An overview of Azure Security

 

Overview

We understand how essential it is to obtain accurate and timely information about Azure security in the cloud, and we understand how important it is to find accurate and timely information about Azure security. Taking use of Azure's extensive range of security tools and capabilities is one of the strongest reasons to utilize it for your apps and services. These tools and capabilities assist in the development of secure solutions on the Azure platform. Microsoft Azure ensures client data's confidentiality, integrity, and availability while also allowing for transparent accountability.

This post takes a close look at the security features offered in Azure.

Azure platform 

Microsoft Azure is a public cloud service platform that supports a wide range of operating systems, programming languages, frameworks, tools, databases, and devices. It can run Linux containers using Docker; construct apps using JavaScript, Python,.NET, PHP, Java, and Node.js; and create backends for iOS, Android, and Windows devices.

The same technologies that millions of developers and IT professionals rely on and trust are supported by Azure public cloud services. When you develop on a public cloud service provider's platform or move IT assets to one, you're depending on that company's ability to safeguard your apps and data using the services and controls they provide to manage the security of your cloud-based assets.

Azure's infrastructure is built for hosting millions of customers at once, from the facility to the apps, and it provides a secure base on which organizations may satisfy their security needs.

Furthermore, Azure offers a large range of adjustable security choices as well as the ability to regulate them, allowing you to tailor security to match the specific needs of your organization's deployments. This document explains how Azure security features can assist you in meeting these needs.

Overview of Azure's security features.

Depending on the cloud service model, there are several levels of responsibility for managing the application or service's security. Built-in features and partner solutions that may be installed into an Azure subscription are both available on the Azure Platform to help you in satisfying these responsibilities.

Operations, Applications, Storage, Networking, Compute, and Identity are the six functional domains in which the built-in capabilities are arranged. Summary information provides further information on the features and capabilities offered in the Azure Platform in these six categories.

Operations

This section contains further details on essential security aspects as well as a synopsis of these capabilities.

Microsoft Sentinel is a security program developed by Microsoft.

Security information and event management (SIEM) and security orchestration, automation, and response (SOAR) solution Microsoft Sentinel is a scalable, cloud-native SIEM and SOAR solution. Microsoft Sentinel is a single solution for attack detection, threat visibility, proactive hunting, and threat response that offers intelligent security analytics and threat data throughout the company.

Microsoft Cloud Defender

With enhanced visibility and control over the security of your Azure resources, Microsoft Defender for Cloud lets you avoid, detect, and respond to attacks. It integrates security monitoring and policy administration across your Azure subscriptions, assists in the detection of threats that might otherwise go unreported, and integrates with a wide range of security solutions.

Defender for Cloud also assists with security operations by offering a single dashboard that displays alarms and suggestions that can be acted on right away. In many cases, you may resolve difficulties in the Defender for Cloud console with a single click.

Azure Resource Manager

You may use Azure Resource Manager to deal with your solution's resources as a group. All of the resources for your solution may be deployed, updated, or deleted in a single, coordinated action. For deployment, you utilize an Azure Resource Manager template that can be used in a variety of environments, including testing, staging, and production. Security, auditing, and tagging capabilities in Resource Manager help you manage your resources after deployment.

Because standard security control settings and may be integrated into standardized template-based deployments, Azure Resource Manager template-based deployments assist to improve the security of solutions deployed in Azure. This decreases the possibility of security configuration problems during manual deployments.

Application Insights

Application Insights is a web developer-friendly Application Performance Management (APM) tool. You may use Application Insights to monitor your live web apps and find performance abnormalities automatically. It comes with advanced analytics capabilities to help you detect problems and analyze how people interact with your apps. It keeps an eye on your app while it's operating, both during testing and after it's been published or deployed.

Application Insights generates graphs and tables that show you things like when your app gets the most traffic, how responsive it is, and how well it is supported by any external services it relies on.

You may browse through the telemetry data in detail to determine the source of crashes, malfunctions, or performance difficulties. In addition, the service notifies you through email whenever your app's availability or performance changes. As a result, Application Insight becomes a vital security tool since it aids availability in the security triangle of confidentiality, integrity, and availability.

Azure Monitor

On data from both the Azure subscription (Activity Log) and each individual Azure resource, Azure Monitor provides visualization, query, routing, alerting, auto scaling, and automation (Resource Logs). You may use Azure Monitor to get notifications about security-related events that occur in Azure logs.

Azure Monitor logs

Azure Monitor logs – In addition to Azure resources, Azure Monitor provides an IT monitoring solution for on-premises and third-party cloud-based infrastructure (such as AWS). Data from Azure Monitor may be seamlessly forwarded to Azure Monitor logs, allowing you to access metrics and logs for your whole environment in one location.

Azure Monitor logs can be valuable in forensic and other security investigations since they allow you to look through vast quantities of security-related items fast and easily using a flexible query strategy. Additionally, logs from on-premises firewalls and proxy servers may be uploaded to Azure and analyzed using Azure Monitor logs.

