{"id":1009,"date":"2019-03-06T12:45:36","date_gmt":"2019-03-06T12:45:36","guid":{"rendered":"https:\/\/www.ciraltos.com\/?p=1009"},"modified":"2023-03-23T23:32:27","modified_gmt":"2023-03-24T04:32:27","slug":"is-azure-disk-encryption-necessary","status":"publish","type":"post","link":"https:\/\/www.ciraltos.com\/staging2\/is-azure-disk-encryption-necessary\/","title":{"rendered":"Is Azure Disk Encryption Necessary?"},"content":{"rendered":"\n
\"Good<\/figure>\n\n\n\n

I got the a good question below from Zaniar this week:<\/p>\n\n\n\n

My question —- If Azure VM’s are encrypted at rest now (SSE) does this mean the data on the volumes are also encrypted? and if we want a further layer of encryption should we use BEK or KEK which one is better?<\/p>\n\n\n\n\n\n\n\n

It comes down to a matter of trust and requirements. Microsoft encrypts Managed Disks and Storage Account data at rest by default and the data is encrypted in transit with encrypted transfer protocols.  If there is a simple requirement to encrypt data at rest and in transit, then everything can be left default and that requirement is met.  <\/p>\n\n\n\n

However, Storage Service Encryption decrypts data at retrieval.\n Data would be decrypted at a new\nlocation if someone copied it outside the environment.  This is true if that person was a legitimate user\nor if someone got unauthorized access to an account.  With Azure Disk Encryption, the data would\nstill be encrypted if a virtual disk was copied to a new location and require\nthe key to decrypt.<\/p>\n\n\n\n

By default, both Storage Service Encryption and Azure Disk Encryption use a Microsoft encryption keys.  This is where trust comes into play.  There is an option for both to uses a customer managed key if you want to add an extra layer of security.  <\/p>\n\n\n\n

If I was hosting sensitive medical records or proprietary\nsource code for a client on a server, I may consider using Azure Disk\nEncryption with a customer managed key.  It\nall comes down to the security requirements of an organization.<\/p>\n\n\n\n

As for BEK and KEK, when I wrote the first couple of posts\non Azure Disk Encryption there were limitations around backup and recovery between\nthe two.  That is no longer an issue,\neither will give similar results. <\/p>\n","protected":false},"excerpt":{"rendered":"

