Azure Security - Day5 - Governance And Architecture

Editor's Notes

• #2: Content is provided in electronic format. We request that you abide by the terms of the agreement and only use the content in the books and labs for your personal use. If you like the class and want to share with others we love referrals! You can ask people to connect with Teri Radichel on LinkedIn or visit the 2nd Sight Lab website for more information. https://www.2ndsightlab.com https://www.linkedin.com/in/teriradichel https://medium.com/cloud-security
• #3: Content is provided in electronic format. We request that you abide by the terms of the agreement and only use the content in the books and labs for your personal use. If you like the class and want to share with others we love referrals! You can ask people to connect with Teri Radichel on LinkedIn or visit the 2nd Sight Lab website for more information. https://www.2ndsightlab.com https://www.linkedin.com/in/teriradichel https://medium.com/cloud-security
• #6: Azure Resource Manager (ARM) is the Azure deployment manager. It provides the capability to add, update, and delete resources on the Azure cloud platform. You can use many different tool to manually or programmatically create resources on Azure. Ultimately all the tools that you use to interact with the platform in turn interact with the Azure Resource Manager which carries out the action on the cloud platform. It also handles authentication for all the different tools. https://docs.microsoft.com/en-us/azure/azure-resource-manager/management/overview
• #7: The Azure Resource Manager handles many different functions related to deployments and resource management on Azure. We won’t go over all these features and functions but this slide is for visibility and awareness. We’ll cover a few important points for security in the next couple of slides, however. Review the links in the documentation menu for more information on each item in the list: https://docs.microsoft.com/en-us/azure/azure-resource-manager/management/overview
• #8: When you use certain features and functions on Azure you will first need to enable an Azure resource provider. These resource providers grant access to cloud resources for a particular service. For example, Key Vault uses the Microsoft.KeyVault resource provider. You can limit your attack surface on Azure by only turning on the Resource Providers you need to use. Leaving some Resource Providers disabled will also ensure that users in your cloud environment cannot use the disabled services if you do not want them to use them. https://docs.microsoft.com/en-us/azure/azure-resource-manager/management/resource-providers-and-types
• #9: Navigate to one of your subscriptions. Click Resource provider in the left menu to see the state of Resource Providers in that subscription.
• #10: Note that many of the Resource Providers on the screen are in the NotRegistered state. Click on one of those and click “Register” at the top of the screen to enable it.
• #11: Sometimes you might have resources that are critical to your cloud environment. You want to make sure no one can delete or change them. Perhaps you are running a bastion host or a critical database. You can use resource lock to ensure that no one can delete it. You can also choose to make it read-only. Regardless of what permissions the person has, if they do not have permission to modify resource locks, they won’t be able to override the lock. Note that sometimes read-only locks may have unintended consequences. Sometimes a resource that appears to exist in a read-only state will need to allow some changes. Refer to the documentation for some of the caveats. Make sure you test locks in a non-production environment before using them on the related resources in production. https://docs.microsoft.com/en-us/azure/azure-resource-manager/management/lock-resources
• #13: The graphic on this slide is from the 2021 Verizon Data Breach Incident Report. It shows just how many times humans have been involved in security incidents. Humans may make an unintended configuration change. They may click on a link and by doing so provide access to a system and/or credentials. The more you can automate actions in the cloud the more you can eliminate human error. This presumes that you have properly tested your automation so it does not contain errors and vulnerabilities itself. Automation can allow data interactions without requiring human access. Separating the people from the data is another way to prevent a data breach. If someone’s credentials are stolen the attackers still don’t have access to the data. https://www.verizon.com/business/en-gb/resources/reports/dbir/2021/masters-guide/summary-of-findings/
• #14: Automation can be used for so many things as explained on this slide. Anywhere you are performing repetitive tasks over and over again, explore whether you might be able to automate that task. Automation can help you perform that task without error and more quickly. Instead of responding to every misconfiguration, consider if you could auto-remediate the problem. Better to prevent it in the first place but there may be cases where that is not possible. Automation on cloud platforms allows systems to self-heal and failover when problems occur.
• #15: Be careful with automation. Ensure you have a secure network and well-protected credentials, keys, tokens, and tickets. Deployment systems typically have very powerful credentials that can take significant actions in your cloud environment. In the case of Solar Winds, the credentials provided enough access for Azure account takeover by way of creating new credentials. All three of the breaches or attacks on the slide occurred by way of an insecure deployment process. The integrity of code deployed by a deployment system should have integrity checks to make sure it is the same code the developers wrote in the first place. About the Solar Winds breach: https://medium.com/cloud-security/solarwinds-hack-retrospective-322f03b4eb9b
• #16: When it comes to automating deployments, you have many options. This slide shows the different languages you can use to interact with and make changes on Azure. On the first day we showed how to deploy a new user with Azure CloudShell and the command line. If you are seeking certification on Azure you will want to understand the basic syntax and some of the Azure PowerShell and CLI commands. You will also want to know something about Azure ARM templates. Azure CLI: https://learn.microsoft.com/en-us/cli/azure/ PowerShell: https://learn.microsoft.com/en-us/powershell/azure/ ARM Templates: https://learn.microsoft.com/en-us/azure/azure-resource-manager/templates/overview Azure SDKs: https://azure.microsoft.com/en-us/downloads/
• #17: All the Azure CLI commands: https://docs.microsoft.com/en-us/cli/azure/deployment?view=azure-cli-latest
• #18: Azure PowerShell Reference: https://docs.microsoft.com/en-us/powershell/module/?view=azps-7.5.0 Getting started with PowerShell on Azure: https://docs.microsoft.com/en-us/powershell/azure/get-started-azureps?view=azps-7.5.0
• #19: An ARM template is written in JSON or Bicep. The template follows a particular structure to define what you want to deploy on the Azure platform. Once you’ve written your template, you can use a number of different methods to deploy it. A template defines the infrastructure you want to deploy or the state you want to obtain. You don’t tell Azure how to deploy it. Azure knows how to process the template and deploy the resources you want. Some resources depend on each other and need to be deployed in a specific order. You don’t have to worry about that. Azure will take care of it for you in most cases. It will also perform validation on your template prior to deployment and tell you if it has any issues (usually). If you write templates to deploy your infrastructure, it will be easy to redeploy it in the case of a disaster. You rerun the template you originally used to deploy the resources and should be able to rebuild it to the same state as the first time you deployed it. ARM JSON: https://learn.microsoft.com/en-us/azure/azure-resource-manager/templates/syntax Azure Bicep https://learn.microsoft.com/en-us/azure/azure-resource-manager/bicep/overview
• #20: This slide has some of the constructs in the template structure. When you create a template you will always need to define the resources you want to deploy. The other sections will be optional. Using parameters helps you create reusable templates because you can pass environment-specific values into the template. https://docs.microsoft.com/en-us/azure/azure-resource-manager/templates/overview Read more details about the syntax of each element here: https://docs.microsoft.com/en-us/azure/azure-resource-manager/templates/syntax
• #21: When you deploy resources you choose a scope or the layer in the Azure hierarchy where you want to deploy the resource. Some resources can be deployed at multiple layers but many resources must be deployed within a resource group. The scope gets specified on the command line when you deploy a template. Since the Tenant is the highest left and a Tenant cannot exist within a Tenant, you can’t create a tenant using an arm template. It appears that there is no way to create a new tenant using the Azure CLI or PowerShell either. We’ll cover management groups in an upcoming section and how they can help with governance.
• #22: Schemas are like templates for templates. They define the structure of the type of template you are using and the syntax that the template has to match. This helps ARM validate that you have written a valid template. A few different schemas exist and depending on what type of resource you are trying to deploy you will need to specify the correct schema at the top of the template. Refer to the documentation for details. https://docs.microsoft.com/en-us/azure/azure-resource-manager/templates/syntax
• #23: When you’re looking at most resources in the Azure portal, you’ll be able to click on a JSON link to view the JSON output for that item. If you were to run a command line command to view that resource, that’s what you would see. The JSON output is similar to the information you put in an ARM template but not exactly. There’s another way to get a template for a resource you want to deploy in the portal.
• #24: After you go through the steps to create a resource in the Azure portal, you will usually find a way to download a template to deploy that same item at the end. Let’s try that now by creating a resource. In the Azure portal in the left menu click + Create Resource.
