AzureSecurity Day4 Compute And Application Service Security

Editor's Notes

• #2: Content is provided in electronic format. We request that you abide by the terms of the agreement and only use the content in the books and labs for your personal use. If you like the class and want to share with others we love referrals! You can ask people to connect with Teri Radichel on LinkedIn or visit the 2nd Sight Lab website for more information. https://www.2ndsightlab.com https://www.linkedin.com/in/teriradichel https://medium.com/cloud-security
• #3: Content is provided in electronic format. We request that you abide by the terms of the agreement and only use the content in the books and labs for your personal use. If you like the class and want to share with others we love referrals! You can ask people to connect with Teri Radichel on LinkedIn or visit the 2nd Sight Lab website for more information. https://www.2ndsightlab.com https://www.linkedin.com/in/teriradichel https://medium.com/cloud-security
• #6: Applications running on cloud platforms use compute resources to process data. In the cloud, you need to understand the different layers of compute that need to be secured, and who has responsibility to do so. We’ll talk about these different types of compute resources: A hypervisor runs multiple “virtual” computers on one physical server or laptop. The hypervisor typically runs on an operating system (like Linux or Windows), but specialized hypervisors interact directly with the hardware as we’ll explain in an upcoming slide. Virtual machines run on top of and are managed by hypervisors. In a cloud environment, typically multiple virtual machines from different customers run on top of a single hypervisor, running on the same hardware. Containers are even smaller compute resources that run on operating systems like Windows, Mac, and Linux. Containers package up all the resources for an application. Serverless is a new type of compute resource developed by AWS and now adopted by the other big cloud providers. Developers don’t have to configure container management systems or operating systems. They simply drop their compute into the cloud and it runs - magic! We’ll talk more in depth about all these different types of compute resources and what you need to do to configure them securely.
• #7: You will want to understand how your cloud provider secures layers for which they are responsible. In almost every case, hypervisor security is the responsibility of the cloud provider. The hypervisor allows multiple virtual computers to run on one single hardware computer. The hypervisor has to make sure the virtual machines can’t access each other unless authorized. If the hypervisor is compromised the virtual machines are at risk.
• #8: Each cloud provider may use different types of hypervisors to run virtual machines on their cloud platform. Understanding what type of hypervisor is interacting with the virtual machines you run in the cloud can help you assess the security of the cloud platform. For example, you can look at assessments of the different types of underlying hypervisors by security researchers and third-party auditors to determine if the hypervisor in use has known vulnerabilities or questionable security implementation. You can also track and monitor cloud providers to see how quickly they patch new vulnerabilities announced for these underlying systems. Each of these hypervisors has security controls, logging, and monitoring that need to be implemented correctly. Although you cannot control this yourself you can ask the cloud provider questions regarding how they manage their hypervisors and for third-party audits and pentests that validate the security of these systems. https://learn.microsoft.com/en-us/azure/security/fundamentals/hypervisor
• #9: Azure provides a fairly detailed amount of information explaining how they provide tenant isolation on the platform, which includes the following: Azure Active Directory for isolation via authentication and role-based authentication (RBAC). Each Active Directory instance for each client is on a separate host. Microsoft Hyper-V segregates virtual machines on the host using a variety of proprietary techniques and continuous learning. This includes strategic host placement to avoid Side Channel attacks. A Side Channel attack occurs when you can determine something about a victim based on the data around the victim, not in the victim itself. The analogy is like determining something about a person based on their shadow. Researchers showed that AWS was vulnerable to a side-channel attack in 2015 where attackers could gain access to VM secrets via cached memory. This has since been resolved and AWS has a completely different architecture with Nitro. The hypervisor provides memory and process separation between virtual hosts. The Azure Fabric Controller securely routes traffic to Azure tenants over the network using network segregation via VLANs. Logical Separation exists between compute and storage. Compute and storage run on separate hardware. Compute accesses storage via a logical pointer. For more details see: https://docs.microsoft.com/en-us/azure/security/fundamentals/isolation-choices
• #10: Virtual machines run on top of the hypervisor. Each virtual machine will run its own operating system and applications can be installed on top of that. Each operating system needs to be secured according to the same best practices as your security teams do internally when you deploy new physical devices. Virtual machines run operating systems you are used to seeing on traditional hardware servers such as Windows and different types of Linux. Amazon has created their own operating system called Amazon Linux which has a lot of things built into it to interact with AWS services. Windows on Azure will have the same type of capabilities. Each of the cloud providers will run the most common operating systems on their platforms. The CIS Benchmarks offer best practices for securing differnet types of operating systems: https://www.cisecurity.org/cis-benchmarks/ However, when security operating systems always refer to the vendor documentation as usually it will have more detail. When you’re using an open source software platform you might not have as much guidance as there’s no single vendor supporting it. Also stay in tune with vulnerability announcements published by the vendor an organizations like CISA: https://www.cisa.gov/uscert/announcements
• #11: Containers are compute instances that package up all the requirements for a particular application and allow you to run the container on a host that runs software that supports containers. The most popular software for running containers that you may have heard of or already use is called Docker. You can create docker containers and install applications on them that run on different emulated operating systems like Ubuntu or Centos or Windows. Then you can run that application in the container on your laptop - regardless of what operating system you are running on your laptop, as long as it and the software installed on it can run a container. Containers have been around a long time though they recently became more prevalent. They were initially part of the Linux operating system. Now containers have been improved and various software to manage them more effectively exists, like Docker. However, Docker is not the only type of container software. Other types of containers include kata containers, CoreOS migrated to RedHat Fedora, Mesos Containerizor, LXC Linux Containers, OpenVZ, containerd and others. Open Container Image Format https://github.com/opencontainers/image-spec/blob/master/spec.md
• #12: You may be wondering - what’s the difference between a container and a virtual machine? They both seem to do the same thing. They run applications in a virtualized software machine instead of on a hardware machine. Each environment is sandboxed and separated from other processes on the machine. Each container and virtual machine can use a different operating system than the underlying host on which it is running. The difference is in the details of how a container is implemented compared to a virtual machine. When you run a virtual machine it has a full copy of an operating system installed on top of it. When an action occurs inside a virtual machine, it is sent to the operating system on that virtual machine. If that virtual machine needs to interact with the physical hardware, it sends the request to the hypervisor, which sends it to the operating system on the host, which then sends it to the hardware. When you run a container, the container does not have a full operating system installed on it. It has just enough functionality to mimic the operating system, and send them through the container management software to be processed by the host operating system. Because containers do not have a full operating system, they are more lightweight. They will be smaller in size, load faster, and potentially run faster. https://blog.aquasec.com/a-brief-history-of-containers-from-1970s-chroot-to-docker-2016 https://www.redhat.com/en/blog/history-containers
• #13: A microservices architecture is a way to create and deploy applications. When I originally wrote this class slide, the concept was pretty new but now it has been around for a while and many organizations deploy applications via microservices. In the past, applications were written as one big blob of code, sometimes in separate files, sometimes compiled, but one big monolithic block of code all deployed together. Within the code, different code blocks called functions or methods were used for different pieces of functionality. The code could also call functions in external libraries (packages of code) which were deployed with the application code. All of this resided on a single computer. If one thing in the application needed to change, the whole application needed to be re-deployed. A microservices architecture breaks the application into smaller pieces. Each piece of the application typically runs in a container (though a container can run any application, not only microservices). Each microservice might perform a specific function within the larger application or architecture. If something needs to change in one function of the application, the container(s) that run that function can be updated and re-deployed independently of the rest of the application. Typically microservices implement Application Programming Interfaces (APIs) which take the place of what used to be functions in code. We’ll talk more about APIs later today. Microservice applications should be written to be horizontally scalable, and resilient so if something fails, the application continues to function until the failed service is restored. Although the text on Wikipedia is editable by anyone and not always the best source to reference, it has many references at the bottom of each page where you can learn more about the topic. This Wikipedia page explains the history of Microservices and has many links that reference more original sources. https://en.wikipedia.org/wiki/Microservices#History
• #14: Developers create Docker images. Docker images are used to deploy containers. The docker image is like a template. The containers are the actual running version of the template. The same Docker image can be used to deploy many containers. When you create an image and want to store and deploy it in an automated fashion, it is often stored in a container registry. Docker offers a public registry called Docker Hub people can use to share docker containers. Unfortunately some of the containers contain extra code that you don’t want in all cases, as we have discussed. Additionally malicious containers are deployed with very similar names to valid containers. Developers may download these by mistake. Consider whether you want to give your developers access to public repositories and in what environments. You probably never want to deploy to production from a public repository. You can also use software like Sonatype (formerly Nexus) and JFrog to store containers. These repositories store more than just containers and offer additional features to help with application deployment security. They allow you to set policies, can scan containers, and create immutable containers that persist between development, QA, and production environments. Docker Hub https://hub.docker.com/ AWS Elastic Container Registry (ECR) https://aws.amazon.com/ecr/ Azure Private Container Registry https://docs.microsoft.com/en-us/azure/container-registry/container-registry-intro Google Container Registry https://cloud.google.com/container-registry/ JFrog https://jfrog.com/ Sonatype (formerly Nexus) https://www.sonatype.com/automate-devops
• #15: Orchestration Software manages containers used by an application. Containers for an application need to be deployed and managed. Some sort of orchestration software needs to run all the containers, monitor them if they fail, and create a new container. Applications generally need multiple containers for each service for reliability and scalability. Containers are deployed in clusters. The number of containers may grow and shrink as application load changes. These are just some of the functions of orchestration software. You’ll get a chance to deploy Kubernetes in a lab tomorrow. Most of the cloud providers deploy and manage the orchestration software for you. AWS has their own orchestration software called Elastic Container Service. All three cloud providers offer a managed Kubernetes service. Docker Swarm https://docs.docker.com/engine/swarm/ Amazon ECS https://aws.amazon.com/ecs/ Kubernetes https://kubernetes.io/ Google Kubernetes Engine (GKE) https://cloud.google.com/kubernetes-engine/ AWS Elastic Kubernetes Service (EKS) https://aws.amazon.com/eks/ Azure Kubernetes Service (AKS) https://azure.microsoft.com/en-us/services/kubernetes-service/
