Security, Privacy, Compliance and Trust Flashcards
What are Networks?
Give access to everything, allowing our services to connect with apps, users and other servcies
How can we secure network connectivity (4)
1) Firewalls
2) DDoS protection service
3) Network security groups
4) Application security groups
What are firewalls
Rules: firewall defines rules for what traffic can/cannot access device or service behind it
Variations: firewalls come as hardware and software versions, and can suit any type and size of network
Critical part for any network
What is DDoS Protection Service
DDoS protection service detects the DDoS attack and deflects it. Various levels of protection depending on the scenario
No downtime: no interruption to your service and Azure will mitigate the attack globally
Two tiers: basic (traffic monitoring and real time mitigation) and standard (mitigation tuned to VNet resources)
What is DDoS
Distributed denial of services attack. Servers can only handle a certain number of requests per second. If there are too many requests, the server will stop. Some attacks are done on purpose, from many different services. These attacks cause loss of business, loss of customer trust and costs money to recover services
Lots of computers and other connected devices targeting a single website to make it stop
What is a Network Security Group (NSG)?
Resource firewall: personal resource firewall attached to virtual network, subnet or network interface
Rules: A NSG determines who can access the resources attached to it, using rules for inbound and outbound traffic
E.g. if you have a VM on a Vnet, these can both be behind a firewall. The VM will then be on its own NSG to define its own security
What is an Application Security Group?
NSG protects and monitors traffic to specific network/VM (IP endpoint), application SG will protect an application
ASG lets you configure Network security as a natural extension of application structure. Group VMs and Vnets into logical application groups and apply an application security group
What is Security Center
Portal within Azure portal that helps with consistent and manageable cloud security by integrating services into a unified view
1) Each VM has an agent installed to send data to the portal, which analyses it
2) Alerts you to threats and helps you protect against them
3) Ready for hybrid arch
What are some highlights of the security centre
1) Policy and compliance metrics
2) Gives you a ‘secure score’ for gamification of security hygiene
3) Integrates with other cloud provides
4) Two levels: free (assess and recommend) and standard (monitor and detect)
How do you use Security Centre?
1) Define policies: set of rules to evaluate a resource. Use predefined policies or your own
2) Protect resources: Actively protect your resources through monitoring policies and outcomes
4) Respond to security alerts by investigating and redefining policies
What is Azure Key Vault?
Stores passwords and secrets and certificates, and allows you to share with other users/services without them knowing the value
What are the key features of Key Vault
1) Secure hardware: even the hardware is secure, so MS can’t access your data
2) Application isolation: apps can’t pass on secrets, nor access other application secrets
3) Gobal scaling
When is an example of using Key Vaults?
You want to give access to a 3rd party web service to access your SQL DB. You don’t want to give it your username and password, so you give it access to key vaults which will grant access to certain applications
Key features
Also works for secrets to prevent sharing credentials
What is Azure Information Protection
Helps organisation classify, and optionally, protect its documents and emails by applying labels
1) Secure documents, emails and data outside of the company network
2) Classify data: according to how sensitive is it, automatically according to policies, or manually
3) Track activities: track what is happening with sharing and revoke access if needed
4) Share data: you can control who edits, views, prints and forwards
5) Integration: controls for document access is integrated with common apps and tools (MS365)
What is Advanced Threat Protection?
Attackers may target users as a weak link to access servers/apps/systems. ATP allows you to monitor user behavior on-prem and in the cloud via a portal
1) Monitor users: analyse user activity and info. Includes permissions and memberships of groups
2) Baseline behaviour: record what a users normal behaviour and routine is. Any activity outside of this will be logged as suspicious
3) Suggest changes: ATP will suggest changes to conform with security best practices, to reduce risks
What aspects of Cyber-Attack Kill Chain will ATP monitor
1) Reconnaissance: if a user is searching for info about other users, device IP addresses and more, ATP will raise alerts
2) Brute force: any attempts to guess user credentials will be identified and flagged
3) Increasing privileges: any attempt by a user to gain more privileges will be flagged. This could be through another users log in
What is a security policy in Security Center?
Set of rules that Azure can use to evaluate if your configuration of a service is valid to comply with company/regulator requirements
How is access to key vaults managed?
Access to secrets and passwords can be granted or denied very fast and as needed
What is governance
Without governance, you may risk compliance, incorrect configuration or services that cost too much as developed in isolation.
What are some tools and services to implement adaquate governance?
1) Azure Policy
2) Role based access control
3) Locks
What is Azure Policy
Azure Policy evaluates resources in Azure by comparing the properties of those resources to business rules, allowing all resources to work together even if developed individually. Through its compliance dashboard, it provides an aggregated view to evaluate the overall state of the environment, with the ability to drill-down to the per-resource
Governance validates that your organisation can achieve its goals through effective and efficient use of IT
What is Role Based Access Control (RBAC)
Define user access to individual resources and what actions then can take on the resource
Minimum access: RBAC can enable minimum access necessary, ensuring only users with valid access can manage resources
Target specific use cases. Be very explicit about users and access. For example, allow an application access to certain resources or allow a user to manage resources in a resource group
How does RBAC work based on role assignment
1) Security principal: an object representing an entity such as a user or group/serboce, which can access the resource
2) Role definition: collection of permissions such as read/write/delete
3) Scope: the resources the access applies to. Specify which role can access a resource or resource group
Give a scenario where you would use RBAC
You have 3 VMs (admin, billing and general). You could create 3 roles:
1) Admin: read/write to all
2) Accountant: read/write to billing and read to general
3) Standard user: read to general
You can now assign each role to a number of users, and if there is a change to the role you can update this and all users with this assignment will be updated
What are locks and their workflow
Used to manage changes and removal or resources. Locks need to be removed before actions can be performed. Workflow:
1) Assign a lock to a subscription, RG or resource
2) Types: can be of type delete (can delete a locked item) or read only (cant make any changes)
How can you ensure resources are up to date for governance?
1) Azure Blueprints
2) Azure Advisor for security assistance
