Sagar Lad

Azure Security For Critical Workloads

Implementing Modern Security Controls for Authentication, Authorization and Auditing

Sagar Lad
Navsari, India
ISBN 978-1-4842-8935-8e-ISBN 978-1-4842-8936-5
https://doi.org/10.1007/978-1-4842-8936-5
© Sagar Lad 2023
This work is subject to copyright. All rights are solely and exclusively licensed by the Publisher, whether the whole or part of the material is concerned, specifically the rights of translation, reprinting, reuse of illustrations, recitation, broadcasting, reproduction on microfilms or in any other physical way, and transmission or information storage and retrieval, electronic adaptation, computer software, or by similar or dissimilar methodology now known or hereafter developed.
The use of general descriptive names, registered names, trademarks, service marks, etc. in this publication does not imply, even in the absence of a specific statement, that such names are exempt from the relevant protective laws and regulations and therefore free for general use.
The publisher, the authors, and the editors are safe to assume that the advice and information in this book are believed to be true and accurate at the date of publication. Neither the publisher nor the authors or the editors give a warranty, expressed or implied, with respect to the material contained herein or for any errors or omissions that may have been made. The publisher remains neutral with regard to jurisdictional claims in published maps and institutional affiliations.

This Apress imprint is published by the registered company APress Media, LLC, part of Springer Nature.

The registered company address is: 1 New York Plaza, New York, NY 10004, U.S.A.

This work is dedicated to my parents, Bharatbhai Lad and Renukaben Lad, who have always loved me unconditionally and whose good examples have taught me to work hard for the things that I aspire to achieve.

Preface

This book is intended for developers and IT consultants/architects who want practical insights into moving mission-critical workloads to Azure from technology and process aspects.

Over the course of the book, you will learn about the following:
  1. 1.

    Dimensions of cloud security and the need for having clear demarcations of security boundaries to implement Azure's defense-in-depth security architecture.

     
  2. 2.

    The intricacies of Identity and Access Management (IAM) with Azure Active Directory and deeper insights into authentication protocols, Azure AD Application Proxy, and single sign-on with practical examples.

     
  3. 3.

    Design patterns regarding the network, infrastructure, and software aspects, including the richness of security design patterns. Includes modern design concepts like software-defined networks, network segmentation, Azure Tenant Security, Container Security, application and data access, data classification, and data encryption patterns.

     
  4. 4.

    Security processes like threat modeling, security testing, and key management for complete mediation and securing the infrastructure and application deployments.

     
  5. 5.

    Automated security monitoring with advanced observability, with practical insights into how this can be implemented with Azure Monitor and Azure Sentinel.

     

With that said, let’s get started!

