OS Disks Lacking Encryption
More Info:
Encrypting the IaaS VMs OS disk (boot volume) ensures that its entire content is fully unrecoverable without a key and thus protects the volume from unwarranted reads.Risk Level
HighAddress
SecurityCompliance Standards
HIPAA, HITRUST, SOC2, NISTCSF, PCIDSSTriage and Remediation
Remediation
Using Console
Using Console
Here are the steps to remediate the OS Disks Lacking Encryption misconfiguration in AZURE using the AZURE console:
- Log in to the AZURE portal.
- Navigate to the Virtual Machines blade.
- Select the virtual machine that has the OS Disks Lacking Encryption misconfiguration.
- Click on the “Disks” option under the Settings section.
- Select the OS disk that you want to encrypt.
- Click on the “Disk Encryption” option under the “Settings” section.
- Click on the “Enable” button to enable the disk encryption.
- Choose the encryption type and the encryption key.
- Click on the “Save” button to save the changes.
Using CLI
Using CLI
To remediate the misconfiguration of OS Disks lacking encryption in AZURE using AZURE CLI, you can follow the below steps:
- Open the Azure CLI on your local machine or Azure Cloud Shell.
-
Run the following command to check if the encryption is enabled on the VM:
az vm encryption show --resource-group <resource-group-name> --name <vm-name>Replace<resource-group-name>with the name of the resource group in which the VM is located, and<vm-name>with the name of the VM. -
If encryption is not enabled on the VM, run the following command to enable encryption:
az vm encryption enable --resource-group <resource-group-name> --name <vm-name> --disk-encryption-keyvault <key-vault-name> --key-encryption-keyvault <key-vault-name> --volume-type ALLReplace<resource-group-name>with the name of the resource group in which the VM is located,<vm-name>with the name of the VM, and<key-vault-name>with the name of the key vault where encryption keys are stored. - Once the command is executed successfully, the encryption process will start, and it may take some time depending on the size of the VM.
-
After the encryption process is complete, run the following command to verify that encryption is enabled:
az vm encryption show --resource-group <resource-group-name> --name <vm-name>This command will display the encryption status of the VM. - Finally, confirm that the OS disks are encrypted by logging into the VM and checking the disk properties.
Using Python
Using Python
To remediate the misconfiguration of OS Disks Lacking Encryption in AZURE using python, follow these steps:
- Install the Azure SDK for Python using the following command:
- Import the necessary modules:
- Authenticate to the Azure account using the
DefaultAzureCredentialclass:
- Get a list of all the virtual machines in the subscription:
- For each virtual machine, check if the OS disk is encrypted or not:
- Save the script and run it to remediate the misconfiguration.