Azure Enterprise Security in Practice Radu Vunvulea Codecamp Cluj Napoca Nov 2017
•Télécharger en tant que PPTX, PDF•
0 j'aime•255 vues
How does an enterprise looks like when you talk about security and cloud? Complicated, rigid and challenging to accept cloud based architectures. After working closely with security teams from different companies I identified different approaches and requirements that are standard for enterprises. In this session I want to discuss and share with you lessons learned on how we can map security requirements to Azure.
Recommandé
Recommandé
Contenu connexe
Tendances
Tendances (20)
Similaire à Azure Enterprise Security in Practice Radu Vunvulea Codecamp Cluj Napoca Nov 2017
Similaire à Azure Enterprise Security in Practice Radu Vunvulea Codecamp Cluj Napoca Nov 2017 (20)
Dernier
Dernier (20)
Azure Enterprise Security in Practice Radu Vunvulea Codecamp Cluj Napoca Nov 2017
- 1. 1 ENTERPRISE SECURITY IN PRACTICE RADU VUNVULEA, OCTOBER 2017 @RADU VUNVULEA
- 4. RADU VUNVULEA Technology Enthusiast Dreamer Microsoft Azure MVP Speaker & Trainer Writer & Blogger Idealist Software Architecture Crafter
- 7. DIRECT ACCESS Same network Visible between each other Easy access and control
- 8. ISOLATION Restric traffic Controls what goes to and from VNET Isolate from outside
- 9. NSG – TIPS AND TRICKS
- 11. CROSS SYSTEM COMMUNICATION Specify what can be exchange between systems Full control on inbound and outbound traffic NSG
- 13. NETWORK VIRTUAL APPLIANCE Control security from only one location Cross location synchronization
- 14. MONITOR AND AUDIT All traffic goes through virtual appliance Push audit data to on-premises system Firewall, IDS, IPS UDR
- 16. EXTERNAL TRAFFIC CONTROL Full control of IP Filtering Traffic goes through VPN S2S VPN Internet
- 17. IPSEC VPN TERMINATED OUTSIDE FIREWALL Cannot be done using S2S VPN VPN terminated before NGFW, inside Virtual Gateway Appliance VPN
- 18. IPSEC VPN TERMINATED OUTSIDE FIREWALL Cannot be done using S2S VPN VPN terminated before NGFW, inside Virtual Gateway Appliance VPN OpenVPN
- 19. IPSEC VPN TERMINATED OUTSIDE FIREWALL Appliance plays the role of firewall and VPN Gateway VPN
- 20. DEVICE AUTHENTICATION USING CERTIFICATES Supported only for Point-to-Site VPN Site-to-Site VPN is connected directly to VPN hardware certificates
- 21. CASCADED VIRTUAL APPLIANCES Multiple virtual appliances connected together
- 22. VNET TO VNET CONNECTIVITY Peering – Fast and reliable VPN Gateway – More granular control of what goes in or out Peering / VPN Gateway
- 24. CENTRAL LOGGING DATA Activity Logs Azure Diagnostic Logs AAD Reporting VM and Cloud Services Storage Analytics Network Security Groups Application Insights Security Alert Configurable, +180 days, 90 days
- 25. MONITOR AND REACT - OMS
- 27. API AND INFRASTRUCTURE CHANGES CLOUD SERVICE PROVIDER CAN MAKE CHANGES ONLY AFTER THE NATURE OF CHANGE IS UNDERSTOOD AND A SECURITY ASSESSMENT IS DONE YES • Microsoft announce 12 months in advance any breaking changes at API or functionality level NO • Infrastructure and services change are done on the fly as long as the API or functionality is not altered
- 29. IDENTITY AND ACCESS MANAGEMENT
- 32. Mitigation
Notes de l'éditeur
- Images: https://pixabay.com/en/snail-slug-shell-animal-nature-918899/ https://pixabay.com/en/chain-rust-iron-metal-macro-rusty-566778/ https://pixabay.com/en/directory-traffic-note-shield-road-641914/
- https://docs.microsoft.com/en-us/azure/security/azure-log-audit Activity Logs - config Azure Diagnostic Logs - config AAD Reporting – 180 days VM and Cloud Services - config Color map: Configurable +180 days 90 days Storage Analytics - config Network Security Groups – 1 year Application Insights – 90 days Security Alert - config
- Migrate to on-prem
- https://azure.microsoft.com/en-us/blog/an-introduction-to-eai-bridges/
- https://azure.microsoft.com/en-us/blog/an-introduction-to-eai-bridges/
- Picture source: https://pixabay.com/en/sting-free-snuff-snuff-2-in-1-snuff-2526043/