Securing Virtual Machines

In the previous chapter, we covered recipes that allow you to provide secure remote access to Azure resources and minimize exposure to management ports on Azure Virtual Machines (VMs).

When we create Azure VMs or any Azure resource, we should take a defense-in-depth (DiD) approach. This means we should not rely on just the identity or network and remote access layers to secure our resources. We should, in addition, also apply protection controls at the resource layer, often referred to as workload protection.

This chapter will teach you how to secure and protect Azure VMs. We will break down the chapter into sections, covering using the VM Update Management service and protection through the Microsoft Antimalware service and disk encryption.

By the end of this chapter, you will have gained skills for securing Azure VMs through the following recipes:

• Implementing VM Update Management
• Implementing VM Microsoft Antimalware
• Implementing...

Technical requirements

For this chapter, it is already assumed that you have an Azure AD tenancy and an Azure subscription from completing the recipes in previous chapters of this cookbook. If you skipped straight to this chapter, the information to create a new Azure AD tenancy and an Azure subscription for these recipes is included in the following list of requirements.

For this chapter, the following is required for the recipes:

• A device with a browser, such as Edge or Chrome, to access the Azure portal (https://portal.azure.com)
• An Azure AD tenancy and Azure subscription; you may use an existing subscription or sign up for free: https://azure.microsoft.com/en-us/free
• An Owner role for the Azure subscription

Implementing VM Update Management

Prevention is always better than cure. And so, it is always important to ensure the continued integrity of the software running on our VMs and to minimize the risk of a vulnerability being exploited.

Azure’s VM Update Management is part of the Azure Automation solution and can aid in managing the complex operations of tracking and remediating software patching for Azure and non-Azure VMs.

This recipe will teach you how to implement VM Update Management as part of Azure Automation for your Azure VMs.

Getting ready

This recipe requires the following:

• A device with a browser, such as Edge or Chrome, to access the Azure portal (https://portal.azure.com).
• Access to an Azure subscription, where you have access to the Owner role for the Azure subscription.
• An Azure Automation account to manage VMs; we will step through creating an Automation account as a Getting ready task.
• A Windows Server Azure VM to use with this...

Implementing VM Microsoft Antimalware

In implementing our DiD strategy, we have looked at recipes to protect our identities and networks and remediate any unpatched Azure VMs on the network.

Our next level of defense is a need for a security capability that will protect our VMs in real time from malicious software (malware) such as viruses, worms, and Trojans.

Microsoft Antimalware is a free built-in solution that offers a protection capability that alerts and remediates these malware threats in real time.

Getting ready

This recipe requires the following:

• A device with a browser, such as Edge or Chrome, to access the Azure portal (https://portal.azure.com)
• Access to an Azure subscription, where you have access to the Owner role for the Azure subscription

How to do it…

This recipe consists of the following task:

• Enabling Antimalware when creating a VM

Task – enabling Antimalware when creating a VM

Perform the following...

Implementing VM Azure Disk Encryption

Azure Disk Encryption (ADE) provides encryption of data on VM disks at rest in Azure Storage. The solution uses an integrated Azure Key Vault to store and manage the encryption keys.

Getting ready

This recipe requires the following:

• A device with a browser, such as Edge or Chrome, to access the Azure portal (https://portal.azure.com)
• You should sign in to an Azure subscription with the Owner role

Continue with the following Getting ready task for this recipe:

• Creating a VM

Getting ready task – creating a VM

Perform the following steps:

1. Sign in to the Azure portal: https://portal.azure.com.
2. In the search box in the Azure portal, type virtual machines and select Virtual machines from the listed Services results.
3. Click + Create from the top-left menu bar on the Virtual machine screen and select Azure virtual machine.
4. From the Basics tab, under the Project details section, set the...