Securing Azure Networks

In the previous chapter, we covered recipes that provided the foundation for securing Azure AD identities.

We should consider Zero Trust and defense in depth to be cornerstones of a cloud security strategy. We must consider the network as untrusted and assume a breach.

In this chapter, we build on those foundations and go through recipes that will equip us with the skills for securing Azure networks.

We will take a look at the protection of the network from the Open Systems Interconnection (OSI) model perspective and focus on solutions to protect Layer 3 (Network), Layer 4 (Transport), and Layer 7 (Application).

By the end of this chapter, you will have gained valuable skills for securing Azure networks through the following recipes:

• Implementing network security groups
• Implementing Azure Firewall
• Implementing Azure Web Application Firewall
• Implementing Azure DDoS

Technical requirements

For this chapter, it is assumed that you have an Azure AD tenancy and an Azure subscription after completing the recipes in the previous chapter of this cookbook. If you skipped straight to this chapter, the information to create a new Azure AD tenancy and an Azure subscription for these recipes is included in the following list of requirements.

For this chapter, the following are required for the recipes:

• A device with a browser, such as Edge or Chrome, to access the Azure portal: https://portal.azure.com
• An Azure AD tenancy and Azure subscription; you may use an existing one or sign up for free: https://azure.microsoft.com/en-us/free
• An Owner role for the Azure subscription

Implementing network security groups

As part of an in-depth defense strategy, you should implement measures to protect your workload resources and filter network traffic between resources in your Azure virtual networks. Network Security Groups (NSG) can offer protection against lateral movement threats.

This recipe will teach you how to implement NSGs to protect your Azure virtual network virtual machine resources.

We will take you through creating a virtual network and a workload server virtual machine resource to protect. Then, we will walk through creating an NSG and apply it to the virtual network subnet where the test workload server virtual machine is located to demonstrate providing both allow and deny controls.

Getting ready

This recipe requires the following:

• A device with a browser, such as Edge or Chrome, to access the Azure portal: https://portal.azure.com
• You should sign in with an account that has the Owner or Contributor role for the Azure subscription...

Implementing Azure Firewall

As part of our defense-in-depth strategy, we should implement measures to protect the perimeters of our Azure virtual networks. In environments with many distributed workload resources that need to communicate securely, we must ensure we protect these across many regions and subscriptions.

We must protect traffic entering our network from the internet (North/South), internal traffic from spoke-to-spoke virtual networks (East/West), and cross-premises hybrid or partner edge connections.

This recipe will teach you how to implement Azure Firewall Premium to protect your resources in an Azure virtual network.

We will take you through creating an Azure Firewall and policy, creating a default route, creating a workload server virtual machine for testing, and configuring and testing firewall rules.

Getting ready

This recipe requires the following:

• A device with a browser, such as Edge or Chrome, to access the Azure portal: https://portal...

Implementing Azure Web Application Firewall

As we continue with our defense-in-depth strategy, we should look at the different types of traffic on the network, their protocols, and their direction, such as inbound/outbound and lateral traffic flows; this can be referred to as north/south and east/west traffic.

We should evaluate the most appropriate defense mechanism based on our desired outcomes. If we allow any HTTP(s) protocols into our Azure networks, such as to allow access to web applications, we need to implement measures to protect against Layer 7 web protocol attacks, such as cross-site scripting and SQL injection.

This outcome can be achieved by implementing a Layer 7 Web Application Firewall (WAF), rather than a Layer 4 network firewall.

It is important to note that a traditional Layer 4 network firewall will not offer protection against these inbound Layer 7 attacks; an Intrusion Detection and Prevention System (IDPS) solution will also be ineffective in detecting...

Implementing Azure DDoS

In the previous section on implementing a WAF-enabled application gateway, we looked at protecting our web applications that are vulnerable to Layer 7 inbound web protocol attacks.

We continue, in this section, with our defense-in-depth strategy and look at additional protection methods for the protection of the network.

We will look at protecting Layers 3 and 4 of our network against Distributed Denial of Service (DDoS) attacks using the Azure DDoS Protection Standard service.

This recipe will teach you how to implement an Azure DDoS protection plan to protect your Azure virtual network(s).

We will take you through creating a DDoS protection plan and enabling protection for new and existing virtual networks, and provide information on how you may perform validation testing using Microsoft-supported third-party tools.

Getting ready

This recipe requires the following:

• A device with a browser, such as Edge or Chrome, to access the Azure...