Using hardened baseline VM images
One of the first choices that we need to make when deploying a VMs in Azure is the image that it will be based on. We have three options to choose from:
- Microsoft-provided marketplace image
- Third party-provided marketplace image
- Customer-provided image
The decision that we make here has an impact on the security posture of the virtual machine after deployment! The image that users choose when deploying VMs in Azure could be one that has vulnerable binaries and configurations that need to be patched or reconfigured after deployment.
The best practice here is to choose a hardened image that already has baseline security configurations and the most recent patches applied. But where can we get this? Customers who are willing could build the hardened images themselves using an automation tool such as Packer or a service such as Azure Image Builder.
Information
Packer is an open source tool created by Hashicorp that can be...
