cis-azure-compute-20-10

name	cis-azure-compute-20.10
description	Ensure Trusted Launch is enabled on Virtual Machines
category	cis-azure-compute
version	2.0.0
author	cyberstrike-official
tags	["cis","azure","virtual-machines","vm","disks","encryption"]
cis_id	20.10
cis_benchmark	CIS Microsoft Azure Compute Services Benchmark v2.0.0
tech_stack	["azure"]
cwe_ids	[]
chains_with	[]
prerequisites	[]
severity_boost	{}

Ensure Trusted Launch is enabled on Virtual Machines

Description

When Secure Boot and vTPM are enabled together, they provide a strong foundation for protecting your VM from boot attacks. For example, if an attacker attempts to replace the bootloader with a malicious version, Secure Boot will prevent the VM from booting. If the attacker is able to bypass Secure Boot and install a malicious bootloader, vTPM can be used to detect the intrusion and alert you.

Rationale

Secure Boot and vTPM work together to protect your VM from a variety of boot attacks, including bootkits, rootkits, and firmware rootkits. Not enabling Trusted Launch in Azure VM can lead to increased vulnerability to rootkits and boot-level malware, reduced ability to detect and prevent unauthorized changes to the boot process, and a potential compromise of system integrity and data security.

Impact

Secure Boot and vTPM are not currently supported for Azure Generation 1 VMs.

IMPORTANT: Before enabling Secure Boot and vTPM on a Generation 2 VM which does not already have both enabled, it is highly recommended to create a restore point of the VM prior to remediation.

Audit Procedure

Using Azure Portal

1. Go to Virtual Machines
2. For each VM, under Settings, click on Configuration on the left blade
3. Under Security Type, make sure security type is not standard and if it is Trusted Launch Virtual Machines then make sure Enable Secure Boot & Enable vTPM are checked

Using Azure CLI

Run the following command to list VM names and security profile settings:

az vm list --query [*].[name,securityProfile]

For each VM, ensure that securityType is set to TrustedLaunch, uefiSettings.secureBootEnabled is set to true, and uefiSettings.vTpmEnabled is set to true.

Using Azure PowerShell

Run the following command to list VMs:

Get-AzVm

Run the following command to get the VM in a resource group with a given name:

$vm = Get-AzVm -ResourceGroupName <resource-group> -Name <vm>

Run the following command to get the security profile settings for the VM:

$vm.SecurityProfile

Ensure that SecurityType is set to TrustedLaunch.