Azure Security Notes

CTU Training Solutions

Introduction to Azure Security

Topic Elements Covered:

• What is Microsoft Azure?
• Common Security Issues in the Cloud
• The AAAs of Access Management
• Encryption in Azure
• Network Segmentation
• Cybersecurity Considerations in Cloud
• Major Cybersecurity Threats
• Shared Responsibility Model
• Physical Security in Azure
• Azure Network Infrastructure
• Infrastructure Availability
• Infrastructure Integrity
• Usage & Quotas Management
• Infrastructure Monitoring Tools
• Azure Security Foundations

What is Microsoft Azure?

• Microsoft Azure is a comprehensive cloud computing platform developed by Microsoft.
• Offers Infrastructure as a Service (IaaS), Platform as a Service (PaaS), and Software as a Service (SaaS).
• Provides on-demand services such as:
  • Virtual machines and containers (Compute)
  • Blob, file, and disk storage
  • Virtual networks, load balancers, VPN gateways (Networking)
  • Azure SQL, Cosmos DB, and other database services
  • Identity, access, and threat protection (Security)

Key Capabilities of Azure

• Global Reach: Azure has 60+ regions and over 200 data centers worldwide.
• Hybrid Capabilities: Azure supports hybrid cloud with services like Azure Arc and Azure Stack.
• AI and Machine Learning: Pre-built models and customizable solutions.
• DevOps Integration: Tools like Azure DevOps, GitHub Actions for CI/CD.
• Compliance & Security: Meets 90+ compliance certifications.

Azure Service Models

• IaaS (Infrastructure as a Service):
  • Users manage VMs, networks, storage.
  • Azure handles the hardware and virtualization.
  • Example: Azure Virtual Machines.
• PaaS (Platform as a Service):
  • Provides runtime environments, development tools.
  • Users focus on app development; Azure handles infrastructure.
  • Example: Azure App Service.
• SaaS (Software as a Service):
  • Ready-to-use applications delivered via the internet.
  • No infrastructure or platform management.
  • Example: Microsoft 365.

Common Security Issues in the Cloud

• Misconfigured Services:
  • Example: Open Azure Blob Storage exposing sensitive data.
  • Publicly accessible resources without proper access restrictions.
• Unsecured APIs:
  • APIs lacking authentication or encryption can be exploited.
  • Leads to data leakage, injection attacks, or unauthorized actions.
• Inadequate Identity & Access Controls:
  • Excessive permissions (e.g., users with owner rights unnecessarily).
  • Lack of Multi-Factor Authentication (MFA).
• Unpatched Software:
  • Outdated virtual machines or services vulnerable to exploits.
  • Lack of automated patching policies.
• Insecure Third-Party Integrations:
  • Poorly vetted vendor services with weak security postures.
  • Supply chain attacks via connected apps/services.

Real-World Examples of Cloud Security Failures

• Capital One (2019):
  • Misconfigured AWS firewall led to a data breach of 100M+ records.
• Microsoft Power Apps (2021):
  • Misconfigured default settings in Azure Power Apps exposed 38M records.
• Lessons Learned:
  • Default settings are often insecure—need review and hardening.
  • Misconfigured storage and access policies are a top threat vector.
  • Monitoring and alerting must be proactive, not reactive.

Mitigating Common Security Issues in Azure

• Use Azure Security Center:
  • Real-time insights into misconfigurations and threat protection.
• Implement Least Privilege Access:
  • Role-Based Access Control (RBAC), Just-In-Time (JIT) VM access.
• Enforce MFA and Conditional Access:
  • Protect identity and access management.
• Keep Systems Patched:
  • Use Azure Update Management or auto-patching features.
• Secure APIs:
  • Use Azure API Management and OAuth2.0.
• Vet Third-Party Integrations:
  • Review permissions and certifications before allowing access.

The AAAs of Access Management

The AAA framework is essential for controlling and securing access in cloud environments like Azure.

• Authentication – Verifies who you are.
• Authorization – Determines what you can access.
• Accounting (Auditing) – Tracks what you did.

Use Case in Azure:

• Azure Active Directory (Azure AD) handles authentication.
• Role-Based Access Control (RBAC) handles authorization.
• Azure Monitor and Microsoft Defender for Cloud provide accounting/auditing.

