--- title: Strengthen your cloud cyber security with Ubuntu Pro and confidential VMs description: Discover how Ubuntu Pro and confidential VMs provide robust cloud cyber security measures. Understand why your OS choice impacts security. url: https://canonical.com/blog/cloud-cyber-security-with-ubuntu-pro-confidential-vms?format=md --- 1. [Blog](https://canonical.com/blog) 2. Article --- [Ijlal Loutfi](https://canonical.com/blog/author/ijlal-loutfi "More about Ijlal Loutfi") 28 June 2023 # Strengthen your cloud cyber security with Ubuntu Pro and confidential VMs [Cloud security](https://canonical.com/blog/tag/cloud-security) [confidential computing](https://canonical.com/blog/tag/confidential-computing) [confidential VM](https://canonical.com/blog/tag/confidential-vm) [Hardening](https://canonical.com/blog/tag/hardening) [Security](https://canonical.com/blog/tag/security) [Ubuntu Pro](https://canonical.com/blog/tag/ubuntu-pro) --- Share the article In today’s digital landscape, organisations of all sizes have expanded their presence in the cloud. But with this expansion comes a significant increase in the attack surface, making security a top concern. In this blog, we will dive into the exciting world of cloud cyber security, and explore a stronger approach to securing your workloads with the help of Ubuntu. ## Why does your OS choice matter for cloud cyber security? Let’s first talk about why your choice of operating system matters for security. While developers put in a lot of effort to secure their applications, the security guarantees they provide are just one piece of the puzzle. Once your application is running on a platform in production, threats can still arise from the privileged system software, which includes the operating system, virtual machine manager, and the platform’s firmware. By design, this software has extensive access to all of your application’s resources, and if it ever becomes malicious or compromised, it can leak all of your application’s sensitive data. Therefore, It is crucial to recognise that the security of the operating system sets the upper limit for application security. So what security measures does Ubuntu offer for [cloud workloads](https://ubuntu.com/engage/azure-cloud-security-with-ubuntu)? ## Cloud cyber security with Ubuntu Ubuntu offers many built-in security features like Full disk encryption, [Mandatory Access Control via AppArmor](https://ubuntu.com/server/docs/security-apparmor), filesystem capabilities and [UEFI secure boot](https://wiki.ubuntu.com/UEFI/SecureBoot?_ga=2.25768061.1935334473.1687209781-750751692.1687209781). To further improve your security posture, you can also enable additional security features with an Ubuntu Pro subscription. [Ubuntu Pro](https://ubuntu.com/pro) is Canonical’s comprehensive subscription for open source software security. When used on the public cloud, Ubuntu Pro will take your security to a whole new level. Let us  break down what’s included: 1. **Wide security coverage:** Ubuntu Pro provides comprehensive security patching for over 25,000 open-source packages, including popular applications like Apache Kafka, NGINX, MongoDB, Redis, and PostgreSQL. 2. **Reduced downtime**: With Ubuntu Pro’s [Livepatch Service](https://ubuntu.com/security/livepatch), you can enjoy instantaneous patches of your kernel’s high and critical CVEs at run time, with no need for an immediate reboot. This can greatly minimise your business disruptions and maximise your  uptime. 3. **10 years of platform stability and peace of mind**: Canonical guarantees 10 years of security maintenance for Ubuntu Pro users running LTS releases, ensuring a decade of stability and protection for your workloads. 4. **Compliance certifications** Ubuntu Pro offers automation and auditing tooling for [DISA-STIG](https://ubuntu.com/security/disa-stig), [CIS hardening](https://ubuntu.com/security/cis) and auditing, [FIPS-certified cryptographic modules](https://ubuntu.com/security/fips), and more. It simplifies compliance processes and helps you meet regulatory requirements effortlessly. 