Azure Advisor

Azure Advisor is a one-on-one cloud specialist who assists you in optimizing Azure deployments. It examines your resource settings as well as use data. It then suggests options to assist you increase the performance, security, and dependability of your resources while also searching for ways to cut your Azure spending overall. Azure Advisor makes security advice that might help you enhance the overall security posture of your Azure products. These suggestions are based on Microsoft Defender for Cloud's security analysis.

Applications

Additional information on major elements in application security is provided in this part, as well as a synopsis of these capabilities.

Penetration Testing

We don't do your application's penetration testing for you, but we recognize that you want and need to do it yourself. That's a good thing, since improving the security of your apps improves the security of the whole Azure ecosystem. Customers must to follow the Microsoft Cloud Penetration Testing Rules of Engagement, even though informing Microsoft of pen testing operations is no longer necessary.

Web Application firewall

The web application firewall (WAF) in Azure Application Gateway protects web applications against threats like as SQL injection, cross-site scripting, and session hijacking. It is preconfigured with protection against the top 10 frequent vulnerabilities determined by the Open Web Application Security Project (OWASP).

Authentication and authorization in Azure App Service

App Service Authentication / Authorization is a feature that allows your app to sign in users without requiring changes to the app's backend code. It gives you a simple solution to secure your app and interact with per-user data.

Layered Security Architecture

Developers may construct a tiered security architecture with different levels of network access for each application tier using App Service Environments, which provide an isolated runtime environment deployed into an Azure Virtual Network. A typical objective is to keep API backends hidden from broad Internet access and only enable upstream web apps to call APIs. Network Security Groups (NSGs) may be used to limit public access to API apps on Azure Virtual Network subnets hosting App Service Environments.

Application diagnostics and web server diagnostics

Service for Apps Diagnostic capabilities for logging information from both the web server and the web application is provided by web applications. Web server diagnostics and application diagnostics are conceptually separated. Two key advancements in diagnosing and debugging sites and applications are included in the Web server.

Real-time state information about application pools, worker processes, sites, application domains, and current requests is the first new feature. The comprehensive trace events that monitor a request throughout the whole request-and-response process are the second new benefit.

IIS 7 may be set to automatically capture entire trace logs in XML format for every given request depending on elapsed time or incorrect response codes to allow the gathering of these trace events.

Storage

Additional information on major aspects of Azure storage security is provided in this section, as well as a synopsis of these capabilities.

Azure role-based access control (Azure RBAC)

Azure role-based access control can help you protect your storage account (Azure RBAC). Organizations that wish to implement security rules for data access must restrict access based on the need to know and least privilege security principles. The proper Azure role is assigned to groups and apps at a certain scope to give these access permissions. You may provide rights to users using Azure built-in roles like Storage Account Contributor. Azure RBAC may be used to manage access to storage keys for a storage account using the Azure Resource Manager paradigm.

Shared Access Signature

A shared access signature (SAS) grants delegated access to your storage account's resources. You may provide a client restricted rights to items in your storage account for a defined amount of time and with a set of permissions using the SAS. You don't have to disclose your account access credentials to provide these limited capabilities.

In-Transit Encryption

Encryption in transit is a method of safeguarding data while it travels across networks. You may safeguard data using Azure Storage by utilizing the following methods:

• When transferring data into or out of Azure Storage, use transport-level encryption, such as HTTPS.
• SMB 3.0 encryption for Azure File sharing is an example of wire encryption.
• Client-side encryption encrypts data before it is put into storage and decrypts it after it has been transmitted out.

At-rest encryption

Data encryption at rest is a need for many enterprises in terms of data privacy, compliance, and data sovereignty. There are three security capabilities in Azure storage that encrypt data while it is "at rest":

• You may use Storage Service Encryption to have the storage service automatically encrypt data when it's written to Azure Storage.
• Client-side Encryption also has the ability to encrypt data at rest.
• You may encrypt the OS and data disks used by an IaaS virtual machine using Azure Disk Encryption.

Analytical Storage

For a storage account, Azure Storage Analytics does logging and gives metrics data. This information may be used to track down requests, examine use patterns, and detect problems with your storage account. Storage Analytics keeps track of successful and unsuccessful queries to a storage service. This information may be used to track individual requests and troubleshoot storage service problems. On a best-effort basis, requests are logged. Authenticated requests of the following sorts are logged:

• Requests that were successful.
• Timeout, throttling, network, authorisation, and other problems are examples of failed requests.
• Requests with a Shared Access Signature (SAS), both successful and unsuccessful.
• Requests for data from analytics.

Using CORS to enable browser-based clients

CORS (Cross-Origin Resource Sharing) is a system that allows domains to provide authorization to each other to access each other's resources. Extra headers are sent by the User Agent to guarantee that JavaScript code loaded from one domain may access resources from another domain. The later domain then responds with additional headers granting or prohibiting access to its resources to the original domain.

Azure storage services now support CORS, which means that when you specify the CORS rules for the service, a fully authenticated request from a different domain is assessed to see if it is authorized according to the criteria you set.