4.2.1. Disk Encryption and VM Security Features
💡 First Principle: A VM's disk is a portable attack surface in a way its running memory isn't — a disk (or a snapshot of one) can be detached, copied, or accessed outside the running VM entirely, which is exactly the scenario disk encryption is designed to defeat, while secure boot and vTPM protect the boot process itself from tampering.
Disk encryption starts with server-side encryption (SSE), which is always on for managed OS and data disks but doesn't cover temp disks or disk caches. Encryption at host closes that gap on the VM host, encrypting temp disks, caches, and the data flowing to storage without using the VM's CPU; it's Microsoft's recommendation for new VMs. Azure Disk Encryption (BitLocker or DM-Crypt inside the guest OS) also covers those disks, but it retires on September 15, 2028, after which ADE-encrypted disks fail to unlock on reboot, so existing ADE VMs must migrate to encryption at host before then. Secure boot verifies that only signed, trusted bootloaders and OS components load during startup, preventing bootkit and rootkit attacks that try to compromise the OS before it's even running. A virtual Trusted Platform Module (vTPM) provides a virtualized hardware root of trust for operations like measured boot attestation and key storage. Integrity monitoring (via guest attestation) continuously verifies that boot integrity hasn't been tampered with after startup, catching a compromise that occurs post-boot rather than only at the moment of boot. Security type on a VM (Trusted launch, Confidential, or Standard) determines which of these protections are available and enabled together.
⚠️ Exam Trap: Secure boot and disk encryption protect against different threat models — secure boot stops a compromised or malicious bootloader from ever running, while disk encryption protects data confidentiality if the disk itself is extracted or accessed outside the running VM. A scenario about a stolen VHD file is a disk-encryption question; a scenario about a bootkit is a secure-boot question.
Reflection Question: A VM relies only on default server-side encryption. Which data does that leave unencrypted, and why is encryption at host (rather than Azure Disk Encryption) the fix Microsoft recommends today?
