Lockdown Lab #31 HIGH Microsoft Azure

Enable Azure Disk Encryption

Enable Azure Disk Encryption

Think your data in Azure is safe just because it’s “in the cloud”? Think again. If your VM disks aren’t encrypted at rest with ADE, you’re leaving a gaping hole for anyone who gets access to the underlying storage. It’s a fundamental control, yet I still see too many organizations skip it.

An attacker with access to your storage accounts or even a compromised VM can easily exfiltrate unencrypted disk images. ADE with customer-managed keys (CMK) is your last line of defense here. It means even if the storage is breached, the data remains unreadable.

This isn’t rocket science, it’s basic hygiene. You need to enable ADE for all your Azure VM disks. For new VMs, it’s a part of the provisioning process. For existing ones, you’ll need to enable it retrospectively, often with a reboot. For CMK, you’ll integrate with Azure Key Vault.

Stop rolling the dice on data confidentiality. Get this done.

The fix

# Check encryption status\naz vm encryption show --resource-group <rg> --name <vm_name>\n# Enable on VM\naz vm encryption enable --resource-group <rg> --name <vm_name> \\\n  --disk-encryption-keyvault\

Reference: CIS Azure Foundations Benchmark 7.2

Mark this as done

Open the interactive hardening checklist and tick this off in your environment.

Open interactive checklist →

Related Posts

Enable diagnostic logging for key resources

Think about the last time you had an incident. If you couldn't tell who did what, when, or how, your response was already crippled. That's...

lockdown-labhardeningazurelogging
/Shimi Cohen

Enable Microsoft Defender for Cloud

I've seen environments fall apart because basic monitoring wasn't in place. Attackers love flying under the radar. If you're running Azure without Defender for Cloud,...

lockdown-labhardeningazurelogging
/Shimi Cohen

Configure Network Security Groups (NSGs)

I've walked into far too many Azure environments where the perimeter is a sieve. The most common culprit? Missing or misconfigured Network Security Groups. This...

lockdown-labhardeningazurenetwork
/Shimi Cohen