Microsoft Azure
TMA-AZURE-COMPUTE-20.11
Ensure that encryption at host is enabled
Description
Encryption at host enhances Azure Disk Storage Server-Side Encryption to ensure that all temporary disks and disk caches are encrypted at rest and flow encrypted to the storage clusters. Encryption at host provides an additional layer of security to protect sensitive information.
Méthode de vérification
Méthode d'audit: Revue manuelle
Audit from Azure Portal 1. Go to Virtual machines. 2. Click the name of a virtual machine. 3. In the Properties pane, under Disk, ensure that Encryption at host is set to Enabled. 4. Repeat steps 1-3 for each virtual machine. Audit from Azure CLI Run the following command to list VM names and security profile settings: az vm list --query [*].[name,securityProfile] For each VM, ensure that encryptionAtHost is set to true. Audit from PowerShell Run the following command to list VMs: Get-AzVm Run the following command to get the VM in a resource group with a given name: $vm = Get-AzVm -ResourceGroupName <resource-group> -Name <vm> Run the following command to get the security profile settings for the VM: $vm.SecurityProfile Ensure that EncryptionAtHost is set to True. Repeat for each VM. Audit from Azure Policy If referencing a digital copy of this Benchmark, clicking a Policy ID will open a link to the associated Policy definition in Azure. If referencing a printed copy, you can search Policy IDs from this URL: https://portal.azure.com/#view/Microsoft_Azure_Policy/PolicyMenuBlade/~/Definitions - Policy ID: fc4d8e41-e223-45ea-9bf5-eada37891d87 - Name: 'Virtual machines and virtual...
Méthode de correction
Méthode de correction: Recommandation ou correctif d'infrastructure
Note: Encryption at host must first be enabled in a subscription before it can be used for virtual machines. 1. From Azure Portal, select the Cloud Shell icon. 2. Run the following command to set the context to the current subscription: Set-AzContext -SubscriptionId <subscription-id> 1. Run the following command to register the encryption at host feature for the subscription: Register-AzProviderFeature -FeatureName "EncryptionAtHost" -ProviderNamespace "Microsoft.Compute" 1. Run the following command to confirm that the RegistrationState is Registered: Get-AzProviderFeature -FeatureName "EncryptionAtHost" -ProviderNamespace "Microsoft.Compute" Remediate from Azure Portal Note: Ensure that it is safe to change the state of the VM. 1. Go to Virtual machines. 2. Click the name of a virtual machine. 3. Click Stop. 4. Click Yes. 5. Under Settings, click Disks. 6. Click Additional settings. 7. Next to Encryption at host, select Yes. 8. Click Save. 9. Click Overview. 10. Click Start. 11. Repeat steps 1-10 for each virtual machine requiring remediation. Remediate from Azure CLI Note: Ensure that it is safe to change the state of the VM. Run the following command to deallocate the VM: az...
Propriétés
- Systèmes d'exploitation
- Tous
- Étiquettes
- azurecloudcomputeencryption
- Référence
- CIS Microsoft Azure Compute Services Benchmark v2.0.0 - 20.11 Ensure that encryption at host is enabled