5. **24/7 support**: Optional weekday or 24/7 [support](https://ubuntu.com/support) is also available with Ubuntu Pro, ensuring that you have expert assistance whenever you need it. It includes troubleshooting, break fix and bug fix on 25,000 open source packages and a wide set of applications, with 1 hour first response time for critical, disruptive issues with 24/7 support. Ubuntu Pro is free for up to 5 machines for personal and small-scale commercial use, or up to 50 machines for official Ubuntu Community members. [Get started with Ubuntu Pro today](https://ubuntu.com/pro) Photo by [FLY:D](https://unsplash.com/@flyd2069) From [Unsplash](https://unsplash.com/photos/B6eNd1W1Cic) ## Enhancing cloud cyber security with confidential computing While security hardening and automated CVE patching are essential for protecting your public cloud workloads from known security vulnerabilities, they cannot protect your data from zero-day vulnerabilities within the cloud’s privileged system software, or from a potentially malicious cloud provider. This is because, up until recently, there were no available mechanisms for protecting sensitive workloads at run-time. Today, [confidential computing](https://canonical.com/blog/what-is-confidential-computing-a-high-level-explanation-for-cisos) offers a systems-level primitive that allows you to run your applications within a hardware-rooted logically isolated execution environment. ## Ubuntu Confidential VMs Using [AMD SEV-SNP](https://canonical.com/blog/whats-confidential-generally-available-and-open-source-its-canonical-ubuntu-22-04-on-microsoft-azure) or [Intel TDX](https://canonical.com/blog/ubuntu-confidential-vms-intel-tdx-microsoft-azure-confidential-computing) CPU extensions, you can deploy [Ubuntu Confidential VMs](https://canonical.com/blog/lets-get-confidential-canonical-ubuntu-confidential-vms-are-now-generally-available-on-microsoft-azure) whose system memory and CPU registers are encrypted using the latest AES-128 hardware encryption engine. Because workloads running in the cloud are loaded from a hard disk, Ubuntu also leverages its full disk encryption capabilities to secure your data at rest. Using AES, Ubuntu encrypts and decrypts all data written at disk, storing the encryption key (itself encrypted) in your VMs virtual disk. Only the virtual Trusted Platform Module (vTPM) associated with your CVM instance can decrypt the key. With Ubuntu’s Confidential VMs, your data is secured at runtime, rest, and boot. At Canonical, We strongly believe that in the future, confidential computing and privacy-enhancing technologies will become the standard approach to computing. That’s why our portfolio of confidential computing solutions is available for free on all public clouds. To learn more about this topic, we invite you to [read our whitepaper](https://ubuntu.com/engage/azure-cloud-security-with-ubuntu) which provides an in-depth discussion on adopting a stronger approach to Azure cloud cyber security with Ubuntu. ## Combining Ubuntu Pro and Confidential VMs Confidential computing introduces a security model where CVMs protect data from external software threats. However, vulnerabilities from within their boundaries remain a concern. This is where Ubuntu Pro becomes essential. Ubuntu Pro offers security measures to tackle vulnerabilities within the CVM’s software stack or the guest OS. Regular security patching and updates provided by Ubuntu Pro mitigate this risk. For a detailed exploration on the importance of securing your CVM from internal vulnerabilities, you can read our in-depth article [here](https://ubuntu.com/blog/why-you-need-to-protect-your-confidential-virtual-machine-from-itself). This integration ensures a more secure environment suitable for enterprise operations and is compatible with both AMD SEV-SNP hardware and, for those in the Azure limited preview, Intel TDX. ### How to Deploy Ubuntu Confidential VMs on Azure To deploy a new Confidential VM with Ubuntu Pro, use the Azure CLI command as follows: ``` az vm create \ --resource-group "${RESOURCE_GROUP}" \ --name "${VM_NAME}" \ --size Standard_DC4as_v5 \ --enable-vtpm true \ --image "Canonical:0001-com-ubuntu-confidential-vm-focal:20_04-lts-cvm:latest" \ --security-type ConfidentialVM \ --os-disk-security-encryption-type VMGuestStateOnly \ --enable-secure-boot true \ --license-type UBUNTU_PRO ``` The –license-type UBUNTU\_PRO flag is the key for deploying Ubuntu