🛡️ Azure Unattached Managed Disk is not encrypted with Customer-managed key🟢

• Contextual name: 🛡️ Unattached Managed Disk is not encrypted with Customer-managed key🟢
• ID: /ce/ca/azure/virtual-machine/unattached-disk-encryption-with-cmk
• Tags:
  • 🟢 Policy with categories
  • 🟢 Policy with type
  • 🟢 Production policy
• Policy Type: COMPLIANCE_POLICY
• Policy Categories: SECURITY

Logic

• 🧠 prod.logic.yaml🟢
  • 📗 Azure Managed Disk
  • 🔌 Azure Managed Disk - object.extracts.yaml
  • 🧪 test-data.json

Similar Policies

• Cloud Conformity: Server Side Encryption for Unattached Disk using CMK
• Internal: dec-x-f63fd4f0

Similar Internal Rules

Rule	Policies	Flags
✉️ dec-x-f63fd4f0	1

Description

Open File

Description

Ensure that unattached disks in a subscription are encrypted with a Customer Managed Key (CMK).

Rationale

Managed disks are encrypted by default with Platform-managed keys. Using Customer-managed keys may provide an additional level of security or meet an organization's regulatory requirements. Encrypting managed disks ensures that its entire content is fully unrecoverable without a key and thus protects the volume from unwarranted reads. Even if the disk is not attached to any of the VMs, there is always a risk where a compromised user account with administrative access to VM service can mount/attach these data disks, which may lead to sensitive information disclosure and tampering.

Impact

NOTE: You must have your key vault set up to utilize this. Encryption is available only on Standard tier VMs. This might cost you more.

Utilizing and maintaining Customer-managed keys will require additional work to create, protect, and rotate keys.

Audit

From Azure Portal

1. Go to Disks.
2. Click on Add Filter.

... see more

Remediation

Open File

Remediation

If data stored in the disk is no longer useful, refer to Azure documentation to delete unattached data disks at:

• https://docs.microsoft.com/en-us/rest/api/compute/disks/delete
• https://docs.microsoft.com/en-us/cli/azure/disk?view=azure-cli-latest#az-disk-delete

If data stored in the disk is important, To encrypt the disk refer azure documentation at:

• https://docs.microsoft.com/en-us/azure/virtual-machines/disks-enable-customer-managed-keys-portal
• https://docs.microsoft.com/en-us/rest/api/compute/disks/update#encryptionsettings

