cis-azure-compute-20-11

name	cis-azure-compute-20.11
description	Ensure that encryption at host is enabled
category	cis-azure-compute
version	2.0.0
author	cyberstrike-official
tags	["cis","azure","virtual-machines","vm","disks","encryption"]
cis_id	20.11
cis_benchmark	CIS Microsoft Azure Compute Services Benchmark v2.0.0
tech_stack	["azure"]
cwe_ids	[]
chains_with	[]
prerequisites	[]
severity_boost	{}

Ensure that encryption at host is enabled

Description

Encryption at host enhances Azure Disk Storage Server-Side Encryption to ensure that all temporary disks and disk caches are encrypted at rest and flow encrypted to the storage clusters.

Rationale

Encryption at host provides an additional layer of security to protect sensitive information.

Impact

• Virtual machines must be deallocated for encryption at host to be enabled.
• Encryption at host does not use virtual machine CPU, and does not impact virtual machine performance.
• Encryption at host cannot be enabled on virtual machines that have ever had Azure Disk Encryption enabled.

Audit Procedure

Using Azure Portal

1. Go to Virtual machines.
2. Click the name of a virtual machine.
3. In the Properties pane, under Disk, ensure that Encryption at host is set to Enabled.
4. Repeat steps 1-3 for each virtual machine.

Using Azure CLI

Run the following command to list VM names and security profile settings:

az vm list --query [*].[name,securityProfile]

For each VM, ensure that encryptionAtHost is set to true.

Using Azure PowerShell

Run the following command to list VMs:

Get-AzVm

Run the following command to get the VM in a resource group with a given name:

$vm = Get-AzVm -ResourceGroupName <resource-group> -Name <vm>

Run the following command to get the security profile settings for the VM:

$vm.SecurityProfile

Ensure that EncryptionAtHost is set to True. Repeat for each VM.

Expected Result

All VMs should have encryptionAtHost set to true in the security profile.

Remediation

Note: Encryption at host must first be enabled in a subscription before it can be used for virtual machines.

1. From Azure Portal, select the Cloud Shell icon.
2. Run the following command to set the context to the current subscription:

Set-AzContext -SubscriptionId <subscription-id>