I got the a good question below from Zaniar this week: My question —- If Azure VM’s are encrypted at rest now (SSE) does this mean the data on the volumes are also encrypted? and if we want a further layer of encryption should we use BEK or KEK which one is better?<\/p>\n","protected":false},"author":1,"featured_media":4039,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"site-sidebar-layout":"default","site-content-layout":"default","ast-global-header-display":"","ast-main-header-display":"","ast-hfb-above-header-display":"","ast-hfb-below-header-display":"","ast-hfb-mobile-header-display":"","site-post-title":"","ast-breadcrumbs-content":"","ast-featured-img":"","footer-sml-layout":"","theme-transparent-header-meta":"","adv-header-id-meta":"","stick-header-meta":"","header-above-stick-meta":"","header-main-stick-meta":"","header-below-stick-meta":""},"categories":[1],"tags":[175,9,154,360,361,358,359,155,11,150],"yoast_head":"\nIs Azure Disk Encryption Necessary? - ciraltos<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.ciraltos.com\/staging2\/is-azure-disk-encryption-necessary\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Is Azure Disk Encryption Necessary? - ciraltos\" \/>\n<meta property=\"og:description\" content=\"I got the a good question below from Zaniar this week: My question —- If Azure VM’s are encrypted at rest now (SSE) does this mean the data on the volumes are also encrypted? and if we want a further layer of encryption should we use BEK or KEK which one is better?\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.ciraltos.com\/staging2\/is-azure-disk-encryption-necessary\/\" \/>\n<meta property=\"og:site_name\" content=\"ciraltos\" \/>\n<meta property=\"article:published_time\" content=\"2019-03-06T12:45:36+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2023-03-24T04:32:27+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.ciraltos.com\/staging2\/wp-content\/uploads\/2023\/03\/LTd5a5Xyc.png\" \/>\n\t<meta property=\"og:image:width\" content=\"463\" \/>\n\t<meta property=\"og:image:height\" content=\"599\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"Travis Roberts\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@ciraltos\" \/>\n<meta name=\"twitter:site\" content=\"@ciraltos\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Travis Roberts\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"2 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/www.ciraltos.com\/staging2\/is-azure-disk-encryption-necessary\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/www.ciraltos.com\/staging2\/is-azure-disk-encryption-necessary\/\"},\"author\":{\"name\":\"Travis Roberts\",\"@id\":\"http:\/\/www.ciraltos.com\/staging2\/#\/schema\/person\/25391996d6cddfecd4d257162b7e373a\"},\"headline\":\"Is Azure Disk Encryption Necessary?\",\"datePublished\":\"2019-03-06T12:45:36+00:00\",\"dateModified\":\"2023-03-24T04:32:27+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/www.ciraltos.com\/staging2\/is-azure-disk-encryption-necessary\/\"},\"wordCount\":317,\"commentCount\":0,\"publisher\":{\"@id\":\"http:\/\/www.ciraltos.com\/staging2\/#\/schema\/person\/25391996d6cddfecd4d257162b7e373a\"},\"keywords\":[\"ARM\",\"Azure\",\"Azure Disk Encryption\",\"BEK\",\"Certificate\",\"disk encryption\",\"KEK\",\"managed disks\",\"Microsoft\",\"storage account\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\/\/www.ciraltos.com\/staging2\/is-azure-disk-encryption-necessary\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.ciraltos.com\/staging2\/is-azure-disk-encryption-necessary\/\",\"url\":\"https:\/\/www.ciraltos.com\/staging2\/is-azure-disk-encryption-necessary\/\",\"name\":\"Is Azure Disk Encryption Necessary? - ciraltos\",\"isPartOf\":{\"@id\":\"http:\/\/www.ciraltos.com\/staging2\/#website\"},\"datePublished\":\"2019-03-06T12:45:36+00:00\",\"dateModified\":\"2023-03-24T04:32:27+00:00\",\"breadcrumb\":{\"@id\":\"https:\/\/www.ciraltos.com\/staging2\/is-azure-disk-encryption-necessary\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.ciraltos.com\/staging2\/is-azure-disk-encryption-necessary\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.ciraltos.com\/staging2\/is-azure-disk-encryption-necessary\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"http:\/\/www.ciraltos.com\/staging2\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Is Azure Disk Encryption Necessary?\"}]},{\"@type\":\"WebSite\",\"@id\":\"http:\/\/www.ciraltos.com\/staging2\/#website\",\"url\":\"http:\/\/www.ciraltos.com\/staging2\/\",\"name\":\"ciraltos\",\"description\":\"cloud, technology and trends\",\"publisher\":{\"@id\":\"http:\/\/www.ciraltos.com\/staging2\/#\/schema\/person\/25391996d6cddfecd4d257162b7e373a\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"http:\/\/www.ciraltos.com\/staging2\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"en-US\"},{\"@type\":[\"Person\",\"Organization\"],\"@id\":\"http:\/\/www.ciraltos.com\/staging2\/#\/schema\/person\/25391996d6cddfecd4d257162b7e373a\",\"name\":\"Travis Roberts\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"http:\/\/www.ciraltos.com\/staging2\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/www.ciraltos.com\/staging2\/wp-content\/uploads\/2023\/03\/Logo-1.png\",\"contentUrl\":\"https:\/\/www.ciraltos.com\/staging2\/wp-content\/uploads\/2023\/03\/Logo-1.png\",\"width\":5657,\"height\":3563,\"caption\":\"Travis