• #16: When implementing a container solution it is important to architect with separation of duties in mind and segregation between different architectural components. Typically container architectures have three different segments: Management plane: where humans interact with and manage the deployment of containers and define how the system should operate. Make sure you do not expose the management plane to the Internet with no security controls in place. This common mistake has led to many breaches involving Kubernetes and Docker where either credentials were exposed or the dashboards and APIs had no credential requirements at all! Control plane: In traditional networking, the control plane defines the route traffic should take, whereas the data plane actually forwards the packets. Container architectures are similar. The control plane typically handles load balancing and routing. Data plane: The data plane is the space in which the containers operate. It is very important to keep this part of the architecture separated in case a container become compromised. That way malware cannot reach the other planes and take over your entire architecture because it can access the parts of the system that control it. Nginx defines their architecture in terms of the management plane, control plane, and data plane: https://www.nginx.com/resources/glossary/control-plane/ Kubernetes only references the control plane, but system architects should take the above into consideration when designing a Kubernetes implementation. https://kubernetes.io/docs/concepts/overview/components/ Docker does not have a lot about control plane and data plane in its documentation at the time of this writing. The SWARM documentation mentions control and management plane together and a separate data plane in terms of service networking. Swarm is the docker orchestration platform but many companies have opted to use Kubernetes instead. https://docs.docker.com/engine/swarm/networking/
• #17: When creating applications on Azure a three-tier architecture is still beneficial because you can monitor traffic between tiers for suspicious behavior. Continue to use a defense in depth model that allows you to not be dependent on a single security control to protect your data. Weed out the noise from the Internet at the Web tier and then you’ll have less traffic between your application and data tier to manage and monitor. Some newer JavaScript UI frameworks do not lend themselves easily to this model but it can be done! https://docs.microsoft.com/en-us/azure/architecture/reference-architectures/n-tier/n-tier-sql-server
• #18: Typically security teams can monitor traffic logs such as host-based traffic logs and logs on network security appliances. Then along came containers. Those types of logs wouldn’t have visibility into container to container traffic. A host-based firewall is generally looking at traffic coming into and going out of the host. The network based logs look at the traffic as it traverses network security appliances. In order to obtain visibility into container to container networking the term service mesh evolved. Docker offers a number of different networking options for different use cases. Note that some networking options offer zero host isolation, meaning any container on the same host can access other containers on the same host via networking capabilities. Would you be able to see unwanted traffic in that case? We’ll look at options for container monitoring on an upcoming slide. Also note that most cloud providers block the macvlan option. https://docs.docker.com/network/ https://docs.docker.com/network/iptables/ Note that you can also disable networking for a container, though not sure there are a lot of use cases for this option. Perhaps the container stores data to disk of the machine on which it resides but we will see how access to the file system may be problematic if not configured correctly. A container that can access the root folders can essentially take over the host. https://docs.docker.com/network/none/
• #19: When Kubernetes was developed, it seems that the goal was to optimize use of compute, vs. a security focus. There was not a good way (if any way) to monitor network traffic between instances, restrict network traffic externally to a node, and handle certain types of traditional security functions and logging. Also, when you block network traffic between hosts, you can do that on the host itself. The same is true for a container. You can allow and disallow traffic within the container. There are problems with this approach. If you allow developers to configure the container and they don’t understand networking you’re going to end up with wide open containers. The author worked on networking for Capital One and led other teams deploying networking in the cloud and has seen this happen with every kind of networking. It’s not malicious. It’s simply trying to get the job done and not sure why everything is breaking or what ephemeral ports or protocols are. Additionally if malware gets on the container and has enough privileges, it can simply open the ports it needs and wants. It can potentially then communicate with other nodes on the same host or even over the network. Kubernetes is designed to deploy all types of different services on the same host. It optimizes where it places containers to maximize your compute usage. This can save you money in a cloud environment. It was not designed however, to be very strict between containers on the same host, encrypt traffic between containers, or provide visibility for all the traffic between the containers - initially. In contrast when you deployed a node in an AWS ECS cluster, you can deploy each service to a separate host. You might lose some money on wasted compute but you can restrict access easily between different services. Now you can also deploy a security group on a “task” which is the AWS term for a container running on ECS. These security groups provide network traffic visibility as we demonstrated in the last lab yesterday. Over time people wanted a better solution. This is how the sidecar pattern evolved. Lyft created a solution called Envoy that leverages this sidecar pattern. Envoy acts as a proxy that provides visibility between containers, encrypts the traffic, and more. What is Envoy: https://www.envoyproxy.io/docs/envoy/latest/intro/what_is_envoy Here’s a good blog post for those who want to dig into the details of how this works: https://www.datawire.io/envoyproxy/getting-started-lyft-envoy-microservices-resilience/ This is an interesting article on using Envoy with containers on Azure. At the time of the writing you could not use an Azure Load Balancer with containers deploy to a private network. https://medium.com/microsoftazure/load-balancing-azure-container-instances-with-envoy-4daf1f4c378c Azure Container Apps uses and Envoy Proxy: https://learn.microsoft.com/en-us/azure/container-apps/networking
• #20: The cloud offers a very useful function in that you can trigger actions in your cloud account based on events that occur. For example, a security event might trigger an automated incident response process. A misconfiguration might trigger an auto-remediation. A batch job may be scheduled at a particular time or in response to a file upload to an Azure storage account. Two types of compute resources that may be triggered based on events are Azure Functions and Azure Batch. These compute resources are triggered to run code in response to a particular event. The compute resource will run until the job is complete and then stop. You pay for the compute resource while it’s running. Azure Functions: https://azure.microsoft.com/en-us/services/functions/ Azure Batch: https://azure.microsoft.com/en-us/services/batch/
• #21: Entire applications are built with serverless functionality and components. In this model, the cloud provider handles a lot of the underlying security of the managed services. Security teams need to understand the security controls for each component and configure them with zero trust principles in mind. Each component should only have access from and to other required components. Limit Internet access as much as possible. Keep traffic on the cloud platform and within private networks where possible. Ensure data is encrypted in transit and at rest. https://docs.microsoft.com/en-us/azure/architecture/reference-architectures/serverless/web-app
• #22: The flowchart on this slide from Microsoft explains when to use each of the different types of compute resources available on Microsoft Azure. We’ll go over a number of these services in class today. https://docs.microsoft.com/en-us/azure/architecture/guide/technology-choices/compute-decision-tree
• #23: Azure Service Fabric https://docs.microsoft.com/en-us/azure/service-fabric/service-fabric-overview Azure Spring Cloud https://docs.microsoft.com/en-us/azure/spring-cloud/overview Azure Red Hat Openshift https://docs.microsoft.com/en-us/azure/openshift/intro-openshift Azure Kubernetes Service (AKS) https://docs.microsoft.com/en-us/azure/aks/intro-kubernetes
• #24: Some organizations have a lot of processes built up around VMware. They may have secure base images used by developers for applications. Some companies may have virtual developer workspaces, access, and backup processes and procedures that they are used to using. Companies may have security standards built around VMware virtual machines as well. To drop all of this and switch to cloud provider virtual machines is not always a quick or easy process. They may have also invested a lot of money into VMware products. For these companies a lift-and-shift of their existing VMware infrastructure to the cloud may be easier. Microsoft offers this option. When using this option companies need to determine where the line gets drawn on the shared responsibility model chart. At one point do the cloud provider’s responsibilities end and the customer’s begin? The customer will have more responsibility in this case to manage the security of their virtual machines as VMWare virtual machines are typically deployed and backed up using VMWare management tools to which the customer may have access but not the cloud provider. https://docs.microsoft.com/en-us/azure/azure-vmware/introduction
• #25: Azure offers container-specific services. For these offerings the customer manages less virtual infrastructure compared to hosting applications on virtual machines. A tradeoff exists between less control and less to manage. Again, customers need to understand where the line is drawn on the shared responsibility chart. Generally, anything a customer can change or access is their responsibility. https://azure.microsoft.com/en-us/products/category/containers/
• #26: Besides the base compute services many other services are built on top of these compute services to create different types of specialized services. With each of these different services customers have more or less access to the underlying infrastructure. With all of these services customers need to understand the security best practices which generally include the following: IAM Networking Encryption and data protection Logging and monitoring For each service, review the security recommendations, best practices, and settings and consider the threat model and attack surface.
• #27: On day one we discussed different types of security principles: Users, Groups, Service Principles and Managed Identities. There were two types of service principals that you can associate with resources and services in your account to allow them to take actions on your other cloud resources and Azure account. Service principles allow you to maintain control over a security principal. For example, you may want to create and reuse a particular service principal associated with an application. In this case, you would need to grant permissions, manage the lifecycle of the service principal, create and securely store and manage any credentials and delete the service principal when it is no longer needed. With a managed identity the identity is created and associated with a resource. When the resource gets deleted, the associated identity is deleted along with it. We created a managed identity in the last class and granted it permissions to access a storage account. We also gave it permission to use the key associated with the storage account that we created in key vault to encrypt and decrypt the data. https://docs.microsoft.com/en-us/azure/active-directory/managed-identities-azure-resources/overview
• #28: If you recall, we associated a managed identity with our storage account in the last class. If you followed those steps you can return to the storage account and you’ll be able to see the managed identity by clicking on Azure role assignments on in the left menu. Here you see that the managed identity has specific permissions for this specific resource. We’ll use this managed identity later today in with some of the compute resources we’re going to create.
