Azure Security: How to protect a hybrid PaaS-IaaS solution built entirely in the cloud

#XeOneDay
www.xedotnet.org
lorenzo.barbieri@microsoft.com
@_geniodelmale
http://linkedin.com/in/geniodelmale
How do you protect a
hybrid PaaS-IaaS solution,
built entirely in the cloud?
Evento realizzato
grazie al supporto di

EVERYTHING STARTS WITH A “GOOD”
ARCHITECTURE
Web UI
Users
Photos URLs
RAW Photos
Thumbnails
Watermarking
Photo resize
RG for
- Dev-Test
- Production

1ST STRIKE
The case of
disappearing
resourcesAttack
one!
Destro
y ‘em
all!
Web UI
Users
Photos URLs
RAW Photos
Thumbnails
Watermarking
Photo resize
RG for
- Dev-Test
- Production

MITIGATION
Infrastructure as Code:
• Script & Backup
everything
• ARM & Azure Policy
PaaS safeguards:
o Azure Web App
Undelete
o SQL Point in time
Web UI
Users
Photos URLs
RAW Photos
Thumbnails
Watermarking
Photo resize
RG for
- Dev-Test
- Production

REMEDIATION
Subscription role
protection
o RBAC
Azure AD could be
protected with MFA
Delete Locks
Web UI
Users
Photos URLs
RAW Photos
Thumbnails
Watermarking
Photo resize
RG for
- Dev-Test
- Production

2ND STRIKE
The case of
unexpected
load
Web UI
Users
Photos URLs
RAW Photos
Thumbnails
Watermarking
Photo resize
Attack
two…o…o…
oooo!
$$$
$RG for
- Dev-Test
- Production

MITIGATION
o Alert rules and
monitoring
o web.config based IP
restriction
o Functions in App
Service Plan
o GB*s daily quota
o App Service
Diagnostics
Web UI
Users
Photos URLs
RAW Photos
Thumbnails
Watermarking
Photo resize
+web.config
RG for
- Dev-Test
- Production

REMEDIATION
o Web App
Firewall/Azure
Firewall/Application
Gateway/3rd party
o API Management
o Azure DDOS
Protections for
VNET
Web UI
Users
Photos URLs
RAW Photos
Thumbnails
Watermarking
Photo resize
+web.config
RG for
- Dev-Test
- Production

3RD STRIKE
The case of
data and
storage loss
Web UI
Users
Photos URLs
RAW Photos
Thumbnails
Watermarking
Attack
three!
I know
your
secrets!
Photo resize
+web.config
RG for
- Dev-Test
- Production

MITIGATION
o Key rotation
o Least user
privilege (DB)
o Alert
Web UI
Users
Photos URLs
RAW Photos
Thumbnails
Watermarking
Photo resize
+web.config
RG for
- Dev-Test
- Production

REMEDIATION
o SQL DB Firewall
o VNET Storage
o Managed Service
Identity
Web UI
Users
Photos URLs
+SQL DB Firewall
RAW Photos
Thumbnails
Watermarking
Photo resize
+web.config
o Handle Disconnect
RG for
- Dev-Test
- Production

4TH STRIKE
The case of
being Gitted
Web UI
Users
Photos URLs
+SQL DB Firewall
RAW Photos
Thumbnails
Watermarking
Fourth
Attack!
Keys
from the
octocat!
Photo resize
+web.config
RG for
- Dev-Test
- Production

REMEDIATION
o Move all the keys to
a secure path
o Use Azure Pipeline to
set them before
deployment
o Azure Key Vault
o Managed Service
Identity
Web UI
Users
Photos URLs
+SQL DB Firewall
RAW Photos
Thumbnails
Watermarking
Photo resize
+web.config
?
RG for
- Dev-Test
- Production

>_
SSH
5TH STRIKE
The case of
remote
connections
Web UI
Users
Photos URLs
+SQL DB Firewall
RAW Photos
Thumbnails
Watermarking
Remote
Attack!
Photo resize
+web.config
>_
SSH
RG for
- Dev-Test
- Production

MITIGATION
o Patching and
security policies
o Azure Security
Center
Not only for VMs, could check
networks, App Services, Blob Storage,
SQL, etc…
Web UI
Users
Photos URLs
+SQL DB Firewall
RAW Photos
Thumbnails
Watermarking
Photo resize
+web.config
>_
SSH
RG for
- Dev-Test
- Production

REMEDIATION
o Network Security
Groups
o VNET
Web UI
Users
Photos URLs
+SQL DB Firewall
RAW Photos
Thumbnails
Watermarking
Photo resize
+web.config
>_
SSH
RG for
- Dev-Test
- Production

A BETTER ARCHITECTURE
Web UI
Users
Photos URLs
+SQL DB Firewall
RAW Photos
Thumbnails
Watermarking
Photo resize
+web.config
RG for
- Dev-Test
- Production

RECAP – THE 7 GOLDEN RULES
• Script everything
• Backup everything
• Least user privilege
• Trust no one
• Monitor everything
• Assume cloud failure
• Protect your secrets

