Module-3

Security, Privacy, Compliance, and Trust

Azure security
 Microsoft Azure is one of the safest and most flexible cloud platforms on the
market. Azure contains a range of configurable security tools and supports
numerous types of security services and features.
 This enables one to expand Azure’s monitoring and remediation capabilities and
achieve an advanced level of cybersecurity proficiency.
Azure’s top native cloud security tools and features

Azure contains an extensive list of built-in security offerings that you can use to
strengthen your cloud environment.

1. Sentinel
 Microsoft Sentinel is a cloud-native solution for security information and
event monitoring (SIEM.)
 Sentinel offers threat intelligence and security analytics and empowers
security teams to act with greater speed and responsiveness using a single
dashboard.

[Link]
2. Defender for Cloud
 Defender for Cloud is a powerful cloud security posture management (CSPM)
tool. Its main purpose is to identify cloud vulnerabilities and help businesses
handle evolving threats.
 This tool also lets you remediate security issues from a central location, which
saves time and effort for team members.

3. Application Insights
 Application Insights is an extensible application performance management
(APM) solution.
 Using this tool, you can monitor live web applications and discover
performance issues. It also provides analytics and performance anomaly
detection.
4. Resource Manager
 Resource Manager is a system deployment and management service that you can
use to create and manage Azure assets.
 Resource Manager also offers template-based deployments, which can replace
manual deployments and reduce configuration errors.

5. Azure Monitor
 Azure Monitor provides ongoing security alerts for events that arise from Azure
and activity logs. This tool supports data querying, routing, and visualization.

6. Web Application Firewall (WAF)

 Microsoft provides a secure WAF component in the Azure Application Gateway.
WAF helps protect applications from threats like session hijacking and SQL
injection.
Identity and Access Management (IAM)

 Identity and access management ensures that the right people, machines, and
software components get access to the right resources at the right time.
 First, the person, machine, or software component proves they're who or what
they claim to be. Then, the person, machine, or software component is allowed
or denied access to or use of certain resources.
IAM System core functionality:
1. Identity management
 The process of creating, storing, and managing identity information.
 Identity providers (IdP) are software solutions that are used to track and
manage user identities, as well as the permissions and access levels associated
with those identities.
2. Identity federation
 You can allow users who already have passwords elsewhere (for example, in
your enterprise network or with an internet or social identity provider) to get
access to your system.
3. Provisioning and deprovisioning of users
 The process of creating and managing user accounts, which includes specifying
which users have access to which resources, and assigning permissions and
access levels.
4. Authentication of users
 Authenticate a user, machine, or software component by confirming that
they're who or what they say they are.
 You can add multi-factor authentication (MFA) for individual users for extra
security or single sign-on (SSO) to allow users to authenticate their identity
with one portal instead of many different resources.
5. Authorization of users
 Authorization ensures a user is granted the exact level and type of access to a
tool that they're entitled to.
 Users can also be portioned into groups or roles so large cohorts of users can
be granted the same privileges.
6. Access control
 The process of determining who or what has access to which resources. This
includes defining user roles and permissions, as well as setting up
authentication and authorization mechanisms.
 Access controls regulate access to systems and data.
7. Reports and monitoring
 Generate reports after actions taken on the platform (like sign-in time, systems
accessed, and type of authentication) to ensure compliance and assess security
risks.
 Gain insights into the security and usage patterns of your environment.
Working of IAM (Authenticating, authorizing, and accessing resources)