• #25: We’re going to go through the process of creating a web app in order to get a template we could use to deploy that same configuration using code. Click on Web App.
• #26: Enter the basic information as shown on the slide. We’re selecting the option to deploy a web app using Docker in this case.
• #27: Here you can see the various options for deploying a web app. You could choose to deploy a container from a particular container repository. In this case we’ll just choose the option to deploy from a Quickstart provided by Azure for testing purposes since we don’t have a container repository set up. Notice that it offers the option to deploy from Docker Hub which you might want to disallow. Deploying directory from an Internet repository comes with a host of serious security risks. Many rogue containers have been used to deploy cryptominers and malware. In any case, we are testing templates here so choose the Quickstart option and click the button to proceed to Networking.
• #28: We talked about injection to run resources in VNets on Day 2. That would be a better option but we’re not actually going to deploy right now so you can just choose Next: Monitoring.
• #29: Here you could change the monitoring options. Click Next: Tags.
• #30: Create a tag because we are going to look at this in our template. Notice that you can tag one or all of the resources created as part of this Web App.
• #31: Finally we get to the last screen. This is a summary screen where we can review our settings and then click Create to deploy our Web App. Notice that we have another option which is to Download a template for automation. Click that link instead.
• #32: Here you can see an ARM template that would deploy the Web App we just configured in the portal. Instead of clicking buttons we could use this template to deploy the same exact thing. You can explore the template code to see the different sections we covered earlier under template syntax.
• #33: On this slide you can see the parameters ection. These are values that can be passed into the template when we deploy it. These parameters let you use the same template to deploy multiple web apps with the same configuration. Of course you need to know what to pass into those parameters.
• #34: Net check out the Resources section. That’s the section that contains information about the resources you want to deploy. Each resource has a number of properties about that resource which define its configuration. Notice the type property for the first resource. Microsoft.Web/sites. That is the type of resource we are deploying. You can scroll down to find other resources and types. Notice that there’s a configuration item on that resource called “tags”. There you can see the configuration for the tag we added to the Web App when we went through the portal. Take a look at the properties. The “name” property is referencing the parameter “name”. When you run the template you would pass a value into the name parameter and that would be inserted into the name property for this resource.
• #35: Notice at the top of the template screen you can take a few different actions with the template. You can download the template. That way you could use it with a command to deploy the resource. We’ll look at those commands in a few slides. You could add the template to a library in Azure so you can use it later. You can also click “Deploy” to deploy the template. That essentially does what the “Create” button does, except that we will be able to see a bit of additional information. Click that Deploy button.
• #36: When you click the deploy button you can see the values that get passed in as parameters. If you are trying to figure out what values to pass into a command line script this might help.
• #37: Let’s say you wanted to build a template from scratch. Typically that’s what you will want to do because often generated templates have a lot of extraneous information. This reference shows a list of resources and the syntax to write a template for each of them. https://docs.microsoft.com/en-us/azure/templates/
• #38: Remember the type in our template? You would search for the type of resource you want to deploy in this reference. Click on web and then Sites in the reference list. Next click on JSON as that was the syntax used by the template we were viewing. Here you will find the structure for that particular template. If wanted to create your own template you would follow this structure and syntax. It shows you the properties that you can add to the template and the format.
• #39: Scroll down below the code to get more information about the template. The details below the code show you information such as which properties are required and acceptable values for each property. ARM templates are very similar to AWS CloudFormation templates. If you’re just getting started you can follow the same approach used in this blog post to get started with CloudFormation: https://medium.com/cloud-security/easier-aws-cloudformation-47a30c631963
• #40: When you use parameters in templates you can use the same template to deploy resources in different environments. This is very important when you want to maintain code integrity across development, QA, and production environments. When you deploy resources in production the team performing the environment should not need to change the code to deploy it. If they do, the code was not written correctly. The same code that was written in development with no changes should be written in QA. The same code should be deployed to production. By pulling out the things that need to change in each environment into parameters you can achieve this objective. Additionally, you want to avoid writing repetitive code as much as possible. If you find yourself writing repetitive code, consider whether pulling out a few things that need to change each time you write it into parameters can eliminate the repetition. Repetitive code leads to errors. Additionally when you need updates you need to make them in many templates instead of one that effectively uses parameters.
• #41: Use tags to identify your resources with custom metadata. Tags are very useful for providing information on resources that is not part of the cloud platform itself. You may have data specific to your organization that helps you identity the purpose of a resource, who deployed it, and who should be billed for it. Tags are managed by the Azure Resource Manager. https://docs.microsoft.com/en-us/azure/azure-resource-manager/management/tag-resources?tabs=json
• #42: Instead of writing huge, unwieldy templates, you can break templates into smaller reusable templates. Longer templates can be harder to read, more error prone, and don’t allow you to deploy resources within the template independently. You can instead write smaller templates with specific resources in each template. Then include the smaller templates into a larger template. https://docs.microsoft.com/en-us/azure/azure-resource-manager/templates/linked-templates
• #43: Azure offers another language besides JSON which attempts to make it easier to write ARM templates. The only problem with Bicep is that it is specific to Azure and not an industry standard. If you learn Bicep you might not be able to use it anywhere else. https://docs.microsoft.com/en-us/azure/azure-resource-manager/bicep/overview
• #44: If you want to deploy a template from the Azure Portal follow these instructions: https://docs.microsoft.com/en-us/azure/azure-resource-manager/templates/deploy-portal
• #45: If you’re looking for sample quickstarts you can find many of them on Github. Azure provides a number of Quickstarts templates to help you get started. Note that they are grouped by the different scopes discussed on a prior slide. https://github.com/Azure/azure-quickstart-templates
• #46: If you scroll down on the GitHub page you can click a link on Github to deploy the various templates. How did they do that? Stay tuned…
• #47: You can install your templates using the Azure CLI. You can access the Azure CLI on Azure CloudShell but you can also install the Azure CLI on your own system or a cloud host. https://docs.microsoft.com/en-us/cli/azure/install-azure-cli
• #48: Installing the Azure CLI has a number of advantages over Azure CloudShell. You have less control over the host running the Azure CLI on Azure CloudShell. The web browser also becomes an attack vector. The benefit of CloudShell is that you don’t have to add credentials your machine or keep software up to date. Consider installing the Azure CLI to a cloud VM in a restricted network. We’ll look at creating VM images in an automated manner so you can always ensure your VM and CLI is up to date. You can then use an appropriate machine identity to perform actions in your Azure environment. You can easily rebuild your VM on failure and operate it in a secure private network.
• #49: Once you have access to the Azure CLI you can run a command to deploy a template. In the first example on this slide, you would replace <file path-to-template> with the path to the file that contains your template. In the second command, you can reference a remote file.
• #50: This slide shows the commands you can run to to deploy a template using powershell. The first example deploys a file on your local machine. The second command can deploy a remote file.
• #51: You can also deploy resources with an HTTP Rest API. This method is less common but may be useful in some scenarios with certain types of applications. https://docs.microsoft.com/en-us/azure/azure-resource-manager/templates/deploy-rest You can also use the ARM client to call the HTTP API as shown in the second command. https://docs.microsoft.com/en-us/dotnet/api/azure.resourcemanager.armclient?view=azure-dotnet
• #52: If you want to add a button to your github page to execute a command as shown on a previous slide, follow these instructions: https://docs.microsoft.com/en-us/azure/azure-resource-manager/templates/deploy-to-azure-button This is not the most secure or preferred option. However, it could be used for demo purposes such as is done on the Azure Quickstarts page.
