Securing Azure Storage

In the previous chapter, we covered recipes for securing Azure databases.

We introduced the concept of the shared responsibility model for public cloud platform service providers. The same approach and model applies to this chapter; the customer is responsible for the security of storage held in Azure and enabling and configuring the appropriate level of protection and security controls for the customer’s needs.

This chapter concludes Part 1 of this cookbook, in which we have been looking at Azure’s security features and capabilities.

In this final chapter of this part, the recipes we look at will cover the security settings that can be configured and data protection through encryption.

By the end of this chapter, you will have learned the following skills to carry out the following recipes to secure Azure Storage:

• Implementing security settings on storage accounts
• Implementing network security
• Implementing encryption...

Technical requirements

For this chapter, it is already assumed that you have an Azure AD tenancy and an Azure subscription from completing the recipes in previous chapters of this cookbook. If you skipped straight to this section, the information to create a new Azure AD tenancy and an Azure subscription for these recipes is included in the following list of requirements.

For this chapter, the following are required:

• A device with a browser, such as Edge or Chrome, to access the Azure portal at https://portal.azure.com.
• An Azure AD tenancy and Azure subscription; you may use existing ones or sign up for free: https://azure.microsoft.com/en-us/free.
• An Owner role for the Azure subscription.

Implementing security settings on storage accounts

Azure Storage accounts, by default, have an internet-accessible public endpoint, the same as we learned about with Azure SQL databases from the last chapter. Therefore, we must provide security and access control layers for our defense-in-depth strategy.

This recipe will teach you to secure and control access to your Azure storage accounts.

We will look at the security settings that can be configured when creating storage accounts, network security, and encryption.

Getting ready

This recipe requires the following:

• A device with a browser, such as Edge or Chrome, to access the Azure portal: https://portal.azure.com
• Access to an Azure subscription, where you have access to the Owner role for the Azure subscription

How to do it…

This task consists of the following tasks:

• Reviewing the security settings when creating a storage account

Task – reviewing the security settings...

Implementing network security

We must secure not only the storage account itself but also the network we use for access; this enforces our defense-in-depth strategy.

This recipe will teach you to secure network access to your storage accounts.

We will look at the network access settings that can be configured when creating storage accounts, virtual network access, and implementing a storage IP firewall.

This recipe requires the following:

• A device with a browser, such as Edge or Chrome, to access the Azure portal at https://portal.azure.com.
• Access to an Azure subscription, where you have access to the Owner role for the Azure subscription.

How to do it…

This task consists of the following tasks:

• Implementing network access settings when creating a storage account
• Implementing virtual network access
• Implementing a storage IP firewall

Task – implementing network access settings when creating a storage account

Perform...

Implementing encryption

When implementing a Zero Trust approach to cloud resource security, we must adopt the stance of Assumed Breach. This means assuming that bad actors have already compromised our perimeter defenses, and we are at risk of data integrity breaches and data exfiltration. Therefore, we must provide mechanisms that ensure our data’s integrity remains and our data is unreadable and unusable in the case of exfiltration.

This recipe will teach you to secure your storage account data at rest through encryption using Azure Storage Service Encryption.

In this task, we will look at the customer-managed keys encryption type; by default, storage accounts are encrypted by Microsoft-managed keys with no configuration required.

We will look at how encryption can be set for existing storage accounts.

Getting ready

This recipe requires the following:

• A device with a browser, such as Edge or Chrome, to access the Azure portal at https://portal.azure.com...