• #30: This slide contains a few tips for securing your virtual machines. Whole classes and books exist on best practices for security operating systems so consider this a bare minimum. Refer to the CIS Benchmarks and other best practice resources for more detailed information specific to your particular operating system. You can also try out operating systems designed to be more secure like SELinux or immutable operating systems like Silverblue and Clear Linux. Limit services. Why do I need print spooler running on a VM? Any service running on your system could be leveraged in an attack, especially if it is accessible via the network or has elevated privileges. When exposed to the network, attackers will scan from other machines looking for services. When they find your service exposed they will try to attack it. Additionally some malware injects malicious code into a running process so as not to be discovered when someone is investigating the list of services on a machine. If you don’t need it, turn it off. Patch! Keep all software up to date. One of the most common ways attackers get onto your machine or gain elevated privileges after the obtain access is by leveraging out of data software. Least privilege for users and applications in VM configuration. If something doesn’t need to be running as an admin, or a person doesn’t need admin privileges on a machine, remove them. Use Roles or Service Accounts for applications and cloud resources that require permissions to do things in your cloud environment. AWS roles automatically rotate credentials periodically, so if stolen they will not be active for very long. No secrets on host - in file system, environment variables, registry. Secrets where they should not be is one of the most common flaws in cloud configurations that leads to a security incident. We’ll explain how to access secrets more securely in future sections and a lab. As mentioned, use AWS roles instead of putting AWS developer credentials on a host. Do not store your database credentials, etc. on the host or in environment variables, registry, or anywhere else on the machine. Access from a secure, encrypted, authenticated repository. Ship logs to permanent storage - cloud virtual machines are ephemeral. Ephemeral means after you shut them down, they are gone. Make sure you ship logs to a more permanent location and secure the logs so they are not accessible to prying eyes. Network configuration on the host - lockdown access to the instance metadata service if not required. Host based network controls may not be practical in a base image unless the rules are applicable to every host. You may employee host based firewall rules to prevent access from the cloud to your host, however the cloud provider hypervisor based networking may also serve some of that purpose. If you think the hypervisor could be compromised, then you can employ host based firewall services as well. The network configuration on the host itself could be changed by malware or an attacker who obtains elevated privileges, so best to start with network security outside the host. CIS benchmarks provide more specific guidance as does other documentation and security frameworks. Each operating system has a myriad of controls that differ due to the unique configuration of each system. Refer to specialized documentation and guidance for your operating system. https://www.cisecurity.org/cis-benchmarks/ Microsoft VM security best practices: https://learn.microsoft.com/en-us/azure/virtual-desktop/security-guide
• #31: When securing VMs or anything else in the cloud, you need to understand which aspect of security you own vs. what the cloud provider responsibilities are. Microsoft provides the chart on this slide to outline which aspects of cloud security belong to them and which belong to their customers. https://learn.microsoft.com/en-us/azure/virtual-desktop/security-guide
• #32: Microsoft offers a list of VM security best practices, some of which involve use of additional Microsoft products and services that will cost more. We will cover some of these in upcoming slides. You can read more about all of these items in this documentation. https://learn.microsoft.com/en-us/azure/virtual-desktop/security-guide Some additional security features for Azure VMs are listed on this page: https://learn.microsoft.com/en-us/azure/security/fundamentals/virtual-machines-overview Best practices for IAAS Workloads https://learn.microsoft.com/en-us/azure/security/fundamentals/iaas
• #33: Launch virtual machines in Azure and use them like you would a physical machine. You can run log into them and run applications on them. In order to understand the security options for a virtual machine we’ll walk through the process of creating one and look at the associated options. Search for virtual machines in the Azure portal. Click +Create and create an Azure virtual machine.
• #34: Creating a virtual machines involves multiple steps. The first step is named Basics and that screen is shown on this slide. You could technically fill out the basics and potentially launch a virtual machine. However, we are going to go through all the options and look at what security controls can be applied.
• #35: As always fill out the standard information: Subscription to which the machine will be billed, a resource group, a name, and a region. One caveat here is that you need to choose a region that has capacity for your machine and supports the options you want to use. It could be that by default your account is not configured to allow you to use a particular region. The other option is that you need to be within your limits in terms of the number of virtual machines you are allowed to create in a particular region. Check out the next slide to understand quotas.
• #36: Next you can choose whether or not you want to deploy your VM in an availability zone. Recall from day 2 that an availability zone is basically a data center. If you want your application to be highly available you design it so that it runs in two separate data centers. If one data center has an issue and your virtual machine in that data center is affected then the virtual machine in the other data center will be available and keep your application up and running. Shifting traffic to the available VM will require a network load balancer, traffic manager, or CDN like we discussed on day two. We’ll talk about some other options today. Not all regions have an availability zone so you’ll need to choose an appropriate region and virtual machine to use this option. https://docs.microsoft.com/en-us/azure/virtual-machines/create-portal-availability-zone
• #37: The next option is security type. You can choose from three options at the time of this writing. The first option is the standard security offering. By default Microsoft encrypts virtual machines and provides some basic security. Azure provides two other options covered on the next slides. See next slides for more on VM Security types (trusted launch and confidential virtual machines)
• #38: Trusted Launch Virtual Machines: Requires certain VM sizes and operating systems - see documentation for details. Certain features are not supported: Azure Site Recovery Shared disk Ultra disk Managed image Azure Dedicated Host Nested Virtualization https://docs.microsoft.com/en-us/azure/virtual-machines/trusted-launch
• #39: Azure offers a number of different confidential computing options. You can use a TEE for an entire VM or with a specific Application on the VM. In the past you would have to use libraries to setup and manage confidential computing yourself. Now Azure is offering more and more managed confidential computing options for serverless, containers, and databases. You can learn more about confidential computing options in this video: https://www.youtube.com/watch?v=ds48uwDaA-w&t=241s Note that the above ability claims “encryption in use” but that is not exactly accurate. It is unencrypted while processed in an enclave which is validated through cryptographic attestations and protected through hardware segregation. If you want true encryption in use, consider homomorphic encryption, however it is not really applicable to large data sets and can process limited data types. https://learn.microsoft.com/en-us/azure/architecture/solution-ideas/articles/homomorphic-encryption-seal
• #40: Confidential computing was mentioned at the end of the last class. Microsoft was the first cloud provider to offer the concept of confidential computing. Applications run in trusted enclaves. Data remains encrypted within the machine and within memory except when in the trusted enclave where an application running in that enclave can view and process it. From the documentation: Enclaves are secured portions of the hardware's processor and memory. You can't view data or code inside the enclave, even with a debugger. If untrusted code tries to change content in enclave memory, SGX disables the environment and denies the operations. These unique capabilities help you protect your secrets from being accessible in the clear. Confidential Computing requires a specific type of virtual machine since this option requires specialized Intel hardware. You’ll notice the option was greyed out when we were creating our virtual machine and selecting security type. The options on the virtual machine creation page are a bit backwards because you select the virtual machine size and type after you select your security option on the screen. https://docs.microsoft.com/en-us/azure/confidential-computing/confidential-computing-enclaves How to deploy: https://docs.microsoft.com/en-us/azure/confidential-computing/virtual-machine-solutions-sgx Develop an enclave-aware application: https://docs.microsoft.com/en-us/azure/confidential-computing/application-development
• #41: About confidential VMs (includes supported instance types and operating systems: https://learn.microsoft.com/en-us/azure/confidential-computing/confidential-vm-overview OS disk encryption - Higher cost: https://azure.microsoft.com/en-us/pricing/details/managed-disks/ Attestation includes: A signed attestation report issues by AMD SEV-SNP Platform boot settings Platform firmware measurements OS measurements https://github.com/Azure/confidential-computing-cvm-guest-attestation For some considerations if you’re considering Azure Confidential VMs, check out this blog post: https://medium.com/cloud-security/azure-confidential-vms-fb820899885a
• #42: When you deploy a virtual machine on Azure you choose a machine image. The machine image contains the operating system configuration and can also include pre-configured applications. When you choose an image you can choose from the Microsoft standard images, images provided by others from the Azure marketplace, and you can also create your own image. Organizations can create their own images to ensure that their employees are using a machine configured according to their security standards. In other cases, a pre-configured machine might come with a set of tools for a specific project or task. For example, 2nd Sight Lab creates machine images that contain required penetration testing tools to perform a penetration test. Then we can launch images that have all our tools built in for each test. https://docs.microsoft.com/en-us/azure/virtual-machines/linux/cli-ps-findimage https://docs.microsoft.com/en-us/azure/virtual-machines/linux/imaging https://docs.microsoft.com/en-us/azure/virtual-machines/windows/prepare-for-upload-vhd-image
• #43: You can use spot instances to save money. Check spot instances and then some additional options show up. Save money by entering the maximum price you are willing to pay for a VM. Note that the VM will either stop or terminate when capacity is no longer available at that price. You might not be able to launch a VM if you don’t bid high enough. Check the documentation for all the options and details. https://docs.microsoft.com/en-us/azure/virtual-machines/spot-vms
• #44: Azure offers different types of machines optimized for different purposes. These different options are known as the “machine size.” When you create a VM choose the appropriate machine size for the application you are building. For example, certain applications are CPU intensive and others require a lot of memory. Different sizes will cost different amounts of money. They will have different processors, number of processors, and amount of memory among other things. The machine size options at the time of this writing are shown on the slide and more details can be found in the documentation: https://docs.microsoft.com/en-us/azure/virtual-machines/sizes
• #45: I had some problems creating VMS for a while. Sometimes the options you want do not exist in a region or availability zone - or at all. https://medium.com/cloud-security/when-the-cloud-runs-out-of-vms-532516abb01c
• #46: In this particular case, clicking on the See all sizes link presents a screen with no available sizes for the operating system, region, and availability zone selected.
• #47: Click the down arrow for a section on the screen to see the VMs in it. Click the X at the top right to close this screen and return to the create VM screen. Let’s try some other options.
• #48: Through the process of trial and error, we can see that we also cannot create this VM in this size in East US 2. We aren’t allowed to create virtual machines in Southeast Asia. As it turns out we are allowed to create this VM operating system and size in Southeast Australia. Why can’t we create this VM in East US or East US 2? It could be an issue with quotas. Let’s take a look at the Quotas in our account.
• #49: Let’s take a look at the quotas for our account. For each Azure service you are limited to deploy a certain number of resources. You can see what your limits are by navigating to the quota section of the Azure portal. Search on quota. On the next screen that shows up click compute. https://docs.microsoft.com/en-us/azure/azure-resource-manager/management/azure-subscription-service-limits
• #50: The quota list is quite long because it covers all possible regions and services. Filter it by the region you want to create resources in by clicking on region at the top and checking the appropriate region or regions.
• #51: On the quota screen you can see a list of services, features, and their respective options. Here it shows that this account can create 25,000 virtual machines in the East US region. This account can create 10 virtual machines of the size family Dv2 in the selected subscription. Note that the adjustable column indicates limits the customer can adjust themselves and those that require a support request to change. You can click the link or icon in that column to make or request a limit adjustment.
• #52: This screen shows that we should have availability in this region for this instance size, but for some reason it’s not showing up. What’s the problem?
• #53: Eventually this was resolved, possibly in part due to my blog post on the topic, but it has happened before and could happen again, so be aware and plan accordingly. You may want to have your legal department review the contract you have with Azure and any relevant service level agreements (SLAs). If you expect to get compensation while Azure is unavailable you will need to understand the legal implications of the SLA and ensure you are following any requirements for the SLA to apply to your case. https://medium.com/cloud-security/when-the-cloud-runs-out-of-vms-532516abb01c
• #54: In a region where you have available instance types you can request a quota increase directly from the size list. You can put in a support request to get access to another region or increase your limit in that region: https://docs.microsoft.com/en-us/troubleshoot/azure/general/region-access-request-process
• #55: For this example, we selected a Windows operating system. Different options would appear if creating a Linux VM such as creating an SSH key to access the VM.
• #56: Note that you can open port 3389 for RDP on this page. However, heed the warning. This option will open the port for any IP address on the entire Internet. There’s a warning on this page as well. Choose the None option as we can create more specific rules under the networking options.
• #57: Next choose the appropriate OS disk type. The selection will depend on your application and architecture requirements.
• #58: Choose whether to delete the disk when the VM terminates. If you’ve automated your deployment and can recreate the VM completely from scratch then you can delete the disk with the virtual machine. Logs should be shipped to permanent storage since disks may be deleted on termination. You might opt to keep the disk if the VM terminates. Beware of orphaned disks in that case and consider how you will track them and the data they contain. Unattached disks will also incur storage costs. Another option here is Encryption at host. Without this option, your disk data gets encrypted when it reaches the Azure storage service. With encryption at host, the data is encrypted by the server running the VM and then send in its encrypted format to the storage service. It’s a good idea to use end-to-end encryption wherever possible. https://docs.microsoft.com/en-us/azure/virtual-machines/disk-encryption This option is not currently enabled in this account. Follow these instructions to turn on this feature: https://docs.microsoft.com/en-us/azure/virtual-machines/disks-enable-host-based-encryption-portal
• #59: Before you can use end-to-end encryption you’ll need to enable it in your account. This slide shows the command to do that. It will take some time for this feature to become available. Check to see when it is available using the second command. Once the feature is enabled you can check the box to enable it on your virtual machine. https://docs.microsoft.com/en-us/azure/virtual-machines/disks-enable-host-based-encryption-portal
• #60: The next encryption options drop down offers three options for disk encryption at rest. Choose to encrypt the data with the default Microsoft encryption (Microsoft managed key or MMK) Choose to encrypt with a customer managed key (CMK) created in key vault. Choose double encryption to use both. The latter two options will incur additional fees and the last option may have performance implications. Additionally, before you can use one of the latter two options you’ll need to create a Disk Disk Encryption set. https://docs.microsoft.com/en-us/azure/virtual-machines/disks-enable-customer-managed-keys-portal https://docs.microsoft.com/en-us/azure/virtual-machines/disks-enable-double-encryption-at-rest-portal
• #61: This slide shows the encryption process with encryption sets. The process for enabling disk encryption involves creating an encryption set that uses a key vault and key in the region with the resources you want to encrypt. The identity associated with the encryption set needs permission to access and use the key in the key vault. Then configure the VM to use the encryption set. https://docs.microsoft.com/en-us/azure/virtual-machines/disk-encryption
• #62: In order to use an customer managed key first create a Disk Encryption Set. The process is fairly straightforward as shown on this screen. Note that because we cannot create a VM in our region of choice, we have to create a key vault and encryption key in the proper region for this application.
• #63: Click on Go To Resource to go to your encryption set. Click on the error and permissions will be automatically assigned. Note that on this slide the key vault exist in East US. This won’t work with a VM created in a different region.
• #64: Once you have the key vault, key, and encryption set with permissions assigned to the associated managed identity, you can select it on your VM. You might need to click over to Microsoft managed encryption key and back to customer managed key to get the option to show up. Here you can select your encryption set.
• #65: To encrypt boot disks and data disks on the command line use the VolumeType parameter on the Set-AzVMDiskEncryptionExtension command. Linux: The VolumeType parameter is required when encrypting Linux virtual machines, and must be set to a value ("Os", "Data", or "All") supported by the Linux distribution. Windows: The VolumeType parameter may be omitted, in which case the operation defaults to All; if the VolumeType parameter is present for a Windows virtual machine, it must be set to either All or OS. https://docs.microsoft.com/en-us/powershell/module/az.compute/set-azvmdiskencryptionextension
• #66: Default encryption will limit anyone who does not have permission to your Azure account from decrypting data. Unfortunately, anyone with access to the account could attach a backup of a disk or a detached disk to a VM and read the data using a default microsoft managed key. A better approach would be to encrypt disks with your own managed keys. Limit access to use the keys when dealing with sensitive data. Even if someone has access to your storage account, backups, and VMs they would not have access to attach the VM and decrypt the data if they do not have permission to use the decryption key.
• #67: Encryption is not supported for every type of virtual machine. Ensure you test virtual machine encryption for your application and base image early in the process and chose a configuration that meets your security requirements. https://docs.microsoft.com/en-us/azure/virtual-machines/linux/disk-encryption-faq
• #68: Instead of opening up the administrative port to the entire Internet, you can choose a specific network security group (NSG) on this screen and open the required ports only for the necessary IP addresses. This is a more secure approach. Better yet, restrict the access to a private network using a VPN or Azure Express Route. You could also create a bastion host and log into the VM from a bastion host instead of allowing direct access from the Internet.
• #69: Next come the management options shown on this screen. Boot diagnostics OS guest diagnostics System managed identity Login with Azure AD Enable Auto-shutdown Enable hotpatch Manual or automatic updates Mangual or automatic options gives you control over updates if you want them. Otherwise you can let Azure automatically apply updates. We’ll look at a few of the other options in more detail on the upcoming slides.
• #70: Boot disk diagnostics help troubleshoot why a virtual machine won’t boot. https://docs.microsoft.com/en-us/troubleshoot/azure/virtual-machines/boot-diagnostics OS guest diagnostics help monitor metrics from the operating system on the virtual machine. You’ll need to install an extension on your machine and configure this option to send diagnostics from the operating system to the Diagnostics storage account. https://docs.microsoft.com/en-us/azure/virtual-machines/windows/extensions-diagnostics https://docs.microsoft.com/en-us/azure/virtual-machines/extensions/diagnostics-linux
• #71: Here you can choose to allow Azure to create a system-managed identity as explained earlier. The identity gets created with the VM and will be deleted when the VM terminates. Permissions can be assigned to the identity to allow applications and scripts on the VM to take actions on the cloud platform. Enable login with Azure AD to allow logins using Azure user accounts. Auto-shutdown allows you to set a time to automatically shut down a virtual machine. Get a notification prior to the shutdown at the specified email address.
• #72: Last comes the advanced options. Azure VM Extensions: Add additional functionality to Azure VMs. Refer to the documentation which explains how to query the available extensions for Linux and Windows. This is something security professionals may want to be aware of to understand exactly how VMs are configured and may be altered. https://learn.microsoft.com/en-us/azure/virtual-machines/extensions/overview VM Applications: Instead of packaging all your applications on a VM, you can let Azure install and update them using VM Applications. https://learn.microsoft.com/en-us/azure/virtual-machines/vm-applications Script Execution When a VM starts you may want to execute a custom script. You may also want to limit this functionality and use immutable images to ensure malware or unwanted code or vulnerabilities cannot be injected at this point. Host groups, capacity reservations and placement groups are covered on an upcoming slide.
• #73: Azure offers extensions that can be added and configured at time of deployment. Click the extensions link to see available extensions. Review extensions to ensure they come from a trusted source. Consider any threats associated with the additional functionality added to the host. Also test for any performance issues. https://docs.microsoft.com/en-us/azure/virtual-machines/extensions/overview
• #74: Sometimes you want to execute a script when a virtual machine is starting up, or you may want to pass a script into a virtual machine that can be accessed while it is running. For example, you may have a VM specific script that is generated once the machine’s domain name or IP address becomes available. These types of scripts and configuration files can be inserted using custom or user data. Various mechanisms exist for running scripts on VMs that security professionals of which security professionals should be aware: Custom script extension Run command Hybrid Runbook Worker Serial console https://learn.microsoft.com/en-us/azure/virtual-machines/windows/run-scripts-in-vm
• #75: Host groups are collection of dedicated machines. This is a more expensive option than than the multi-tenant option. Check the price! https://docs.microsoft.com/en-us/azure/virtual-machines/dedicated-hosts Capacity reservation groups allow you to reserve capacity for future use. As shown in today’s slides you might run into a situation where you cannot create a virtual machine in your region of choice due to limited availability. https://docs.microsoft.com/en-us/azure/virtual-machines/capacity-reservation-overview Proximity placement groups allow you to create virtual machines close to each other. In some cases, machines need to be close to reduce latency and for faster performance. https://docs.microsoft.com/en-us/azure/virtual-machines/co-location
• #76: Tags are often used to track and categorize resources in cloud environments. Sometimes they are used for cost-allocation or inventory-tracking. More on tags when we cover governance, but this screen shows how you can add a tag to a virtual machine. A tag is a key-value pair. The key is like a label and the value is the value associated with the label. https://docs.microsoft.com/en-us/azure/azure-resource-manager/management/tag-resources
• #77: You might get an validation error when you are creating a new virtual machine. Click on the error message to view the details of the error.
• #78: Once validation passes you should be able to create your virtual machine. Notice that you can click on the link to view a template associated with this resource. You could use that template to automatically deploy another resource with the same configuration in the future. We’ll look more at these templates - called ARM or Azure Resource Manager templates in the next class in more detail.
• #79: You can review all the details for your virtual machine before you launch it.
• #80: When the virtual machine is deleted, make sure to delete any unnecessary resources unless they are required once the VM terminates. These extraneous resources may be used inappropriately, exposed, or at a minimum may incur additional costs. Someone could attach a disk, IP address, or network interface attached to a sensitive subnet to a different VM in the future.
