Azure Fundamentals Part 3

Editor's Notes

• #3: We have a lot to cover and may not get to live questions at the end. Please send your questions to Sami, and I will get back to you after the webinar. Provided is my contact information and reach out any time. I do provide half day and full day workshops for this course. The workshops are more hands on and we do more live demos within the product. Something to note if interested.
• #5: Once again, here is the exam layout. In part three of our three part series, we will be focusing on understanding security, privacy, compliance, and, trust which is 25-30% of the exam.
• #6: As mentioned in part 1, I used 2 resources and spent around $16 combined for those resources. The exam itself is $99. This is the same study plan I used for the AZ-900 exam: Microsoft Learn Platform Whizlabs If you want to learn more about these and how I leveraged them for the exam, request part 1 of the webinar series from Sami.
• #7: Every system, architecture, and application needs to be designed with security in mind. Before we begin better understanding Azure Security, let’s look back at some of the biggest data breaches of the 21st century. From 2014-2018, a data breach impacted over 500 million Marriott customers. The breach actually occurred on systems supporting Starwood hotel brands starting in 2014. The attackers remained in the system after Marriott acquired Starwood in 2016 and were not discovered until September 2018. From 2013 to 2014, 3 billion user Yahoo accounts were breached. In September 2016, while in negotiations to sell itself to Verizon, it announced it had been the victim of the biggest data breach in history, likely by “a state-sponsored actor,” in 2014. The attack compromised the real names, email addresses, dates of birth and telephone numbers of 3 billion users. The breaches knocked an estimated $350 million off Yahoo’s sale price. Verizon eventually paid $4.48 billion for Yahoo’s core Internet business.
• #8: Let’s first discuss how we secure our data center. Physical security – who can access the building and touch server racks. Microsoft invests heavily in protecting Azure’s infrastructure with walls and security cameras, security personnel, and strict procedures for employees. Should be noted, Microsoft has the most cloud certifications from outside vendors among all cloud vendors to date. Digital Security – who can connect to your systems and data over the network Azure is a network of large data center throughout the world. There are real security threats when companies deploy compute resources like VMs that run company applications and services in the cloud as well as data stored in the cloud and data traveling outside of Azure and across the public internet. There are security threats at each endpoint, for example user devices or computers, that consume data or services. It is very important to note, Microsoft provides the tools that help mitigate the threats, but the user must use these tools to protect the resources they use. To assist with security, Microsoft provides two-factor authentication and role-based access control to authorized users. Data encryption is avaible, which provides a second layer of security in case of a breach. Users can monitor login failures, login attempts from suspicious locations, etc. Microsoft provides automatic denial of service protection, real-time telemetry to see where requests are coming from, firewalls to block malicious traffic.
• #9: As previously mentioned, Azure has over 90 compliance offerings and some are displayed here. Now you do not need to know all these, but there will be a few exam questions around compliance offerings. For example, I had four matching questions where I needed to properly match NIST, ISO, GDPR, and SOC to their appropriate groupings. Let’s start with: ISO - The International Organization for Standardization is an international standard-setting body composed of representatives from various national standards organizations NIST - The National Institute of Standards and Technology is a physical sciences laboratory and a non-regulatory agency of the United States Department of Commerce.  GDPR - The General Data Protection Regulation 2016/679 is a regulation in EU law on data protection and privacy in the European Union and the European Economic Area. 
• #10: I found this image very impactful. The important thing to note here is the shift in commodity responsibilities to the provider. The question becomes, how will you allocate your employees, time, resources to other challenges now that the commodity responsibilities have been shifted to the provider?
