Chapter 7: Azure Security

In Chapter 6, Azure Management Tools, you learned the skills that covered Azure Advisor, Azure Monitor, Azure Service Health, the Azure portal, Azure PowerShell, and the Azure command-line interface (Azure CLI).

This chapter will outline the security aspects available in Azure, including security concepts and the security services themselves that you can enable, as well as security posture management and security operations tooling.

This chapter aims to provide complete coverage of the AZ-900 Azure Fundamentals – Skills Measured section: describe general security and network security features.

By the end of this chapter, you will have learned the following skills:

• Describe the concept of threat modeling.
• Describe the concept of Zero Trust.
• Describe the concept of defense in depth (DiD).
• Describe the functionality and usage of Azure Key Vault and Azure Dedicated Host.
• Describe the functionality and usage of network security...

Technical requirements

To carry out the hands-on labs in this chapter, you will require the following:

• An Azure subscription that has access to create and delete resources in the subscription. If you do not have an Azure subscription, you can create a free Azure account from this link: https://azure.microsoft.com/free.
• Access to an internet browser, as you will log in to the Azure portal at https://portal.azure.com.
• You can alternatively use the Azure desktop app, available at https://portal.azure.com/App/Download.

It is important to note that in November 21 some Microsoft Security Services have been renamed. These are renamed as follows:

• Azure Security Center and Azure Defender are now called Microsoft Defender for Cloud
• Azure Defender plans to Microsoft Defender plans
• Azure Sentinel is now called Microsoft Sentinel
• Azure Defender for IoT is now called Microsoft Defender for IoT
• Azure Defender for SQL is now called Microsoft Defender...

Threat modeling

Attackers can take many forms, such as criminal hackers, hacktivists, competitors, and foreign nations. Don't forget either that attackers are not only external; they can be internal to an organization—for example, ex-employees—these often being the hardest to detect and prevent. For further reading, you should enter Sly Dog gang into your favorite search engine to read about a real-world insider espionage attack on one of the highest-profile manufacturers of electric vehicles.

You must put in measures so that you don't become an easy target for opportunists as well as the crafted, pre-meditated, military-style operation of some sophisticated attacks; these measures are designed to raise the attacker's costs significantly, so they divert their resources and activities to an easier attack target that has a higher return on their attack investment.

The approach that should be taken is to adopt a threat priority model; this can then aid...

Zero Trust

An important concept to consider is Zero Trust, which uses the approach of never trust, always verify; this concept relates to thinking beyond traditional network perimeter-based security and adopting a holistic approach to security.

Zero Trust is not a service or solution but a wider-thinking security strategy and framework to be adopted, and works on the notion of ensuring compliance and securing access at the resource and no longer the location or network the resource is on; we must NOT assume trust because of the resource's network or location.

The Zero Trust framework is built upon the following foundational principles:

• Assume breach.
• Verify explicitly.
• Use least-privilege access (Just In Time (JIT), and just enough access).

In this new world of hybrid work where organizations' traditional firewalls and security service-controlled network perimeters have vanished due to remote working, we must now consider identity as the new perimeter...

Defense in depth

DiD refers to a strategy that places multiple layers of different forms of defenses between attackers and the resources you are trying to protect.

Adopting a DiD strategy allows an organization to adopt a strong security posture and help ensure that all systems, data, and users are better protected from threats and compromise.

A DiD strategy means there is no single layer of protection or security service that is solely responsible for protecting resources, but by implementing many different types of defense at individual layers, you can slow down an attack path. It may successfully breach one defensive layer but be halted by subsequent protection layers, preventing the protected resource from being exposed.

The following screenshot shows that DiD as a concept is nothing new as a strategy; it can be considered the medieval castle concept of protecting resources:

Figure 7.5 – Medieval castle defense approach

The medieval castle...

Network and application protection

This section introduces the core solutions available in Azure to protect and secure the network and applications running in Azure; this section also covers solutions that, while not part of the exam objectives, have been included with brief coverage as they should be considered required knowledge for a day-to-day Azure role.

NSGs

An NSG is a network security control and should be part of your DoD approach to protecting the network layer from network threats.

An NSG controls access, limits connections to virtual machines (VMs) in an Azure Virtual Network (VNet), and uses a deny-by-default policy; this means that all access is denied unless explicitly allowed. The following diagram shows a simplification of this:

Figure 7.7 – VM access

In the preceding diagram, Subnet 1 has no traffic filtering in place, so you would be able to connect to Windows VM1 using Remote Desktop Protocol (RDP) on port 3389, and so can...

Azure Key Vault

Azure Key Vault is a cloud-based centralized solution for storing and managing sensitive information used by an application, service, or resource in an encrypted format. It can store information using hardware security modules (HSMs) to meet Federal Information Processing Standard (FIPS) 140-2.

Azure Key Vault is used for the following:

• Secrets management: Used to store information such as passwords, tokens, application programming interface (API) keys, .pfx files, and so on
• Key management: Used to store cryptographic keys, both software- and hardware-protected.
• Certificate management: Used to store and manage public certification authority (CA) Secure Sockets Layer (SSL)/TLS certificates

These secrets, keys, or certificates are generally intended to be called programmatically by app or resource.

Similar to all other Azure resources we covered already, Azure Key Vault can be deployed using different approaches, from the Azure CLI/PowerShell...