• #81: This series of slides shows that there are many security considerations when creating a virtual machine on Azure. Organizations need to define policies and procedures to define how they want to deploy virtual machines to minimize configuration mistakes and errors.
• #82: Any code or scripts, or a person at a command line prompt on a virtual machine can do anything that a virtual machine can do. The following documentation explains who to obtain an access token using different types of code on a machine with an assigned managed identity or service principal. Once an application or user has an access token they can use the token to make requests to the Azure platform to take actions on the associated account. That means if an attacker can obtain access to a virtual machine by way of an application they may be able to obtain the credentials to take whatever actions the VM is allowed to perform. Virtual machines have a service running on them called the metadata service. This service returns information about the machine on the non-routable IP address 169.254.169.254. This IP address can also be used to obtain the machine credentials by making a curl request to it in the appropriate format as shown on the slide. https://docs.microsoft.com/en-us/azure/active-directory/managed-identities-azure-resources/how-to-use-vm-token
• #83: The same command you can run on a VM to run commands that the VM is allowed to perform can be executed in the Azure shell.
• #84: Once an attacker or rogue user has an access token they can perform any action that the token is allowed to take on the Azure platform. As mentioned previously every call on Azure is an API call. The following documentation explains how to make API calls using an Oauth token and all the actions for services on the platform. https://docs.microsoft.com/en-us/rest/api/azure/
• #87: Use Azure Availability Sets to improve application availability. By configuring these settings you can improve uptime and resiliency. Ensure a power outage doesn’t impact all your VMs. Esure all your VMs for an application are not updated and rebooted at once. https://learn.microsoft.com/en-us/azure/virtual-machines/availability-set-overview You need to deploy your application with two or more VMs with an availability set to meet the 99.5% SLA. https://azure.microsoft.com/en-us/support/legal/sla/virtual-machines/v1_9/
• #88: Think of fault domains like racks in a data center. You’ll want to have machines in different racks that use different power sources and network equipment. That way if one particular power source or switch goes out you’ll still have machines running in that data center.
• #89: As always search for the service you want to use. In this case search for availability set. Click on the service. Click +Create.
• #90: This screen probably looks very familiar at the beginning. Choose your subscription, resource group, name and region. Then you have various options for configuring the fault and update domains. You’ll typically want to use managed disks. Under the advanced tab you can choose a placement group to keep virtual machines located physically close to one another. Click Review + create.
• #91: This slide shows the details blade for an availability set and some of the menu options.
• #92: You can select Availability set from the list of Availability options. Then you can select your new availability set. You’ll need to wait for it to show up and also have the appropriate permissions to use it here. Alternatively, you can create a new availability set.
• #93: On the VM details scroll down to Availability + scaling. Note that the availability set is not shown here. However, if you click on Availability + scaling you’ll see that this VM is in an availability set. You can click on the Availability set name to navigate to the AS.
• #94: To see the VMs in your availability set click on virtual machines in the left menu.
• #96: Virtual machine scale sets are a logical group of machines that can be managed together and used to scale and maintain a highly-available application. You can configure a scale set to increase or decrease the number of machines in the set based on a schedule, or based on the application load. You can use a scale set in conjunction with an Azure load balancer or application gateway. Recall that we discussed Azure load balancers on day two of class. These are network load balancers that act on traffic at layer 4 of the OSI model. An Application Gateway operates at layer 7 and we’ll cover those next. https://docs.microsoft.com/en-us/azure/virtual-machine-scale-sets/overview
• #97: Uniform Orchestration mode Template to scale up All the VMs are managed as a group https://learn.microsoft.com/en-us/azure/virtual-machine-scale-sets/virtual-machine-scale-sets-orchestration-modes Flexible orchestration mode Can manage VMS independently as standard VMs Some VM SKUs are not supported https://docs.microsoft.com/en-us/azure/virtual-machines/flexible-virtual-machine-scale-sets
• #98: A software load balancer works in the same way. All the cloud providers offer a load balancer that can function like a hardware load balancer, and considering adoption rates, this seems to be working well enough for most companies. One company moved off of physical F5 load balancers and saved a significant amount of money in the cloud - but he was very conscious of and monitoring costs, and adjusting everything over time to optimize for cost-savings. This requires some effort! Each of the cloud providers offers load balancers at layer 4 and layer 7 in the OSI Model. If you recall layer 4 would be sending raw TCP or UDP packets for example. At layer 7 you would be getting packets fully reassembled into web requests and responses at the application layer. The different load balancers handle requests at each layer based on the type of data they receive, and send the requests to the appropriate place.
• #99: Vertical scaling means when an application needs to grow, a larger server is purchased, and the application is deployed to a larger host machine. This causes many problems. A single monolithic node supporting all application functionality means that when the application goes down, the whole application goes down. If the application needs to be updated, it could be that the entire application needs to be taken down to perform the update. If the application crashes, the whole application may be taken out. If the application has a performance issue, the entire application and all customers may be impacted. In contrast, a horizontally scaling application will add additional nodes to support the load, instead of a bigger server. The application must be designed to process requests and data across multiple nodes in a distributed architecture. If the application needs to be updated, one node can be updated at a time. If well designed, failure of one node will not affect the functionality of the application for most customers.
• #100: In addition to load balancers, your servers are no longer physical machines, limited to a maximum of say, 5 physical servers in your data center. If one of your servers failed, you would be limited to four servers until the fifth one was fixed. No more thanks to scale sets! Scale sets define how many minimum and potentially maximum servers you want behind a load balancer at any given time. Then you provide the machine image and configuration you want these virtual machine to have when they are created by the autoscaling group. When a machine fails, the machine will be removed from the scale set and a new virtual machine will be created using the image and configuration you provided to the scale set. In addition, if the load to your application grows, the scale set will create new virtual machines. As the load as reduced, machines will be terminated. This is a horizontally scaling, distributed architecture. https://learn.microsoft.com/en-us/azure/virtual-machine-scale-sets/overview
• #103: We discussed the following types of load balancers on Day 2: Azure Load Balancer is a layer 4 load balancer discussed on Day 2. Sometimes this is referred to as a “network” load balancer. The load balancing occurs at a lower network layer in the OSI model. Azure Front Door, a Layer 7 is a load balancing for HTTP/S, HTTP/2 Workloads. Traffic Manager is a DNS-based load balancing option. Today we’ll cover Application Gateway which handles traffic at the application layer - layer 7. This slide covers the load balancing options and when to use each one. You can use load balancers in conjunction with scaling sets to create highly-available, scalable applications. https://docs.microsoft.com/en-us/azure/architecture/guide/technology-choices/load-balancing-overview
• #104: Azure application gateway operates at the OSI model application layer instead of the network layer. It routes traffic using information found in HTTP requests such as the URI and host headers instead of traffic data in lower layer packet headers like IP addresses, ports, and protocols. https://docs.microsoft.com/en-us/azure/application-gateway/overview Comparison of SKU1 and SKU 2: https://docs.microsoft.com/en-us/azure/application-gateway/overview-v2#differences-from-v1-sku The Azure Application Gateway is a service that offers a WAF, Autoscaling, end-to-end SSL and layer 7 routing. An Application Gateway can support up to 100 web sites at the same time. https://docs.microsoft.com/en-us/azure/application-gateway/how-application-gateway-works
• #105: SKU: Choose a SKU. Note some of the options changed based on your selection. Autoscaling: the Application Gateway and WAF v2 SKUs scale out or in based on application traffic requirements. With this support, you no longer need to choose an instance count or size when deploying Application Gateways.
• #106: When you choose different SKUs you can see different options that you will need to configure for each type of SKU. Dive into the details of the SKU documentation for details.
• #107: Application Gateway receives traffic from an external source such as the Internet or another network or subnet. It receives the traffic at a particular IP address or IP addresses on the frontend. On the backend the service can redirect the traffic to a number of different types of targets. IP or FQDN: Traffic gets directed to another IP address or domain name. Virtual machine: Direct the traffic to a specific machine that can handle the request. VMSS: Virtual Machine Scale Set App Services: An application hosted on Azure App Service More on Azure App Service later in class.
• #109: We’re not going to dive too deeply here into routing rules but note that developers or application gateway administrators can redirect requests to different sources - including external URLs. As a security professional, you’ll want to consider what could go wrong if someone has access to change routing rules and how you will address it. We’ll talk about automated deployments and how they can help in an upcoming class.
• #110: Troubleshooting load balancers can become very tricky. Many configuration options exist both on the Application Gateway, the hosts and the network that need to be aligned for applications to work properly. Turn on monitoring on each layer and component involved.
• #112: A web application firewall (WAF) is designed to block attacks at layer 7 in the OSI model. This type of protection is designed to specifically thwart attacks against web servers sent via the HTTP protocol. In order to defend against an attack in HTTP traffic, the packets need to be sent through all the other networking layers up to layer 7, and then reassembled before they are sent to the WAF, which inspects the HTTP request for malicious content. If no malicious content exists, then request is forwarded to the web server. Some types of attacks that a WAF can block include malformed HTTP request. For example, not following the HTTP specification and leaving off a space at the end of the HTTP request can cause some web servers to hold requests open. A number of these can cause a server to become overloaded and fail. This is known as a slowloris attack. Other types of attacks might be things like Cross-Site Scripting and SQL Injection attacks which are part of the OWASP top 10 website programming flaws. We’ll learn more about those on Day 5. In order to determine if the request has those attacks in it, the HTTP request needs to be reassembled and parsed. WAFs can also block malicious IP addresses and domain names, but is this really the best place to block that type of attack?
• #113: If you think about the OSI Model when a network packet passes through various network devices, they may handle packets individually. In some cases they have to put the packets back together to analyze them. In the case of an IP address, those can be blocked all the way down at layer 3. That’s a long way before layer 7. If we are trying to block a malicious IP address, wouldn’t it make sense to drop it before we send it all the way up to Layer 7 and reassemble the whole web request? DDoS protection is more efficient when IPs are dropped at these lower layers. Some non-cloud devices even offer auto-blocking of IP addresses at this layer after detecting that particular IP address sends known-malicious traffic. When creating network protections, it’s important to understand at what layer network packets are being dropped and how efficient that will be. In addition, dropping the packets long before they reach your WAF will help prevent attacks designed to bypass a WAF using malicious characters. Also, you won’t have to pay for the cost of the WAF and other systems that are required to reassemble an HTTP request when you are simply blocking an IP address! The same is true for domain names. You can get the IP to which a address a domain it much more efficiently at a layer far before a layer 7 WAF.