• #11: Before we begin responsibility of services, you should note that regardless of the deployment type, you always retain responsibility for the following items: Data Endpoints Accounts Access management IaaS (Infrastructure as a Service): Organization responsibility to patch and secure operating systems and software, as well as configure network to be secure. Security advantage of having outsourced concern over protecting the physical parts of the network. PaaS (Platform as a Service): Azure is taking care of the operating system and of most foundational software like database management systems. Everything is updated with the latest security patches and can be integrated with Azure Active Directory for access controls. “Point and click" within the Azure portal or run automated scripts to bring complex, secured systems up and down, and scale them as needed. SaaS (Software as a Service): Organization outsources almost everything. The code is controlled by the Microsoft Azure but configured to be used by the organization. Well I am a visual learner, what does this look like: Show chart.
• #12: Lets discuss defending our information. Defense in Depth: If one layer is breached, a subsequent layer is already in place to prevent further exposure. Microsoft applies a layered approach to security, both in physical data centers and across Azure services. The objective is to protect and prevent information from being stolen by individuals who are not authorized to access it. Now we will discuss these layers in more detail.
• #13: It's the responsibility of those storing and controlling access to data to ensure that it's properly secured.
• #15: Before bullets: Malware, unpatched systems, and improperly secured systems open environment to attacks. So you want to Secure access to virtual machines. Implement endpoint protection and keep systems patched and current.
• #16: Before bullets: By limiting this communication, the organization reduces the risk of lateral movement throughout the network. Limit communication between resources. Deny by default. Restrict inbound internet access and limit outbound, where appropriate. Implement secure connectivity to on-premises networks.
• #17: Before bullets: Identifying these attacks, eliminating their impact, and alerting the org when they happen are important ways to keep the organizations network secure. Use distributed denial of service (DDoS) protection to filter large-scale attacks before they can cause a denial of service for end users. Use perimeter firewalls to identify and alert on malicious attacks against your network. If you remember from Part 2 of our Azure series, a distributed denial-of-service (DDoS) attack is one of the most powerful weapons on the internet. When you hear about a website being “brought down by hackers,” it generally means it has become a victim of a DDoS attack. In short, this means that hackers have attempted to make a website or computer unavailable by flooding or crashing the website with too much traffic.
• #20: There are motion sensors, 24x7 protected access, biometric access systems, video surveillance, security breach alarms, and I am sure some other pretty formidable things unknown to most.
• #21: Identity management provides authentication, privileges, authorization, and roles of the enterprise boundaries. The main purpose is to upgrade security and productivity by decreasing the total cost, repetitive tasks, and system downtime.
• #22: If you have O365, you have Azure AD. Administrators and developers can control access to internal and external data and applications using centralized rules and policies. The Azure Active Directory (Azure AD) enterprise identity service provides single sign-on and multi-factor authentication to help protect your users from 99.9 percent of cybersecurity attacks.
• #23: Multi-factor example: You have a user who logs in from Los Angeles. 20 minutes later that same user logs in from Tokyo. Using this method, the second login attempt would be forced to provide a secondary means of authentication. Something you know Something you possess Something you are
• #24: Application Management: Access Panel is a web based portal that allows users to reset their own passwords, and it provides a list of all the groups users can join within the organization. B2B identity services: Customize and control how users sign up, sign in, and manage their profiles when using your apps with services.
• #25: Symmetric Example: Consider a desktop password manager application. You enter your passwords and they are encrypted with your own personal key (your key is often derived from your master password). When the data needs to be retrieved, the same key is used, and the data is decrypted. Asymmetric Example: Used for things like Transport Layer Security (TLS) (used in HTTPS) and data signing. Both symmetric and asymmetric encryption play a role in properly securing data and Encryption is typically approached in two ways: Encryption at rest and Encryption in transit. Lets discuss those a little more.
• #26: The actual data that is encrypted could vary in its content, usage, and importance to the organization. 2. Data at rest is the data that has been stored on a physical medium, stored on the disk of a server, data stored in a database, or data stored in a storage account. Encryption of Data Example: If an attacker was to obtain a hard drive with encrypted data and did not have access to the encryption keys, the attacker would not compromise the data without great difficulty. In the Graphic: This financial information could be critical to the business, intellectual property that has been developed by the business, personal data about customers or employees that the business stores, and even the keys and secrets used for the encryption of the data itself.