Pro. ### In-Place Upgrade of Ubuntu Confidential VMs on Azure Existing Confidential VM Ubuntu LTS VMs can be upgraded to Ubuntu Pro using a few commands. For more details, you can visit our [In-Place Upgrade announcement](https://ubuntu.com/blog/announcing-in-place-upgrade-from-ubuntu-server-to-ubuntu-pro-on-azure). ## Deploy secure Ubuntu workloads on the public cloud today Using Ubuntu on the public cloud provides you the foundation you need to fortify your cloud workloads. With Ubuntu Pro’s extended security coverage, reduced downtime, compliance tooling, and confidential computing support, you can gain confidence and peace of mind with state-of-the-art security. Take your cyber cloud security to the next level with [https://ubuntu.com/pro](https://azuremarketplace.microsoft.com/en-us/marketplace/apps/canonical.0001-com-ubuntu-pro-focal?tab=Overview) and [confidential VMs](https://ubuntu.com/confidential-computing) and build a solid foundation for your security-sensitive environments. ## Learn more about Ubuntu security If you would like to know more about the Canonical approach to security at large, [contact us](https://ubuntu.com/security/contact-us). ## Additional resources * [Contact us](https://ubuntu.com/confidential-computing#get-in-touch) * [Ubuntu Pro | product page](https://ubuntu.com/pro) * [Ubuntu Pro 20.04 on Azure Marketplace Microsoft Azure Marketplace](https://azuremarketplace.microsoft.com/en-us/marketplace/apps/canonical.0001-com-ubuntu-pro-focal?tab=Overview) * [Watch our webinar to learn more about confidential computing](https://www.brighttalk.com/webcast/6793/543562) * [Read our blog post for “What is confidential computing? A high-level explanation for CISOs”](https://canonical.com/blog/what-is-confidential-computing-a-high-level-explanation-for-cisos) * [Read our blog post for “Confidential computing in public clouds: isolation and remote attestation explained](https://canonical.com/blog/confidential-computing-in-public-clouds-isolation-and-remote-attestation-explained)” * [Start creating and using Ubuntu CVMs on Azure](https://docs.microsoft.com/en-us/azure/confidential-computing/quick-create-confidential-vm-portal-amd) * [Is Linux Secure?](https://ubuntu.com/blog/is-linux-secure) [Get in touch Interested in running Ubuntu in your organization?](https://ubuntu.com/about/contact-us/form) ## Sign up for our newsletter Get the latest Canonical news and updates in your inbox. Work email: \*I agree to receive information about Canonical's products and services. By submitting this form, I confirm that I have read and agree to [Canonical's Privacy Policy](https://canonical.com/legal/dataprivacy). Sign up ## Share on --- ## Related posts [### Canonical joins the Open Secure AI Alliance](https://canonical.com/blog/open-secure-ai-alliance) Canonical is now part of the Open Secure AI Alliance, announced by NVIDIA with partners across cloud computing, cybersecurity, enterprise software, open source foundations, and... [Canonical](https://canonical.com/blog/author/canonical) 28 August 2026 [### Arduino® VENTUNO™ Q is available for pre-order with Ubuntu pre-installed](https://canonical.com/blog/arduino-ventuno-q-is-available-for-pre-order-with-ubuntu-pre-installed) London, UK – August 25, 2026 – Following our initial collaboration announcement in March 2026, Canonical and Arduino (a subsidiary of Qualcomm Technologies, Inc.) are excited... [Canonical](https://canonical.com/blog/author/canonical) 25 August 2026 [### Canonical announces the Enterprise Store as part of Ubuntu Pro](https://canonical.com/blog/canonical-announces-the-enterprise-store) Canonical introduces a new way to manage software behind firewalls and in air-gapped environments with the Enterprise Store. The Enterprise Store makes software distribution... [Holly Hall](https://canonical.com/blog/author/hollyhall) 21 July 2026 [### Tracing a memory leak bug in PID 1 and contributing an upstream fix: a Linux support story](https://canonical.com/blog/fixing-memory-bug) How Canonical Support helped a global retail organization trace the cause for an unusual memory leak originating in PID 1. By investigating the issue across three separate... [Lidia Luna Puerta](https://canonical.com/blog/author/lidia-luna) 17 July 2026