Authentication in Azure

• Purpose: Confirm a user’s or system’s identity before granting access.
• Methods:
  • Passwords & PINs
  • Biometrics (fingerprint, facial recognition)
  • Multi-Factor Authentication (MFA) – Combines two or more methods.
• Azure Tools:
  • Azure AD for identity management
  • Azure MFA for strong authentication
  • Conditional Access policies for dynamic authentication controls

Authorization & Accounting in Azure

Authorization

• Determines what resources a user can access and what actions they can perform.
• Tools:
  • RBAC (Role-Based Access Control): Assigns roles to users, groups, or applications.
  • Azure Policies: Enforce organizational standards (e.g., restrict VMs to certain regions).

Accounting / Auditing

• Tracks user actions and resource access for security and compliance.
• Tools:
  • Azure Monitor, Log Analytics
  • Azure Activity Logs and Diagnostic Logs
  • Microsoft Sentinel for SIEM

Encryption in Azure

• Encryption in Azure ensures confidentiality, integrity, and compliance of data.
• Three main areas of focus:
  • Encryption at Rest
  • Encryption in Transit
  • Key Management
• Azure follows international standards (FIPS 140-2, ISO/IEC 27001).

Encryption at Rest

• Azure Storage Encryption: Automatically encrypts Blob, Table, Queue, and File data using AES-256.
• Azure Disk Encryption (ADE):
  • Uses BitLocker (Windows) or DM-Crypt (Linux) for OS and data disks.
  • Integrated with Azure Key Vault for key management.

Encryption In Transit

• Uses Transport Layer Security (TLS 1.2/1.3) for secure communication between:
  • Clients ↔ Azure Services
  • Services ↔ Services within Azure
• All Azure services support HTTPS endpoints and mutual TLS when configured.

Key Management with Azure Key Vault

• Azure Key Vault is a secure, central location to manage:
  • Encryption keys
  • Secrets (e.g., API keys, passwords)
  • Certificates
• Key Types:
  • Azure-managed keys (default)
  • Customer-managed keys (CMK)
  • Bring Your Own Key (BYOK)
• Integration: Works with Azure Storage, SQL Database, Virtual Machines, and more.
• Benefits:
  • Access control with Azure AD & RBAC
  • Secure key rotation and expiration policies
  • Logging with Azure Monitor and Defender for Cloud

Introduction to Network Segmentation in Azure

• Network segmentation is the practice of dividing a network into multiple smaller, isolated segments to enhance security, performance, and management.
• Purpose:
  • Limit lateral movement of attackers
  • Enforce least privilege networking
  • Simplify monitoring and troubleshooting
• Azure Tools:
  • Virtual Networks (VNets) – Define network boundaries
  • Network Security Groups (NSGs)– Control inbound and outbound traffic
  • Subnets – Organize resources within VNets

Subnetting and NSGs for Resource Isolation

• Subnetting
  • Divide a VNet into smaller segments (subnets) for logical isolation.
  • Use subnets for separating environments (e.g., Web, App, DB).
  • Enforce specific policies per subnet (e.g., no internet access for DB).
• Network Security Groups (NSGs)
  • NSGs contain security rules to allow/deny traffic.
  • Rules evaluated in order by priority (lower number = higher priority).
  • Applied at subnet or network interface level.
  • Can restrict:
    • Traffic between subnets
    • Inbound/outbound internet access

Advanced Controls – Azure Firewall & Private Link

• Azure Firewall

  • A fully managed, stateful firewall as a service.
  • Offers:
    • Application and network rule filtering
    • Threat intelligence-based filtering
    • Logging with Azure Monitor

• Azure Private Link

  • Enables private access to Azure PaaS services (e.g., Blob, SQL) over your VNet.
  • Eliminates exposure to public internet.
  • Uses Private Endpoints for secure access.

Cybersecurity Considerations in Cloud

Shared Responsibility Model:

• Cloud Provider (e.g., Microsoft Azure): Secures physical infrastructure, network, and core services.
• Customer: Secures data, identities, apps, devices, and configurations.
• Cloud ≠ Automatically Secure:
  • Users are responsible for enabling and managing security features.
• Key Risks:
  • Misconfigurations
  • Insecure APIs and interfaces
  • Identity-based attacks (e.g., credential stuffing)
  • Data exfiltration from public-facing services

Adopting the Zero Trust Model in Azure

• Zero Trust Principle: "Never trust, always verify."
• Every access request is treated as if it originates from an untrusted network.
• Core Pillars:
  • Verify explicitly – authenticate and authorize every access attempt.
  • Use least privileged access – grant only what is needed.
  • Assume breach – design systems to minimize impact of a compromise.
• Azure Implementations:
  • Conditional Access in Azure AD
  • Just-In-Time VM Access
  • RBAC & Privileged Identity Management (PIM)
  • Identity Protection

