Configure Azure Disk Encryption

This virtual lab will teach you how to encrypt an Azure data disk on a virtual machine. First, you will configure and connect to a virtual machine (VM) through the Remote Desktop Protocol (RDP). If you do the lab on a mac Operating System (OS), you will need Microsoft Remote Desktop. After verifying the existing machine and disk setup, you will add a new drive to the Azure VM. Finally, you will create an Azure Key Vault and implement Azure encryption, securing disk storage on the VM.

Lab exercises will guide the beginner learner, who has worked on a Windows OS and has some familiarity with the Windows command line towards successful completion. It would be helpful if lab participants set aside a full 45-minute time period as the lab takers cannot pause activities mid-way. However, users can take the virtual lab more than once. Learners will log into an Azure portal containing a resource group and permissions to initiate and configure a VM and data storage.

Legal and corporate policies require keeping data accessible for those who have permission and secure from those who do not have the authority to work with the data. For example, corporate fines for improperly protected data have resulted in fines from 124 million to 575 million dollars. This virtual lab will teach you to comply with data laws by successfully encrypting disk storage, on a VM.

System Administrators and Microsoft Azure Cloud Engineers will learn to provide safe, usable disk storage on a virtual machine. Cybersecurity Specialists will learn to assess and respond to data breach risks and threats by knowing about encryption.

Understanding the Scenario:

You are a system administrator for a company that is migrating its application services from its data center to Azure. You need to create and deploy an Azure virtual machine that hosts Windows Server 2016 Datacenter. You also need to add a data disk to the virtual machine and implement Azure Disk Encryption as a proof of concept.

Create an Azure Virtual Machine:

In this lab section, you sign in to the Azure portal and create a standard virtual machine. Then you RDP to the remote computer you created. You verify disk drives attached to the VM by using the Azure Portal and the VM’s Disk Manager.

In Azure, you set the VM size, storage space, availability, and types based on subscriptions you choose. In the lab, you select a Standard B2 with Standard Hard Disk Drive (HDD). This option provides the best storage results for infrequent access less sensitive to performance variabilities, like development and test environments. You verify the disk attached to the VM through viewing its Disk Manager.

Add a New Data Disk to the Azure Virtual Machine:

You add a new standard managed disk, in this lab exercise, by using the Azure portal. Then you format the new data disk and allocate a volume to it, using Disk Manager on the VM. Make sure you save the new drive configuration by pressing the save button at the top of the window.

First, you verify that Azure added the new data disk and then, the new volume has a healthy primary partition. A partition describes the logical section on the storage device, facilitating putting, finding and retrieving data on the disk. When creating, formatting, and assigning a volume to the new drive, you automatically create a logical partition.

Enable Azure Disk Encryption:

This lab portion has you set up a key vault and enable disk encryption using Azure Cloud Shell. Cloud Shell does not support the keyboard shortcut to paste, copied commands. But you can right-click and select paste. You can also use the up arrow to retype a previous command, helpful in the case of a mistyped command. Azure’s Disk Encryption takes ten to fifteen minutes to implement.

After you configure disk encryption, you verify successful disk configuration by connecting to the virtual machine and viewing the Disk Manager for stored data. If you see a healthy Bitlocker Encryption Key or Bek volume in the VM’s disk manager, then you have enabled Azure disk manager successfully. A Bek volume organizes all the encryption and decryption keys to get to the data.

Summary:

Upon completing this virtual lab, you will know how to create a VM with encrypted disks. You know how to:

• Configure and connect to a VM.
• Add a new data disk to the VM.
• Enable Azure Disk Encryption.

With the knowledge gained from this lab, you will better comply with company and government security requirements, by creating and using a Bek volume for Azure disk encryption.