Azure Security Services, Features and Options. Ioannis Stavrinides Technical Evangelist, CEE MC

Transcription

1 Azure Security Services, Features and Options Ioannis Stavrinides Technical Evangelist, CEE MC

2 Agenda for today General security features Encryption Other security mechanisms Azure Active Directory security features Azure Key Vault SQL Db security features Azure Security Center

3 Securing your services shouldn t be an afterthought It should be the foundation of the process

4 General security features

5 Encryption

6 Encryption Data in transit Strong SSL/TLS cipher suite Perfect Forward Secrecy Datacenter-to-datacenter encryption Data at rest BitLocker disk encryption Per-file encryption for customer content

7 Encryption in Transit Azure Encrypts communication between Azure Datacenters Encrypts transactions through Azure Portal with HTTPS Supports FIPS Customer Can choose HTTPS for REST API (recommended) Configures HTTPS endpoints for application running in Azure Encrypts traffic between Web client and server by implementing TLS on IIS

8 Encryption at Rest Provides defense-in-depth against Offline attacks Online attacks when keys are used as a secondary AuthZ mechanism Encryption at-rest is required by certain sovereign laws and certifications

9 Azure Promises Control Customers can choose if and when data is encrypted Customers can choose what encryption keys are used and where they are stored Customers can decide at anytime to revoke access to the keys and data Transparency Customers have full visibility to the encryption state of their data Customers know at any time where their data is stored Customers have the ability to view logs at any time related to the stored data and keys

10 Encryption Models Encryption Models Server Encryption Client Encryption Server Side Encryption using service managed keys Server side encryption using customer managed keys in Azure KeyVault Server side encryption using on-prem customer managed keys Azure services can see decrypted data Microsoft manages the keys Full cloud functionality Azure services can see decrypted data Customer controls keys via Azure Key Vault Full cloud functionality Azure services can see decrypted data Customer controls keys On- Prem Full cloud functionality Azure services cannot see decrypted data Customer keep keys onpremises REDUCED cloud functionality

11 Other security mechanisms

12 Firewall Protection GA

13 Threat Detection GA

14 Network Security Group GA

15 Role Based Access Control GA

16 Azure Active Directory

17 GA Integration Federation for AD integration Directly from the Portal. No code necessary Using the Active Directory Authentication Library (ADAL) for custom scenarios

18 IN PREVIEW Azure AD B2C: IdMaaS for Applications Azure AD security, availability, and scalability for customer IDM Adds B2C features to Azure AD Social IdPs and application local accounts Self-service sign up, password reset, profile management Customizable sign in and sign up UI Same protocols, libraries, and programming model Consumption based pricing Meters for # of users and # of authentications

19 Azure AD B2C IN PREVIEW

20 GA Microsoft account + Azure AD Many apps want to sign users in from both Microsoft account and Azure AD Working on unified dev experience Single endpoint, OpenID Connect and OAuth 2.0 Single SDK Single end user sign in experience Single streamlined app registration experience, outside of Azure portal, no Azure subscription required Works with unified Office business + consumer APIs

21 IN PREVIEW Enhanced Device Support Windows 10 Azure AD Join: sign-in to desktop with Azure AD account Single sign on to: Kerberos-based on-premises applications Native applications that use WebAccountManager Web apps that support Azure AD sign-in

22 GA Multi Factor Authentication Authenticate the user over a different channel Text Call Authenticator app Secure Tokens Username/Password is something you know Second factor is something you own/have (device, RSA tokens etc)

23 GA Self Service Password Reset Administrators can create users and know only their initial password User must change password on first log-in Users can reset their password without contacting support Two factor authentication (phone, secondary )

24 GA Rights Management (RMS) Protect information from unauthorized access Protect information anywhere Audit and monitor usage

25 Azure Active Directory Advanced Monitoring Features

26 Brute Force attack

27 Sign in from anonymizing network IP Address:

28 Unlikely Travel Location: Seattle, WA Time: 8:29 AM, PST (3:29 PM, UTC) Location: Somewhere in Asia Time: 7:54 AM, local time (3:54 PM, UTC)

