Download to read offline
Uploaded byMarco Obinu
Securing an Azure full-PaaS architecture - Data saturday #0001 Pordenone
The document discusses the benefits of Platform as a Service (PaaS) architecture, highlighting its ease of management and built-in high availability features. It emphasizes the importance of securing applications and databases through authentication, authorization, and encryption, while also addressing potential security risks such as data exfiltration. Real-world scenarios are used to illustrate key points and best practices for implementing security measures in Azure environments.
More Related Content
![[DO16] Mesosphere : Microservices meet Fast Data on Azure](https://cdn.slidesharecdn.com/ss_thumbnails/do16-170616021542-thumbnail.jpg?width=640&height=640&fit=bounds)
Similar to Securing an Azure full-PaaS architecture - Data saturday #0001 Pordenone
![[Toroman/Kranjac] Red Team vs. Blue Team in Microsoft Cloud](https://cdn.slidesharecdn.com/ss_thumbnails/fs0fswrr36f3q9puu3u6-signature-d4523b3bf020616e67040d2a940ba8bf9aeab187b20da49956548f98de22ea12-poli-180606121949-thumbnail.jpg?width=640&height=640&fit=bounds)
![Coded Agents – with UiPath SDK + LangGraph [Virtual Hands-on Workshop]](https://cdn.slidesharecdn.com/ss_thumbnails/codedagentsdeck-251215155422-5497c599-thumbnail.jpg?width=640&height=640&fit=bounds)
Securing an Azure full-PaaS architecture - Data saturday #0001 Pordenone
- 1. #datasatpn February 27th, 2021 DataSaturday #1 Securing a full-PaaS architecture Marco Obinu - @OmegaMadLab
- 2. Marco Obinu • AdvisoryEngineer @ • Geek to the 🦴😁 • 💘Azure and SQL Server ABOUTME.OMEGAMADLAB.COM
- 3.
- 4. Why PaaS? LESS DUTIES EASIER TO SIZE AzureStorage (remote storage) Virtualization host OsDisk DataDisk DataDisk VM VM NIC vSwitch Host NIC BlobCache (local storage) TempDisk RAM cache SSD cache CACHED THROUGHPUT UNCACHEDTHROUGHPUT Standard HDD Standard SSD Premium SSD Ultra disks
- 5. Why PaaS? Less duties Easier to size Built- inHA SQL CLUSTER IP SQL CLUSTER IP PREMIUM FILE SHARE S2D STORAGE REPLICATION SQL CLUSTER IP DATABASE REPLICATION LISTENER
- 6.
- 7.
- 8.
- 9. Any risk? Less controlover the infrastructure Who did what? Usually outside of your network boundaries • Can be an issue with security policies • What about data exfiltration?
- 10. How to mitigate? Enforceauthentication and authorization Protect your data at rest, in transit, in use Secure your network
- 11. How to mitigate? ITTeam • Define guidelines • Enforce rules • Monitor the environment Dev Team • Don't be shy with the architecture • Follow the best practices
- 12. A real-world scenario UsersWebApp Azure SQL DB ADF Blob Console VM VNET managementSubnet Azure Hosted IR
- 13. A real-world scenario:week points Users WebApp Azure SQL DB Blob Console VM VNET managementSubnet Auth? TLS? WAF? IP Restriction? Auth? Encryption? Firewall? Traffic flow? Auth? Encryption? Firewall? Data exfiltration? ADF Azure Hosted IR
- 14.
- 15.
- 16.
- 17.
- 18.
- 19. Introduce a WebApplication Firewall
- 20. Introduce a WebApplication Firewall Users WebApp
- 21. Introduce a WebApplication Firewall Users WebApp WAF Vnet Public IP
- 22. Introduce a WebApplication Firewal
- 23. Introduce a WebApplication Firewal
- 24.
- 25.
- 26.
- 27.
- 28.
- 29. A real-world scenario:week points Users WebApp Azure SQL DB Blob Console VM VNET managementSubnet Auth? TLS? WAF? IP Restriction? Auth? Encryption? Firewall? Traffic flow? Auth? Encryption? Firewall? Data exfiltration? ADF Azure Hosted IR WAF wafSubnet Public IP
- 30.
- 31.
- 32. Azure AD integration Server=tcp:sqlsrv-secure-jecptzwgjjo7o.database.windows.net,1433;Initial Catalog=DemoDB;PersistSecurity Info=False;User ID=*************;Password=**************;MultipleActiveResultSets=False;Encrypt= True;TrustServerCertificate=False;Connection Timeout=30;
- 33.
- 34.
- 35.
- 36.
- 37.
- 38.
- 39.
- 40.
- 41.
- 42.
- 43.
- 44.
- 45. Encryption in use AlwaysEncripted Row Level Security Dynamic Data Masking
- 46.
- 47. Network security VPN GW VM VNET Publicendpoint Public endpoint On-prem IP Azure Svcs 1 2
- 48. Network security VPN GW VM VNET Publicendpoint Public endpoint On-prem IP Subnet 1 1 2 Subnet 2
- 49. Network security VPN GW VM VNET Publicendpoint Public endpoint 1 2 Private link
- 51. A real-world scenario:week points Users WebApp Azure SQL DB Blob Console VM VNET managementSubnet Auth? TLS? WAF? IP Restriction? Auth? Encryption? Firewall? Traffic flow? Auth? Encryption? Firewall? Data exfiltration? ADF Azure Hosted IR WAF wafSubnet IntSubnet privateLinkSubnet Public IP
- 52. Securing the storageaccount Encryption at rest
- 53.
- 54.
- 55.
- 56.
- 57.
- 58.
- 59.
- 60.
- 61.
- 62.
- 63. A real-world scenario:week points Users WebApp Azure SQL DB Blob Console VM VNET managementSubnet Auth? TLS? WAF? IP Restriction? Auth? Encryption? Firewall? Traffic flow? Auth? Encryption? Firewall? Data exfiltration? ADF Azure Hosted IR WAF wafSubnet IntSubnet privateLinkSubnet Public IP
- 64. What about DataFactory? Azure AD integration Resource connectivity
- 65. What about DataFactory? Azure AD integration Resource connectivity VNET Azure Hosted IR
- 66. What about DataFactory? Azure AD integration Resource connectivity VNET Azure Hosted IR ADF Managed VNET (Preview)
- 68. What about DataFactory? Azure AD integration Resource connectivity VNET Self Hosted IR
- 69. A real-world scenario:week points Users WebApp Blob Azure SQL DB Console VM ADF WAF wafSubnet Public IP VNET IntSubnet managementSubnet Self-hosted IR adfSubnet privateLinkSubnet Auth? TLS? WAF? IP Restriction? Auth? Encryption? Firewall? Traffic flow? Auth? Encryption? Firewall? Data exfiltration?
- 70. Limiting the exposureto data exfiltration Users WebApp Blob Azure SQL DB Console VM ADF WAF wafSubnet Public IP VNET IntSubnet managementSubnet Self-hosted IR adfSubnet privateLinkSubnet
- 71. Limiting the exposureto data exfiltration Users WebApp Blob Azure SQL DB Console VM ADF WAF wafSubnet Public IP VNET IntSubnet managementSubnet Self-hosted IR adfSubnet privateLinkSubnet NSG Outbound traffic Priority Source Destination Action 100 ConsoleVM IP, any port AzSQLDB private IP, 1433 Allow 110 ConsoleVM IP, any port AzSQLDB Service Tag 120 ConsoleVM IP, any port AzStorage Service Tag
- 72. A real-world scenario:a good starting point Users WebApp Blob Azure SQL DB Console VM ADF WAF wafSubnet Public IP VNET IntSubnet managementSubnet Self-hosted IR adfSubnet privateLinkSubnet NSG NSG NSG
- 73. A different approach Users Blob ConsoleVM ADF WAF wafSubnet Public IP VNET AseSubnet managementSubnet Self-hosted IR adfSubnet privateLinkSubnet ASE sqlmiSubnet Az SQL MI NSG NSG NSG NSG
- 74. Checking for anyblind spot Azure SQL Database • Label sensitive data • Enable audit Azure Security Center • Check your security posture (free tier) • Integrate with Defender for SQL, App Service, Storage (former standard tier)
- 75. Some useful resources •What is Azure Private Link? | Microsoft Docs • Managed virtual network & managed private endpoints - Azure Data Factory | Microsoft Docs • Tutorial: Access data with managed identity - Azure App Service | Microsoft Docs • Manage traffic to multi-tenant apps using the portal - Azure Application Gateway | Microsoft Docs
- 76.