• #53: If you want to deploy a local template using CloudShell you’ll need to upload it first as shown on the slide. You can find additional instructions here: https://docs.microsoft.com/en-us/azure/azure-resource-manager/templates/deploy-cloud-shell?tabs=azure-cli
• #54: The Azure PowerShell option has a what-if operation that can help you test what will happen if you deploy a template. The different colors in the output give you information about the changes and it can show you any validation errors. https://docs.microsoft.com/en-us/azure/azure-resource-manager/templates/deploy-what-if?tabs=azure-powershell https://docs.microsoft.com/en-us/learn/modules/arm-template-whatif/
• #55: You can find many code samples for automating actions on Azure using the SDKs on Azure on the following page. You can filter by the programming language you want to resources you are using. https://docs.microsoft.com/en-us/samples/browse/
• #57: There are a few different options for deploying code on a virtual machine. You want to consider which of these options you want to allow or disallow. The first one is pretty obvious. You could log into the virtual machine and deploy software manually. What’s the problem? Let’s say the instance fails. You’ll need to go in and reinstall all the software by hand again. What if the person who initially installed the software is no longer around and no one knows how to do it? How long will it take to get up and running again? How will you track the steps and process for installing the software and track things like license keys? You will need to provide access to log into the virtual machine as well. The second option involves logging into the cloud console, running a virtual machine by clicking buttons, and installing software by adding it to the configuration as you go. This process has the same drawbacks as manually adding the code to a running instance, but at least you don’t have to open a port for remote access. You can use various configuration management tools to deploy patches, updates, and new software to instances while they are running. This requires you to add credentials and permissions to change running machines. You’ll need to open a port for remote access. Some of these management tools cost money. If an attacker or malicious insider can get into this process, or leverage the credentials of the systems that deploy software, they could install malware on your cloud hosts. The last option would be to write code that deploys the virtual machine and the host software all at once. The benefit of this option is that you have a repeatable deployment process. If your host fails, you can run the script to deploy the host again and have it up and running in minutes. It also works with infrastructure that scales on demand by deploying new hosts. You can track changes if you check it into source control. In addition, you can lock down your virtual hosts to allow no changes once deployed. To update the host, update the code and run it through your standardized deployment process, which hopefully includes basic security configuration checks. If you limit the ways in which attackers can access your hosts and install malware, you limit the potential avenues for attack!
• #58: As discussed in the last class you can choose a virtual machine image provided by Azure when you instantiate a VM. Alternatively, you can choose one from the Azure Marketplace. Be careful with that option because you don’t know what else is on that VM. Ensure you only get those from trusted sources. The other option would be to create your own VM. You can construct a new image in various ways. You build an image (a template) of a machine with a particular configuration and then you can use that to deploy new VMs with the same configuration.
• #59: One way to create a virtual machine image is from the menu at the top of the VM details. Click on Capture. https://docs.microsoft.com/en-us/azure/virtual-machines/capture-image-portal
• #60: When you create your image you can choose an existing image gallery or create a new one if you don’t have any. You can store images you want people to use and grant them access to your image gallery. https://docs.microsoft.com/en-us/azure/virtual-machines/shared-image-galleries You can limit users to specific VMs as well: https://docs.microsoft.com/en-us/azure/virtual-machines/windows/policy#permitted-virtual-machines https://docs.microsoft.com/en-us/azure/virtual-machines/linux/policy
• #61: Create a new image definition as shown on the slide and select your desired options.
• #62: Add a version. Add an end of life date if you wish. Review + Create.
• #63: Notice that you can choose an automation template for this image as well on the validation screen. Take a look at the template if you want to see how it is structured.
• #64: Now go to the Azure Compute Gallery blade in the Azure portal. Choose your gallery that you just created. Choose your image.
• #65: Click on your image to see the details. Here you can click “Create VM” to create another VM with the image you just created.
• #66: Packer is an open source tool from HashiCorp that can help you create cloud images. This tool can work with the tools we discussed earlier that help you configure operating systems. This is a good point to use these tools. They help you create code for standard configurations that you can check into source control. You can automate the process for creating, updating, and deploying new images. In addition you can automate and wrap security around the whole process, defining who has permission to create, update, and deploy images to your account.
• #67: If you want to learn how to use packer, this tutorial is a good starting point. https://learn.hashicorp.com/tutorials/packer/docker-get-started-build-image
• #68: Another way to create an image is using Azure Image Builder. Uses packer behind the scene. https://docs.microsoft.com/en-us/azure/virtual-machines/image-builder-overview Demo: https://www.youtube.com/watch?v=vN62cL5_fV4
• #69: Other methods exist for adding images to your gallery such as using an existing VHD file. Check out the links below for more information. https://docs.microsoft.com/en-us/azure/virtual-machines/shared-image-galleries https://docs.microsoft.com/en-us/azure/virtual-machines/vm-applications https://docs.microsoft.com/en-us/azure/virtual-machines/image-version-encryption
• #70: Automanage tries to help you define secure images that follow best practices. Note that it requires particular protocols that you’ll want to understand and secure appropriately if you choose to use them. https://docs.microsoft.com/en-us/azure/automanage/automanage-virtual-machines Beware of QUIC - make sure you can create appropriate firewall rules that do not facilitate C2 channels and data exfiltration. Ensure that your security tools can properly monitor these protocols. https://medium.com/cloud-security/quic-and-dns-over-https-6878dcbdfde3 Windows Servers use SMB + QUIC https://docs.microsoft.com/en-us/azure/automanage/automanage-windows-server-services-overview From documentation: SMB over QUIC offers an "SMB VPN" for telecommuters, mobile device users, and branch offices, providing secure, reliable connectivity to edge file servers over untrusted networks like the Internet. Additionally, SMB over QUIC is integrated with Automanage machine best practices to help make SMB over QUIC management easier. QUIC uses certificates to provide its encryption and organizations often struggle to maintain complex public key infrastructures. Automanage machine best practices ensures that certificates do not expire without warning and that SMB over QUIC stays enabled for maximum continuity of service. SMB over QUIC: https://docs.microsoft.com/en-us/azure/automanage/automanage-smb-over-quic
• #71: Azure Desired State Configuration is another tool that can help you maintain the state of your VMs once deployed. You want to ensure the security settings don’t change. Note that this tool has an overview with an example that contains credentials in a configuration file. That is generally not a good practice. We’ll look at an alternative to this in a few slides called guest configuration in Azure Policy. https://docs.microsoft.com/en-us/azure/virtual-machines/extensions/dsc-overview
• #72: Create a secure baseline for containers the same way you do for VM images. This slide lists some best practices for creating secure base images. Docker Security: https://docs.docker.com/engine/security/ https://docs.docker.com/engine/scan/ https://docs.docker.com/engine/sbom/ CIS Benchmarks for docker: https://www.cisecurity.org/benchmark/docker SELinux policies for containers: https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/using_selinux/creating-selinux-policies-for-containers_using-selinux
• #74: When it comes to cloud governance, you have a lot of considerations. One of the problems organizations face is not being able to think through governance before developers get into the account and start working. Then you’ll be facing a lot of complicated clean up and restructuring. It is not always easy to move resources around after the fact into new subscriptions, resource groups, and networks. If possible you want to think through the structure of your Azure account in advance. The answers to these questions on this slide may vary a lot depending on the size, risk tolerance and structure of an organization. Many organizations face angst when it comes to cloud management because roles and responsibilities are not clearly defined. This lack of clarity can lead to in-fighting as people try to gain control over different aspects of the cloud environment and management. It’s best to think through, clearly define, and clearly communicate these roles and responsibilities in advance.
• #75: Use segregation and separation of duties wherever possible to limit your attack surface, blast radius, and the chance that someone could make an unintended mistake. This is always a balance between letting people get things done easily and protecting organization assets. It’s important to have someone who understands the needs of different groups within the organization who can design a cloud architecture and governance policies that allows people to get their work done without creating unnecessary risk.
• #76: Deployment pipelines are critical in a cloud environment (or any environment) if you want to maintain security. First and foremost, you have to know what was deployed, who deployed it, and why. That way if you have a problem with the resource you know who to contact. You’ll want to track software languages, components, and versions in case a log4j type incident occurs and you need to quickly update all affected resources. You can monitor and alert the security team when insecure deployments happen, or block known vulnerabilities and bad configurations altogether. Many organizations underestimate the impact of the deployment pipeline on their overall security and it has been the source of some of the most major breaches in recent years.
• #77: Decide which services you will allow people to use. Do you know what they are, how they work, and how to secure them? Are you aware of the best practices for each service? Do you know what base controls such as IAM, networking, and encryption exist and how to configure them? Are you aware of other security controls and best practices - and ways they might be potentially bypassed? Take all this into account and create a definition and secure baseline for each service you intend to use in your organization. If possible, enforce automated deployments from security templates and use organizational policies to prevent non-compliance. We’ll discuss that more in a bit.
• #78: Use abstraction to find reusable patterns that help make cloud governance and risk management easier. If you can define a set way to deploy certain types of resources, you can translate that to code and provide developers a secure baseline on which to deploy their applications, thereby limiting some chance for human error. Letting every developer or team deploy systems every which way will be difficult to manage. You might not have the logs you need as a security team. You might have a myriad of different tools and technologies which the organization is not fully up to speed on securing with best practices. Tools may require a mish-mash of ports that turns your network firewall rules into swiss cheese. Defining standard patterns can ensure more secure configurations and less network rules to support to get the application deployed. It will ensure that logs are shipped to the appropriate location so security teams can monitor infrastructure and applications for anomalies.
• #79: Leverage automation! You can automate deployments and test them so you know they will work on deployment night. Those late night deployments are where a lot of bad things happen. At one organization where I worked, someone accidentally deployed a database to a replica instead of production. A team spent all night reversing the damage. I’ve seen all manner of problems on deployment nights…you’ll want to automate deployments and automate away errors like that as much as possible. I’ve also seen “tweaks” that weakened data integrity on deployment night because something wasn’t fully tested against prod-like data. All sorts of things can go wrong when you don’t fully test your deployments, use automation, and check code integrity throughout the process. If you use automation, you can prevent downtime from things like expired TLS certificates. You can generate passwords for new applications and store them in a password manager so the team deploying the application never even sees the password.
• #80: Consider how you will manage and monitor costs in the cloud. Many large organizations have different cost centers or accounting codes to which they bill resources used by different departments. How will the accounting team sort out the billing and be able to add the expenses properly in the accounting system? Make it easy for them by including them in the process of defining the subscriptions. Consider whether you can export the costs from Azure straight into the accounting system.
• #81: Use organization-wide policies wherever you can. We’ll talk about designing the organizational structure in Azure and applying policies at different layers. Leverage abstraction here to move the policies up to the highest possible level to reduce management overhead. Prevent egregious mistakes like exposing data directly to the Internet by blocking it across the organization. Write your policies in code instead of on paper! Enforce and track policies automatically instead of a document that no one actually reads and if they do, might not fully understand.
• #82: Determine what questions you want to ask about your cloud security, cost, and risk. Understanding what questions you want to answer up front will help ensure you put the systems in place that help you obtain those metrics. The cloud platform is one huge configuration metadata database. You can ask it all manner of questions about the resources in your cloud. However, you have to make sure that the data you need is present, such as appropriate resource group, subscription, and management group names, and tags to identify specific resources in the case of an incident. Once you know the questions, analyze and test the tools that might help you answer them - or write your own reports.
• #83: Exceptions will happen. Plan for them. Make it easy to deploy the standard templates and patterns that exist in your environment. Try to create face-to-face (or zoom-to-zoom or phone) processes for handling exceptions. Don’t just throw it over a wall rejected. Have discussions to understand the problems, explain them on both sides, and look for creative solutions that work for everyone. When an exception exists that is unwanted, track it. Track the owner - and that is not the security team if it’s an exception they don’t want. It’s the person asking for the exception who approved it on the business side. Set a date for how long the exception will exist and when you will revisit it.
• #84: If you are having trouble explaining these things to executives in your organization, I wrote this book to help them understand cybersecurity and risk management basics. https://www.amazon.com/Cybersecurity-Executives-Cloud-Teri-Radichel/dp/1652474811/
• #86: Management groups on Azure allow you to organize subscriptions in your organization. Then you can apply policies at the management group layer. You can also give individuals access to different management groups through IAM. https://docs.microsoft.com/en-us/azure/governance/management-groups/overview
• #87: As explained previously, subscriptions are related to billing. All the resources on a particular subscription will be on the same bill. Structure your subscriptions to make it easy for your accounting team to track expenses in accounting systems by aligning subscriptions with cost centers or whatever accounting codes your account team uses to track expenses. Additionally, consider who will approve the expenses and which budget the cost goes into. You can further track cost against tags for things like resources in all subscriptions owned by IT or the security team. https://docs.microsoft.com/en-us/azure/cloud-adoption-framework/ready/azure-best-practices/scale-subscriptions https://docs.microsoft.com/en-us/azure/cloud-adoption-framework/ready/azure-best-practices/organize-subscriptions
• #88: We also looked at Resource Groups earlier. This is the next layer down where you can apply policies and IAM to a group of resources. These will also be a part of your organizational governance considerations and architecture. You’ll want to know when you see a resource group who created and owns the resources in it. https://learn.microsoft.com/en-us/azure/azure-resource-manager/management/manage-resource-groups-portal
• #89: By default, anyone can create a management group on Azure. You may want to change it. This slide shows different permissions associated with management groups. Ensure that only the appropriate people can create, change, and delete policies associated with a management group. https://docs.microsoft.com/en-us/azure/governance/management-groups/overview
• #90: The next series of slides show how to create a management group. Navigate to management groups and click the button in the middle of the screen to “Start using management groups”
• #91: For this example we’re going to create a governance group. This group will be able to set policies or view resources across the organization but not access things assigned directly to the root group. You may or may not want this structure. It is being created this way to demonstrate some concepts.
• #92: Create the five additional management groups shown on the screen. Create groups based on the access policies and security policies you need to create. If you have different access and security policies for a particular set of resources, you probably need a new management group.
• #93: Move your subscriptions into the hierarchy as shown. With this hierarchy you could give a DevOps team access to Dev, QA, and Production subscriptions, but not the Security Team subscription.
• #94: Navigate to the governance management group. Click on IAM to grant access to this group.
• #95: Select the security reader role. We want to give permissions to read security settings in any subscription under this management group.
• #96: Select Grace Hopper, the user created on day 1.
• #97: Navigate to the security management group. Make Grace Hopper a co-administrator of that group. Now let’s think for a minute. There’s a subscription directly under the root above the governance management group. Can Grace see it?
• #98: Grace can’t see the 2slbiz subscription because it resides above the governance management group to which she has access. She can read security settings in the rest of the subscriptions and she can manage resources in the security management group.
• #99: Grace has read-only access to all subscriptions in the governance management group. But recall that recently she had access to create VMs. Does she still have this access?
• #100: If you test Grace’s access in this subscription you will see that yes, she can still create VMs. It’s important to understand precedence when creating IAM policies. In some systems higher level policies restrict access. In some cases, they can be overridden at lower levels. Always test your IAM permissions and policy settings!
• #101: Can she create a subscription? Well, she can if she adds her own credit card apparently. That’s interesting. You may want to test that out further to see if and how it may affect your organization.
• #102: Here Grace has the option to create a free account. Will it be associated with your organization and IAM user? Test it out…
• #103: If we look at Management Groups Grace does not have the option to add an existing subscription to a management group.
• #104: Even as co-administrator of the security management group she still can’t perform this action in a second tenant added to the account.
• #105: This slide shows the permissions required to create subscriptions. The options vary depending on what type of Azure license you have. The account that is being used to test and create these slides falls into the MCA category above.
• #106: Here are some additional details about the billing roles related to subscriptions. Depending on what you want your user to be able to do you’ll need to assign them the appropriate billing role. We’ll look more at cost management and billing in upcoming slides.
• #107: Add two new subscriptions using your global admin account. Add a developer subscription under the developer management group and a security subscription under the security management group.
• #108: Now you can carry on this test and explore what access Grace has in each of those accounts. If you create resources with the global admin or a new user granted access to the development account, Grace should not be able to modify those resources, but she should be able to view them for security purposes. Grace should be able to grant permissions and create resources in the security management group. Always test your permissions when you assign them to make sure they provide the access you expect!
• #110: Misconfigurations are one of the biggest security problems in the cloud. We hear this over and over again. This report is just one example from 2020 that puts some metrics and costs on the problem. DivvyCloud has since been acquired by Rapid 7. https://divvycloud.com/wp-content/uploads/2020/02/Cloud-Misconfiguration-Report-FINAL.pdf
• #111: Organizational governance intends to enforce policies throughout the organization to reduce security risk. In the cloud you can use code to enforce policies instead of documents nobody reads! We can apply policies in azure at the different layers we looked at previously: Management Groups Subscriptions Resource Groups You can write reusable policies and store them in source control. That allows you to track versions, who made changes, and if the policy deployed in your account still matches what it is supposed to be.
• #112: Create a policy in Azure. Migrate to the development management group we created. Click on Policy in the left menu.
• #113: Click on Definitions. You can choose from predefined policies here, or write your own.
• #114: Filter on storage to see storage related policies. Click on the policy shown on the slide, as an example.