• #27: Encrypting the Data Example: HTTPS = application layer in transit encryption. In the graphic, Customer data is encrypted as it's sent over the network. Only the receiver has the secret key that can decrypt the data to a usable form.
• #28: Key Vault helps control applications' secrets by keeping them in a single, central location and by providing secure access, permissions control, and access logging capabilities.
• #29: Azure has a layered approach to network security. Reduces risk of exposure through network-based attacks. Several available services and capabilities to secure your internet-facing resource, internal resources, and communication between on-premises networks. Combine multiple Azure networking and security services to manage network security and provide increased layered protection. Example: use Azure Firewall to protect inbound and outbound traffic to the Internet, and Network Security Groups to limit traffic to resources inside virtual networks.
• #31: Azure creates the following default rules in each network security group that you create: You cannot remove the default rules, but you can override them by creating rules with higher priorities. Name: A unique name within the network security group. Priority: A number between 100 and 4096. Rules are processed in priority order, with lower numbers processed before higher numbers, because lower numbers have higher priority. Once traffic matches a rule, processing stops. Source or destination: Any, or an individual IP address, (CIDR) block (10.0.0.0/24, for example), service tag, or application security group. If you specify an address for an Azure resource, specify the private IP address assigned to the resource. Protocol: TCP, UDP, ICMP or Any. Direction: Whether the rule applies to inbound, or outbound traffic. Port range: You can specify an individual or range of ports. For example, you could specify 80 or 10000-10005. Specifying ranges enables you to create fewer security rules. Action: Allow or deny Highlighting port further, you will likely see port 80 or port 443 on the exam within examples. A little background information, port 80 was chosen as the default HTTP port and 443 as the default HTTPS port. HTTPS (443) is HTTP with encryption. The only difference between the two protocols is that HTTPS (443) uses TLS (SSL) to encrypt normal HTTP (80) requests and responses. As a result, HTTPS is far more secure than HTTP. A website that uses HTTP has http:// in its URL, while a website that uses HTTPS has https://
• #32: Microsoft Azure Information Protection (sometimes referred to as AIP) is a cloud-based solution that helps organizations classify and optionally protect documents and emails by applying labels. Labels can be applied automatically based on rules and conditions. Labels can also be applied manually. Guide users to choose recommended labels with a combination of automatic and manual steps. Here is an example of AIP in action on a user's computer. The administrator has configured a label with rules that detect sensitive data. When a user saves a Microsoft Word document containing a credit card number, a custom tooltip is displayed. This label is configured by the administrator. Using this label classifies the document and protects it. Analyze data flows to gain insight into your business Detect risky behaviors and take corrective measures Track access to documents Prevent data leakage or misuse of confidential information
• #33: Last image: Installed directly on your domain controllers, the Azure ATP sensor accesses the event logs it requires directly from the domain controller. After the logs and network traffic are parsed by the sensor, Azure ATP sends only the parsed information to the Azure ATP cloud service (only a percentage of the logs are sent).
• #34: The Microsoft SDL became an integral part of the software development process at Microsoft in 2004. The development, implementation, and constant improvement of the SDL represents a strategic investment to the security effort. This is an evolution in the way that software is designed, developed, and tested, and has now matured into a well-defined methodology. Now, over a decade later, the Microsoft SDL continues to be fundamental to how Microsoft develops products and services. With the rise of mobile, cloud computing, Internet of Things, artificial intelligence, and other new technologies, Microsoft continues to evolve the practices.
• #35: Note: This is highly introductory. Security is a deep and complex topic, so whatever your cloud approach, an ongoing security education is necessary.