Roberts\"},\"logo\":{\"@id\":\"http:\/\/www.ciraltos.com\/staging2\/#\/schema\/person\/image\/\"},\"sameAs\":[\"http:\/\/www.ciraltos.com\",\"https:\/\/twitter.com\/ciraltos\"],\"url\":\"https:\/\/www.ciraltos.com\/staging2\/author\/admin\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Is Azure Disk Encryption Necessary? - ciraltos","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.ciraltos.com\/staging2\/is-azure-disk-encryption-necessary\/","og_locale":"en_US","og_type":"article","og_title":"Is Azure Disk Encryption Necessary? - ciraltos","og_description":"I got the a good question below from Zaniar this week: My question —- If Azure VM’s are encrypted at rest now (SSE) does this mean the data on the volumes are also encrypted? and if we want a further layer of encryption should we use BEK or KEK which one is better?","og_url":"https:\/\/www.ciraltos.com\/staging2\/is-azure-disk-encryption-necessary\/","og_site_name":"ciraltos","article_published_time":"2019-03-06T12:45:36+00:00","article_modified_time":"2023-03-24T04:32:27+00:00","og_image":[{"width":463,"height":599,"url":"https:\/\/www.ciraltos.com\/staging2\/wp-content\/uploads\/2023\/03\/LTd5a5Xyc.png","type":"image\/png"}],"author":"Travis Roberts","twitter_card":"summary_large_image","twitter_creator":"@ciraltos","twitter_site":"@ciraltos","twitter_misc":{"Written by":"Travis Roberts","Est. reading time":"2 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.ciraltos.com\/staging2\/is-azure-disk-encryption-necessary\/#article","isPartOf":{"@id":"https:\/\/www.ciraltos.com\/staging2\/is-azure-disk-encryption-necessary\/"},"author":{"name":"Travis Roberts","@id":"http:\/\/www.ciraltos.com\/staging2\/#\/schema\/person\/25391996d6cddfecd4d257162b7e373a"},"headline":"Is Azure Disk Encryption Necessary?","datePublished":"2019-03-06T12:45:36+00:00","dateModified":"2023-03-24T04:32:27+00:00","mainEntityOfPage":{"@id":"https:\/\/www.ciraltos.com\/staging2\/is-azure-disk-encryption-necessary\/"},"wordCount":317,"commentCount":0,"publisher":{"@id":"http:\/\/www.ciraltos.com\/staging2\/#\/schema\/person\/25391996d6cddfecd4d257162b7e373a"},"keywords":["ARM","Azure","Azure Disk Encryption","BEK","Certificate","disk encryption","KEK","managed disks","Microsoft","storage account"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/www.ciraltos.com\/staging2\/is-azure-disk-encryption-necessary\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/www.ciraltos.com\/staging2\/is-azure-disk-encryption-necessary\/","url":"https:\/\/www.ciraltos.com\/staging2\/is-azure-disk-encryption-necessary\/","name":"Is Azure Disk Encryption Necessary? - ciraltos","isPartOf":{"@id":"http:\/\/www.ciraltos.com\/staging2\/#website"},"datePublished":"2019-03-06T12:45:36+00:00","dateModified":"2023-03-24T04:32:27+00:00","breadcrumb":{"@id":"https:\/\/www.ciraltos.com\/staging2\/is-azure-disk-encryption-necessary\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.ciraltos.com\/staging2\/is-azure-disk-encryption-necessary\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/www.ciraltos.com\/staging2\/is-azure-disk-encryption-necessary\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"http:\/\/www.ciraltos.com\/staging2\/"},{"@type":"ListItem","position":2,"name":"Is Azure Disk Encryption Necessary?"}]},{"@type":"WebSite","@id":"http:\/\/www.ciraltos.com\/staging2\/#website","url":"http:\/\/www.ciraltos.com\/staging2\/","name":"ciraltos","description":"cloud, technology and trends","publisher":{"@id":"http:\/\/www.ciraltos.com\/staging2\/#\/schema\/person\/25391996d6cddfecd4d257162b7e373a"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"http:\/\/www.ciraltos.com\/staging2\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"en-US"},{"@type":["Person","Organization"],"@id":"http:\/\/www.ciraltos.com\/staging2\/#\/schema\/person\/25391996d6cddfecd4d257162b7e373a","name":"Travis Roberts","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"http:\/\/www.ciraltos.com\/staging2\/#\/schema\/person\/image\/","url":"https:\/\/www.ciraltos.com\/staging2\/wp-content\/uploads\/2023\/03\/Logo-1.png","contentUrl":"https:\/\/www.ciraltos.com\/staging2\/wp-content\/uploads\/2023\/03\/Logo-1.png","width":5657,"height":3563,"caption":"Travis Roberts"},"logo":{"@id":"http:\/\/www.ciraltos.com\/staging2\/#\/schema\/person\/image\/"},"sameAs":["http:\/\/www.ciraltos.com","https:\/\/twitter.com\/ciraltos"],"url":"https:\/\/www.ciraltos.com\/staging2\/author\/admin\/"}]}},"_links":{"self":[{"href":"https:\/\/www.ciraltos.com\/staging2\/wp-json\/wp\/v2\/posts\/1009"}],"collection":[{"href":"https:\/\/www.ciraltos.com\/staging2\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.ciraltos.com\/staging2\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.ciraltos.com\/staging2\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.ciraltos.com\/staging2\/wp-json\/wp\/v2\/comments?post=1009"}],"version-history":[{"count":4,"href":"https:\/\/www.ciraltos.com\/staging2\/wp-json\/wp\/v2\/posts\/1009\/revisions"}],"predecessor-version":[{"id":4047,"href":"https:\/\/www.ciraltos.com\/staging2\/wp-json\/wp\/v2\/posts\/1009\/revisions\/4047"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.ciraltos.com\/staging2\/wp-json\/wp\/v2\/media\/4039"}],"wp:attachment":[{"href":"https:\/\/www.ciraltos.com\/staging2\/wp-json\/wp\/v2\/media?parent=1009"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.ciraltos.com\/staging2\/wp-json\/wp\/v2\/categories?post=1009"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.ciraltos.com\/staging2\/wp-json\/wp\/v2\/tags?post=1009"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}