabled    = true
  soft_delete_retention_days  = 90

  access_policy {
    tenant_id = "TENANT_ID"
    object_id = "DISK_ENCRYPTION_SET_MSI_OBJECT_ID"       # will be the DES identity later
    key_permissions = [
      "Get",
      "WrapKey",
      "UnwrapKey",
    ]
  }
}

resource "azurerm_key_vault_key" "OS_DISK_KEY" {
  name         = "os-disk-cmk"
  key_vault_id = azurerm_key_vault.OS_DISK_KV.id
  key_type     = "RSA"
  key_size     = 2048

  key_opts = [
    "wrapKey",
    "unwrapKey",
  ]
}

resource "azurerm_disk_encryption_set" "OS_DISK_DES" {
  name                = "os-disk-des"
  location            = azurerm_resource_group.RG_NAME.location
  resource_group_name = azurerm_resource_group.RG_NAME.name
  key_vault_key_id    = azurerm_key_vault_key.OS_DISK_KEY.id

  identity {
    type = "SystemAssigned"
  }
}

resource "azurerm_linux_virtual_machine" "VM_NAME" {
  name                = "VM_NAME"                # replace with your VM name
  location            = azurerm_resource_group.RG_NAME.location
  resource_group_name = azurerm_resource_group.RG_NAME.name
  size                = "Standard_DS1_v2"
  admin_username      = "ADMIN_USERNAME"
  network_interface_ids = [
    "NIC_RESOURCE_ID",                             # reference your NIC
  ]

  os_disk {
    name                 = "VM_NAME-osdisk"
    caching              = "ReadWrite"
    storage_account_type = "Premium_LRS"

    # This is the fix: encrypt the OS disk with a Disk Encryption Set (customer-managed key)
    disk_encryption_set_id = azurerm_disk_encryption_set.OS_DISK_DES.id
  }

  source_image_reference {
    publisher = "Canonical"
    offer     = "0001-com-ubuntu-server-focal"
    sku       = "20_04-lts"
    version   = "latest"
  }

  admin_ssh_key {
    username   = "ADMIN_USERNAME"
    public_key = "SSH_PUBLIC_KEY"
  }
}

Changing or adding disk_encryption_set_id on the existing OS disk forces replacement of the OS disk and VM (planned downtime and data loss on that disk), so apply only after backups or migration.For an existing standalone managed OS disk (azurerm_managed_disk), set disk_encryption_set_id similarly on that resource; this also forces disk replacement.Verification: terraform plan should show creation of azurerm_disk_encryption_set.OS_DISK_DES (and its Key Vault/key if new) and an update to the VM (or managed disk) adding disk_encryption_set_id on the OS disk, with a note that the disk and VM will be recreated.

Azure Introduction

Azure Pricing

Azure Threats

Azure Misconfigurations

OS Disks Lacking Encryption

More Info:

Risk Level

Address

Compliance Standards

Triage and Remediation

Remediation

Additional Reading:

​More Info:

​Risk Level

​Address

​Compliance Standards

​Triage and Remediation

​Remediation

​

​Additional Reading: