1. Enterprise Security in Practice
5/20/ :12 PM
THR3067
Enterprise Security in Practice
Radu Vunvulea
Senior Architect, Endava
@RaduVunvulea
© Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

2. Purpose
Discover how we can mitigate enterprise security requirements using Microsoft Azure resources

3. Enterprise and security
5/20/ :12 PM
Enterprise and security
Slow feedback
Lack of flexibility
High number of stakeholders
© Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

4. 5/20/ :12 PM
Infrastructure
© Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

5. Sandbox Each System is isolated inside a sandbox
5/20/ :12 PM
Sandbox Each System is isolated inside a sandbox
Group resources
Control
Manage
Resource Group
System
© Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

6. Direct access Direct communication between resources inside System
5/20/ :12 PM
Direct access Direct communication between resources inside System
Same network
Visible between each other
Easy access and control
VNET
Resource Group
System
© Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

7. Isolation Control traffic inside and outside a network
5/20/ :12 PM
Isolation Control traffic inside and outside a network
NSG
Restric traffic
Controls what goes to and from VNET
Isolate from outside
VNET
Resource Group
System
© Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

8. NSG – Tips and Tricks Don’t remove default rules Rules priority
Control traffic that goes to the same network
Load Balancer probes
Allow outbound traffic
Rules priority
Rules are checked in the order of priority
Multiple association
Same NSG can be associate to multiple resources

9. Cross System communication Control traffic between Systems
5/20/ :12 PM
Cross System communication Control traffic between Systems
VNET
VNET
Specify what can be exchange between Systems
Full control on inbound and outbound traffic
System A
System B
NSG
© Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

10. Integrate with company firewall security policies
5/20/ :12 PM
Integrate with company firewall security policies
© Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

11. Network Virtual Appliance Protection and monitoring capabilities
5/20/ :12 PM
Network Virtual Appliance Protection and monitoring capabilities
VNET
Control security from only one location
Cross location synchronization
NGFW
NGFW
Appliance
System A
© Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

12. Monitor and Audit Monitor all traffic that goes through a VNET
5/20/ :12 PM
Monitor and Audit Monitor all traffic that goes through a VNET
VNET
All traffic goes through virtual appliance
Push audit data to on-premises system
Firewall, IDS, IPS
System
Virtual
Appliance
UDR
© Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

13. 5/20/ :12 PM
Traffic Control
© Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

14. 5/20/ :12 PM
External traffic control External traffic needs to come only from on-premises
NSG & NVA
Full control of IP Filtering
Traffic goes through VPN
VNET
S2S
VPN
System
Internet
© Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

15. 5/20/ :12 PM
IPSec VPN terminated outside firewall VPN connection shall be terminated on dedicated IPSec router
VNET
Cannot be done using S2S VPN
VPN terminated before NGFW, inside Virtual Gateway Appliance
S2S
VPN
System
NGFW
VG Appliance
© Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

16. 5/20/ :12 PM
IPSec VPN terminated outside firewall VPN connection shall be terminated on dedicated IPSec router
VNET
Appliance plays the role of firewall and VPN Gateway
S2S
VPN
System
VNS3
© Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

17. 5/20/ :12 PM
Device authentication using certificates VPN connection shall rely on certificates
VNET
Supported only for Point-to-Site VPN
Site-to-Site VPN is connected directly to VPN hardware
System
VG Appliance
certificates
© Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

18. 5/20/ :12 PM
Cascaded Virtual Appliances Dedicated firewall, auditing, stateful, antivirus
VNET
Multiple virtual appliances connected together
VNS3
NGFW
System
© Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

19. Independent log management server

20. 5/20/ :12 PM
Central logging data Available for at least 180 days, longer retention policies
Activity Logs
Azure Diagnostic Logs
AAD Reporting
VM and Cloud Services
Storage Analytics
Network Security Groups
Application Insights
Security Alert
Color Map:
Configurable, +180 days, 90 days
© Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

21. Monitor and react - OMS Respond to alerts in a timely manner
5/20/ :12 PM
Monitor and react - OMS Respond to alerts in a timely manner
Agent
Log Analytics Repository
Alerts
Cloud
Log Search
API
© Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

22. API and Infrastructure changes
5/20/ :12 PM
API and Infrastructure changes
Cloud service provider can make changes only after the nature of change is understood and a security assessment is done.
YES: Microsoft announce 12 months in advance any breaking changes at API or functionality level.
NO: Infrastructure and services change are done on the fly as long as the API or functionality is not altered.
© Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

23. Azure Active Directory

24. 5/20/ :12 PM
Identity and Access Management System shall be integrated with the following systems AD
TIM/TAM
EAI
ADFS
TFIM
SecurID
© Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

25. Azure Active Directory The gold mine of enterprises
5/20/ :12 PM
Azure Active Directory The gold mine of enterprises
Separation of duties
Access policies
Remote access accounts
Multi-factor authentication
Encrypted password
Password hashed in motion
Identity life-cycle management
Accounts updated immediately
Password policies compliant
Users federation
Role-based access
Edge authentication
© Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

26. 5/20/ :12 PM
Final thoughts
© Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

27. Mitigation Document and Mitigate 5/20/2018 11:12 PM
© Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

28. 5/20/ :12 PM
Q&A
© Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

29. Please evaluate this session
Tech Ready 15
5/20/2018
Please evaluate this session
From your
Please expand notes window at bottom of slide and read. Then Delete this text box.
PC or tablet: visit MyIgnite
Phone: download and use the Microsoft Ignite mobile app
Your input is important!
© 2012 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries.
The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

30. 5/20/ :12 PM
© Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.