Let's say you have an application that signs in a user and then accesses a protected
resource.
Steps:
1. The user (resource owner) initiates an authentication request with the identity
provider/authorization server from the client application.
2. If the credentials are valid, the identity provider/authorization server first sends
an ID token containing information about the user back to the client application.
3. The identity provider/authorization server also obtains end-user consent and
grants the client application authorization to access the protected resource.
Authorization is provided in an access token, which is also sent back to the client
application.
4. The access token is attached to subsequent requests made to the protected
resource server from the client application.
5. The identity provider/authorization server validates the access token. If
successful the request for protected resources is granted, and a response is sent
back to the client application.
[Link]
Azure Active Directory (Azure AD)
 Azure Active Directory (Azure AD) is Microsoft’s enterprise cloud-based
identity and access management (IAM) solution.
 Azure AD is the backbone of the Office 365 system, and it can sync with on-
premise Active Directory and provide authentication to other cloud-based
systems via OAuth.
 During the 2020 pandemic, Microsoft Teams saw a drastic 70% increase in
daily Teams users in a single month. While it is unclear how many of those users
are net new to Azure AD, we can assume that the 2020 pandemic jump-started
both adoption and implementation of Azure AD to meet the demands of a remote
workforce.
[Link]
 Azure Active Directory is Microsoft’s multi-tenant, cloud-based directory and
identity management service. For an organization, Azure AD helps employees
sign up to multiple services and access them anywhere over the cloud with a
single set of login credentials.
 Windows Active Directory (AD) is Microsoft’s predecessor to Azure AD.
Microsoft released Active Directory in Windows 2000 server, and it became a
standard for enterprise identity management.
 Example: All employees in an organization need access to some Azure services to
perform their tasks. They can access services like SQL database, machine learning, or
Azure container services when the administrator assigns them separate user id and
password for each service. Employees, as well as administrators, often find it hard to
manage multiple user logins at the same time. It creates more of a hassle for
administrators working in an organization that involves more than 1000 employees.
Thisis is where Azure Active Directory (AD) comes into the picture. With Azure AD,
the administrators can handle multiple user logins without any issue. Administrators
need to assign a single username and password to access all the services they want.
Windows AD vs. Azure AD
 Windows Active Directory (AD) was the previous version of Azure AD.
 Active Directory (AD) is an OS directory service that facilitates working with
interconnected, complex, and different network resources in a unified manner.
 The biggest drawback of Windows AD was that it had many layers that
performed various bits of work.
Azure Security
 The most common question CIOs and CTOs ask before moving to Azure is, “Is
Azure Secure?“. We understand that the ‘job one’ in the cloud is security. And
one of the best reasons to migrate to Azure is taking advantage of its wide array
of security tools and capabilities.
 These tools make it possible for you to build secure solutions on the Azure
platform.
 Azure public cloud service provides a highly secure infrastructure which is a
trustworthy foundation upon which companies can meet their security
requirements.
[Link]
Security Features and Capabilities in Azure:
1. Identity and Access Management with Azure Active Directory
• AAD provides a range of identity services, including single sign-on (SSO),
multi-factor authentication (MFA), and conditional access policies, which
form the first line of defense against unauthorized access.
• By ensuring that only authenticated users can access resources, AAD
significantly reduces the risk of security breaches.
2. Advanced Threat Protection with Azure Security Center
• It offers a centralized view of security alerts and incidents, enabling rapid
response and mitigation to potential threats, thus minimizing the impact of
security breaches.
• This tool continuously assesses the security posture of Azure resources,
providing recommendations to improve security settings and practices.
• Security Center’s advanced threat protection capabilities leverage machine
learning and behavioral analytics to detect and respond to threats in real-
time.
3. Network Security with Azure Firewall and NSGs
• Azure Firewall is a managed, cloud-native network security service that provides
stateful packet inspection, ensuring secure network traffic to and from Azure
resources.
• It allows users to centrally manage and log all their network traffic flows.
• Complementing Azure Firewall, Network Security Groups (NSGs) are used to filter
network traffic to and from Azure resources in an Azure Virtual Network.
• NSGs act as a virtual firewall for your VMs, defining what traffic is allowed or
denied to and from network interfaces (NIC), VMs, and subnets, providing an
additional layer of security.
4. Data Protection through Encryption and Azure Key Vault
• Azure places a strong emphasis on data protection, offering encryption for
data in transit and at rest.
• Azure provides a range of encryption capabilities, including Azure Storage
Service Encryption for data stored in Azure Blob Storage, File Storage, and
Queue Storage.
• Azure Disk Encryption helps secure disk data against theft and
unauthorized access.
5. Compliance and Security Integration
• Azure’s security features are not standalone; they are integrated with the
platform’s compliance capabilities, ensuring that security measures also
contribute to meeting regulatory and compliance requirements.
• For example, Azure’s compliance documentation often references specific
security features as part of the compliance controls, demonstrating the
synergy between Azure’s security and compliance efforts.
6. Continuous Innovation and User Empowerment
• Azure continuously innovates and updates its security features to address
emerging threats and vulnerabilities.
• This commitment to innovation ensures that Azure remains at the
forefront of cloud security, offering the latest in security technologies
and practices.
Understanding Compliance in the Cloud
 Compliance in the cloud refers to the adherence of cloud services to various
laws, regulations, and standards that govern data protection, privacy, and
security.
 These regulations are often complex and vary significantly across different
industries and regions.
 For example: healthcare organizations must comply with the Health Insurance
Portability and Accountability Act (HIPAA) to protect sensitive patient data.
Azure Compliance Framework
 Microsoft Azure’s approach to compliance is built on a comprehensive
framework designed to meet the diverse and evolving regulatory requirements
faced by businesses across different industries and regions.
 This framework is a testament to Azure’s commitment to providing a cloud
platform that not only enhances operational efficiency and innovation but also
ensures that users’ data is handled with the utmost integrity and in accordance
with global compliance standards.
 Following are the elements of Azure Compliance policy:
• Meeting Global and Industry-Specific Standards
• Azure Compliance Documentation Center
• Third-Party Audits and Certifications
• Leveraging Compliance for Cloud Governance
• Continuous Evolution and Adaptation

[Link]
security-standards-66d8942d7816
Azure governance policies
 Cloud governance policies specify what should or shouldn't happen in the cloud.
 The cloud governance team should create one or more cloud governance
policies for each risk identified in the risk assessment.
 Cloud governance policies define the guardrails for interacting with and in the
cloud.
 Governance Policies establish an approach for creating, maintaining, and
updating the rules and guidelines that govern the use of cloud services.
 Cloud governance policies shouldn't be unique to a specific workload.
 The goal is to produce cloud governance policies that don’t require frequent
updates and that consider the effects of cloud governance policies across the
cloud environment.
To define a policy documentation approach, follow these recommendations:

1. Define standard governance language.

 Develop a standard structure and format for documenting cloud governance policies.
 The policies must be a clear and authoritative reference for stakeholders.
2. Recognize the different scopes of governance.
 Define and assign specific governance responsibilities tailored to the unique roles within
your organization.
 For example, a developer governs application code. A workload team is responsible for
a single workload, and the platform team is responsible for governance that workloads
inherit.
 3. Evaluate the broad effects of cloud governance.
 Cloud governance creates friction. Find a balance between friction and freedom.
 Consider the effects of governance on workload architecture, software
development practices, and other areas as you develop cloud governance
policies.
 For example, what you allow or disallow determines workload architecture and
affects software development practices.

[Link]
[Link]