1.
SECRUE APPLICATION
ARCHITECTURE IN AZURE

2.
Intro: Your Presenter
Tadd Axon
Microsoft Services Practice
Lead
• MS Practice Lead
• Background in IT Operations,
system architecture,
• Information security, security
& compliance audit

3.
Agenda
• Public cloud has changed the (development) world
• Tools to support secure application architecture
• Cloud Provider Capabilities to support security
• Technologies to accelerate secure application development
• The Learning Curve
• Demo
• Q&A – Post an IM anytime

4.
Impact of Public Cloud
• Tools, capabilities, and technologies once only available to large
enterprise are now accessible and affordable
• The burden of maintaining the supporting infrastructure for these
is greatly reduced
• Responsibility for delivery of security is split
o Cloud provider has contractual obligation to provide secure foundation and
it serves their best interest to do so, and provide transparency
o Cloud provider shoulders the burden for attracting and retaining security talent
o Cloud consumer focusses on the security of the application versus application
and entire supporting infrastructure

5.
Supporting Tools for Secure Applications
TOOL CAPABILITY
Azure Security Center Alerts, Analysis, Recommendations
Azure AD Identity Protection
Alerts, Analysis, Guidance, Policy and
Enforcement
Application Insights Performance metrics, code level issues
Operations Management Suite
Log analytics, assessment, recommended
actions

6.
Azure Security Center
270%

7.
Azure Identity Protection

8.
Azure Application Insights

9.
Azure Operations Management Suite

10.
Q&A

11.
Supporting Capabilities for Secure Applications
CAPABILITY BENEFITS
AZURE RESOURCE
MANAGER
• Template based deployment
• Manage application infrastructure as source code
• Idempotency
• Resource Policy
• Resource Locks
AZURE STORAGE
ENCRYPTION
• Encryption for Data at Rest
• Client side libraries for encryption in transit

12.
Supporting Technologies for Secure Applications
• API Management
o Publish APIs rapidly, even from “legacy” services
o Secure access and protect from overuse
• Azure KeyVault
o HSM based storage for secrets (passwords, cryptographic keys)
o Auditable
• Azure SQL
o Azure AD integration for role based access control at the DB level
o Least-privilege design for access to DB services
• Virtual Machine Scale Sets
o Idempotent deployment at scale
o Disposable, ephemeral worker nodes

13.
Q&A

14.
DEMO

15.
The Learning Curve
• The learning curve for this can appear steep
• There are a multitude of resources
o Sample code and templates to provision resources
o Architecture Guidance
o Development Guidance
o Strong community of MS Partners

16.
Q&A