Encrypting VM disks with Azure Disk Encryption

VM disks are encrypted at rest in Azure data centers. While this will protect against data theft if someone breaks into one of the Microsoft data centers and steals a bunch of disks (an unlikely scenario), it will not prevent an attacker or a malicious insider with the right credentials from taking a snapshot of a VM disk, and then mounting it on another system to access its data (a more likely scenario). The recommendation to prevent this likely scenario is to enable volume-level encryption, and the easiest way to implement this is to utilize a feature called Azure Disk Encryption (ADE).

ADE leverages built-in OS encryption capabilities to provide volume-level encryption for your OS and its data disks. For Windows VMs in Azure, ADE uses the built-in BitLocker feature. For Linux VMs in Azure, ADE uses the DM-Crypt feature. To store the encryption secrets and keys, ADE uses Azure Key Vault (which we will cover in Chapter 12, Implementing...