• #115: Take a look at the underlying code that defines the policy. Here you can see the syntax and format of an Azure policy. You can use this as a starting point to write your own policies. If you want to try to create a custom policy check out the tutorial here: https://docs.microsoft.com/en-us/azure/governance/policy/tutorials/create-custom-policy-definition
• #116: Now assign the selected policy.
• #117: Here you can view some additional details about the policy and click Review +create to assign it.
• #118: Click on assignments for your management group and now you can see that the policy has been added.
• #119: Now let’s assign an initiative. An initiative is a group of policies that you can assign all at once. Click Assign initiative at the top of the screen.
• #120: Here you can choose an initiative definition.
• #121: You’ll see there are a number of built-in initiatives. One of them is the Center for Internet Security (CIS) Azure Foundation Benchmark v1.3.0. Select that one. The Center for Internet Security has crowd-source security best practices for a number of different platforms and environments. We’ll talk more about that in the next class. Click Select.
• #122: You can choose to enforce the policy which will prevent deployment of non-compliant resources, or simply report on non-compliance. When you are just starting to apply policies in an existing Azure environment it’s best to start with disabled policies and review their impact on existing systems before enabling them. That way you can avoid breaking production systems! You can also test first in dev and QA environments before deploying to production. Always safer!
• #123: You have the option of remediating non-compliance. Very important to also test this before deploying to avoid unexpected consequences. Understand the required permissions and the impact to existing systems.
• #124: You have the option to change non-compliant systems. It would probably be a good idea to let people know who to contact here if they are having problems related to this policy or point them to helpful documentation.
• #125: Note that the initiative is initially in a non-started state after deployment. It will take some time for Azure to review the resources and apply the policy.
• #126: Wait a bit and then return to the initiative. Here you can see a lot of non-compliant resources. One of the issues is that the policy wants me to turn on every option in Azure Defender.
• #127: We’ll talk about Azure Defender for Cloud again in the next class, but it helps you monitor security in your environment and use various security services with your Azure resources. Navigate to Microsoft Defender for Cloud and click on the developer subscription where we applied the policy.
• #128: Noticel that all the options for this subscription in Microsoft Defender are not enabled. You can enable them here.
• #129: Wait a bit and return to view the state of your initiative. Now you can see that those items related to Microsoft Defender have been remediated. The number of findings is reduced. If you want to ensure you aren’t billed for Microsoft Defender at this point, delete the new subscription and everything in it.
• #130: With Azure policy you can use the guest configuration and policy extension. As mentioned earlier this is a newer and better option than DSC because you won’t need to deploy credentials in a configuration file. You can learn more about how to apply this option in these links below. It is also included in Azure ARC which we will cover in some upcoming slides. https://docs.microsoft.com/en-us/azure/governance/policy/concepts/guest-configuration https://docs.microsoft.com/en-us/azure/virtual-machines/extensions/guest-configuration
• #131: If you want an open source tool to help you enforce policies, check out Open Policy Agent. It has a very cool architecture similar to something I had to create manually in the past for a containerized microservices environment. It can integrate with any type of system to apply policies written in JSON and return an allow or deny result. This tool is used a lot with Kubernetes deployments but has application across a wide ranges of systems and use cases. https://www.openpolicyagent.org/
• #132: Azure Policy for Kubernetes allows you to apply policies to AKS environments and it uses OPA under the hood.
• #134: Azure Blueprints allow you to deploy sets of resources across subscriptions in an automated, consistent, programmatic way. They are useful for example, when IT and security teams need to deploy resources to every Azure subscription for monitoring and security purposes. You may also want to deploy consistent networking in each subscription. https://docs.microsoft.com/en-us/azure/governance/blueprints/overview
• #135: Navigate to Blueprints. Click Create.
• #136: Scroll down to see sample blueprints.
• #137: Scroll back up and let’s choose a blank Blueprint so we can create one from scratch and see what options exist.
• #138: Enter the basic information. Choose a management group where you want the blueprint to deploy resources. When you create a blueprint at the management group level, the resource will be deployed to every subscription.
• #139: Add artifacts to the blueprint. (What do you want to deploy?) Check out what type of artifacts you can add in the drop down list. Policies, Roles, Arm Templates, and Resource Groups
• #140: Add a role for Grace Hopper as a Security Reader. This would be another way to add a role assignment in each subscription in that management group.
• #141: Add an ARM Template. If you had a template that deployed a set of resources you wanted to exist in every subscription in this management group you could add it here.
• #142: Assign policies that you want to exist in each subscription in this management group.
• #143: Deploy a Resource Group.
• #144: If you wanted to apply that Blueprint to an additional management group you could click Apply under Add to scope.
• #145: You can publish the Blueprint to make it active and deploy the resources.
• #146: Click to assign the blueprint.
• #147: Fill out the required information.
• #148: After the assignment and publishing you can find the resources you deployed in the subscriptions. Note that you could also lock the resources so no one could change them, regardless of their assigned permissions in the subscription, unless they have permission to change this lock setting.
• #150: Azure automation allows you create Run Books or sets of scripts that you want to apply to resources. https://docs.microsoft.com/en-us/azure/automation/overview
• #151: You can create runbooks to update resources, respond to security groups, and orchestrate deployments.* Note that you will want to use a full CI/CD pipeline for deployments, not just click in the portal to deploy resources or make changes for best security when it comes to making changes in your cloud environment. https://docs.microsoft.com/en-us/azure/automation/automation-services
• #152: You can trigger your runbooks in response to many different actions in your environment. For example, if your monitoring notices suspicious behavior on a VM, make an image of it and investigate in a security subscription or resource group.
• #153: You can use a graphical user interface to create a runbook, but most of the time you’ll be better off just writing code.
• #154: This slide shows an example of using the portal to create a powershell runbook. Make sure that you check the version of any programming language you are using here. Azure was supporting an old version of Python. This video offers a demo of Azure Automation: https://www.youtube.com/watch?v=u6eR8yguVxE
• #156: Cloud and on-premises governance management platform. Manage resources as if they are running in Azure: Servers (Physical and Virtual Machines) Kubernetes clusters Databases including SQL Server Azure Stack HCI Could work in other clouds as well Single management plane for governing and monitoring resources https://docs.microsoft.com/en-us/azure/azure-arc/overview Image is from this video which has a more in-depth explanation of this service and demos: https://www.youtube.com/watch?v=ANvAmeN62n8
• #157: Azure Arc can help with governance across your cloud environments and on-premises. This slide lists some of the benefits of using Azure Arc. Anyone using multiple clouds and managing on-premises resources will like the concept of this service. You’ll just need to understand any additional attack surface introduced by network connections and access from the Azure into sensitive environments.
• #158: Resource bridge supports VM self-servicing and management from Azure, for virtualized Windows and Linux virtual machines hosted in an on-premises environment on Azure Stack HCI and VMware. The resource bridge is a packaged virtual machine, which hosts a management Kubernetes cluster that requires no user management. Deploy VMs to your private cloud from Azure. All management operations are performed from Azure, no local configuration is required on the appliance. Limited regions at this time: East US, West Europe.
• #159: Note the networking requirements for Azure Bridge and consider what changes you will need to make to firewall and proxy rules. Consider how you will ensure traffic from these domains is legitimate and triggered by your users and systems only, not Azure staff or customers in a shared Azure environment.
