How to Implement Best Practices for Microsoft Azure

Microsoft Azure can be a big game-changer for businesses, offering a wealth of capabilities and flexibility, on top of added security. However, in order to be secure, it is important that you put a variety of best practices into play.

To do so, let’s begin by reiterating why security is your problem, rather than Microsoft’s.

Azure Splits Responsibility Between the User and Microsoft

Depending on how you are using Microsoft’s products and services, the onus of security falls one way or the other. Basically, while you’re using a service that Microsoft provides via the cloud, they will ensure that the cloud infrastructure remains secure… leaving the security of your cloud services and resources on you.

This is something that you should always think about—even when entrusting a third-party with your information, it is really up to you to do your best to protect yourself. The simplest, most common example would be protecting your credit card information that’s plugged into your Netflix account. Yes, it is Netflix’s responsibility to not let someone steal your credit card information, but it is your responsibility to have a secure password and not reuse the same password elsewhere. Either way, you need to take proactive measures.

This makes it all the more important that you abide by various security best practices, like the principle of least privilege, in order to minimize the threats that could impact your cloud services, or any data for that matter. The more things are restricted, the more secure they will be.

Best Practices to Help Ensure Your Azure Deployment Remains Secure

Here’s the thing—at its most basic level, Azure is just another computing environment, just like any cloud service really is. That means that many of the best practices you’d want your team members to follow in terms of your own infrastructure apply equally well when using Microsoft's cloud platform. Think about how you’d handle data on your own infrastructure… best practice dictates that you do the same for that in the cloud.

Let’s outline a few ways this should take shape:

Secure Storage

You need to ensure that, first and foremost, access to your Azure assets is limited only to those who need it. A combination of access control measures and firewalls will go far in only allowing those with authorization in. Enabling auditing also allows you to review any changes made. In the right/wrong situation, it might be what allows you to identify a pattern and catch a threat. Azure can also be set to alert you when security-related incidents are registered.

• Restrict access to storage and databases to only the users and services that need it.
• Enable auditing for your databases.
• Set up log alerts in the Azure Monitor.
• If you use Azure SQL, activate threat detection for it.
• Enable soft deletes, which will keep deleted data for 14 days in case it is maliciously deleted.

Data Encryption

One aspect of data security that isn’t discussed often enough is how important it is to identify all of your sensitive data, as this will help inform the rest of your security planning. If you don’t know what data you have and where it is being stored, generated, and/or transmitted from/to, it will be difficult to ensure that all sensitive data is being addressed appropriately.

At the same time, it is important that your data is also being shielded appropriately, regardless of whether it is being stored or sent someplace. To this end, all of your data should be encrypted. Ideally, this data should also only be accessible by those who directly need it to perform their tasks, minimizing the threat landscape.

• Encrypt all data at rest and in transit.
• Use Azure Vault Key or a similar solution to securely manage keys and certs.
• Utilize Azure Information Protection to streamline security efforts.
• Protect your endpoints that access your sensitive data.
• Fully backup all data and test this backup regularly!

Compliance

It is also key that you know what compliance requirements apply to your data and what these requirements dictate that you do. Like we said above, Microsoft is only going to make sure that Azure and its services remain secure… your individual use of it is all on you.

We Can Help You Ensure Your Azure Implementation Remains Secure

There is a whole lot more to think about, depending on your configuration and what you have running in your cloud environment. That being said, proactively establishing security best practices makes it easier to maintain security over the long run.

Reach out to us to learn more about what we can do to improve your entire information technology strategy and make each facet of it simpler and more effective for you. Give us a call at (250) 483-5623.