Cybersecurity is a top priority for organizations looking to protect their IT infrastructure. Microsoft Azure has further fortified its cloud security posture with the introduction of Trusted Launch for Virtual Machines (VMs). Effective from August 30, 2023, Trusted Launch will be enabled by default when deploying VMs via the Azure Portal. This feature enhances your VMs with verified and signed bootloaders, OS kernels, and a boot policy.
In this guide, we’ll delve into the features of Trusted Launch and show you how to implement and verify them.
Key Features of Trusted Launch
- Secure Boot: Ensures that only signed OSes and drivers can boot, offering protection against rootkits and boot kits.
- Virtual TPM (vTPM): Safeguards keys, certificates, and secrets within the VM.
- Measured Boot: Validates the bootloader’s signature and conducts an integrity check of the entire boot chain.
- Boot Integrity Monitoring: Uses Azure Attestation and Azure Security Center to generate alerts and recommendations if the boot process is compromised.
How to Create a Trusted Launch VM in Azure Portal
- Login to Azure Portal: Open your browser and navigate to the Azure Portal.
- Navigate to Virtual Machines: Go to ‘Azure services’ and click on ‘Virtual Machines’.
- Create a New VM: Click on ‘Create a virtual machine’.
- Verify Trusted Launch Settings: By default, Trusted Launch and its associated properties like secure boot, vTPM, and integrity monitoring should be enabled. Confirm these settings.
- Deploy the VM: Click ‘Create’ to initiate the VM deployment.
Verifying Trusted Launch Properties
Once the VM is created, you can verify its Trusted Launch properties:
- Go to the VM Overview Page: Locate your VM in the Azure Portal and click to view its overview page.
- Check Trusted Launch Status: Here you should see indicators confirming that Trusted Launch is enabled and protecting your VM against boot and rootkits.
Benefits of Trusted Launch
- Enhanced foundational security for VMs.
- Protection against advanced malware threats like boot kits and rootkits.
- Continuous insights into VM health state and boot chain integrity.
- Compatibility with Windows 11 requirements.
For more advanced details, you can refer to the official Trusted Launch documentation.