> ## Documentation Index > Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt > Use this file to discover all available pages before exploring further. # Disks Lacking Encryption ### More Info: Encrypting disks ensures that their entire content is fully unrecoverable without a key and thus protects the volume from unwarranted reads. ### Risk Level Critical ### Address Security ### Compliance Standards * APRA CPS 234 (Australia) * BSI C5 (Germany) * Brazil LGPD * CCPA / CPRA (California) * CIS Critical Security Controls v8 * CMMC 2.0 * CSA Cloud Controls Matrix v4 * DPDPA * Digital Operational Resilience Act (EU) * GDPR * HIPAA * HITRUST CSF * ISO 27001 * ISO/IEC 27017 * ISO/IEC 27018 * ISO/IEC 27701 * KSA PDPL * MAS Technology Risk Management (Singapore) * MITRE ATT\&CK (Cloud) * NIS2 Directive * NIST * NIST CSF * NIST SP 800-171 * NYDFS 23 NYCRR 500 * PCI * Reserve Bank of India (RBI) Cyber Security Framework * SOC2 * SWIFT Customer Security Controls Framework * Sarbanes-Oxley IT General Controls * Securities and Exchange Board of India (SEBI) - Cloud Security Adoption Framework * UK NCSC Cyber Assessment Framework ### Triage and Remediation ### Remediation Sure, here are the step-by-step instructions to remediate the issue of disks lacking encryption in Azure using the Azure console: 1. Login to your Azure portal ([https://portal.azure.com/](https://portal.azure.com/)). 2. On the left-hand side of the portal, click on the "Virtual machines" option under the "Compute" section. 3. Select the virtual machine that has the unencrypted disk(s) that you want to encrypt. 4. In the virtual machine's "Overview" page, click on the "Disks" option in the left-hand menu. 5. Select the unencrypted disk that you want to encrypt, and then click on the "Disk encryption" option in the top menu. 6. In the "Disk encryption" page, click on the "Enable encryption" button. 7. In the "Enable encryption" page, select the Azure Key Vault where you want to store the disk encryption keys, or create a new one if you don't have one already. 8. Click on the "Select" button next to the "Key vault" field, and then select the key vault that you want to use or create a new one. 9. In the "Encryption settings" section, choose the encryption type that you want to use. Azure offers two types of encryption: "Azure managed keys" and "Customer managed keys". 10. If you choose "Azure managed keys", Azure will automatically generate and manage the encryption keys for you. If you choose "Customer managed keys", you will need to provide your own encryption keys. 11. Click on the "Review + create" button to review your settings. 12. If everything looks good, click on the "Create" button to enable encryption for the selected disk. That's it! The selected disk will now be encrypted using the encryption settings that you specified. Repeat the above steps for any other unencrypted disks that you want to encrypt. # To remediate disks lacking encryption in Azure using Azure CLI, you can follow these steps: 1. Open Azure CLI and log in to your Azure account. 2. Run the following command to identify the disks that lack encryption: ``` az disk list --query "[?encryptionSettingsCollection.enabled=='false']" ``` This command will list all the disks that have encryption disabled. 3. Once you have identified the disks that lack encryption, you can enable encryption on them by running the following command: ``` az disk encryption set --resource-group --name --encryption-type --key-source ``` Replace `` with the name of the resource group that contains the disk, `` with the name of the disk, `` with the encryption type you want to use (e.g. "EncryptionAtRestWithPlatformKey"), and `` with the source of the encryption key (e.g. "Microsoft.Keyvault"). 4. Verify that encryption has been enabled on the disk by running the following command: ``` az disk show --resource-group --name --query "encryptionSettingsCollection.enabled" ``` This command should return "true" if encryption has been enabled on the disk. 5. Repeat steps 3-4 for all the disks that lack encryption. By following these steps, you can remediate disks lacking encryption in Azure using Azure CLI. To remediate disks lacking encryption in Azure using Python, you can follow these steps: 1. Import the necessary libraries: ```python theme={null} from azure.identity import DefaultAzureCredential from azure.mgmt.compute import ComputeManagementClient from azure.mgmt.storage import StorageManagementClient from azure.mgmt.resource import ResourceManagementClient