Azure Security Foundations

What is Microsoft Azure?

  • Microsoft Azure is a comprehensive cloud computing platform developed by Microsoft.
  • It offers:
    • Infrastructure as a Service (IaaS)
    • Platform as a Service (PaaS)
    • Software as a Service (SaaS)
  • Provides on-demand services, including:
    • Virtual machines and containers (Compute)
    • Blob, file, and disk storage
    • Virtual networks, load balancers, VPN gateways (Networking)
    • Azure SQL, Cosmos DB, and other database services
    • Identity, access, and threat protection (Security)

Key Capabilities of Azure

  • Global Reach: Azure has 60+ regions and over 200 data centers worldwide.
  • Hybrid Capabilities: Supports hybrid cloud with services like Azure Arc and Azure Stack.
  • AI and Machine Learning: Offers pre-built models and customizable solutions.
  • DevOps Integration: Includes tools like Azure DevOps and GitHub Actions for CI/CD.
  • Compliance & Security: Meets over 90 compliance certifications.

Azure Service Models

  • IaaS (Infrastructure as a Service):
    • Users manage VMs, networks, and storage.
    • Azure handles the hardware and virtualization.
    • Example: Azure Virtual Machines.
  • PaaS (Platform as a Service):
    • Provides runtime environments and development tools.
    • Users focus on application development; Azure handles infrastructure.
    • Example: Azure App Service.
  • SaaS (Software as a Service):
    • Ready-to-use applications delivered via the Internet.
    • No infrastructure or platform management is required.
    • Example: Microsoft 365.

Common Security Issues in the Cloud

  • Misconfigured Services:
    • Example: Open Azure Blob Storage exposing sensitive data.
    • Publicly accessible resources without proper access restrictions.
  • Unsecured APIs:
    • APIs lacking authentication or encryption can be exploited.
    • Leads to data leakage, injection attacks, or unauthorized actions.
  • Inadequate Identity & Access Controls:
    • Excessive permissions (e.g., users with owner rights unnecessarily).
    • Lack of Multi-Factor Authentication (MFA).
  • Unpatched Software:
    • Outdated virtual machines or services vulnerable to exploits.
    • Lack of automated patching policies.
  • Insecure Third-Party Integrations: Poorly vetted vendor services with weak security postures, potentially leading to supply chain attacks via connected apps/services.

Real-World Examples of Cloud Security Failures

  • Capital One (2019):
    • A misconfigured AWS firewall led to a data breach of 100M+ records.
  • Microsoft Power Apps (2021):
    • Misconfigured default settings in Azure Power Apps exposed 38M records.
  • Lessons Learned:
    • Default settings are often insecure and need review and hardening.
    • Misconfigured storage and access policies are a top threat vector.
    • Monitoring and alerting must be proactive, not reactive.

Mitigating Common Security Issues in Azure

  • Use Azure Security Center: Provides real-time insights into misconfigurations and threat protection.
  • Implement Least Privilege Access: Utilize Role-Based Access Control (RBAC) and Just-In-Time (JIT) VM access.
  • Enforce MFA and Conditional Access: Protect identity and access management.
  • Keep Systems Patched: Use Azure Update Management or auto-patching features.
  • Secure APIs: Use Azure API Management and OAuth2.0.
  • Vet Third-Party Integrations: Review permissions and certifications before allowing access.

Authentication in Azure

  • Purpose: To confirm a user’s or system’s identity before granting access.
  • Methods:
    • Passwords & PINs
    • Biometrics (fingerprint, facial recognition)
    • Multi-Factor Authentication (MFA) – Combines two or more methods.
  • Azure Tools:
    • Azure AD for identity management
    • Azure MFA for strong authentication
    • Conditional Access policies for dynamic authentication controls.

The AAAs of Access Management

  • The AAA framework is essential for controlling and securing access in cloud environments like Azure.
    • Authentication: Verifies who you are.
    • Authorization: Determines what you can access.
    • Accounting (Auditing): Tracks what you did.
  • Use Case in Azure:
    • Azure Active Directory (Azure AD) handles authentication.
    • Role-Based Access Control (RBAC) handles authorization.
    • Azure Monitor and Microsoft Defender for Cloud provide accounting/auditing.

Authorization & Accounting in Azure

  • Authorization: Determines what resources a user can access and what actions they can perform.
    • Tools:
      • RBAC (Role-Based Access Control): Assigns roles to users, groups, or applications.
      • Azure Policies: Enforce organizational standards (e.g., restrict VMs to certain regions).
  • Accounting / Auditing: Tracks user actions and resource access for security and compliance.
    • Tools:
      • Azure Monitor, Log Analytics
      • Azure Activity Logs and Diagnostic Logs
      • Microsoft Sentinel for SIEM

Encryption in Azure

  • Encryption in Azure ensures confidentiality, integrity, and compliance of data.
    • Three main areas of focus:
      • Encryption at Rest
      • Encryption in Transit
      • Key Management
  • Azure follows international standards (FIPS 140-2, ISO/IEC 27001).

Encryption at Rest

  • Azure Storage Encryption: Automatically encrypts Blob, Table, Queue, and File data using AES-256.
  • Azure Disk Encryption (ADE):
    • Uses BitLocker (Windows) or DM-Crypt (Linux) for OS and data disks.
    • Integrated with Azure Key Vault for key management.

Encryption In Transit

  • Uses Transport Layer Security (TLS 1.2/1.3) for secure communication between:
    • Clients ↔ Azure Services
    • Services ↔ Services within Azure
  • All Azure services support HTTPS endpoints and mutual TLS when configured.

