In terms of Azure Security best practices, Where do you start? In many different ways, Azure has a lot in common with every other data center. However, Azure can also be quite different. The process of securing Azure is not easy and can present a number of specific problems. The security of the resources that are hosted in Azure is of paramount importance, but it’s sometimes ignored by new companies who are not familiar with Azure.
During the initial stages of a company’s path to cloud adoption, it’s commonly believed that Microsoft protects the cloud services it hosts. While Azure assists in securing your company’s assets, a lot of responsibility falls to users to take responsibility to ensure the security of their Azure cloud.
In this post, I’ll share my top 9 Azure Security best practices. If you’re interested in digging deeply into Azure Security, you might be interested in a Microsoft Azure course learning path. Even if there’s no interest in becoming an Azure Security Certified Professional, these classes, as well as hands-on labs, will assist you in starting your journey to managing and deploying Microsoft Azure security technologies.
Although I could provide a huge amount of details about Azure shared responsibility Azure sharing responsibility system, I’ll briefly outline the fundamental concepts. It is essential that cloud security professionals be aware of the roles and responsibilities which are shared by the Azure customer (you) in conjunction with Microsoft. The assignment of responsibility is different depending on the Azure service; however, at a fundamental level, you’re responsible for the security of your data and access to it. In the case of the service you’re using, you might have additional responsibilities, as shown below.
2. Azure Security Center suggested changes and alerts.
Let me begin by saying that this is not a new article. The suggestions you will see below can be found within Azure through Azure Security Center, and that is why I’m starting there.
Azure Security Center is the ideal place to begin. Azure Security Center offers suggested adjustments and alerts for safeguarding the security of your Azure resources. The first Azure Security recommendation is that you get the most from Azure Security Center by visiting the portal frequently for alerts that are new and taking steps to immediately correct any alerts that are detected. The third Azure Security recommendation is to use Azure Security Center as a standard feature for all subscriptions or, at the minimum, for every subscription that has production resources.
The base version in Azure Security Center included in Microsoft Azure offers limited information. Azure Security Center Standard helps to identify security weaknesses and provides a suggested solution. Microsoft offers a trial period of 60 days for Security Center Standard at no cost.
3. Secure Identity with Azure Active Directory
The days of the primary security barrier within the network was the Firewall. Identity is fast becoming the main security boundary. For Microsoft Azure, this is more than ever. This is why Microsoft has issued a number of recommendations concerning the security of Identity through Azure Active Directory. Since Microsoft Azure relies on Azure Active Directory to authenticate users and security, these Azure Security recommendations are essential for the protection of the Azure cloud.
Microsoft strongly recommends that Identity be centralized into one Authoritative source. In the case of a hybrid identity model, one Azure security ideal practice is to connect your cloud and on-premise directories by using Azure Active Directory Connect. The integration will enable identities to be managed at one time at a single location. The “single point of reference” will enhance transparency and decrease the chance of making mistakes that could lead to security risks and create a lot of configuration complexity.
4. Owners of subscriptions with a limit
This Azure Best Practices for Security for security is simple. There is no need to have at least one Azure account owner; however, there shouldn’t be more than three owners with permissions. Ideally, you’ll want to have two trustworthy Azure Administrators, or “Product Owners,” to be the holders of the subscription(s) and, should it be possible, one “break-glass” account in case of emergency.
5. Access to the control network
As with all data centers, the network access within Azure should be carefully managed. My suggestion is to use a “protection rings” method that lets you create multiple security rings within (and among) the protected resource. Applying this method to Azure, the first ring (often known as”the perimeter” ring) is usually composed of a Firewall like Azure Firewall or an external virtual network appliance.
The second ring can be a Network Security Group (or NSG) which is applied on the subnet. Network Security Groups allow you to limit network traffic as well as from Azure resources on the Azure virtual network.
6. Deleting the remote connection (RDP/SSH)
I suggest that you block RDP as well as SSH access to Azure virtual machines on the internet. In actual fact, the use of both RDP as well as SSH access should be made available via a secure private network (such as VPN or ExpressRoute, as described earlier), making use of Just-in-Time (JIT) virtual Machine access.
After you have enabled Azure Security Center Standard in the first place, I strongly recommend that you enable Just-in-time access to virtual machines. Just-in-time virtual machine access is used to manage the inbound traffic that is directed to Azure Virtual Machines, reducing the risk of being a victim of brute force attacks while allowing easy access for connecting to virtual machines (VMs) through Remote Desktop and Secure Shell.
7. Update and protect your virtual machine
It is essential to safeguard your server operating systems just as you would for data centers on-premises. It is essential to have anti-malware and antivirus. I would recommend Windows Defender Advanced Threat Protection (ATP) as well as Microsoft anti-malware. Both of which are integrated together with Azure Security Center to provide one place to manage the security of your VM security.
Microsoft is still requiring system updates for VMs hosted on Azure, and Azure offers an update management system that provides an automated method of applying the latest updates for Windows Virtual Machines. Azure Security Center will find security updates that are missing and apply them on your behalf.
8. Safeguard sensitive data
They are securely protecting sensitive data, including keys, certificates, and secrets, essential to protect your data stored in cloud computing with Microsoft Azure cloud. Azure Key Vault is a good option to secure cryptographic keys as well as secrets that cloud-based applications and services utilize. Each vault is a distinct access-control list, which is based on the role-based access controls (RBAC).
9. Enable Encryption
With Microsoft Azure, protect all of your information, both in transit and in rest, using Encryption. In some cases, Encryption is turned on by default. In other situations, Encryption must be enabled by hand.
Encryption at rest is accomplished by default on Managed Disks (created after June 10th in 2017) by using Storage Service Encryption for Azure Managed Disks using encryption keys controlled by Microsoft. I also suggest using Azure Disk Encryption which can be enabled by hand, to secure any drive that holds sensitive data.
Furthermore, using Azure SQL, Azure SQL encryption of data in the database transparent to it should be used to safeguard the database files on disk.
Closing
Secure Azure is not without its own different issues. If done correctly, it will be just as secure as the top data center. This list of Azure Security best practices will get your feet moving; however, understanding Azure Security is going to require technical expertise and practical training.