• #160: Azure Arc uses a machine agent to make changes. This slide provides details about the machine agent. You can generate a script to run on the local machine to install it. The Azure Arc machine agent allows you to manage your virtual machines outside of Azure including on-premises and at other cloud providers. The Hybrid Instance Metadata service (HIMDS) manages the connection to Azure and the connected machine's Azure identity. The guest configuration agent provides functionality such as assessing whether the machine complies with required policies and enforcing compliance. Note the following behavior with Azure Policy guest configuration for a disconnected machine: Guest assignment is stored locally for 14 days. Within the 14-day period, if the Connected Machine agent reconnects to the service, policy assignments are reapplied. Assignments are deleted after 14 days, and are not re-assigned to the machine after the 14-day period. The Extension agent manages VM extensions, including install, uninstall, and upgrade. Extensions are downloaded from Azure and copied to the %SystemDrive%\%ProgramFiles%\AzureConnectedMachineAgent\ExtensionService\downloads folder on Windows, and to /opt/GC_Ext/downloads on Linux. On Windows, the extension is installed to the following path %SystemDrive%\Packages\Plugins\<extension>, and on Linux the extension is installed to /var/lib/waagent/<extension>. https://docs.microsoft.com/en-us/azure/azure-arc/servers/agent-overview
• #161: Once again, consider the network requirements and any new risks by enabling it in your environment. https://docs.microsoft.com/en-us/azure/azure-arc/servers/network-requirements
• #162: When you allow these networking options through your firewall also consider whether the traffic is on a public or private network. You have some different options: Over the Internet Proxy server - monitor connections Private endpoints over Express Route Security Overview: https://docs.microsoft.com/en-us/azure/azure-arc/servers/security-overview Private Link: https://docs.microsoft.com/en-us/azure/azure-arc/servers/private-link-security
• #163: From Azure Documentation: The Azure Connected Machine agent uses public key authentication to communicate with the Azure service. After you onboard a server to Azure Arc, a private key is saved to the disk and used whenever the agent communicates with Azure. If stolen, the private key can be used on another server to communicate with the service and act as if it were the original server. This includes getting access to the system assigned identity and any resources that identity has access to. The private key file is protected to only allow the himds account access to read it. To prevent offline attacks, we strongly recommend the use of full disk encryption (for example, BitLocker, dm-crypt, etc.) on the operating system volume of your server. https://docs.microsoft.com/en-us/azure/azure-arc/servers/security-overview
• #164: This slide shows which operating systems you can use with Azure Arc. https://docs.microsoft.com/en-us/azure/azure-arc/servers/prerequisites
• #165: To see a demo of using Log Analytics with Azure Arc check out this video: https://www.youtube.com/watch?v=ANvAmeN62n8
• #166: Azure Arc makes it possible to run Azure data services on-premises. App Services, Functions and Logic Apps on Azure Arc: https://docs.microsoft.com/en-us/azure/app-service/overview-arc-integration Azure API Management with Azure Arc: https://docs.microsoft.com/en-us/azure/api-management/how-to-deploy-self-hosted-gateway-azure-arc Azure Event Grid with Azure Arc: https://docs.microsoft.com/en-us/azure/event-grid/kubernetes/overview You can also use Azure-Arc enabled data services: https://docs.microsoft.com/en-us/azure/azure-arc/data/overview
• #167: You can use Azure Arc Box for testing out Azure Arc to see how it works. Check out the links below for more information. https://techcommunity.microsoft.com/t5/azure-arc-blog/announcing-jumpstart-arcbox-a-complete-azure-arc-sandbox/ba-p/2376039 https://techcommunity.microsoft.com/t5/azure-arc-blog/the-azure-arc-jumpstart-project/ba-p/1655188 GitHub: https://github.com/microsoft/azure_arc
• #168: There are various deployment mechanisms to deploy Azure Arc as noted on the slide. Depending on your environment you may already have a tool that helps you deploy it. https://docs.microsoft.com/en-us/azure/azure-arc/servers/deployment-options https://www.youtube.com/watch?v=ANvAmeN62n8 Azure provides guidance to help you plan your deployment: https://docs.microsoft.com/en-us/azure/azure-arc/servers/plan-at-scale-deployment
• #170: Data classification allows you to apply policies and rules to different types of data. For example, you can apply more stringent policies on data that is deemed highly sensitive such as only allowing access from the corporate network. You can also monitor who is accessing sensitive data. Microsoft uses the data classifications on the slide and provides guidance on data classification in the link below. https://docs.microsoft.com/en-us/azure/cloud-adoption-framework/govern/policy-compliance/data-classification
• #171: This slide shows how the Canadian government classifies data. The government has rules around different classifications and which ones can go into which cloud environments. https://www.tpsgc-pwgsc.gc.ca/esc-src/protection-safeguarding/niveaux-levels-eng.html
• #172: O365 offers some classification features such as sensitivity labels and retention labels. Apply those features and view reports on your data. https://docs.microsoft.com/en-us/microsoft-365/compliance/data-classification-overview
• #173: Sensitivity labels allow users to classify documents and data. In the screen shot on the slide the user is selecting the sensitivity of the document they are creating or editing. Obviously, you would need to ensure people cannot change a highly sensitive document to a less sensitive document unless you trust that person to make that change. https://docs.microsoft.com/en-us/microsoft-365/compliance/sensitivity-labels
• #174: Retention settings allow you to define how long different types of data should exist before deleting it. Best practice in security is to only retain data as long as you really need it. Certain regulations such as GDPR which aims to protect the data belonging to European citizens requires that you delete data within a certain time period unless you document and justify why you need to keep it longer. https://docs.microsoft.com/en-us/microsoft-365/compliance/retention
• #175: Data Discovery & Classification is built into Azure SQL Database, Azure SQL Managed Instance, and Azure Synapse Analytics. It provides basic capabilities for discovering, classifying, labeling, and reporting the sensitive data in your databases. https://docs.microsoft.com/en-us/azure/azure-sql/database/data-discovery-and-classification-overview
• #176: This slide shows the SQL Server data classification dashboard. https://docs.microsoft.com/en-us/azure/azure-sql/database/data-discovery-and-classification-overview?view=azuresql
• #177: Microsoft for SQL server can suggest classification recommendations based on its analysis of your data. https://docs.microsoft.com/en-us/azure/azure-sql/database/data-discovery-and-classification-overview?view=azuresql
• #178: This slide shows adding classification to a particular part of a SQL Server database. For more information see the link below. https://docs.microsoft.com/en-us/azure/azure-sql/database/data-discovery-and-classification-overview?view=azuresql
• #179: You can use tags to help you classify resources in Azure that contain sensitive information. Just ensure you understand who has permission to change, add, and remove tags if you use this option and depend on it for reports and automated actions. https://docs.microsoft.com/en-us/azure/azure-resource-manager/management/tag-resources?tabs=json
• #180: Microsoft Purview attempts to try to help organizations automatically classify data. Microsoft states that the Purview governance portal provides a unified data governance service that helps you manage your on-premises, multicloud, and software-as-a-service (SaaS) data. It can help you govern data across multiple environments, not just your Azure account. https://docs.microsoft.com/en-us/azure/purview/overview
• #181: Purview components create a map of your data and helps organizations govern and search for data using the four components described on the slide. https://docs.microsoft.com/en-us/azure/purview/overview Microsoft offers some introductory policies which you can use to get started: Data owner access policies https://learn.microsoft.com/en-us/azure/purview/concept-policies-data-owner Self-Service data discovery access policies https://learn.microsoft.com/en-us/azure/purview/concept-self-service-data-access-policy DevOps policies https://learn.microsoft.com/en-us/azure/purview/concept-policies-devops Metadata is stored in Purview while customer data remains in the region where it is stored.
• #182: To use Purview start by creating an account. Note the checklist in the tutorial below which may be helpful. Purview has a number of best practices and prerequisites that you will probably want to review before you get started. https://docs.microsoft.com/en-us/azure/purview/tutorial-azure-purview-checklist https://docs.microsoft.com/en-us/azure/purview/deployment-best-practices
• #184: Microsoft licensing and pricing is complicated! There are so many options and variations that explaining all of it is beyond the scope of this class. Throughout class we looked at different SKUs and options while creating various resources. You can find some details here: https://docs.microsoft.com/en-us/microsoft-365/enterprise/subscriptions-licenses-accounts-and-tenants-for-microsoft-cloud-offerings
• #185: Many services require premium licenses to use various security features as we’ve been demonstrating throughout class. We showed that in order to use conditional access in Azure Active Directory, which is a very powerful security feature, you’ll need to pay extra.
• #186: Compare Microsoft 365 Enterprise plans to see which security features are included with which licenses. Sometimes there is crossover between O365 and Azure licensing. If you have one you get the other. You’ll want to understand all that when coming up with your security budget. https://www.microsoft.com/en-us/microsoft-365/compare-microsoft-365-enterprise-plans
• #187: When you are building reliable systems that withstand outages and have additional redundancy you’ll need to understand the different storage plans and costs. https://docs.microsoft.com/en-us/azure/storage/blobs/access-tiers-overview
• #188: The Azure pricing calculator can help you try to estimate costs up front - but always do a beta test or proof of concept (POC) to make sure you haven’t missed anything! Pick the resources you want to add to your pricing calculation. https://azure.microsoft.com/en-us/pricing/calculator/
• #189: You can choose different regions and services options to get a cost for each service, and an overall total.
