Top 5 Practices for Azure Cloud Security

Cloud migration can be a relatively new venture for many small businesses. Therefore, the security concerns about moving and monitoring important data may seem more threatening and unpredictable. As part of the migration to the Azure Cloud, security is an essential part of the migration. While it may seem that many of the security principles are the same as on-premises, the implementation is often very different. In this post, I will talk about the top five best practices for securing your Azure cloud.

1 - Access Control

The use of traditional security practices doesn't stand a chance against modern security attacks. The modern approach to virtual attacks is to assume that there is a breach and protect the infrastructure under the assumption that an attacker has access to your network. The only consistent form of data access in a remote workforce and virtual machines is the user identity so let's start there.

In order to accommodate the risk of unknown access locations with the same user identity, it is best to institute MFA (Multi-Factor-Authentication). This will provide a unique layer of security by requiring two or more authentication methods on top of the usual username/password combination to gain access. Another element to enhance access control is by operating under a zero-trust model. This means that the identity of everything and anything attempting to connect or authenticate credentials must be verified before being granted access to a resource.

There is a fine balance between security and productivity, this can be mastered by factoring in how each resource will be accessed with a built-in access control decision.

2 - Improve Your Current Security Situation

There is ever more truth to the idea that the right tools will take you far. When the cloud market grew at an exponential rate last year, so did the variety of tools to manage everything in the cloud computing space. It is most important to be sure that you have the tools you need to continually assess your current cloud environments and assets. This is the most reliable method of ensuring that any potential security issues are identified and resolved without interrupting operations. I recommend a tool like Secure Score in Azure Security Center to understand and improve your security posture by implementing best practices. I would also suggest the progress on your secure score be shared with stakeholders and your software development team. The latter is an exercise in transparency so that your team can apply key security policies at the beginning of every development cycle as another layer of insurance for your data.

3 - Secure Your Apps and Data

This may seem kind of basic but is necessary for this purpose. You need to protect your company data, apps, and infrastructure through a layered, defense-in-depth strategy across all aspects of identity, data, hosts, and network. Never take shortcuts and always use encryption wherever possible; encrypt data at rest and in transit. You should also consider encrypting data at use with 3rd party tools.

Depending on how your company will use the Azure cloud, responsibilities may change. Some tasks may switch between you and your cloud provider, based on your selected cloud architecture.
IaaS: for applications running in virtual machines, more of the burden is on you to ensure that both the application and OS are secure.
PaaS: as you move to cloud-native PaaS, Microsoft will take more of the security responsibility at the OS level itself.
SaaS: at the SaaS level, more responsibility shifts away from you to the cloud provider.

4 - Mitigate Threats

Ensure threat detection is enabled for virtual machines, databases, storage, and IoT. Azure Security Center is the best defense hub with its built-in threat detection that supports all Azure resource types. On top of that, Azure integrates threat intelligence; providing the necessary context, relevance, and prioritization for you to make faster, better, and more proactive decisions. Your best bet is to take advantage of that.

5 - Protect the Network

There are three elements to network protection:

Firewall - A secure firewall setup is still extremely important in the cloud, even with identity and access management. Controls need to be in place to protect the perimeter, detect hostile activity, and build your response.
Denial of Service (DDoS) Protection - It is also important to enable a CDN service or any Azure service that will protect your web assets and networks from malicious traffic that could be targeting the application and network layer.
Micro Segmented Network - Familiarize yourself with concepts like virtual networking, subnet provisioning, and IP addressing. Use micro-segmentation and embrace a whole new concept of micro-perimeters to support zero-trust networking.

 

Are you looking to strengthen the security of your cloud workloads? Contact our Microsoft Gold-certified Azure Cloud team at CSW Solutions for more information and to learn more about remote security to improve your cloud strategy on Azure.