{"id":107,"date":"2021-03-14T11:23:14","date_gmt":"2021-03-14T10:23:14","guid":{"rendered":"http:\/\/www.activeparc.fr\/?p=107"},"modified":"2021-03-14T12:23:34","modified_gmt":"2021-03-14T11:23:34","slug":"security-baseline-on-azure","status":"publish","type":"post","link":"https:\/\/www.activeparc.fr\/index.php\/2021\/03\/14\/security-baseline-on-azure\/","title":{"rendered":"Security Baseline on Azure"},"content":{"rendered":"\n

Security Baseline on Azure hands-on lab step-by-step<\/p>\n\n\n\n

Overview<\/span><\/h2>\n\n\n\n

Contoso is a multinational corporation, headquartered in the United States that provides insurance solutions worldwide. Its products include accident and health insurance, life insurance, travel, home, and auto coverage. Contoso manages data collection services by sending mobile agents directly to the insured to gather information as part of the data collection process for claims from an insured individual. These mobile agents are based all over the world and are residents of the region in which they work. Mobile agents are managed remotely, and each regional corporate office has a support staff responsible for scheduling their time based on requests that arrive to the system.<\/p>\n\n\n\n

They are migrating many of their applications via Lift and Shift to Azure and would like to ensure that they can implement the same type of security controls and mechanisms they currently have. They would like to be able to demonstrate their ability to meet compliance guidelines required in the various countries\/regions they do business. They have already migrated a web application and database server to their Azure instance and would like to enable various logging and security best practices for administrator logins, SQL Databases, and virtual network design.<\/p>\n\n\n\n

Solution architecture<\/span><\/h2>\n\n\n\n

Contoso administrators recently learned about the Azure Security Center and have decided to implement many of its features to secure their cloud-based Azure infrastructure (IaaS) and applications (PaaS). Specifically, they want to ensure that any internet exposed resources have been property secured and any non-required internet access disabled. They also decided that implementing a \u201cjump machine\u201d for admins with Application Security was also important as they have had instances of admins installing non-approved software on their machines and then accessing cloud resources. Additionally, they want the ability to be alerted when TCP\/IP Port Scans are detected, and fire alerts based on those attacks.<\/p>\n\n\n\n

\"This<\/figure>\n\n\n\n

The solution begins by creating a jump machine. This jump machine is used to access the virtual machines and other resources in the resource group. All other access is disabled via multiple virtual networks<\/strong>. More than one virtual network is required as having a single virtual network<\/strong> would cause all resource to be accessible based on the default currently un-customizable security group rules. Resources are organized into these virtual networks. Azure Center Security<\/strong> is utilized to do Just-In-Time<\/strong> access to the jump machine. This ensures that all access is audited to the jump machine and that only authorized IP-addressed are allowed access, this prevents random attacks on the virtual machines from bad internet actors. Additionally, applications are not allowed to be installed on the jump machine to ensure that malware never becomes an issue. Each of the virtual network and corresponding network security groups<\/strong> have logging enabled to record deny events to Azure Logging<\/strong>. These events are then monitored by a custom alert rule<\/strong> in Azure Sentinel<\/strong> to fire custom alerts<\/strong>. Once the solution is in place, the Compliance Manager<\/strong> tool is utilized to ensure that all GDPR based technical and business controls are implemented and maintained to ensure GDPR compliance.<\/p>\n\n\n\n

Requirements<\/span><\/h2>\n\n\n\n
  1. Microsoft Azure subscription must be pay-as-you-go or MSDN.