📝 Unattached Azure Managed Disk is not encrypted with Customer-managed key 🟢

• Contextual name: 📝 Unattached Managed Disk is not encrypted with Customer-managed key 🟢
• ID: /ce/ca/azure/virtual-machine/unattached-disk-encryption-with-cmk
• Located in: 📁 Azure Virtual Machines

Flags

• 🟢 Policy with categories
• 🟢 Policy with type
• 🟢 Production policy

Our Metadata

• Policy Type: COMPLIANCE_POLICY
• Policy Category:
  • SECURITY

Similar Policies

• Cloud Conformity
  • Server Side Encryption for Unattached Disk using CMK
• Internal
  • dec-x-f63fd4f0

Similar Internal Rules

Rule	Policies	Flags
✉️ dec-x-f63fd4f0	1

Logic

• 🧠 prod.logic.yaml 🟢
  • 📕 Azure Managed Disk
  • 🔌 Azure Managed Disk - object.extracts.yaml
  • 🧪 test-data.json

Description

Open File

Description

Ensure that unattached disks in a subscription are encrypted with a Customer Managed Key (CMK).

Rationale

Managed disks are encrypted by default with Platform-managed keys. Using Customer-managed keys may provide an additional level of security or meet an organization's regulatory requirements. Encrypting managed disks ensures that its entire content is fully unrecoverable without a key and thus protects the volume from unwarranted reads. Even if the disk is not attached to any of the VMs, there is always a risk where a compromised user account with administrative access to VM service can mount/attach these data disks, which may lead to sensitive information disclosure and tampering.

Impact

NOTE: You must have your key vault set up to utilize this. Encryption is available only on Standard tier VMs. This might cost you more.

Utilizing and maintaining Customer-managed keys will require additional work to create, protect, and rotate keys.

Audit

From Azure Portal

1. Go to Disks.
2. Click on Add Filter.

... see more

Remediation

Open File

Remediation

If data stored in the disk is no longer useful, refer to Azure documentation to delete unattached data disks at:

• https://docs.microsoft.com/en-us/rest/api/compute/disks/delete
• https://docs.microsoft.com/en-us/cli/azure/disk?view=azure-cli-latest#az-disk-delete

If data stored in the disk is important, To encrypt the disk refer azure documentation at:

• https://docs.microsoft.com/en-us/azure/virtual-machines/disks-enable-customer-managed-keys-portal
• https://docs.microsoft.com/en-us/rest/api/compute/disks/update#encryptionsettings

policy.yaml

Open File

Linked Framework Sections

Section	Sub Sections	Internal Rules	Policies	Flags
💼 APRA CPG 234 → 💼 52c appropriate encryption, cleansing and auditing of devices;		9	9
💼 APRA CPG 234 → 💼 54 Cryptographic techniques can be used to control access to sensitive data, both in storage and in transit. The strength of the cryptographic techniques deployed would be commensurate with the sensitivity and criticality of the data as well as other supplementary or compensating controls (refer to Attachment E for further guidance).		17	18
💼 CIS Azure v1.1.0 → 💼 7.3 Ensure that 'Unattached disks' are encrypted		1	1
💼 CIS Azure v1.3.0 → 💼 7.3 Ensure that 'Unattached disks' are encrypted with CMK - Level 2 (Automated)		1	1
💼 CIS Azure v1.4.0 → 💼 7.3 Ensure that 'Unattached disks' are encrypted with CMK - Level 2 (Automated)		1	1
💼 CIS Azure v1.5.0 → 💼 7.3 Ensure that 'Unattached disks' are encrypted with 'Customer Managed Key' (CMK) - Level 2 (Automated)		1	1
💼 CIS Azure v2.0.0 → 💼 7.4 Ensure that 'Unattached disks' are encrypted with 'Customer Managed Key' (CMK) - Level 2 (Automated)		1	1
💼 CIS Azure v2.1.0 → 💼 7.4 Ensure that 'Unattached disks' are encrypted with 'Customer Managed Key' (CMK) - Level 2 (Automated)		1	1
💼 CIS Azure v3.0.0 → 💼 8.4 Ensure that 'Unattached disks' are encrypted with 'Customer Managed Key' (CMK) (Automated)			1
💼 Cloudaware Framework → 💼 Data Encryption			31
💼 FedRAMP High Security Controls → 💼 AC-4(4) Flow Control of Encrypted Information (H)		20	21
💼 FedRAMP High Security Controls → 💼 SC-13 Cryptographic Protection (L)(M)(H)		13	16
💼 FedRAMP High Security Controls → 💼 SC-28 Protection of Information at Rest (L)(M)(H)	1	7	17
💼 FedRAMP High Security Controls → 💼 SC-28(1) Cryptographic Protection (L)(M)(H)		5	12
💼 FedRAMP Low Security Controls → 💼 SC-13 Cryptographic Protection (L)(M)(H)			16
💼 FedRAMP Low Security Controls → 💼 SC-28 Protection of Information at Rest (L)(M)(H)	1		17
💼 FedRAMP Low Security Controls → 💼 SC-28(1) Cryptographic Protection (L)(M)(H)			12
💼 FedRAMP Moderate Security Controls → 💼 SC-13 Cryptographic Protection (L)(M)(H)			16
💼 FedRAMP Moderate Security Controls → 💼 SC-28 Protection of Information at Rest (L)(M)(H)	1		17
💼 FedRAMP Moderate Security Controls → 💼 SC-28(1) Cryptographic Protection (L)(M)(H)			12
💼 ISO/IEC 27001:2013 → 💼 A.10.1.1 Policy on the use of cryptographic controls		14	15
💼 ISO/IEC 27001:2022 → 💼 5.33 Protection of records		10	10
💼 NIST CSF v1.1 → 💼 PR.DS-1: Data-at-rest is protected		15	19
💼 NIST CSF v1.1 → 💼 PR.DS-5: Protections against data leaks are implemented		43	51
💼 NIST CSF v2.0 → 💼 PR.DS-01: The confidentiality, integrity, and availability of data-at-rest are protected			82
💼 NIST CSF v2.0 → 💼 PR.DS-02: The confidentiality, integrity, and availability of data-in-transit are protected			69
💼 NIST CSF v2.0 → 💼 PR.DS-10: The confidentiality, integrity, and availability of data-in-use are protected			67
💼 NIST SP 800-53 Revision 5 → 💼 AC-4(2) Information Flow Enforcement _ Processing Domains		25	27
💼 NIST SP 800-53 Revision 5 → 💼 SC-28(1) Protection of Information at Rest _ Cryptographic Protection		10	12
💼 PCI DSS v3.2.1 → 💼 3.4.1 If disk encryption is used, logical access must be managed separately and independently of native operating system authentication and access control mechanisms.		7	7
💼 PCI DSS v4.0.1 → 💼 3.5.1.3 If disk-level or partition-level encryption is used (rather than file-, column-, or field--level database encryption) to render PAN unreadable.			7
💼 PCI DSS v4.0 → 💼 3.5.1.3 If disk-level or partition-level encryption is used (rather than file-, column-, or field--level database encryption) to render PAN unreadable.			7