• #114: If an attacker can break into an application and get onto a web host, they may be able to obtain a token to take actions on your cloud platform. That’s why defending against web application attacks is so crucial in a cloud environment (on top of all types of phishing attacks that steal similar credentials). A Web Application Firewall (or WAF) tries to defend against these threats by inspecting HTTP/S requests prior to them reaching your API or web application. The WAF will reject suspicious requests with known attack strings and malformed requests that could result in unwanted data exposure or application behavior. The Microsoft WAF integrates with three other Microsoft services to inspect traffic: Application Gateway, Front Door, and Azure CDN. Note that Microsoft now recommends using Azure Front Door over Azure CDN so we didn’t really cover that in class. It provides CDN functionality in a less scalable way than Azure Front Door and costs more in most cases. https://docs.microsoft.com/en-us/azure/web-application-firewall/overview
• #115: Azure WAF integrated with Front Door offers centralized protection for web applications. Choose standard or premium tiers. Different options exist for rules including allowing or blocking traffic based on a rule, logging it only or redirecting the traffic to another source. The Azure WAF with Front Door allows both detection and prevention mode. With detection mode, you can get alerts and test the WAF to understand what it’s going to block before your turn on prevention mode. Prevention mode will block bad traffic. A detailed list of rules exists in the documentation. You can block IP addresses, perform rate limiting, block geographic locations and different types of application attacks. https://docs.microsoft.com/en-us/azure/web-application-firewall/afds/afds-overview https://docs.microsoft.com/en-us/azure/web-application-firewall/afds/waf-front-door-create-portal
• #116: You can use Azure WAF with Application Gateway. This option allows you to assign one or more WAF policies which can protect one or more applications. WAF policies are based on the OWASP core rule sets. https://docs.microsoft.com/en-us/azure/web-application-firewall/ag/ag-overview The Azure WAF integrates with the Azure Application Gateway to protect against web attacks targeted at a website that is fronted by an Application Gateway. Logs are sent to Azure Monitor and are also integrated into Azure Security Center which we’ll talk about more on the last day of class. https://docs.microsoft.com/en-us/azure/application-gateway/waf-overview Azure has a bot protection rule designed to allow you to take actions to block or allow bots. Bots are categorized as bad, good, and unknown. https://docs.microsoft.com/en-us/azure/web-application-firewall/afds/afds-overview#bot-protection-rule-set-preview
• #117: In the earlier steps to create an application gateway we saw the option to choose the WAF SKUs when creating our application gateway. When choosing the WAF V2 option the ability to choose or create a WAF policy appeared. https://learn.microsoft.com/en-us/azure/web-application-firewall/ag/create-waf-policy-ag
• #118: Create a WAF Policy with Azure Front Door: https://docs.microsoft.com/en-us/azure/web-application-firewall/afds/waf-front-door-create-portal
• #119: If you want global protection for your application, use Front Door and assign the WAF to Front Door. All regions where traffic hits Front Door will be protected. If you only want the WAF rules to apply to a specific region, add the WAF to an Application Gateway. Start out in detection mode to ensure your application is not adversely affected by the new rules blocking valid traffic. Tune the rules and turn on prevention mode once you are sure you you have them set up the way you want.
• #120: Managed rulesets let you use a ruleset created and defined by someone else instead of creating your own. https://docs.aws.amazon.com/waf/latest/developerguide/aws-managed-rule-groups.html
• #121: Video Reference: https://www.youtube.com/watch?v=Cane6R-GukQ Additional Resources: https://learn.microsoft.com/en-us/azure/web-application-firewall/afds/waf-front-door-tuning https://techcommunity.microsoft.com/t5/azure-network-security-blog/azure-waf-tuning-for-web-applications/ba-p/3776133 https://learn.microsoft.com/en-us/azure/application-gateway/log-analytics https://learn.microsoft.com/en-us/azure/web-application-firewall/ag/application-gateway-waf-configuration?tabs=portal https://learn.microsoft.com/en-us/azure/web-application-firewall/afds/waf-front-door-exclusion
• #122: Set WAF policy Settings. https://learn.microsoft.com/en-us/azure/web-application-firewall/ag/policy-overview
• #123: You can create custom rules for the Azure WAF. Match on variables which are at the time of this writing: RemoteAddr – IPv4 Address/Range of the remote computer connection RequestMethod – HTTP Request method QueryString – Variable in the URI PostArgs – Arguments sent in the POST body. Custom Rules using this match variable are only applied if the 'Content-Type' header is set to 'application/x-www-form-urlencoded' and 'multipart/form-data'. Additional content type of application/json is supported with CRS version 3.2 or greater, bot protection rule set, and geo-match custom rules. RequestUri – URI of the request RequestHeaders – Headers of the request RequestBody – This contains the entire request body as a whole. Custom rules using this match variable are only applied if the 'Content-Type' header is set to application/x-www-form-urlencoded media type. Additional content types of application/soap+xml, application/xml, text/xml are supported with CRS version 3.2 or greater, bot protection rule set, and geo-match custom rules. RequestCookies – Cookies of the request Alert on matches or block them. https://learn.microsoft.com/en-us/azure/web-application-firewall/ag/custom-waf-rules-overview
• #126: Serverless is very popular amongst developers because it reduces complexity even further. No longer does a developer have to set up a server, container orchestration software, or even configure a container. Just drop the code into a function and it runs! There are some potential configuration options but much less configuration than other options.
• #127: Azure functions are a form of what is known as serverless computing. A function is a block of code that runs on a compute resource that starts, runs the code, and then ends. You only pay for the compute resource while the function runs. Functions are often triggered by an event. For example, a function can run in response to a particular entry in a log file, or a file uploaded to a storage account. Functions have limited compute capacity and memory. If the code execute exceeds the limits of the function then the code program execution terminates prematurely. https://docs.microsoft.com/en-us/azure/azure-functions/functions-overview In 2016, Lambda functions were new. No one was talking about or doing automated incident handling in the cloud. Teri Radichel asked a cloud vendor why they only had alerts and no automated responses at the Seattle AWS Architects and Engineers Meetup. Then she decided to write a paper on how a security incident could trigger an automated response. The paper sets up two hosts in a VPC in different subnets and turned on VPC Flow Logs, which sends data to CloudWatch. An event triggers processing the logs when stored. A function would search for DENY traffic in the logs. When the DENY entry was received, an snapshot (backup) is created of the offending host and it is terminated. A new host with the same configuration is deployed in its place. You can read the details in this paper, which covers different types of responses to events in a cloud environment: https://www.sans.org/reading-room/whitepapers/incident/balancing-security-innovation-event-driven-automation-36837
• #128: Create a function app. Instead of creating an individual function like you would on AWS, in Azure you crate a “function app”. After you crate your function app you can add individual functions to your function app. https://learn.microsoft.com/en-us/azure/azure-functions/functions-create-function-app-portal
• #129: Create a storage account. Your function will leverage the storage account to store code and data.
• #130: In order to host an Azure function in a private network you need to pay for a dedicate app service plan. Functions within a virtual network (VNet) can be governed by network security groups (NSGs) we discussed on day 2 of class. Dedicated plans for Azure functions: https://docs.microsoft.com/en-us/azure/azure-functions/dedicated-plan
• #131: Enable monitoring for your function app. https://learn.microsoft.com/en-us/azure/azure-functions/configure-monitoring
• #132: Create your function app and wait for provisioning to complete. After that point you can review the details of your function app.
• #133: Let’s add a function to the function app. Click on Functions on the left menu. Click +Create to add a new function. Choose Develop in portal from the development environment drop down. That will allow you to write code in the Azure portal and add it to your function. Azure offers a number of methods to run code including a local development environment: https://docs.microsoft.com/en-us/azure/azure-functions/functions-develop-local Note that the local development environment would need to be able to interact with the Azure platform over the network. Consider the implications of someone doing some from the office or a home network. https://docs.microsoft.com/en-us/azure/azure-functions/functions-develop-local
• #134: Azure offers a number of templates for different types of functions. Functions can be triggered based on an event that occurs on the Azure platform or at a scheduled time. Choose the Time trigger option to create a function that runs at a scheduled point in time. You can use the default time or learn more about the time options in this documentation: https://docs.microsoft.com/en-us/azure/azure-functions/functions-bindings-timer Click create to create your function. You can read more about triggers and bindings that cause a function to run here: https://docs.microsoft.com/en-us/azure/azure-functions/functions-triggers-bindings?tabs=csharp
• #137: If you want to restrict access to a virtual network in your account you’ll need to sign up for a dedicated plan as explained on a prior slide. You can limit inbound traffic to your application by clicking on Network in the left menu and then Access restrictions. More about Azure functions networking here: https://docs.microsoft.com/en-us/azure/azure-functions/functions-networking-options Azure serverless Functions would have the same considerations as Lambda functions. Make sure you can control the networking and view the logs you need. https://medium.com/cloud-security/lambda-networking-72e2b915f31b Network Design: Serverless Applications: https://medium.com/cloud-security/network-design-serverless-applications-92b06dc2a5b1
• #138: You can add network rules here to allow networks to access your function. By default all networks should be allowed. Note that without a dedicated plan you cannot limit outbound access, only inbound traffic to your application.
• #139: In order for your function to make calls to the Azure platform you’ll need to assign it a managed or user-assigned identity and grant it the permissions to take the actions you want it to take via code in the function. For example, if you want the function to be able to access a key vault nad read a secret in that key vault, you’ll need to assign a managed identity. Then grant that managed identity to key vault by returning to the key vault and clicking IAM in the left menu. Grant access via a role to the managed identity.