Cloud Security Tools: Defender for Cloud & Sentinel

• Microsoft Defender for Cloud

  • Unified security management system.
  • Capabilities:
    • Threat protection for hybrid and multi-cloud workloads
    • Secure score recommendations
    • Compliance tracking
    • Alerts for misconfigurations and threats

• Microsoft Sentinel (SIEM/SOAR)

  • Cloud-native Security Information and Event Management (SIEM) and Security Orchestration Automated Response (SOAR).
  • Use cases:
    • Collects and correlates logs from all sources (Azure, AWS, on-prem)
    • Real-time detection and investigation
    • Automated incident response

Major Cybersecurity Threats

Phishing & Social Engineering

• Use deception to trick users into revealing credentials or installing malicious software.
• Tactics include:
  • Fake login pages
  • Urgent emails impersonating executives
  • Smishing (SMS phishing)

Malware & Ransomware

• Malware: Malicious software (viruses, trojans, spyware) that disrupts or steals data.
• Ransomware: Encrypts data and demands payment for decryption.

Data Breaches & Insider Threats

• Data Breaches

  • Unauthorized access to sensitive data due to:
    • Weak passwords
    • Misconfigured cloud storage (e.g., open S3 buckets or Azure Blobs)
    • Exploited vulnerabilities

• Insider Threats

  • Malicious or careless employees or contractors
  • Types:
    • Intentional (data theft, sabotage)
    • Unintentional (accidental data sharing or credential loss)
  • Impacts:
    • Legal penalties (GDPR, POPIA)
    • Loss of customer trust
    • Financial and reputational damage
  • Tools for mitigation:
    • Azure Information Protection (AIP)
    • Data Loss Prevention (DLP)
    • Audit logs and access reviews in Azure AD

Denial-of-Service (DoS) and DDoS Attacks

• DoS/DDoS Attacks

  • Denial of Service (DoS): Overwhelm a server with requests to render it unavailable.
  • Distributed DoS (DDoS): Attack traffic from many sources (botnets), making it harder to block.
  • Common Targets:
    • Web apps, DNS servers, login portals
  • Mitigation in Azure:
    • Azure DDoS Protection (Basic + Standard)
    • Web Application Firewall (WAF) with Azure Front Door or Application Gateway
    • Rate limiting and autoscaling policies

What is the Shared Responsibility Model?

• A cloud security framework that defines the division of security responsibilities between Azure (cloud provider) and the customer.
• Core Idea:
  • Azure secures the cloud infrastructure (hardware, software, networking, and facilities).
  • Customers are responsible for securing everything they deploy or configure in the cloud.
• Why it matters:
  • Prevents false assumptions
  • Helps avoid security gaps
  • Supports compliance and audit readiness

Responsibilities by Service Model (IaaS, PaaS, SaaS)

Azure Security Tools That Support the Model

• Azure Defender (Defender for Cloud)

  • Provides recommendations and hardening tips for IaaS and PaaS.

• Microsoft Sentinel

  • Monitors both customer-managed and Azure-managed services (SIEM/SOAR).

• Azure Key Vault

  • Manages keys/secrets under customer control, even if infrastructure is managed.

• Azure Policy & Blueprints

  • Enforce configuration compliance across subscriptions and resource groups.

Physical Security – First Line of Cloud Defense

Microsoft Azure Data Centers

• Globally distributed across more than 60 regions
• Operated by Microsoft personnel only
• Redundancy in power, cooling, and connectivity

Layered Physical Security Model:

• Perimeter Defense
• Facility Access Controls
• Internal Data Center Segmentation
• Server Room Restrictions

Physical Controls in Azure Data Centers

• External Perimeter Security

  • High fences and vehicle barriers
  • Armed response units and patrols
  • Entry controlled through security gates and guards

• Facility Access & Authentication

  • Multi-factor authentication including:
    • Badge scanning
    • Biometric verification (e.g., fingerprint, iris scan)
    • Mantraps (airlock-style doors preventing tailgating)
    • Role-based access: only authorized personnel can enter critical areas

• Monitoring & Surveillance

  • 24/7 security staff on-site
  • CCTV with 90+ days of video retention
  • Sensors and motion detection

