Migrating an existing system to Microsoft Azure can be a challenge when strong security requirements need to be in place. There are multiple tools and services that help us to provide a secure environments that it is not in our own datacenter.
Often we are focusing to secure the application and systems that are running inside Azure and forgetting about the Azure Portal itself. We can have the most secure application inside Azure if our subscription is compromised and someone is able to access it as admin.
In this post, we will look on some basic mechanisms and policies that enable us to secure access to the Azure Portal and subscription.
Channels
There two ways to access an Azure Subscription and to any kind of changes.
1. Azure Portal: The main dashboard used to administrate our Azure Subscription
2. SMAPI: Over the Rest API exposed by Microsoft, command-line interfaces like PowerShell, Batch can be used with success or even custom applications
Multi-factor authentication
One of the first things that can be done to the accounts that are accessing Azure Subscription is to activate multi-factor authentication. Additional to the password, the use will be required to do a second authentication step using SMS, phone number and so on.
Smart Cards
Account can be secured using a Smart Card or similar devices that are based on TPM (Trusted Platform Module) chips. They are using an asymmetric key pair or certificate where the secret (private key) is stored on the device.
Azure Management Certificates
These certificates are generated by Azure and can be used by different system to access and manage Azure Subscription. These certificates enable us to manage the subscription without having to enter a username and password.
They are very powerful especially when you want to use in combination with a Remote Desktop Gateway hosted inside Azure and a VPN.
Connection Authorization Policies
These policies can be used when Remote Desktop Gateway is used and can ensure that the machine that connect to it, it is part of a specific domain and even check and validate the machine name.
Point-to-Site VPN
To ensure a more secure connection between client machines and Azure, a P2S VPN connection can be used to a machine hosted inside Azure. This would enable us to have a more communication channels between them. This is similar with having a Jump Box machine inside Azure.
Don’t forget that all communication with Azure management endpoints are over TLS.
Site-to-Site VPN
By using S2S VPN, your on-premises system is connected with your VNET network from Azure. As P2S VPN, this offers us a secure tunnel that can be used to communicate with Azure. A jump-box is not needed anymore; it is enough to configure traffic to Azure to goes over the S2S VPN directly.
NSG (Network Security Groups) and IP Restrictions
When a jump box with(out) a VPN connection it is used, NGS and IP Restrictions can be used to restrict access to the jump box.
Express Route
Express route is offering a dedicated and secure communication channel between your on-premises system and Azure. The private connection with Azure ensures are that there are no man in the middles.
Restrict number of users
Try to keep the number of users that have access to the subscription as low as possible. Many times 2-3 people are more than enough to have admin/co-admin rights.
Jump-box with Azure Management Certificates
This enable us to provide limited access to the Azure Portal through Remote Desktop Gateway without sharing with the user the credentials. The certificate that it is installed on the jump-box will provide access to Azure Management API.
This requires of course extra security measure at jump-box level.
Conclusion
Many feature and capabilities enable us to secure access to Azure Portal and Management API. Beside these, don’t forget that in the most of the cases people are the breach and not the system itself.
Often we are focusing to secure the application and systems that are running inside Azure and forgetting about the Azure Portal itself. We can have the most secure application inside Azure if our subscription is compromised and someone is able to access it as admin.
In this post, we will look on some basic mechanisms and policies that enable us to secure access to the Azure Portal and subscription.
Channels
There two ways to access an Azure Subscription and to any kind of changes.
1. Azure Portal: The main dashboard used to administrate our Azure Subscription
2. SMAPI: Over the Rest API exposed by Microsoft, command-line interfaces like PowerShell, Batch can be used with success or even custom applications
Multi-factor authentication
One of the first things that can be done to the accounts that are accessing Azure Subscription is to activate multi-factor authentication. Additional to the password, the use will be required to do a second authentication step using SMS, phone number and so on.
Smart Cards
Account can be secured using a Smart Card or similar devices that are based on TPM (Trusted Platform Module) chips. They are using an asymmetric key pair or certificate where the secret (private key) is stored on the device.
Azure Management Certificates
These certificates are generated by Azure and can be used by different system to access and manage Azure Subscription. These certificates enable us to manage the subscription without having to enter a username and password.
They are very powerful especially when you want to use in combination with a Remote Desktop Gateway hosted inside Azure and a VPN.
Connection Authorization Policies
These policies can be used when Remote Desktop Gateway is used and can ensure that the machine that connect to it, it is part of a specific domain and even check and validate the machine name.
Point-to-Site VPN
To ensure a more secure connection between client machines and Azure, a P2S VPN connection can be used to a machine hosted inside Azure. This would enable us to have a more communication channels between them. This is similar with having a Jump Box machine inside Azure.
Don’t forget that all communication with Azure management endpoints are over TLS.
Site-to-Site VPN
By using S2S VPN, your on-premises system is connected with your VNET network from Azure. As P2S VPN, this offers us a secure tunnel that can be used to communicate with Azure. A jump-box is not needed anymore; it is enough to configure traffic to Azure to goes over the S2S VPN directly.
NSG (Network Security Groups) and IP Restrictions
When a jump box with(out) a VPN connection it is used, NGS and IP Restrictions can be used to restrict access to the jump box.
Express route is offering a dedicated and secure communication channel between your on-premises system and Azure. The private connection with Azure ensures are that there are no man in the middles.
Restrict number of users
Try to keep the number of users that have access to the subscription as low as possible. Many times 2-3 people are more than enough to have admin/co-admin rights.
Jump-box with Azure Management Certificates
This enable us to provide limited access to the Azure Portal through Remote Desktop Gateway without sharing with the user the credentials. The certificate that it is installed on the jump-box will provide access to Azure Management API.
This requires of course extra security measure at jump-box level.
Conclusion
Many feature and capabilities enable us to secure access to Azure Portal and Management API. Beside these, don’t forget that in the most of the cases people are the breach and not the system itself.
Comments
Post a Comment