• #190: Azure Cost Management and Billing will help you analyze and hopefully control costs. https://docs.microsoft.com/en-us/azure/cost-management-billing/cost-management-billing-overview
• #191: From documentation: Cost Management works at all scopes above resources to allow organizations to manage costs at the level at which they have access, whether that's the entire billing account or a single resource group. Although billing scopes differ based on your Microsoft agreement (subscription type), the Azure RBAC scopes don't. https://docs.microsoft.com/en-us/azure/cost-management-billing/costs/understand-work-scopes
• #192: You can use the cost analysis dashboard to query different cost metrics. On this slide I’ve change the first item on the dashboard to show costs by resource group, for example. https://learn.microsoft.com/en-us/azure/cost-management-billing/costs/quick-acm-cost-analysis
• #193: Definitely make use of budgets and billing alerts. If your costs are way out of line, or you have an attacker spinning up VMs with GPUs to host bitcoin miners, you’ll want an alert for that! https://docs.microsoft.com/en-us/azure/cost-management-billing/costs/tutorial-acm-create-budgets
• #194: Billing profiles allow you to assign permissions for billing purposes to different users. As discussed earlier creating subscriptions is related to billing. https://docs.microsoft.com/en-us/microsoft-365/commerce/billing-and-payments/manage-billing-profiles?view=o365-worldwide
• #195: You can view subscriptions in your account. Note that this allows me to view all subscriptions across all tenants. Also note there is a higher level of account management if you have an Enterprise account. An Azure support person said less than 1% of all customers have an Enterprise account and it obviously costs more. You’ll hopefully have a dedicated account support person in that case who can provide a lot assistance as it costs more.
• #197: The importance of deployment pipeline architecture and management cannot be overstated.
• #198: Understand all the paths to deploy resources in your cloud environment - and especially the ability to deploy or change networking and IAM permissions. Consider who has access to create new permissions, such as those managical managed machine identities created by Azure for new web applications.
• #199: Some people tell me they can’t get control of the deployment pipeline in their accounts. It generally starts this way. I remember first moving to the cloud at Capital One and asking others who had moved to the cloud prior about this issue. At that point some of the early movers were already taking action to reign in deployment systems across the company. Often the people who contact me for a security assessment do so after a security breach, at which point they have started the process to fully automate and standardize their deployment pipeline. Different organizations will have different levels of risk but resources in any environment can be used by attackers against others - so your security matters for reasons beyond your data protection.
• #200: Think about what you do and do not want to allow in terms of deployment. You may have different rules and policies at different layers of your organization (management groups, subscriptions, resource groups).
• #201: Find patterns that you can leverage to make deployment management easier. Note that people who try to enforce draconian rules in deployment pipelines generally fail. The shackles are thrown off and the whole system is rejected. Instead, focus on building a pipeline that creates flexible patterns that work for developers. Include them in the process, testing, design and development. Train them on security as you go.
• #202: After you’ve defined your architecture, rules, and patterns, build out the pipeline. Make sure you include disaster recovery and backups - and test those aspects of your architecture.
• #204: The term immutable refers to something that cannot change. Classes are a programming construct use to define values and actions within an application. The term immutable is used in software when classes are instantiated (created) that cannot be changed after that point. Immutable classes are used for data that should never be changed to protect the data. For example, when running a multi-threaded program, many classes may be running in different threads (processes) in a computer program. A common class is used by all the threads but you don’t want to allow any of the threads to update the data in that class, so you make it immutable. The same concept can be applied to infrastructure and virtual machines. Once the virtual machine is deployed you don’t want some human or malware to come along and change it to an insecure or non-compliant state. You limit any channels an attacker could use to deploy new software and you make it very difficult for the malware to get on the machine at all. If possible you can limit permissions on the machine as well to prevent software from being deployed. As mentioned earlier you can also consider immutable operating systems like Silverblue and Clear Linux. What happens when you do need to update a machine with a software patch? You update the source code used to deploy that machine, check it into source control, and then use a secure deployment process to instantiate a new virtual machine. You then terminate the old virtual machine. This approach also facilitates something called Blue-Green deployments, which is a side benefit. You can test the new virtual machine configuration before you terminate the old one, and then switch your DNS from the old host to the new host. Similar mechanisms work with auto-scaling instances as well. Using this approach removes all the complications and potential risks associated with the SSM approach we mentioned earlier.
• #205: If people can go around your deployment system, it is somewhat a waste of time and money. You’ll need to understand all methods of deployment and make sure everyone at the organization is on board with the plan.
• #206: Many open source tools exist for building out a deployment pipeline. Explaining all of these is beyond the scope of this class, but if you use your own tools you can control the networking, location, and configuration of each tool. Cloud platform teams should not have access.
• #207: Azure offers a number of tools in Azure DevOps that try to replicate open source tools. These tools from Azure aare very interesting and let you apply policies to deployment pipelines and processes. You can create private repositories and scan containers before deploying. The only issue is that you are giving a lot of control of your pipeline over to Azure. You’ll also want to look closely at the networking options and requirements and consider if and how rogue changes might infiltrate your pipeline if you choose this option. Ensure hosted agents used to communicate with private networks are not simply proxying traffic to the Internet. https://docs.microsoft.com/en-us/azure/devops/
• #208: These are *some* of the required domains for Azure DevOps. Ensure you understand what sort of traffic to expect from these domains and what they are all doing. You can see all the domains and CIDRS in the details of the documentation. Also understand what metadata exists in the environment and authentication options. https://docs.microsoft.com/en-us/azure/devops/
• #209: The Microsoft identity platform helps you build applications your users and customers can sign in to using their Microsoft identities or social accounts, and provide authorized access to your own APIs or Microsoft APIs like Microsoft Graph. Consider which authentication mechanisms you want to allow or disallow via your deployment pipeline. https://docs.microsoft.com/en-us/azure/active-directory/develop/v2-overview
• #210: From the docs: For an identity provider to know that a user has access to a particular app, both the user and the application must be registered with the identity provider. When you register your application with Azure Active Directory (Azure AD), you're providing an identity configuration for your application that allows it to integrate with the Microsoft identity platform. Take note of the following because access to register applications may in turn offer access to sensitive information. Limit who has access to share these secrets with the Microsoft identity platform: Share a secret with the Microsoft identity platform that proves the app's identity. Using a secret is relevant in the case where the app is a confidential client application. A confidential client application is an application that can hold credentials securely. A trusted back-end server is required to store the credentials. https://docs.microsoft.com/en-us/azure/active-directory/develop/quickstart-register-app
• #211: Deployment system design, development, architecture, and management is a huge topic unto itself. This slide has some of the considerations.
• #212: When creating an secure DevOps pipeline it is important both understand the developer workflow and potential threat models. First of all, a developer might be trying to rapidly push code to a QA environment for iterative development and testing. You don’t want to block them from being able to quickly iterate with long-running scans. At the same time, you don’t want to wait until developers and QA think they have a working application and are about to deploy to run a scan because that will be extremely frustrating to them and the business. Give developers control of the scan between development and QA environments and make sure to let them know they need to resolve any issues discovered before that application will be allowed to deploy in production. It is the developer’s and QA professionals responsibility to ensure the scans are run and issues fixed prior to production deployment. Then, when you are deploying to production, run the scan and block deployment if the scan does not pass. You can also check the integrity of the code the entire way through the process to ensure that what developers wrote and QA teams tested match what is being deployed in your production environment. Make sure no rogue code can get inserted at any point.
• #214: When architecting systems on Azure it is very important to consider back up systems. Ransomware, other security problems, and outages occur in the cloud and you’ll want to be able to recover. Depending on where you are recovering from and to you may also have to consider data transfer time and cost.