• #140: The code this slide is modified form the code sample in the link below. This code would retrieve a secret from a key vault and log the secret in the logs. Of course you would NOT want to do that with an actual secret. Secrets should never, never be written to logs! This is only to demonstrate some code that you could drop into a function and shows how to retrieve a secret from key vault using .NET code. If you configure your function to run and a schedule, it will execute at the specified time, retrieve the secret, log it, and terminate. https://docs.microsoft.com/en-us/azure/key-vault/secrets/quick-create-net
• #141: Add your own code to your function. Then you can test it just like the sample code. Caveat: this code was not fully tested and should not be run in production! This code was pulled from the Microsoft sample code in the prior slide’s notes. It should work. You need to edit the code to add your own key vault name and secret name. Your function would need access to access your key vault on the network and via an IAM managed identity.
• #143: Container instances allow developers to run containers in the cloud without managing servers. Of course, developers who only want to write code and not deal with infrastructure will love this option. Some businesses may be able to shift certain risks and liability to the cloud platform (check with a lawyer!) However, other organizations may have compliance requirements that this type of environment does not meet. Additionally, companies cannot run tools like container runtime security products that execute on the host machine in this type of environment. https://docs.microsoft.com/en-us/azure/container-instances/container-instances-overview
• #144: Creating a container instance should look familiar. When you create a container instance you pull a container image from a repository. You’ll want to consider which repositories you want to allow your development team to use. For this simple example, you can choose the default Microsoft “hello world” linux image.
• #145: Here you have networking options. Set the minimal network access required.
• #146: On the advanced tab you can set environment variables. Best practice is not not put secrets in environment variables. Anyone with access to query the properties of the container instance in the Azure account, subscription or resource group will be able to view the values of the environment variables. Store secrets in key vault.
• #147: Once again you’ll see properties and options that look familiar - networking, IAM, identity, monitoring, locks.
• #149: This slide contains some terminology you might hear when discussing Kubernetes.
• #150: More Kubernetes terminology.
• #151: Setting up a Kubernetes platform is very complicated. Setting up a secure Kubernetes platform is even harder. Major cloud providers offer Kubernetes as a service to make it easier to get up and running and deploying applications. Cloud provider platforms deploy Kubernetes with some best practices to make it easier for customers. That said, there’s still a lot of responsibility on the customer to maintain a secure Kubernetes configuration and secure applications running on the platform. One of the most important things customers need to do is maintain limited access to the components used to manage Kubernetes and manage containers on the platform. In some cases, these management planes have been exposed to the Internet. All components need to stay up to date. Customers need to follow best practices for Kubernetes, Azure configuration, container configurations, and best practices for any components and programming languages used within containers. https://docs.microsoft.com/en-us/azure/aks/intro-kubernetes
• #152: Navigate to the AKS service. Click + Create. Click + Create a Kubernetes cluster. https://learn.microsoft.com/en-us/azure/aks/learn/quick-kubernetes-deploy-portal?tabs=azure-cli
• #153: Kubernetes has so many options and creates a number of components upon deployment. You can see some of the options here. You have the option to choose a cost-optimized deployment if you are simply testing. You can also choose Hardened access which costs more but has default security best practices for organizations that need it.
• #154: Define the node pools that will handle your workloads. Also choose a Microsoft managed encryption key or a customer managed key.
• #155: You can use Kubernetes’ RBAC functionality to control access to resources within the Kubernetes cluster, or Azure AD. https://docs.microsoft.com/en-us/azure/aks/concepts-identity
• #156: You can choose from two different networking options. Use Kubenet from Kubernetes to control network policy, or use Azure CNI. https://docs.microsoft.com/en-us/azure/aks/concepts-network
• #157: The integration page has some additional options. It’s a really good idea to use a private registry to download and deploy containers to your Kubernetes cluster. Turning on logging and monitoring is important for troubleshooting performance issues. Azure Policy can help you ensure your Kubernetes cluster meets your desired security standards and follows your defined policies.
• #158: This driver allows Kubernetes to work with cloud-native services without altering the Kubnernetes kernel. From the Azure documentation: The Container Storage Interface (CSI) is a standard for exposing arbitrary block and file storage systems to containerized workloads on Kubernetes. By adopting and using CSI, Azure Kubernetes Service (AKS) can write, deploy, and iterate plug-ins to expose new or improve existing storage systems in Kubernetes without having to touch the core Kubernetes code and wait for its release cycles. The CSI storage driver support on AKS allows you to natively use: Azure disks can be used to create a Kubernetes DataDisk resource. Disks can use Azure Premium Storage, backed by high-performance SSDs, or Azure Standard Storage, backed by regular HDDs or Standard SSDs. For most production and development workloads, use Premium Storage. Azure disks are mounted as ReadWriteOnce and are only available to a single pod. For storage volumes that can be accessed by multiple pods simultaneously, use Azure Files. Azure Files can be used to mount an SMB 3.0/3.1 share backed by an Azure storage account to pods. With Azure Files, you can share data across multiple nodes and pods. Azure Files can use Azure Standard storage backed by regular HDDs or Azure Premium storage backed by high-performance SSDs. https://docs.microsoft.com/en-us/azure/aks/csi-storage-drivers https://docs.microsoft.com/en-us/azure/aks/azure-disk-csi https://docs.microsoft.com/en-us/azure/aks/azure-files-csi
• #160: Compare Azure messaging services: https://learn.microsoft.com/en-us/azure/event-grid/compare-messaging-services
• #161: This slide depicts how you might send messages between a sender and a receiver. You might have a queue that gets sent in order, one message at a time, or a multi-threaded queue. A multi-threaded queue comes with all the potential security vulnerabilities associated with multi-threaded applications. https://docs.microsoft.com/en-us/azure/service-bus-messaging/service-bus-messaging-overview https://docs.microsoft.com/en-us/azure/service-bus-messaging/service-bus-azure-and-service-bus-queues-compared-contrasted
• #162: You can create a shared access policy with a service bus similar to what we looked at with queues. https://docs.microsoft.com/en-us/azure/service-bus-messaging/disable-local-authentication Set the minimum TLS version. https://docs.microsoft.com/en-us/azure/service-bus-messaging/transport-layer-security-configure-minimum-version
• #163: Option to use a customer-managed key with messages passed by your service bus. https://docs.microsoft.com/en-us/azure/service-bus-messaging/configure-customer-managed-key
• #164: As always, create a zero-trust network. Azure Service Bus offers a number of different networking options. https://docs.microsoft.com/en-us/azure/service-bus-messaging/service-bus-ip-filtering https://docs.microsoft.com/en-us/azure/service-bus-messaging/service-bus-service-endpoints https://docs.microsoft.com/en-us/azure/service-bus-messaging/private-link-service
• #165: Use a managed or user assigned identity as with other services. As always, use least privilege to limit data exposure and reduce risk. https://docs.microsoft.com/en-us/azure/service-bus-messaging/service-bus-managed-service-identity https://docs.microsoft.com/en-us/azure/service-bus-messaging/service-bus-authentication-and-authorization
• #167: When you visit a website and request a web page, you enter a URL in your browser (like Google Chrome, Internet Explorer, or Firefox). Your browser sends an HTTP request to the webserver. The web server returns a web page (which is basically a file on the server and a bunch of files it includes potentially). An Application Programming Interface (API) runs on a webserver like a website. Applications can make a request to the API the same way your browser makes a request for a web page, typically using the same protocol (HTTP or HTTPS, or newer protocols like WebSockets). The request to the API may cause the server to perform an action and possibly return data to the calling application. Many APIs can run on one server, in separate containers, or in serverless functions. One thing about applications using APIs is that now everything is going over the network, depends on the network, and calls can fail and hang on the network, leaving connections open, which then leads to performance problems. Consider using a circuit breaker pattern to prevent this type of issue: https://martinfowler.com/bliki/CircuitBreaker.html
• #168: An API gateway sits between the calling application and the APIs. It receives requests from calling applications and forwards them to the APIs. Why would you want or need that? May reasons. Security checks: as the request passes through the API gateway security checks may be performed. Additionally a WAF (Web Application Firewall) may be set up in front of the API gateway to check for security flaws. Authentication: When an application calls an API it should always be an authenticated and authorized request. Even if the data is completely public it’s a good idea to know who is calling the API and what they are doing on your system for logging and monitoring purposes. Each user should have a separate id and way to authenticate. The API Gateway may perform this function or integrate with other software that performs this function. That way you don’t have to implement authentication inside every single API and count on every API developer to do it right. More on this tomorrow. Performance: API Gateways can help with API performance via monitoring, load balancing the requests, and other functions. The API Gateway may implement the circuit break pattern mentioned on the last slide for you. Monitoring: Request can be monitored external to the APIs. A developer of a particular API might forget to monitor (or intentionally not monitor) something. An API gateway is a layer external to the APIs that can monitor all requests. Centralized monitoring may also help improve performance. Logging: Just like logging the API gateway can do some traffic logging in a centralized way such as access logs and traffic logs. APIs in private networks: With this configuration, APIs can run in private networks. Only the API gateway is exposed to the Internet. This greatly reduces the attack surface exposed to the Internet, if these APIs are called from the Internet. Defense in depth: this architecture provides defense in depth. If an attacker from the Internet tries to break into the API, they must first break through the API gateway. Their actions will hopefully trigger an alarm and someone can investigate before the attacker can get all the way to the APIs.
• #169: Accepts API calls and routes them to configured backends Verifies API keys, JWT tokens, certificates, and other credentials Enforces usage quotas and rate limits Optionally transforms requests and responses as specified in policy statements If configured, caches responses to improve response latency and minimize the load on backend services Emits logs, metrics, and traces for monitoring, reporting, and troubleshooting https://docs.microsoft.com/en-us/azure/api-management/api-management-key-concepts
• #170: Create policies to validate and monitor API requests. API Gateways can process JWT tokens to allow access to backend APIs. Implement rate limiting, limit access by IPs and CIDRs and more. For the complete list of API Management Policies refer to the documentation. https://docs.microsoft.com/en-us/azure/api-management/api-management-policies
• #171: The same types of security controls apply to API gateway as other services. In addition, you’ll want to configure appropriate security policies for APIs to prevent abuse.