policy.yaml

Open File

Linked Framework Sections

Section	Sub Sections	Internal Rules	Policies	Flags	Compliance
💼 APRA CPG 234 → 💼 52c appropriate encryption, cleansing and auditing of devices;		9	9		no data
💼 APRA CPG 234 → 💼 54 Cryptographic techniques can be used to control access to sensitive data, both in storage and in transit. The strength of the cryptographic techniques deployed would be commensurate with the sensitivity and criticality of the data as well as other supplementary or compensating controls (refer to Attachment E for further guidance).		21	22		no data
💼 CIS Azure v1.1.0 → 💼 7.3 Ensure that 'Unattached disks' are encrypted		1	1		no data
💼 CIS Azure v1.3.0 → 💼 7.3 Ensure that 'Unattached disks' are encrypted with CMK - Level 2 (Automated)		1	1		no data
💼 CIS Azure v1.4.0 → 💼 7.3 Ensure that 'Unattached disks' are encrypted with CMK - Level 2 (Automated)		1	1		no data
💼 CIS Azure v1.5.0 → 💼 7.3 Ensure that 'Unattached disks' are encrypted with 'Customer Managed Key' (CMK) - Level 2 (Automated)		1	1		no data
💼 CIS Azure v2.0.0 → 💼 7.4 Ensure that 'Unattached disks' are encrypted with 'Customer Managed Key' (CMK) - Level 2 (Automated)		1	1		no data
💼 CIS Azure v2.1.0 → 💼 7.4 Ensure that 'Unattached disks' are encrypted with 'Customer Managed Key' (CMK) - Level 2 (Automated)		1	1		no data
💼 CIS Azure v3.0.0 → 💼 8.4 Ensure that 'Unattached disks' are encrypted with 'Customer Managed Key' (CMK) (Automated)			1		no data
💼 Cloudaware Framework → 💼 Data Encryption			44		no data
💼 FedRAMP High Security Controls → 💼 AC-4(4) Flow Control of Encrypted Information (H)		25	26		no data
💼 FedRAMP High Security Controls → 💼 SC-13 Cryptographic Protection (L)(M)(H)		16	24		no data
💼 FedRAMP High Security Controls → 💼 SC-28 Protection of Information at Rest (L)(M)(H)	1	7	24		no data
💼 FedRAMP High Security Controls → 💼 SC-28(1) Cryptographic Protection (L)(M)(H)		5	14		no data
💼 FedRAMP Low Security Controls → 💼 SC-13 Cryptographic Protection (L)(M)(H)			24		no data
💼 FedRAMP Low Security Controls → 💼 SC-28 Protection of Information at Rest (L)(M)(H)	1		24		no data
💼 FedRAMP Low Security Controls → 💼 SC-28(1) Cryptographic Protection (L)(M)(H)			14		no data
💼 FedRAMP Moderate Security Controls → 💼 SC-13 Cryptographic Protection (L)(M)(H)			24		no data
💼 FedRAMP Moderate Security Controls → 💼 SC-28 Protection of Information at Rest (L)(M)(H)	1		24		no data
💼 FedRAMP Moderate Security Controls → 💼 SC-28(1) Cryptographic Protection (L)(M)(H)			14		no data
💼 ISO/IEC 27001:2013 → 💼 A.10.1.1 Policy on the use of cryptographic controls		18	19		no data
💼 ISO/IEC 27001:2022 → 💼 5.33 Protection of records		10	15		no data
💼 NIST CSF v1.1 → 💼 PR.DS-1: Data-at-rest is protected		15	30		no data
💼 NIST CSF v1.1 → 💼 PR.DS-5: Protections against data leaks are implemented		47	91		no data
💼 NIST CSF v2.0 → 💼 PR.DS-01: The confidentiality, integrity, and availability of data-at-rest are protected			148		no data
💼 NIST CSF v2.0 → 💼 PR.DS-02: The confidentiality, integrity, and availability of data-in-transit are protected			125		no data
💼 NIST CSF v2.0 → 💼 PR.DS-10: The confidentiality, integrity, and availability of data-in-use are protected			142		no data
💼 NIST SP 800-53 Revision 5 → 💼 AC-4(2) Information Flow Enforcement _ Processing Domains		30	32		no data
💼 NIST SP 800-53 Revision 5 → 💼 SC-28(1) Protection of Information at Rest _ Cryptographic Protection		10	14		no data
💼 PCI DSS v3.2.1 → 💼 3.4.1 If disk encryption is used, logical access must be managed separately and independently of native operating system authentication and access control mechanisms.		7	12		no data
💼 PCI DSS v3.2.1 → 💼 4.1 Use strong cryptography and security protocols to safeguard sensitive cardholder data during transmission over open, public networks.	1	8	22		no data
💼 PCI DSS v4.0.1 → 💼 3.3.2 SAD that is stored electronically prior to completion of authorization is encrypted using strong cryptography.			13		no data
💼 PCI DSS v4.0.1 → 💼 3.5.1.3 If disk-level or partition-level encryption is used (rather than file-, column-, or field--level database encryption) to render PAN unreadable.			12		no data
💼 PCI DSS v4.0.1 → 💼 4.2.1 Strong cryptography and security protocols are implemented to safeguard PAN during transmission over open, public networks.	2		22		no data
💼 PCI DSS v4.0 → 💼 3.3.2 SAD that is stored electronically prior to completion of authorization is encrypted using strong cryptography.		8	13		no data
💼 PCI DSS v4.0 → 💼 3.5.1.3 If disk-level or partition-level encryption is used (rather than file-, column-, or field--level database encryption) to render PAN unreadable.			12		no data
💼 PCI DSS v4.0 → 💼 4.2.1 Strong cryptography and security protocols are implemented to safeguard PAN during transmission over open, public networks.	2	9	22		no data
💼 SOC 2 → 💼 CC6.1-10 Uses Encryption to Protect Data		6	11		no data