Security, Privacy, Compliance and Trust Flashcards
describe Network Security Groups (NSG)
NETWORK SECURITY. Network Security Groups are a series of rules you can apply that allow inbound traffic based on certain rules, or allow outbound traffic based on certain rules. Enable you to filter traffic to and from resources by source and destination IP address, port, and protocol.
Inbound NSG rules protect a destination IP address and port by number. If you have hundreds of servers and machines Application Security Groups are better used.
describe Application Security Groups (ASG)
NETWORK SECURITY. Application security groups enable you to group resources by type, then apply rules to all IP addresses/ports in that type so that you don’t have to keep manually repeating your NSG configuration.
This feature allows you to reuse your security policy at scale without manual maintenance of explicit IP addresses. The platform handles the complexity of explicit IP addresses and multiple rule sets, allowing you to focus on your business logic.
describe User Defined Routes (UDR)
NETWORK SECURITY. Allows you to define some path your traffic needs to travel over your network.
e.g. force traffic to go through a firewall device before reaching your VM by specifying a UDR
Describe Azure DDoS Protection
NETWORK SECURITY. Azure DDoS Protection provides “Basic” and “Standard” service tiers.
Basic tier:
- Always on monitoring
- Automatic mitigation for L3/L4 attacks
- L7 Protection with Application Gateway Web application firewall
-Globally deployed
Standard tier:
- Protection policies tuned to your VNet
- Logging, alerting and telemetry
- Resource cost scale protection
choose an appropriate Azure security solution
Consider all elements of defence in depth.
- Network Perimeter layer (DDoS protection and firewalls)
a) All virtual network subnets should use NSG (Network Security Groups) as this is the most basic layer of allowing or denying traffic
b) WAF Firewalls - Networking layer (limit communication through segmenting your network and configuring access controls, deny by default, restric inbound internet access and limit outbound where appropriate, implement secure connectivity to on-premise networks)
- Comining services e.g. Network security groups and Azure firewall , Application Gateway WAF and Azure Firewall
describe the difference between authentication and authorization
Authentication - Who you are
Authorisation - what you can do
describe Azure Active Directory
Azure Active Directory is a Microsoft cloud-based identity and access management service. Azure AD helps employees of an organization sign in and access internal and external resources.
Azure AD provides services such as:
Authentication, SSO, Application management, Business to business identity services, Busines to customer identity services
describe Azure Multi-Factor Authentication
Azure Multi-Factor Authentication provides additional security for your identities by requiring two or more elements for full authentication. These elements fall into three categories:
Something you know
Something you possess
Something you are (biometric)
Azure MFA comes with Azure AD Premium Licences, MFA authentication for O365 , Azure AD global administrators
Describe Azure Security Center
Azure Security Center is a monitoring service that provides threat protection across all of your services both in Azure, and on-premises.
Security Center can:
Provide security recommendations, Monitor security and automatically apply required security to new services as they come online.
identify potential vulnerabilities before they can be exploited.
Use machine learning to detect and block malware from being installed on your virtual machines and services.
You can also define a list of allowed applications to ensure that only the apps you validate can execute.
Analyze and identify potential inbound attacks and help to investigate threats and any post-breach activity that might have occurred.
Provide just-in-time access control for ports, reducing your attack surface by ensuring the network only allows traffic that you require.
Available as Free or Standard
describe the Microsoft Privacy Statement
This privacy statement explains the personal data Microsoft processes, how Microsoft processes it, and for what purposes.
describe the Trust center
The Trust Center is a website resource containing information and details about how Microsoft implements and supports security, privacy, compliance, and transparency in all Microsoft cloud products and services. The Trust Center is an important part of the Microsoft Trusted Cloud Initiative and provides support and resources for the legal and compliance community.
describe the Service Trust Portal
The Service Trust Portal (STP) hosts the Compliance Manager service, and is the Microsoft public site for publishing audit reports and other compliance-related information relevant to Microsoft’s cloud services. STP users can download audit reports produced by external auditors and gain insight from Microsoft-authored reports that provide details on how Microsoft builds and operates its cloud services.
describe Compliance Manager
Compliance Manager is a workflow-based risk assessment dashboard within the Trust Portal that enables you to track, assign, and verify your organization’s regulatory compliance activities related to Microsoft professional services and Microsoft cloud services such as Office 365, Dynamics 365, and Azure.
describe Azure Government cloud services
Azure Government is a separate instance of the Microsoft Azure service. It addresses the security and compliance needs of US federal agencies, state and local governments, and their solution providers. Azure Government offers physical isolation from non-US government deployments and provides screened US personnel.
describe Azure China cloud services
Azure China is operated by 21Vianet (Azure China 21Vianet) is a physically separated instance of cloud services located in China, independently operated and transacted by Shanghai Blue Cloud Technology Co., Ltd. (“21Vianet”), a wholly owned subsidiary of Beijing 21Vianet Broadband Data Center Co., Ltd.
Describe Azure Security Center
SECURITY TOOL. Azure Security Center is a monitoring service that provides threat protection across all of your services both in Azure, and on-premises.
Security Center can:
Provide security recommendations, Monitor security and automatically apply required security to new services as they come online.
identify potential vulnerabilities before they can be exploited.
Use machine learning to detect and block malware from being installed on your virtual machines and services.
You can also define a list of allowed applications to ensure that only the apps you validate can execute.
Analyze and identify potential inbound attacks and help to investigate threats and any post-breach activity that might have occurred.
Provide just-in-time access control for ports, reducing your attack surface by ensuring the network only allows traffic that you require.
Available as Free or Standard
Describe Azure Key Vault
Azure Key Vault is a centralized cloud service for storing your applications’ secrets. Key Vault helps you control your applications’ secrets by keeping them in a single, central location and by providing secure access, permissions control, and access logging capabilities.
describe Azure Information Protection (AIP)
Azure Information Protection is a cloud-based solution that helps organizations classify and (optionally) protect its documents and emails by applying labels. Labels can be applied automatically (by administrators who define rules and conditions), manually (by users), or with a combination of both (where users are guided by recommendations).
Describe Azure Key Vault
SECURITY TOOL. Azure Key Vault is a centralized cloud service for storing your applications’ secrets. Key Vault helps you control your applications’ secrets by keeping them in a single, central location and by providing secure access, permissions control, and access logging capabilities.
describe Azure Information Protection (AIP)
SECURITY TOOL. Azure Information Protection is a cloud-based solution that helps organizations classify and (optionally) protect its documents and emails by applying labels. Labels can be applied automatically (by administrators who define rules and conditions), manually (by users), or with a combination of both (where users are guided by recommendations).
