Announcing general availability of Azure Trusted Launch for virtual machines
Modern malware is crafted to hide on a virtual machine and has the potential to remain in place for a long time if it's undetected. These persistent malwares such as boot kits and rootkits are so sophisticated that they can run with the same kernel-mode privileges as the operating system they infect. With malware intercepting and modifying operating system processes, information and resources can be easily stolen, undermining trust in information on your virtual machines.
Earlier this year, we introduced Trusted Launch for public preview. Several customers have tried Trusted Launch for a variety of workloads and love the improved security posture of virtual machines. Today, we are excited to announce general availability of Trusted Launch that customers can leverage for their virtual machines to help prevent boot kit and rootkit infections.
Trusted Launch, which is available for all Azure Generation 2 VM hardens your Azure workloads with security features that allow administrators to deploy virtual machines with verified and signed bootloaders, OS kernels, and a boot policy. This is accomplished via Trusted Launch features: secure boot, vTPM, and boot integrity monitoring that protect against boot kits, rootkits, and kernel-level malware.
- Secure Boot protects against the installation of malware-based rootkits and boot kits and only allows signed OSes and drivers to boot.
- Virtual TPM (vTPM) allows customers to protect keys, certificates, and secrets in the virtual machine.
- Measured Boot examines and verifies the authenticity of bootloader’s signature and performs integrity measurement of the entire boot chain.
- Boot integrity monitoring via Microsoft Azure Attestation and Azure Security Center generates integrity alerts, recommendations, and remediations if remote attestation fails.
Trusted Launch is a foundational offering of Azure Confidential Computing (ACC) family. In the spectrum of ACC offerings, Trusted Launch provides a simple and easy way to improve VM security posture and confidentiality with no modification to your workload. To learn how to incorporate the full range of ACC offerings more information can be found on ACC documentation.
Mediterranean Shipping Company (MSC), one of the largest shipping companies in the world, runs its global compute infrastructure on Trusted Launch.
“As UEFI boot kits and rootkits are increasingly becoming the tools for cybersecurity attacks, Azure Trusted Launch VM provides our administrators confidence and ability to securely migrate to Azure while ensuring the integrity of our kernel level components. Azure Trusted Launch comes with comprehensive features of secure boot, measured boot, and remote attestation as well as seamless user experience.” – Aaron Shvarts, CISO, MSC Technology (NA)
Windows 365 CloudPC is a ‘Windows in the Cloud’ service available exclusively in Azure Cloud that allows business and enterprise users a personalized PC in the cloud.
“Trusted Launch has been instrumental for Windows 365 Cloud PC (a new simplified Cloud service to use Windows in the Cloud, on any device) in order to support Windows 11 and Windows 10 upgrades to Windows 11 across all Azure regions we support. Adding more baseline security capabilities for our customer has been one of the reasons why we decided to be one of the first adopters of this service.” – Christiaan Brinkhoff, Principal Program Manager, Windows 365 Engineering
Trusted Launch is available in all Azure public cloud regions with no additional cost and supports the most commonly used operating systems images.
To learn more and get started with Trusted Launch and ACC offerings, visit the following documentation pages:
If you’d like to engage further with the ACC team, please contact us at Azure Confidential PMs.
Published on:
Learn moreRelated posts
Azure NetApp Files now stores sensitive data DoD IL5 compliant in Azure US Government regions
Table of Contents Introduction Why Azure NetApp Files? DoD IL5 compliance in Azure Government Azure NetApp Files reaches feature parity betwee...
Enhancements to Azure Monitor Baseline Alerts for Azure Landing Zones
Introduction Welcome to our latest blog post where we dive into a number of exciting new key updates, highlight the new portal accelera...
Azure Cosmos DB Vector Search with DiskANN Part 1: Full Space Search
Vector Search with Azure Cosmos DB Azure Cosmos DB NoSQL features advanced vector indexing and search capabilities powered by DiskANN, a suite...
Azure Developer CLI (azd) – September 2024
This post announces the September release of the Azure Developer CLI (`azd`). Including remote container build support, multiple hooks per eve...
IBM Power Virtual Server and Microsoft Azure Multi-cloud Integration Patterns
IBM Power Virtual Server and Microsoft Azure Multi-cloud Integration Patterns &nbs...
Azure CLI docker container base Linux image is now Azure Linux
Starting from the version 2.64.0 of Azure CLI, the base Linux distribution of Azure CLI is now Azure Linux. Impact of the change ...
Enhancing Data Security and Digital Trust in the Cloud using Azure Services.
Introduction Think of Client-Side Encryption (CSE) as a strategy that has proven to be most effective in augmenting data security and ...
Optimizing Azure Table Storage: Automated Data Clean-up using a PowerShell script with Azure Automat
Scenario This blog’s aim is to manage Table Storage data efficiently. Imagine you have a large Azure Table Storage that accumulates logs from ...
Exciting New Features for GitHub Copilot for Azure
We've been on a roll adding new features to the private preview and we've added some of my favorites in our latest release! Building App...