Azure Dedicated Host

With Azure being a shared resources computing platform, this means that the default premise is that any VMs you create will run on a multi-tenant platform, thus you share the underlying physical hardware virtualization hosts with other tenants (organizations). However, your VMs and their workloads are isolated from other workloads on other VMs.

Putting this into an analogy, this means that you may have your own individual hotel room, but you share the hotel building itself with others; you may have your own dedicated front door to access your room, and each person has their own door (as it were) to their own room, but you all share the same corridor, stairs, lifts, restaurant, lobby, front entrance, car park, and so on.

However, Azure Dedicated Host changes that model and provides physical virtualization hosts dedicated to individual customers to host their Azure VMs for Windows and Linux workloads. In our analogy, this means that the building and its contents...

Azure Sentinel

Azure Sentinel is your birds-eye view on centralized security data and events across an organization, using integrated AI for large-scale threat analysis and response.

It is Microsoft's cloud-based security information and events management (SIEM) and security orchestration, automation, and response (SOAR) tool; it provides security data aggregation, threat analysis, and response across public cloud and on-premises environments.

A SIEM solution collects security log data (security signaling) and examines this log data for patterns that could indicate an attack, then correlates event information to identify potentially abnormal activity. Finally, any issues are alerted and this automates responses and remediation. The following diagram illustrates this relationship:

Figure 7.11 – Sentinel positioning

Azure Sentinel provides the following core capabilities:

• Collects security data across an organization
• Detects threats...

Azure Security Center

Azure Security Center is Microsoft's Cloud Security Posture Management (CSPM) tool; it provides security policy and compliance management, actionable security hardening tasks, and secure scores.

A security posture is an organization's threat protection and response capabilities; this ensures that an organization has the ability for its systems, data, and identities to be recoverable and operational should an attack be successful. Adopting the Azure Security Center best practices and recommendations can help increase an organization's security posture and secure score.

A security posture's goal should be to reduce the exposure to threats, shrinking attack-surface areas and vectors while building resilience to attacks, gaining intelligence, and learning from each attack, as they cannot be prevented or eliminated. It is critical to understand that an attacker only has to be successful once, while you must protect everything, all the time...

Other protection solutions

Azure, in addition, provides the following two services that provide critical application-delivery protection and security:

• Azure Application Gateway provides a secure way of load balancing to service endpoints such as VMs and can be used for SSL termination, also called SSL offloading. Azure Application Gateway also provides web application firewall (WAF) capabilities to protect internet-facing web applications from application-layer attacks (L7); distribution of traffic is to endpoints within a region only.
• The Azure Front Door service provides an application delivery network (ADN) service. It also provides layer 7 (application layer) load balancing, WAF, and content acceleration capabilities for applications; however, it operates at the geographic layer and is not regional.

While both Front Door and Application Gateway are layer 7 (HTTP/HTTPS) load balancers, the primary difference is that Front Door is a global app delivery service...

Hands-on exercise

To support your learning with some practical skills, we will look at the hands-on creation of some of the resources covered in this chapter.

The following exercises will be carried out:

• Exercise 1 – Create an Azure key vault.
• Exercise 2 – Secure network access using an NSG.

Getting started

To get started with these hands-on exercises, you will need an Azure subscription that has access to create and delete resources in the subscription. You can use an existing account that you created as part of the exercises from any chapter in this book; alternatively, you can create a free Azure account from this link: https://azure.microsoft.com/free.

This free Azure account provides the following:

• 12 months of free services.
• USD $200 credit to explore Azure for 30 days.
• 25+ services that are always free.

Exercise 1 – Create an Azure key vault

This section will look at installing Azure Key Vault and then...

Summary

This chapter, Azure Security, included coverage of the AZ-900 Azure Fundamentals exam skills area: Describe general security and network security features.

In this chapter, you have learned about security concepts, security services, and security operations. This included skills that will provide you the confidence to explain and discuss the functionality and usage of the following aspects with a business or technical audience: the concepts of threat modeling, DoD, Azure Key Vault, Azure Dedicated Host, NSGs, Azure Firewall, Azure DDoS Protection, Azure Security Center, and Azure Sentinel.

The following chapter will cover identity services, including Azure AD, Active Directory (AD), hybrid identity authentication, authorization, single sign-on (SSO), multi-factor authentication (MFA), and Conditional Access.

Additional information and study references

This section provides links to additional exam information and study references, as follows:

• Exam AZ-900: Microsoft Azure Fundamentals:

  https://docs.microsoft.com/learn/certifications/exams/az-900

• Exam AZ-900: Microsoft Azure Fundamentals – Skills Measured:

  https://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RE3VwUY

• Microsoft Learn: Azure Fundamentals part 4 – Describe general security and network security features:

  https://docs.microsoft.com/learn/paths/az-900-describe-general-security-network-security-features

Skills check

Challenge yourself with what you have learned in this chapter by answering the following questions:

1. Explain the Zero Trust framework principles and foundational elements.
2. Explain a DoD strategy; what are the goals?
3. What are the three uses for Azure Key Vault?
4. When would Azure Dedicated Host be required for a solution?
5. Which Azure security feature can be used to improve security posture?
6. Which Azure security feature can be used for Azure and on-premises security operations?
7. Are all Azure security capabilities included in the Free pricing tier?
8. How is Azure Sentinel positioned against Azure Security Center and Azure Defender?
9. How are NSGs positioned against Azure Firewall?
10. When would the Azure DDoS protection service be used in a solution?