Compliance & Security Certifications

• Azure Data Center Compliance Certifications

  • ISO/IEC 27001: Information security management
  • SOC 1, 2, 3 reports: Independent audit of controls
  • PCI DSS, FedRAMP, and GDPR readiness
  • Microsoft’s Azure Trust Center documents all certifications

• Additional Facility Protections

  • Redundant power (UPS + generators)
  • Fire suppression (multi-zone detection and dry-pipe systems)
  • Climate control for equipment longevity

• Global Standards

  • Azure designs data centers to meet international and regional security laws
  • Customers can choose where their data resides (geo-redundancy)

Azure Network Infrastructure

Software-Defined Networking (SDN)

• Virtualizes networking hardware through software
• Enables centralized control and dynamic provisioning
• Supports automation, scalability, and security

Global Network Backbone

• Microsoft operates one of the largest global networks
• Thousands of miles of fiber optic cables connecting data centers worldwide
• Provides high-speed, low-latency connectivity

Key Network Security Tools in Azure

• Azure Firewall

  • Managed, stateful firewall service
  • Application & network-level filtering
  • Threat intelligence-based filtering to block known malicious IPs

• Application Gateway

  • Layer 7 (HTTP/HTTPS) load balancer
  • Web Application Firewall (WAF) to protect against common exploits (e.g., SQL injection, cross-site scripting)

• DDoS Protection

  • Basic protection included by default
  • Standard tier offers adaptive tuning, real-time telemetry, and attack mitigation

Benefits of Azure’s Network Infrastructure

Scalability

• Instantly scale networks to meet demand
• Automate provisioning with ARM templates and APIs

Resiliency

• Multiple redundant paths for failover
• Built-in load balancing and traffic routing

Security

• Segmentation through VNets and NSGs
• Integration with Azure Security Center for holistic protection

What is Infrastructure Availability in Azure?

• High Availability (HA)

  • Guarantees uptime of 99.9% or higher for many services
  • Minimizes downtime to ensure business continuity
  • Key Concepts:
    • Redundancy of critical components
    • Elimination of single points of failure

• Service Level Agreements (SLAs):

  • Defined by Microsoft to ensure performance and uptime
  • Different SLAs for IaaS, PaaS, and SaaS offerings

Availability Zones and Regions

• Azure Regions

  • Geographically distributed data centers grouped into regions
  • Customers choose regions to meet latency, data residency, and compliance needs

• Availability Zones

  • Physically separate datacenters within a region
  • Independent power, cooling, and networking
  • Designed to withstand datacenter failures

• Zone-Redundant Services

  • Services deployed across zones to ensure uptime
  • Automatic failover if one zone goes down

Load Balancing and Auto-Scaling

• Load Balancing

  • Distributes incoming traffic across multiple instances
  • Types:
    • Azure Load Balancer (Layer 4)
    • Application Gateway (Layer 7)
    • Traffic Manager (DNS-based global routing)

• Auto-Scaling

  • Automatically adjusts compute resources based on demand
  • Prevents performance degradation during spikes
  • Saves costs by scaling down during low usage

Ensuring Infrastructure Integrity – Secure Boot & Hardware Root of Trust

Secure Boot

• Verifies the authenticity of software during startup
• Prevents loading of unsigned or malicious firmware and OS components
• Ensures only trusted code runs on the device

Hardware Root of Trust

• Embedded in device hardware (e.g., TPM chip)
• Provides a cryptographic anchor for platform integrity
• Validates firmware and bootloaders before OS loads

OS and Firmware Integrity Verification

• Integrity Checks

  • Continuous verification of OS and firmware to detect tampering
  • Use of cryptographic hashes and digital signatures

• Measured Boot

  • Records measurements of boot components for audit and attestation
  • Enables detection of unauthorized changes over time

• Firmware Updates

  • Secure, signed updates delivered to maintain system integrity
  • Rollback protection to prevent downgrade attacks

Azure Attestation – Validating Trusted Platforms

• Azure Attestation Service

  • Cloud-based service validating device and VM trustworthiness
  • Checks for compliance with security policies before allowing access to sensitive resources
  • Use Cases
    • Confidential Computing: Verifying hardware enclaves
    • Secure Boot validation for VM hosts
    • Policy enforcement for compliance and regulatory requirements
  • Benefits
    • Provides cryptographic proof of platform integrity
    • Enables automated, scalable trust decisions

