Microsoft AzureOverview
When Secure Boot and vTPM are enabled together, they provide a strong foundation for protecting your VM from boot attacks. For example, if an attacker attempts to replace the bootloader with a malicious version, Secure Boot will prevent the VM from booting. If the attacker is able to bypass Secure Boot and install a malicious bootloader, vTPM can detect the intrusion and alert you.
Rationale
Secure Boot and vTPM work together to protect your VM from various boot attacks, including bootkits, rootkits, and firmware rootkits. Not enabling Trusted Launch in Azure VM can lead to increased vulnerability to rootkits and boot-level malware, reduced ability to detect and prevent unauthorized changes to the boot process, and a potential compromise of system integrity and data security.
Impact
Secure Boot and vTPM are not currently supported for Azure Generation 1 VMs.
IMPORTANT: Before enabling Secure Boot and vTPM on a Generation 2 VM that does not already have both enabled, it is highly recommended to create a restore point of the VM before remediation.
Remediation guidance
Remediate from Azure Portal
- Go to Virtual Machines.
- For each VM, under Settings, click on Configuration on the left blade.
- Under Security Type, select 'Trusted Launch Virtual Machines'.
- Make sure Enable Secure Boot & Enable vTPM are checked.
- Click on Apply.
Note: Trusted launch on existing virtual machines (VMs) is currently not supported for Azure Generation 1 VMs
Service-wide remediation
Recommended when many resources are affected: fix the platform baseline first so new resources inherit the secure setting, then remediate the existing flagged resources in batches.
Azure
Use management group or subscription Azure Policy assignments, remediation tasks where supported, landing-zone standards, and IaC modules so drift is prevented at scale.
Operational rollout
- Fix the baseline first at the account, subscription, project, cluster, or tenant scope that owns this control.
- Remediate the currently affected resources in batches, starting with internet-exposed and production assets.
- Re-scan and track approved exceptions with an owner and expiry date.
Query logic
These are the stored checks tied to this control.
Azure VMs without boot security settings
Connectors
Covered asset types
Expected check: eq []
{
vms(
where: {
OR: [
{ securityProfileUefiSettingsSecureBootEnabled: false }
{ securityProfileUefiSettingsVTpmEnabled: false }
]
}
) {
...AssetFragment
}
}