from azure.mgmt.network import NetworkManagementClient ``` 2. Authenticate with Azure using DefaultAzureCredential: ```python theme={null} credential = DefaultAzureCredential() ``` 3. Create clients for Compute, Storage, Resource and Network: ```python theme={null} compute_client = ComputeManagementClient(credential, subscription_id) storage_client = StorageManagementClient(credential, subscription_id) resource_client = ResourceManagementClient(credential, subscription_id) network_client = NetworkManagementClient(credential, subscription_id) ``` 4. Get a list of all VMs in the subscription: ```python theme={null} vms = compute_client.virtual_machines.list_all() ``` 5. For each VM, check if any of its disks lack encryption. If a disk is found without encryption, enable encryption for that disk: ```python theme={null} for vm in vms: vm_name = vm.name vm_rg = vm.id.split('/')[4] disks = compute_client.disks.list_by_resource_group(vm_rg) for disk in disks: disk_name = disk.name disk_rg = disk.id.split('/')[4] disk_encryption = compute_client.disks.get_encryption_status(disk_rg, disk_name) if not disk_encryption: encryption_settings = { "disk_encryption_key": { "sourceVault": { "id": "/subscriptions/" + subscription_id + "/resourceGroups/" + vault_rg + "/providers/Microsoft.KeyVault/vaults/" + vault_name }, "secretUrl": secret_url }, "keyEncryptionKey": { "keyUrl": key_url, "sourceVault": { "id": "/subscriptions/" + subscription_id + "/resourceGroups/" + vault_rg + "/providers/Microsoft.KeyVault/vaults/" + vault_name } } } compute_client.disks.enable_encryption(disk_rg, disk_name, encryption_settings) ``` Note that you will need to replace the variables `subscription_id`, `vault_rg`, `vault_name`, `secret_url`, and `key_url` with the appropriate values for your environment. ```hcl theme={null} # Customer-managed key for disk encryption resource "azurerm_key_vault" "DISK_KV" { name = "DISK_KEY_VAULT_NAME" # substitute: globally-unique Key Vault name location = "AZURE_REGION" # substitute: e.g. "eastus" resource_group_name = "RESOURCE_GROUP_NAME" # substitute: existing resource group sku_name = "standard" tenant_id = "TENANT_ID" # substitute: Azure AD tenant ID soft_delete_retention_days = 7 purge_protection_enabled = true } resource "azurerm_key_vault_key" "DISK_CMK" { name = "DISK_ENCRYPTION_KEY_NAME" # substitute: key name key_vault_id = azurerm_key_vault.DISK_KV.id key_type = "RSA" key_size = 2048 key_opts = [ "decrypt", "encrypt", "wrapKey", "unwrapKey", ] } # Disk Encryption Set (DES) using the CMK above resource "azurerm_disk_encryption_set" "DISK_DES" { name = "DISK_ENCRYPTION_SET_NAME" # substitute: DES name location = azurerm_key_vault.DISK_KV.location resource_group_name = azurerm_key_vault.DISK_KV.resource_group_name key_vault_key_id = azurerm_key_vault_key.DISK_CMK.id identity { type = "SystemAssigned" } } # Grant the DES identity access to the CMK resource "azurerm_key_vault_access_policy" "DISK_DES_POLICY" { key_vault_id = azurerm_key_vault.DISK_KV.id tenant_id = azurerm_disk_encryption_set.DISK_DES.identity[0].tenant_id object_id = azurerm_disk_encryption_set.DISK_DES.identity[0].principal_id key_permissions = [ "get", "wrapKey", "unwrapKey", ] } # Managed disk with encryption enabled via Disk Encryption Set (CMK) # NOTE: adding or changing disk_encryption_set_id on an existing disk forces replacement, # which is an outage for any VM using this disk. Plan carefully. resource "azurerm_managed_disk" "VM_DISK" { name = "VM_DISK_NAME" # substitute: disk name location = "AZURE_REGION" # substitute: e.g. "eastus" resource_group_name = "RESOURCE_GROUP_NAME" # substitute: existing resource group storage_account_type = "Premium_LRS" create_option = "Empty" disk_size_gb = 128 # This is the setting that remediates "Disks Lacking Encryption" disk_encryption_set_id = azurerm_disk_encryption_set.DISK_DES.id } ``` Changing or adding `disk_encryption_set_id` on an existing `azurerm_managed_disk` will show in `terraform plan` as the disk being destroyed and recreated (`-/+` or `forces replacement` on that resource), and any attached VM will show a change to point to the new disk. ### Additional Reading: * [https://docs.microsoft.com/en-us/azure/security/azure-security-disk-encryption-overview](https://docs.microsoft.com/en-us/azure/security/azure-security-disk-encryption-overview) * [https://docs.microsoft.com/en-us/azure/security-center/security-center-apply-disk-encryption](https://docs.microsoft.com/en-us/azure/security-center/security-center-apply-disk-encryption)