• #36: he Azure Resource Manager service is designed for resiliency and continuous availability.  Azure Resource Manager is the deployment and management service for Azure. It provides a management layer that enables you to create, update, and delete resources in your Azure account. You use management features, like access control, locks, and tags, to secure and organize your resources after deployment. We are going to drill down into these further. Graphic: When a user sends a request from any of the Azure tools, APIs, or SDKs, Resource Manager receives the request. It authenticates and authorizes the request. Resource Manager sends the request to the Azure service, which takes the requested action. Because all requests are handled through the same API, you see consistent results and capabilities in all the different tools. The following image shows the role Azure Resource Manager plays in handling Azure requests. 
• #37: Graphic: You apply management settings at any of these levels of scope. The level you select determines how widely the setting is applied. Lower levels inherit settings from higher levels. For example, when you apply a policy to the subscription, the policy is applied to all resource groups and resources in your subscription. When you apply a policy on the resource group, that policy is applied the resource group and all its resources. However, another resource group doesn't have that policy assignment. Lets discuss these levels in more detail.
• #38: In the early days, subscriptions had limits and those limits helped decide whether your subscriptions needed to sprawl.  This was mostly based on whether or not you were supporting customer or breaking up your subscriptions across different departments.  The biggest issue with this sprawl was how to manage it, both from a security and policies standpoint.  Then Azure management groups entered the picture. When I say sprawl or Data sprawl, it refers to the overwhelming amount and variety of data produced by enterprises every day. With the growing number of operating systems, data warehouses, various BYOD (Bring Your Own Device) devices, and enterprise and mobile applications, it’s no wonder that the proliferation of data is becoming a problem. Azure management groups provide a way for an organization to control and manage access, compliance, and policies for their subscription within their tenant. Management groups allow you to order your Azure resources hierarchically into collections, which provide a further level of classification beyond subscriptions.
• #39: Azure governance consists of 5 capabilities (Policy, Blueprints, Resource Graph, Management Group, Cost Management) to ensure you will have the right tools for your applications or workload teams, so they can use cloud resources in an accountable & responsible fashion.
• #41: It serves as a single billing unit for Azure resources in that services used in Azure are billed to a subscription. An Azure subscription is linked to a single account, the one that was used to create the subscription and is used for billing purposes. ... Free Azure accounts can be converted to pay-as-you-go accounts. Azure offers free and paid subscription options to suit different needs and requirements. An account can have one subscription or multiple subscriptions that have different billing models, and to which you apply different access-management policies.
• #42: The resource group can include all the resources for the solution, or only those resources that you want to manage as a group. You decide how you want to allocate resources to resource groups based on what makes the most sense for your organization. Generally, add resources that share the same lifecycle to the same resource group so you can easily deploy, update, and delete them as a group. The resource group stores metadata about the resources. Therefore, when you specify a location for the resource group, you are specifying where that metadata is stored. For compliance reasons, you may need to ensure that your data is stored in a particular region. Resource groups are a logical container for resources deployed on Azure and are anything created in a Azure subscription like Virtual machines, Application Gateways, CosmosDB.
• #44: And here is what the tags look like in the portal.
• #46: RBAC provides fine-grained access management for Azure resources, enabling organizations to grant users the specific rights they need to perform their jobs. Using RBAC, you can:
• #47: Further protection, how can we protect or how can administrators protect themselves from doing something they may not have intended to do. And important to note, even if you are an owner of the resource, you must still remove the lock before you'll actually be able to perform the blocked activity.
• #48: A. User Defined Routes. You can create custom, or user defined routes in Azure to override Azures default system routes or add additional routes to a subnets route tables.
• #49: A. Yes. Authentication methods of both multi factor and self service password reset are the usage, SMS (short message service) is the authentication method.
• #50: B. No. Support also for components like Azure SQL and Storage services.
• #51: A. Azure key vault. You can import or generate keys.
• #52: That concludes part three of our three part series. Thank you for all those who attended todays session and the previous sessions. I wish you the best of luck on your pursuit of AZ-900 and other Azure certs. Over to Sami.