- [Narrator] We mentioned briefly earlier in the course
Azure Disk Encryption.
Well one of the storage technologies
that allows us to completely encrypt the data
that is being used by virtual machines.
And the virtual machines themselves.
So in this video we will go a little bit deeper
into this technology and talk about the components
that make up Azure Disk Encryption,
as well as some of the steps that are required
to put it into place.
Now note that this is not a demonstration
because there are many, many steps
to implementing Azure Disk Encryption,
which are probably longer than we do in a traditional video.
So I've put this in a note form,
but there are documents that provide step-by-step tasks
on how to implement Azure Disk Encryption,
but they're about 30 pages long.
So there are many step-by-step tasks.
So let's take a look at the highlights
of Azure Disk Encryption.
So first of all, Azure Disk Encryption provides the ability
to automatically encrypt new VMs, new virtual machines.
So this is a solution that is built on top of
infrastructure as a service, IAS.
When you create a new virtual machine in Azure,
you can have that virtual machine
automatically be encrypted.
And when I say a virtual machine,
I mean that the virtual machines are made up
of virtual disks, and the disks are the ones
that are going to be encrypted.
Now if you have existing virtual machines in Azure,
you can also encrypt those disk
that make up those virtual machines.
Now there are many operating systems that are supported
for this encryption.
Now you might have heard lately that Linux
is getting a lot of love from Microsoft in many ways,
and it is exemplified in Azure Disk Encryption,
where if you have Linux virtual machines,
you can also encrypt the disk
that make up those virtual machines.
Now note that there are some limitations
when it comes to Linus and not all disk
can be encrypted in all type of scenarios.
So there are too many permutations
for us to go into detail at this point,
but in the documents at describe Azure Disk Encryption
for Linux, you will have those details.
Now you can also encrypt all or some of our your volumes.
So you can have data volumes,
you can have the volumes that contain your operating system,
and you can choose which volumes you will be encrypting.
Now what are the components
that make up Azure Disk Encryption?
Well one of the most important components, first of all,
is the Azure Key Vault.
The Azure Key Vault will be used to control and manage
all of your encryption keys.
It stores the keys that are used to encrypt and decrypt
your virtual disk.
And is essentially a separate storage,
or a separate component from your virtual machines.
Now you can have different types of virtual machines
that are supported for Azure Disk Encryption,
they can be basic or standard.
There are different service plans
and pricing tiers in Azure,
and you'll probably want to get familiar with those,
but the specific ones for Azure Disk Encryption
is basic and standard.
Now note that this constantly changes
and supports stance of Microsoft constantly changes,
and at the point of recording this video,
I've read three different documents
that had four different support stance
for Azure Disk Encryption,
in terms of of the types of the virtual machines.
So that is an element of Microsoft,
they are constantly updating their support stance,
so it's important to keep up with that
to see if you have an issue with a virtual machine,
and you've enabled encrypt for that virtual machine
and encryption is not supported
for that virtual machine type,
you may not get support from Microsoft
in terms of resolving a problem.
So it's very important to always check
on your support stance from Microsoft.
Now encryption reports is also a very important element
where you can always report on the encryption status
and validate the encryption status of a disk.
You may want to make sure that your disk are truly encrypted
and the tasks that you perform to enable disk encryption
were successful and that your disk are encrypted
and secured.
So there are additional aspects to encryption,
with Azure Disk Encryption that are important to note,
first of all the cost, there is none.
It's rare that you hear that, but in this case it's true.
There are no cost other than the cost of what
you're already implementing for your virtual machines.
So using the Azure Key Vault
and storing your encryption keys in there
are not going to generate additional costs for you,
within your Azure subscription.
Of course, your utilization of your virtual machines,
those are charged and that's part of the subscription model
with Azure.
In terms of the support, again,
I mention that there are data disks,
virtual disks that will store your data,
an operating system disk that will be used to
also boot your machine, Linux disk,
all of those disks are supported for encryption
and note that the result of that
is that your data is going to be encrypted at rest.
And even if your virtual machine is not started,
the virtual machine disk will still be encrypted.
So what other details we have with Azure Disk Encryption?
Well it's important to note that if you have existing
virtual machines that are on your on premises infrastructure
or that are in another Azure subscription,
you can upload those existing virtual machines
and those virtual machines, if they are already encrypted,
you can maintain that encryption.
You can also encrypt new virtual machines,
or upload virtual machines that are unencrypted,
and then encrypt those.
So there's a true flexibility as to if a machine
is already encrypted or if you plan to encrypt it in Azure,
you have that flexibility to support both
as part of Azure Disk Encryption.
Now another component that's important to note
that is used as part of the solution
is Azure Active Directory.
Now Azure AD will have several roles
and you'll see that when you look at the document
that talks about the step-by-step tasks,
in terms of creating an application
that is actually used as part of Azure,
but it's mostly used for the authentication
and the access of the key vault.
So all of that transfer, and authentication,
to the key vault to maintain that encrypt key
in a secure repository that is outside
of your virtual machine, which is an essential part
of that solution, is maintain and ensure it,
by using Azure AD.
Now it's because you have Azure Disk Encryption
that you've secured your machine,
your virtual machines completely,
there are other elements that you always must keep in mind.
If your virtual machine is encrypted
and decrypted through Access,
well you need to always maintain additional security
on that virtual machine, similarly to the way that
you're securing right now, your servers
and your operating systems and your virtual machines
that are unencrypted.
Those security mechanisms must remain in place.
For example, you must continue to monitor
by using built in reports or with third-party reports.
Monitoring is an important element to threat identification,
intrusion detection, and ensure if there is an attack
on your server, that you've identified that attack quickly
and that you identify problems quickly.
There are also some third-party reports
that are available through the Azure marketplace.
You also must continue to protect your virtual machines
with anti-virus and anti-malware technology.
I know that it may seem pretty obvious,
but I've heard of administrators coming to the realization
very quickly, that the fact that their virtual machines
are protected in Azure and they're encrypted,
that they are still vulnerable to virus attacks.
So it's very important to always maintain those machines
secure with those technologies.
As well you will want to continue to protect
your virtual machines from network attack.
And that's by using firewalls and solutions
that are going to protect remote access
into your virtual machines.
So all the existing measures that you have in place
right now for your servers and for your virtual machines,
must remain in place.
This is an additional solution,
really that provides that data at rest encryption solution,
which is required for some organization
in order to be compliant with some standards
and is required for other organizations
where they have some very high security needs.