• #215: There are multiple ways to backup data and systems in the cloud. A simple example here is to enable backups for a single VM. https://docs.microsoft.com/en-us/azure/backup/backup-during-vm-creation
• #216: You can also backup a VM with instant restore. https://docs.microsoft.com/en-us/azure/backup/backup-instant-restore-capability
• #217: Enhanced backup policies create multiple backups per day or trusted VMs. https://docs.microsoft.com/en-us/azure/backup/backup-azure-vms-enhanced-policy https://docs.microsoft.com/en-us/azure/virtual-machines/trusted-launch
• #218: From the documentation, you can backup: On-premises - Back up files, folders, system state using the Microsoft Azure Recovery Services (MARS) agent. Or use the DPM or Azure Backup Server (MABS) agent to protect on-premises VMs (Hyper-V and VMware) and other on-premises workloads Azure VMs - Back up entire Windows/Linux VMs (using backup extensions) or back up files, folders, and system state using the MARS agent. Azure Managed Disks - Back up Azure Managed Disks Azure Files shares - Back up Azure File shares to a storage account SQL Server in Azure VMs - Back up SQL Server databases running on Azure VMs SAP HANA databases in Azure VMs - Backup SAP HANA databases running on Azure VMs Azure Database for PostgreSQL servers - Back up Azure PostgreSQL databases and retain the backups for up to 10 years Azure Blobs - Operational backup for Azure Blobs
• #219: You can use Azure backup with a single VM. https://docs.microsoft.com/en-us/azure/backup/backup-azure-vms-first-look-arm
• #220: You can also configure Azure backup for multiple VMs. https://docs.microsoft.com/en-us/azure/backup/backup-azure-arm-vms-prepare If you are backing up encrypted VMs you may need additional permissions: https://docs.microsoft.com/en-us/azure/backup/backup-azure-vms-encryption
• #221: Once backups are created you can monitor and manage them in the Azure Backup Center. https://docs.microsoft.com/en-us/azure/backup/backup-center-overview
• #222: Once you have a backup in recovery vault you can restore it according to the instruction in the link below. Note that if a VM is encrypted and has keys stored in secrets then you’ll need permissions to use those. https://docs.microsoft.com/en-us/azure/backup/backup-azure-arm-restore-vms
• #223: Many other backup options exist within Azure Backup for different types of resources. Understand the backup options for any resources you choose to use and associated pricing when architecting systems and applications on Azure. https://docs.microsoft.com/en-us/azure/backup/backup-overview https://azure.microsoft.com/en-us/pricing/details/backup/
• #224: Restoring backups may incur transfer costs depending on where the systems are backed up to or from. Inbound data transfer is generally free. Outbound and cross region may incur costs. Transfer costs will also vary by region. International costs will also depend on currency fluctuations. https://azure.microsoft.com/en-us/pricing/details/bandwidth/
• #225: This slide and the details in the link below explain some of the different transfer options when you want to move data and from Azure. Sometimes the transfer of large datasets to Azure can take weeks, months, or even years. It may make more sense to physically transfer the data. https://docs.microsoft.com/en-us/azure/storage/common/storage-choose-data-transfer-solution
• #226: Data Box Gateway is a virtual device based on a virtual machine provisioned in your virtualized environment or hypervisor. The virtual device resides in your premises and you write data to it using the NFS and SMB protocols. The device then transfers your data to Azure block blob, page blob, or Azure Files. https://docs.microsoft.com/en-us/azure/databox/data-box-overview
• #227: Azure Stack Edge is an option to bring Azure to an edge location which may reduce transfer time. Get a physical device from Azure with a subset of Azure on it. This option can facilitate faster data transfers to Azure. From the documentation: Network data transfer from the edge to the cloud: Easily and quickly transfer data to Azure for further compute or archival purposes or to expedite your cloud migration. Return the appliance to Microsoft when you’re done. https://docs.microsoft.com/en-us/azure/databox-online/azure-stack-edge-overview
• #228: Azure offers a service to help with database migration as well. https://docs.microsoft.com/en-us/azure/dms/dms-overview
• #230: Architecture is the structure of the entire cloud platform and how everything works together. Using a list of best practices is great at reducing blatant misconfigurations but it doesn’t consider the overall design of your cloud, attack vectors, and paths in your environment.
• #231: This slide lists some of the considerations when designing your cloud architecture. Ultimately you want to understand the current threat landscape and how to build systems to withstand failures and attacks. In order to do that, you need to understand how the cloud platforms and their services work. One of the big differences on cloud platforms compared to on-premises environments is the ability to build horizontally scaling architectures with ephemeral resources.
• #232: Vertical scaling means when an application needs to grow, a larger server is purchased, and the application is deployed to a larger host machine. This causes many problems. A single monolithic node supporting all application functionality means that when the application goes down, the whole application goes down. If the application needs to be updated, it could be that the entire application needs to be taken down to perform the update. If the application crashes, the whole application may be taken out. If the application has a performance issue, the entire application and all customers may be impacted. In contrast, a horizontally scaling application will add additional nodes to support the load, instead of a bigger server. The application must be designed to process requests and data across multiple nodes in a distributed architecture. If the application needs to be updated, one node can be updated at a time. If well designed, failure of one node will not affect the functionality of the application for most customers.
• #233: In addition to load balancers, your servers are no longer physical machines, limited to a maximum of say, 5 physical servers in your data center. If one of your servers failed, you would be limited to four servers until the fifth one was fixed. No more thanks to auto-scaling groups! Auto-scaling groups define how many minimum and potentially maximum servers you want behind a load balancer at any given time. Then you provide the machine image and configuration you want these virtual machine to have when they are created by the autoscaling group. When a machine fails, the machine will be removed from the auto scaling group and a new virtual machine will be created using the image and configuration you provided to the auto scaling group. In addition, if the load to your application grows, the auto scaling group will create new virtual machines. As the load as reduced, machines will be terminated. This is a horizontally scaling, distributed architecture. Note: In order to stop instances in an auto-scaling group - you have to terminate the group, not the instances. Otherwise they will just keep coming back online!
• #234: A software load balancer works in the same way. All the cloud providers offer a load balancer that can function like a hardware load balancer, and considering adoption rates, this seems to be working well enough for most companies. One company moved off of physical F5 load balancers and saved a significant amount of money in the cloud - but he was very conscious of and monitoring costs, and adjusting everything over time to optimize for cost-savings. This requires some effort! Each of the cloud providers offers load balancers at layer 4 and layer 7 in the OSI Model. If you recall layer 4 would be sending raw TCP or UDP packets for example. At layer 7 you would be getting packets fully reassembled into web requests and responses at the application layer. The different load balancers handle requests at each layer based on the type of data they receive, and send the requests to the appropriate place.
• #235: This slide presents a sample three tier architecture on Azure. A three tier architecture allows you to spot rogue traffic between the tiers as an attacker moves closer to your data. You can build scalable, self-healing architectures on Azure while still maintaining network segregation that leverages zero trust networking and facilitates network monitoring. https://docs.microsoft.com/en-us/azure/architecture/reference-architectures/n-tier/images/n-tier-sql-server.png
• #236: Use API gateways to protect APIs published in cloud environments. We discussed API gateways in the last class. This slide revisits the architecture and the link below further dives into the details. https://docs.microsoft.com/en-us/azure/architecture/reference-architectures/apis/protect-apis
• #237: Construct your networks to minimize attack paths. Consider how many changes you give attackers to leverage lateral movement throughout your network. Consider how zero-trust networking can reduce the blast radius in your environment. These topics are covered in more detail in my book. https://www.amazon.com/Cybersecurity-Executives-Cloud-Teri-Radichel/dp/1652474811
• #238: Depending on your DR/BPC strategy you may need to withstand a regional outage on Azure - and it has happened! Azure provides guidance for different types of services in the link below. https://docs.microsoft.com/en-us/azure/architecture/resiliency/recovery-loss-azure-region
• #239: Azure offers a service called Azure Site Recovery which can help yours systems recover more quickly by replicating them from a primary to a secondary site. https://azure.microsoft.com/en-us/services/site-recovery/#overview https://docs.microsoft.com/en-us/azure/site-recovery/site-recovery-overview
• #240: https://docs.microsoft.com/en-us/azure/architecture/framework/
• #241: Many people ask for a “reference architecture” when moving to the cloud. Because the cloud has so many options there is no single reference architecture that will work for every organization. You should review the best practices and detailed workings of each service you use to understand the threat model and any security gaps that may exist as I explained in this post - security architecture is not a checklist: https://medium.com/cloud-security/security-architecture-is-not-a-checklist-b86f1dc0aa0c However, you can leverage the Microsoft reference architecture to get started and make sure you are not missing any key components of your security architecture implementation on Azure: https://docs.microsoft.com/en-us/security/cybersecurity-reference-architecture/mcra