Understanding Usage & Quotas in Azure

• Resource Usage

  • Azure enforces quotas to control resource consumption per subscription or service
  • Examples: Number of VMs, storage accounts, IP addresses, or database DTUs

• Why Quotas Matter

  • Prevents accidental overuse that could cause failures or unexpected charges
  • Helps Azure maintain stable platform performance

• Common Quotas

  • Compute cores per region
  • Storage throughput limits
  • Network bandwidth caps

Tools to Monitor & Manage Resources

• Azure Resource Manager (ARM)

  • Centralized management layer for deploying and managing Azure resources
  • Allows template-driven deployments and tracking of resource configurations

• Azure Monitor

  • Collects metrics, logs, and diagnostics from resources
  • Provides real-time alerts on usage thresholds and anomalies

• Azure Advisor

  • Offers personalized recommendations to optimize cost, performance, security, and reliability
  • Highlights underutilized or over-provisioned resources

Preventing Service Interruptions & Forecasting Needs

• Proactive Alerts & Scaling

  • Set up alerts on quota thresholds and resource usage spikes
  • Use auto-scaling to dynamically adjust capacity based on demand

• Capacity Planning

  • Analyze historical trends via Azure Monitor logs
  • Forecast future needs to request quota increases in advance

• Automation & Governance

  • Use Azure Policy to enforce limits and tagging for cost management
  • Automate scaling and resource cleanup with Azure Automation or Logic Apps

Infrastructure Monitoring Tools

• Azure Monitor

  • Centralized platform for collecting and analyzing metrics and logs from Azure resources
  • Supports real-time monitoring of CPU, memory, network, disk I/O, and more

• Alerts

  • Set thresholds on metrics to trigger notifications or automated actions
  • Alert types include metric alerts, activity log alerts, and service health alerts

• Visualization

  • Dashboards and workbooks for customized monitoring views
  • Integration with Power BI for advanced analytics

Log Analytics – Powerful Log Querying

• Azure Log Analytics

  • Collects and stores log data from Azure resources and on-premises systems
  • Uses Kusto Query Language (KQL) for advanced querying and data analysis
  • Capabilities
    • Search across multiple log sources: activity logs, diagnostics, security events
    • Detect anomalies, track trends, and troubleshoot issues efficiently
  • Integration
    • Works with Azure Monitor, Azure Security Center, and Microsoft Sentinel
    • Enables custom alerts and automation based on log query results

Azure Security Center (Defender for Cloud) and Microsoft Sentinel

• Azure Security Center (ASC) / Defender for Cloud

  • Continuous security assessment and threat detection for Azure and hybrid environments
  • Provides security recommendations, compliance tracking, and vulnerability management
  • Built-in integration with Azure Monitor and Log Analytics

• Microsoft Sentinel SIEM

  • Cloud-native Security Information and Event Management (SIEM) system
  • Collects security data across the enterprise for correlation and alerting
  • Supports automated investigation and response (SOAR capabilities)
  • Integration Benefits
    • End-to-end security visibility from infrastructure to applications
    • Automated threat hunting and incident response workflows

Identity & Access Management (IAM)

Azure Active Directory (Azure AD)

• Central identity provider for Azure and Microsoft 365
• Supports Single Sign-On (SSO), Multi-Factor Authentication (MFA), and passwordless access

Conditional Access

• Policies to control access based on user location, device compliance, risk level
• Enables Zero Trust by enforcing strong authentication and contextual controls

Role-Based Access Control (RBAC)

• Fine-grained permissions management for Azure resources
• Ensures least privilege principle

Security Posture Management & Threat Protection

Defender for Cloud (formerly Security Center)

• Continuous assessment of security posture
• Identifies vulnerabilities and recommends best practices
• Supports hybrid environments

Microsoft Defender

• Specialized threat protection for workloads: servers, containers, databases, IoT
• Detects malware, exploits, and suspicious activities

Microsoft Sentinel

• Cloud-native SIEM with AI-powered threat detection
• Correlates logs from across systems to identify advanced attacks
• Automates incident investigation and response

Compliance & Governance

Azure Blueprints

• Predefined templates to deploy compliant environments quickly
• Combine ARM templates, policies, and RBAC into repeatable packages

Azure Policy

• Enforce rules and guardrails for resource configurations
• Prevents drift from organizational standards

Compliance Manager

• Tracks compliance against industry standards like GDPR, HIPAA, ISO 27001
• Provides actionable insights and audit-ready reports