part 3 Flashcards
(39 cards)
Azure preview portal
beta, preview, pre-release. Can test new features via preview.portal.azure.com
Powershell
CL shell and scripting language. Task automation and configuration management framework. Built on top of .Net Common language runtime. Accepts and returns .Net objects, making scripting easier.
Azure Cloud Shell
Interactive, authenticated, browser-accessible shell for managing resources. Can choose either bash or powershell.
Azure CLI
Command Line Interface - processes commands to a computer program in form of lines of text. OS implement a CLI in a shell or terminal. Azure CLI installed on windows, mac and linux. az followed by commands
Azure Trust Center
Public facing web portal providing easy access to privacy, security and regulatory compliance info
Compliance programs
Businesses have to ensure Azure is:
NIST 800-53 compliant - voluntary framework for managing cybersecurity risks
UK Government G-Cloud: cloud computing certification for services used by government entities in UK
PIPEDA Compliant
HIPPA Compliant -US federal law regulating patient protected health info
FIPS-140-2 Compliant - US/Canadian gov standard specifying security requirements for cryptographic modules protecting sensitve info
CJIS (criminal justice info services) - any US state or local agency that wants to access FBI’s CJIS db is required to adhere to CJIS security policy
CSA (cloud security alliance STAR certification) - independent 3rd party assessment of a cloud provider’s security
GDPR
EU model clauses - contractual guarantees around transfer of personal data outside EU
ISO and IEC - code of practice re personal info processing by cloud service providers
IDA - standard to apply to addressing customer concerns about security + confidentiality of cloud data
SOC 1,2,3 - independent 3rd party exam reports demonstrating how company achieves compliance controls +objectives
Azure AD
identity and access management service. helps employees sign in and access resources. e.g. Azure portal, Office 365, SaaS apps, internal networking, workstations on premise.
- Free - MFA, SSO, user management, usage reports
- Office 365 Apps - company branding, SLA etc
- Premium 1 - hybrid architecture, advanced group/conditional access
- Premium 2 - identity protection, identity governance
Azure Security Center
unified infrastructure security management system. provides advanced threat protection across hybrid workloads in cloud
Key Vault
helps safeguard cryptographic keys and secrets used by cloud apps and services.
Secrets management: store and tightly control access to tokens, passwords, certificates, API keys etc
Key management: create and control encryption keys to encrypt data
Certificate management: easily provision, manage, deploy public and private SSL certificates for use with Azure and internal connected resources
Hardware security module: secrets and keys can be protected by software or FIPS 140-2 Level 2 validated HSMs
HSM
Hardware security module - piece of hardware designed to store encryption keys. Stored in RAM - so when shuts down, keys are gone.
Multitenant HSMs - FIPS 140-2 compliant (multiple customers virtually isolated on an HSM)
Single tenant HSMs - FIPS 140-3 compliant (single customer on a dedicated HSM)
DDOS
Distributed denial of service attack - maliciously disrupting normal traffic by flooding a website with large amounts of fake traffic.
Azure has built in ddos protection
two tiers of ddos protection from azure
DDoS protection basic: free, already turned on protect Azure’s global network
DDoS protection standard: starting at $2994/mo. metrics, alerts, reporting, DDoS expert support, application and cost protection SLA
Azure firewall
managed, cloud-based network security service that protects your Azure virtual network resources. VNet with firewall is an intermediate between main vnets with VMs. decides which traffic can pass through.
Azure firewall features
Centrally create, enforce and log application and network connectivity policies across subscriptions and virtual networks.
Uses a static public IP address for your virtual network resources so outside firewalls can identify traffic originating from your virtual network.
Built in high availability - no load balancers required.
Can configure during deployment to span multiple AZs for inc availability.
No additional cost for a firewall deployed in an AZ
Azure info protection (AIP)
protects sensitive info with encryption e.g. emails and docs, restriced access and rights, and integrated security in Office apps
Azure app gateway
A web-traffic load balancer (HTTP requests, level 7 HTTP) that re-route traffic based on rules. including security rules. A WAF (web app firewall) can be attached for additional protection on OSI level 7.
Advanced Threat Protection (ATP). What is IDS/IPS
Intrusion detection system + intrusion protection system
- Device/software app that monitors a network or systems for malicious activity or policy violations. IDS detects and IPS protects.
ATP
cloud based security solution that leverages your on-premises AD signals to identify, detect and investigate advanced threats, compromised identities and malicious insider actions directed at organisation.
Microsoft Security Development Lifecycle (SDL)
industry-leading software security assurance process.
Microsoft-wide initiative + mandatory policy since 2004.
Critical role in embedding security and privacy in microsoft software + culture
Building security into each SDL phase of dev lifecycle helps catch issues early and reduce dev costs.
Phases: training, requirements, design, implementation, verification, release, response
Azure policy
Service you can use to create, assign and manage policies. Allows you to enforce or control the properties of a resource..
Evaluates resources by comparing properties to business rules called policy definitions.
RBAC
helps manage who has resource access, what they can do with it and what areas they have access to.
Role assignment consists of
security principal, role definition, scope
RBAC: security principal + Scope + role def
SP - represents the identities requesting access to an Azure resource e.g. user, group, service principal, managed identity (identity in AAD automatically managed by Azure)
Scope - set of resources that access for the role assignment applies to. e.g. management group, subscription or resource group.
role definition - collection of permissions e.g. read, write, delete. Roles can be high level like owner or specific like VM reader
fundamental built in roles
owner - can read, grant access + create, update, delete
contributor - read + create, update, delete
reader - read
user access admin - grant access