Key Management with Azure Key Vault

  • Azure Key Vault is a secure, central location to manage:
    • Encryption keys
    • Secrets (e.g., API keys, passwords)
    • Certificates
  • Key Types:
    • Azure-managed keys (default)
    • Customer-managed keys (CMK)
    • Bring Your Own Key (BYOK)
  • Integration: Works with Azure Storage, SQL Database, Virtual Machines, and more.
  • Benefits:
    • Access control with Azure AD & RBAC
    • Secure key rotation and expiration policies
    • Logging with Azure Monitor and Defender for Cloud

Introduction to Network Segmentation in Azure

  • Network segmentation is the practice of dividing a network into multiple smaller, isolated segments to enhance security, performance, and management.
    • Purpose:
      • Limit lateral movement of attackers
      • Enforce least privilege networking
      • Simplify monitoring and troubleshooting
    • Azure Tools:
      • Virtual Networks (VNets) – Define network boundaries
      • Network Security Groups (NSGs)– Control inbound and outbound traffic
      • Subnets – Organize resources within VNets

Subnetting and NSGs for Resource Isolation

  • Subnetting
    • Divide a VNet into smaller segments (subnets) for logical isolation.
    • Use subnets for separating environments (e.g., Web, App, DB).
    • Enforce specific policies per subnet (e.g., no internet access for DB).
  • Network Security Groups (NSGs)
    • NSGs contain security rules to allow/deny traffic.
    • Rules evaluated in order by priority (lower number = higher priority).
    • Applied at subnet or network interface level.
    • Can restrict:
      • Traffic between subnets
      • Inbound/outbound internet access

  • Azure Firewall: A fully managed, stateful firewall as a service.

    • Offers:
      • Application and network rule filtering
      • Threat intelligence-based filtering
      • Logging with Azure Monitor

  • Azure Private Link: Enables private access to Azure PaaS services (e.g., Blob, SQL) over your VNet.

    • Eliminates exposure to public internet.
    • Uses Private Endpoints for secure access.

Cybersecurity Considerations in Cloud

  • Shared Responsibility Model:
    • Cloud Provider (e.g., Microsoft Azure): Secures physical infrastructure, network, and core services.
    • Customer: Secures data, identities, apps, devices, and configurations.
  • Cloud ≠ Automatically Secure:
    • Users are responsible for enabling and managing security features.
      Key Risks:
    • Misconfigurations
    • Insecure APIs and interfaces
    • Identity-based attacks (e.g., credential stuffing)
    • Data exfiltration from public-facing services

Adopting the Zero Trust Model in Azure

  • Zero Trust Principle: "Never trust, always verify."
    • Every access request is treated as if it originates from an untrusted network.
  • Core Pillars:
    • Verify explicitly – authenticate and authorize every access attempt.
    • Use least privileged access – grant only what is needed.
    • Assume breach – design systems to minimize impact of a compromise.
  • Azure Implementations:
    • Conditional Access in Azure AD
    • Just-In-Time VM Access
    • RBAC & Privileged Identity Management (PIM)
    • Identity Protection

Cloud Security Tools: Defender for Cloud & Sentinel

  • Microsoft Defender for Cloud: Unified security management system.
    • Capabilities:
      • Threat protection for hybrid and multi-cloud workloads
      • Secure score recommendations
      • Compliance tracking
      • Alerts for misconfigurations and threats
  • Microsoft Sentinel (SIEM/SOAR): Cloud-native Security Information and Event Management (SIEM) and Security Orchestration Automated Response (SOAR).
    • Use cases:
      • Collects and correlates logs from all sources (Azure, AWS, on-prem)
      • Real-time detection and investigation
      • Automated incident response

Major Cybersecurity Threats

  • Phishing & Social Engineering: Use deception to trick users into revealing credentials or installing malicious software.
    • Tactics include:
      • Fake login pages
      • Urgent emails impersonating executives
      • Smishing (SMS phishing)
  • Malware & Ransomware:
    • Malware: Malicious software (viruses, trojans, spyware) that disrupts or steals data.
    • Ransomware: Encrypts data and demands payment for decryption.

Data Breaches & Insider Threats

  • Data Breaches: Unauthorized access to sensitive data due to:
    • Weak passwords
    • Misconfigured cloud storage (e.g., open S3 buckets or Azure Blobs)
    • Exploited vulnerabilities
  • Insider Threats: Malicious or careless employees or contractors
    • Types:
      • Intentional (data theft, sabotage)
      • Unintentional (accidental data sharing or credential loss)
    • Impacts:
      • Legal penalties (GDPR, POPIA)
      • Loss of customer trust
      • Financial and reputational damage
    • Tools for mitigation:
      • Azure Information Protection (AIP)
      • Data Loss Prevention (DLP)
      • Audit logs and access reviews in Azure AD

Denial-of-Service (DoS) and DDoS Attacks

  • DoS/DDoS Attacks:
    • Denial of Service (DoS): Overwhelm a server with requests to render it unavailable.
    • Distributed DoS (DDoS): Attack traffic from many sources (botnets), making it harder to block.
    • Common Targets: Web apps, DNS servers, login portals
  • Mitigation in Azure:
    • Azure DDoS Protection (Basic + Standard)
    • Web Application Firewall (WAF) with Azure Front Door or Application Gateway
    • Rate limiting and autoscaling policies