• #172: Be aware of the different tiers available for API Management. The selection of tier will affect security, reliability, and price. https://docs.microsoft.com/en-us/azure/api-management/api-management-features
• #173: This slide covers some of the general security considerations for APIs, no matter what technology you happen to be using. I’ve seen many incorrect implementations of OAUTH in videos and blogs online. Also, refer to the latest standard. Are you using the correct OAUTH flow for your use case? https://medium.com/cloud-security/do-you-know-your-oauth-flows-137fb01b45f8
• #175: Azure App service makes it easier to run applications because Azure manages a lot of the components for developers. This is another service where developers can focus on their code instead of managing infrastructure. However, it is important to understand the security and architecture of the underlying service and available options. Customers are still responsible for application security. https://docs.microsoft.com/en-us/azure/app-service/overview
• #176: Choose your standard Azure platform option and choose a particular application configuration. Developers can choose from a number of different programming languages, add a database, and choose different methods of deployments. Consider how you would maintain application security and manage deployments if application developers can deploy applications in this way from the Azure portal. Can they use any language? Where will they store the code? Will they upload a zip file or deploy from source control? If they are deploying from local git then is then does the code have the potential to be altered as it leaves source control, gets onto a developer machine, and then gets pushed to the cloud? Many considerations exist for security teams if developers are using this service. It would be much better to use an automated deployment pipeline as we’ll discuss in the next class. You may still be able to use this service but it would be deployed in a more automated and controlled fashion.
• #177: More security considerations exist when it comes to choosing app service plan tiers. Will you allow your applications to run on a shared or dedicated virtual machine? Review the Azure App Service security processes and configuration in detail to determine if you are comfortable with applications running in a shared environment. From the documentation: App Service runs customer apps in a multi-tenant hosting environment. Apps deployed in the Free and Shared tiers run in worker processes on shared virtual machines, while apps deployed in the Standard and Premium tiers run on virtual machine(s) dedicated specifically for the apps associated with a single customer. App Service Free and Shared (preview) service plans are base tiers that run on the same Azure virtual machines as other App Service apps. Some apps might belong to other customers. These tiers are intended to be used only for development and testing purposes. https://docs.microsoft.com/en-us/azure/app-service/operating-system-functionality The documentation covers the security of the App Service. Ensure this level of security aligns with your organization compliance requirements and security standards. App Service Security Overview https://docs.microsoft.com/en-us/azure/app-service/overview-security
• #178: Application developers can access different external data stores, databases, and services when deploying applications using the App Service. Consider whether you want to allow all this type of functionality and how it affects your overall attack surface. https://docs.microsoft.com/en-us/azure/app-service/operating-system-functionality We’ll look at Azure ARC in the next class which allows organizations to apply security and governance to services like the Azure App Service.
• #180: Features in the documentation: Publish on-premises web apps externally in a simplified way without a DMZ Support single sign-on (SSO) across devices, resources, and apps in the cloud and on-premises Support multi-factor authentication for apps in the cloud and on-premises Quickly leverage cloud features with the security of the Microsoft Cloud Centralize user account management Centralize control of identity and security Automatically add or remove user access to applications based on group membership https://docs.microsoft.com/en-us/azure/active-directory/app-proxy/what-is-application-proxy
• #181: Azure application proxy acts as a service in the cloud that allows or denies access to specific applications that your organization wants to allow users to access. The proxy service is a software service that checks network traffic and allows or denies connections at the application layer of the OSI model based on policies defined by service administrators. One of the benefits of this service is that users only get access to a specific application instead of the entire network. They can login to a specific application but are not connected to a host where they can perform any action allowed by the operating system of the host. They are limited to the functionality offered by a particular application. Policies can check a number of different conditions before allowing access to the application including but not limited to network location. https://docs.microsoft.com/en-us/azure/active-directory/app-proxy/what-is-application-proxy
• #182: Application proxy offers different authentication options for applications. https://docs.microsoft.com/en-us/azure/active-directory/app-proxy/what-is-application-proxy Integrated Windows authentication (IWA) uses Kerberos Constrained Delegation (KCD). https://docs.microsoft.com/en-us/windows-server/security/kerberos/kerberos-constrained-delegation-overview Header-based authentication uses PingAccess for header authentication. https://www.pingidentity.com/en/pingone/pingaccess.html Forms-based or password-based authentication uses sign on with an username and password the first time they access the app. Azure AD stores the password and handles authentication after that point. SAML authentication is supported for applications that use either SAML 2.0 or WS-Federation. Azure AD authenticates using the user’s Azure AD account.
• #183: Pros and cons exist for using application layer authentication to applications compared to a traditional VPN. This slide lists some of the advantages. An upcoming slide will present some caveats to consider when using services like this. https://docs.microsoft.com/en-us/azure/active-directory/app-proxy/what-is-application-proxy
• #184: This slide provides and overview of how the application proxy service authenticates users and the overall architecture. Uses authenticate and obtain access to applications by connecting to a cloud service that grants or denies access. Administrators configure the access policies the cloud uses to determine whether a request is allowed or denied. https://docs.microsoft.com/en-us/azure/active-directory/app-proxy/what-is-application-proxy
• #185: Securely publish REST APIs. When you have business logic or APIs running on-premises or hosted on virtual machines in the cloud, Application Proxy provides a public endpoint for API access. API endpoint access lets you control authentication and authorization without requiring incoming ports. It provides additional security through Azure AD Premium features such as multi-factor authentication and device-based Conditional Access for desktops, iOS, MAC, and Android devices using Intune. To learn more, see How to enable native client applications to interact with proxy applications and Protect an API by using OAuth 2.0 with Azure Active Directory and API Management. Remote Desktop Services (RDS). Standard RDS deployments require open inbound connections. However, the RDS deployment with Application Proxy has a permanent outbound connection from the server running the connector service. This way, you can offer more applications to users by publishing on-premises applications through Remote Desktop Services. You can also reduce the attack surface of the deployment with a limited set of two-step verification and Conditional Access controls to RDS. Publish applications that connect using WebSockets. Support with Qlik Sense is in Public Preview and will be expanded to other apps in the future. Enable native client applications to interact with proxy applications. You can use Azure AD Application Proxy to publish web apps, but it also can be used to publish native client applications that are configured with Microsoft Authentication Library (MSAL). Native client applications differ from web apps because they're installed on a device, while web apps are accessed through a browser.
• #186: Security professionals will want to consider if and how they would shut off network access to a particular IP address when using this service. Prior to using this service investigate and understand what the network traffic will show and how to track specific network activity back to a specific user and IP address. Traffic sent to this cloud services is not maintained on a private network. Organizations can use Azure Peering and Express Route to keep traffic to and from the cloud on a private network but traffic from end users to the cloud service is not on a private network. Additionally, the application proxy service is a multi-tenant service not a privately managed service owned and operated by the organization. Network topology: https://docs.microsoft.com/en-us/azure/active-directory/app-proxy/application-proxy-network-topology
• #188: Azure Relay is similar to Application Proxy in that it offers a VPN alternative to offer access to services at the application layer (layer 7 of the OSI model). Applications can access specific services on specific endpoints instead of the entire network or all the applications on a particular IP address. Azure relay supports: One-way, request/response, and peer-to-peer communication Publish/subscribe event scenarios Bi-directional and unbuffered socket communication Can be scoped to a specific endpoint application on a specific machine. Basic flow from the documentation: An on-premises service connects to the relay service through an outbound port. It creates a bi-directional socket for communication tied to a particular address. The client can then communicate with the on-premises service by sending traffic to the relay service targeting that address. The relay service then relays data to the on-premises service through the bi-directional socket dedicated to the client. The client doesn't need a direct connection to the on-premises service. It doesn't need to know the location of the service. And, the on-premises service doesn't need any inbound ports open on the firewall. https://docs.microsoft.com/en-us/azure/azure-relay/relay-what-is-it
• #189: Azure relay offers two mechanisms for connections. Which option you choose depends on your application capabilities and requirements. WCF Relay is a legacy protocol used by .NET applications only. Hybrid uses HTTP and Web Sockets so it can be used by many types of application and programming languages.
• #190: To use the Azure Relay service developers on each side of the connection write code to allow connections from or send connections to the Azure Relay service. Once the request is received by the listener it can be directed to a different application on a different port on the application running the Azure Relay code. So basically, the developers are able to send different types of connections over port 443 if they can access the Azure Relay service and bypass firewall rules - something to consider! https://docs.microsoft.com/en-us/azure/azure-relay/relay-hybrid-connections-http-requests-node-get-started
• #191: This slide shows the architecture of the Azure Relay service. https://docs.microsoft.com/en-us/azure/azure-relay/relay-what-is-it Authentication and authorization via Azure AD or SAS. https://docs.microsoft.com/en-us/azure/azure-relay/relay-authentication-and-authorization
• #192: Search for the Relay service. Create a namespace.
• #193: Click + Hybrid Connection for this example. You could also choose a WCF Relay.
• #194: Create a name for your hybrid connection. You could also supply some metadata to be associated with the connection.
• #195: The connection URL now allows others with access to connect to the URL without any knowledge of the underlying application specifics. https://docs.microsoft.com/en-us/azure/templates/microsoft.relay/namespaces/hybridconnections?tabs=bicep
• #196: Set up a shared access policy to access the Azure relay. https://docs.microsoft.com/en-us/azure/templates/microsoft.relay/namespaces/hybridconnections
• #197: Administrators can set policies to control whether connections can send, listen or manage the connection.
• #198: This slide shows the requirements for an HCM connection. The service connects on port 443. After the connection is established, requests can be redirected to applications on other ports, but this service requires no changes to firewalls that allow access on port 443 to Azure. You can download an agent for testing: https://www.microsoft.com/en-us/download/details.aspx?id=44216
• #199: You can set some network controls associated with your connection.
• #200: It is also possible to use a private endpoint. Be aware that Network Security Group (NSG) rules and User-Defined Routes don't apply to Private Endpoint. Limitations Supported only on Standard Load Balancer. Not supported on Basic Load Balancer Supported only on Standard Load Balancer where backend pool is configured by NIC when using VM/VMSS Supports IPv4 traffic only Supports TCP and UDP traffic only https://docs.microsoft.com/en-us/azure/azure-relay/private-link-service