Table of Contents
Chapter 1:​ Introduction:​ Dimensions of Cloud Security 1
History of Public Cloud Security 2
Cloud Security Boundaries and Responsibilities​ 10
Pattern-Based Security 13
Consumer Layer 18
Integration Layer 18
Provider Layer 19
Linking Software Layers to Application Security 19
Azure’s Defense-in-Depth Security Architecture 20
Conclusion 23
Chapter 2:​ Identity and Access Management with Azure Active Directory 25
Identity Protocol and Application Types 26
Single Page Applications 26
Web Apps with Sign In and API Calling 28
Azure Active Directory Security Model 35
Make Strong Credentials 36
Resisting Common Attacks 40
Active Directory Federation Services 43
Azure AD Application Proxy 49
Exploring Azure AD B2B and B2C for External Partners 54
PIM Azure AD Identity Protection Hybrid Implementation 57
PIM Admin 60
Approvers 61
Access Reviewers 61
Single Sign-on with Azure AD 61
Conclusion 63
Chapter 3:​ Network Security Patterns 65
Software-Defined Networks (SDNs) 65
Network Topologies 69
Mesh Topology 69
Star Topology 70
Bus Topology 70
Ring Topology 71
Tree Topology 72
Hybrid Topology 72
Segmenting Subnets 73
Controlling Routing Behavior 79
Using Gateways and Firewalls 82
Conclusion 83
Chapter 4:​ Infrastructure Security Patterns 85
Physical Security 85
Built-in Azure Security Controls 88
Azure Tenant Security 95
Container Security 100
Securing Azure Resources 106
Conclusion 109
Chapter 5:​ Application and Data Security Patterns 111
Securing Application Access 111
Identity Management 115
Data Classification 116
Securing Data Access 122
Data Protection 123
Access Control 124
Network Security for Data Access 126
Monitoring 127
Data Encryption Patterns 129
Conclusion 133
Chapter 6:​ Security Processes 135
Complete Meditation with Threat Modeling 135
Form a Team 138
Define the Scope 138
Brainstorm and List Potential Security Threats 138
Prioritize Threats 138
Develop and Implement Risk Mitigation 139
Document the Results 139
Securing the Infrastructure and Application Deployment 140
Automate Security Releases 140
Well-Governed Application Deployment 142
Scan Security Vulnerabilities 143
Monitor Application for Security Vulnerabilities 144
Control the Data Movement 144
Infrastructure as a Code (IaC) 144
Pipeline Secret Management 145
Adhere to the Principle of Least Privilege 146
Security Testing 147
Vulnerability Testing 149
Security Scanning 149
Penetration Testing 149
Risk Assessment 150
Security Auditing 151
Ethical Hacking 152
Requirements 154
Design 154
Unit Testing 154
Integration Testing 155
System Testing 156
Key Management 157
Vulnerability Management 162
Disaster Recovery (DR) 166
Conclusion 171
Chapter 7:​ Automated Security Monitoring 173
Setting Up Security Policies 173
Advanced Observability 178
Azure Monitor 182
Azure Sentinel 192
Conclusion 199
Chapter 8:​ Creating a Security Culture 201
Leadership Support 201
Training 205
Conclusion 207
Index 209
About the Author
Sagar Lad

A photo of Sagar Lad.

is a data solution architect working with a leading multinational software company in the Netherlands. He has deep expertise in implementing data and analytics solutions for large enterprises using the cloud and artificial intelligence. He is an experienced Azure platform evangelist with a strong focus on driving cloud adoption for enterprise organizations using Microsoft Cloud solutions and offerings, with more than nine years of IT experience. He loves blogging and is an active blogger on Medium, LinkedIn, and the C# Corner developer community. He was awarded the C# Corner MVP in September of 2021 for his contributions to the developer community.
 
About the Technical Reviewer
Bhadresh Shiyal

A photo of Bhadresh Shiyal.

is an Azure data architect and Azure data engineer. For the past seven years, he has been working with a large multinational IT corporation as a solutions architect. Prior to that, he spent almost a decade in private- and public-sector banks in India in various IT positions working with several Microsoft technologies. He has 18 years of IT experience, including working for two years on an international assignment from London. He has extensive experience in application design, development, and deployment. He has worked with myriad technologies , including Visual Basic, SQL Server, SharePoint, .NET MVC, O365, Azure Data Factory, Azure Databricks, Azure Synapse Analytics, Azure Data Lake Storage Gen1/Gen2, Azure SQL Data Warehouse, Power BI, Spark SQL, Scala, Delta Lake, Azure Machine Learning, Azure Information Protection, Azure .NET SDK, Azure DevOps, and more. He holds multiple Azure Certifications , including Microsoft Certified Azure Solutions Architect Expert, Microsoft Certified Azure Data Engineer Associate, Microsoft Certified Azure Data Scientist Associate, and Microsoft Certified Azure Data Analyst Associate. Bhadresh has worked as a solutions architect on large-scale Azure Data Lake implementation projects as well as data transformation projects, in addition to large-scale customized content management systems.
 
..................Content has been hidden....................

You can't read the all page of ebook, please click here login for view all page.
Reset
3.15.181.124