29 Tenant spanning activity X Bad password X Bad username X Bad password X Bad username X Bad password X Bad username IP Address: X Bad username X Bad password

30 Sign in from know, infected device

31 IN PREVIEW Active Directory Identity Protection Using the aforementioned features: Compiles risk score of attempt Surfaces data to administrators Admins can investigate and tend to events manually Policies for automated mitigation Request 2FA Block request

32 More AD Security features in Preview Privileged Identity Management Dynamic Group Membership Conditional Access Policies Password Rollover Self-Service Access Requests

33 Azure Key Vault GA

34 Secret management asks from our customers My app on Azure has passwords and cryptographic keys I need a safe place to save these in Azure. I need to (re)use AD users and groups to manage access to secrets. I do NOT want to be in the news for a silly mistake

35 Azure Key Vault An Azure resource provider that lets you Store & manage SECRETS (esp app config), and release them to authorized apps & users. Store & manage KEYS, and perform cryptographic operations in isolated service. Backed by Hardware Security Modules All secrets and keys are protected at rest with key chain terminating in HSMs. Keys marked as HSM-protected are protected even at runtime with HSMs. Key Vault customer s dedicated HSM Azure Key Vault is a multi-tenant service backed by Microsoft-managed HSMs.

36 Your ORG is in control via Active Directory Users and apps authenticate to your key vaults using your organization s Azure AD Benefits for organizations: Organizations can centrally revoke access to ALL key vaults in their organization. If a user leaves, they instantly lose access to ALL key vaults in the organization. Organizations can customize authentication via the options in Azure AD. Azure do not have ANY default access to customer key vault for disk encryption feature

37 Azure SQL Db

38 GA Transparent Data Encryption Regulatory Compliance TDE is a requirement for HIPAA, PCI, SOX etc Simplicity On by default (V12) Protects database, backups and logs Keys managed by the service Transparent No changes needed from the app

39 GA Row-Level Security Fine-grained Access Control Multi-tenant databases allow by definition access to it by different customers RLS allows to secure access to customer data from only the specific customer Application Transparency No change needed for queries Centralized Security Logic Logic in the database Schema-bound to the protected table Higher security, reduced app maintenance and complexity

40 Table.CreditCardNo IN PREVIEW Dynamic Data Masking Limit sensitive data exposure On the fly obfuscation Policy driven Multiple OOB functions available Define privileged users Recommends fields to mask Azure DB Dynamic Masking

41 IN PREVIEW Always Encrypted Client-side encryption for Azure SQL Db Data transparently encrypted inside a client driver Client manages keys Encrypted data is queryable Sensitive data remains encrypted at all times (never (!) decrypted)

42 IN PREVIEW Threat Detection Detects anomalous database activities indicating potential security threats to the database SQL Injection Logging of suspicious, anomalous behavior

43 Azure Security Center IN PREVIEW

44 Azure Security Center Prevent Detect Respond Integrated monitoring across subscriptions Broad ecosystem

45 Azure Security Center Prevention Monitor security state Define policies and provides recommendations Rapid deployment of security services

46 Azure Security Center Detection Collection and analysis of security data Leverage global threat intelligence data Advance analytics (Machine learning, Behavioral analysis)

47 Azure Security Center Respond Prioritize security incidents/alerts Insights to source of attacks and impacted resources Suggestions to stop attack and prevent future attacks

48 Links Encryption in Transit Encryption at Rest Azure IaaS Firewall Azure NetSec Whitepaper Azure NSGs Azure RBAC Azure AD AAD B2C Microsoft Account + AAD Azure AD Domain Services Azure AD MFA Azure AD Self-Service Pass Reset Azure RMS Azure AD Identity Protection Azure Key Vault Azure SQL Db TDE

49 Links Azure SQL Db Row-Level Security Azure SQL Db Dynamic Data Masking Azure SQL Db Always Encrypted Azure SQL Db Threat Detection Azure Security Center

50 Questions?

51 Thank you