WHAT IS DOING
MICROSOFT TO
SECURE AZURE?
Built-in Partner
Controls
Unique Intelligence
Secure
Foundation
Unique Intelligence
Built in + Partner
Controls

Built-in Partner
Controls
Unique Intelligence
Secure
Foundation
Unique Intelligence
Built in + Partner
Controls
SECURE FOUNDATION

Two-factor
authentication
with biometrics
Employee &
contractor vetting
Metal
detectors
Video coverage
rack front & back
Inability to identify
location of specific
customer data
Secure
destruction bins
Ongoing
roaming patrols
Video
coverage
Ongoing
roaming patrols
Front
entrance gate
1 defined
access point
Video
coverage
Perimeter
fencing
Two-factor
authentication
with biometrics
Video
coverage
No building
signage
24x7x365
security operations
Verified single
person entry
Ongoing
roaming patrols
Background
check
System
check
PHYSICAL DATACENTER SECURITY
Access
approval
Perimeter
Building
Server
environment
Built-in Partner
Controls
Unique Intelligence
Secure
Foundation
Unique Intelligence
Built in + Partner
Controls

Protect customer data
Data, network segregation.
DDoS protection at the edge.
Platform segregation.
Confidential computing.
Secure hardware
Custom-built hardware with
integrated security and attestation
Continuous testing
War game exercises by Microsoft
teams, vulnerability scanning &
continuous monitoring
CUSTOMER 2CUSTOMER 1
AZURE INFRASTRUCTURE SECURITYBuilt-in Partner
Controls
Unique Intelligence
Secure
Foundation
Unique Intelligence
Built in + Partner
Controls

Identity &
Access
Apps & Data
Security
Network
Security
Threat
Protection
Security
Management
Role based
access
Encryption
DDoS
Protection
Antimalware
Log
Management
Multi-Factor
Authentication
Confidential
Computing
NG Firewall
AI Based
Detection and
Response
Security Posture
Assessment
Central Identity
Management
Key
Management
Web App
Firewall
Cloud Workload
Protection
Policy and
governance
Identity
Protection
Certificate
Management
Private
Connections
SQL Threat
Protection
Regulatory
Compliance
Privileged
Identity
Management
Information
Protection
Network
Segmentation
IoT Security SIEM
Built-in Partner
Controls
Unique Intelligence
Unique Intelligence

VIRTUAL MACHINES APPLICATIONS STORAGE & DATABASES
PROTECT DATA AND COMMUNICATIONS
Enable built-in encryption across resources
Azure Storage Service Encryption
Azure Disk Encryption
SQL TDE/Always Encrypted
Encrypt data while in use
Azure confidential computing
Use delegated access to storage objects
Shared Access Signature enables more granular access
control
Use a key management system
Keep keys in a hardware HSM/don’t store key in
apps/GitHub
Use one Key Vault per security boundary/per app/per
region
Monitor/audit key usage-pipe information into SIEM for
analysis/threat detection
Use Key Vault to enroll and automatically renew certificates
Built-in Partner
Controls
Unique Intelligence
Unique Intelligence

Azure Security Center
with advanced analytics for threat detection
Virtual
machines Applications
Storage
& databases Network
PROTECT WORKLOADS AGAINST
EVOLVING ATTACKS
Mitigate potential vulnerabilities
proactively
Ensure up to date VMs with relevant security
patches
Enable host anti-malwareReduce surface area of attack
Enable just in time access to management
ports
Configure Application Whitelisting to
prevent malware execution
Detect threats early and respond
faster
Use actionable alerts and incidents
Interactive investigation tool and playbooks
to orchestrate responses
Built-in Partner
Controls
Unique Intelligence
Unique Intelligence

TAKE A LOOK AT AZURE SECURITY
CENTER
Built-in Partner
Controls
Unique Intelligence
Unique Intelligence

APP SERVICE DIAGNOSTICS
• An interactive and intelligent experience for
self-troubleshooting your app issues
• What does that actually mean?
• 🔒Diagnose and troubleshoot your app issues
and learn about best practices
• 🎨Use Genie to guide you through each
problem category tile
• 📈 Intelligent search capabilities
• 🌏Straight out-of-the box, no extra
configuration necessary
Built-in Partner
Controls
Unique Intelligence
Unique Intelligence

threats detected/monthBuilt-in Partner
Controls
Unique Intelligence
Unique Intelligence
Built-in Partner
Controls

linkedin.com/in/geniodelmale
lorenzo.barbieri@microsoft.com
@_geniodelmale
Thank you!!!
Feedbacks are important!
Tweet: @_geniodelmale #xeoneday
or send me an email 

Azure Security: How to protect a hybrid PaaS-IaaS solution built entirely in the cloud

Recommended

Recommended

More Related Content

What's hot

What's hot (20)

Similar to Azure Security: How to protect a hybrid PaaS-IaaS solution built entirely in the cloud

Similar to Azure Security: How to protect a hybrid PaaS-IaaS solution built entirely in the cloud (20)

More from Lorenzo Barbieri

More from Lorenzo Barbieri (20)

Recently uploaded

Recently uploaded (20)

Azure Security: How to protect a hybrid PaaS-IaaS solution built entirely in the cloud

Editor's Notes