Series:
(Disclaimer: The
manuscript is my personal view and is not affiliated to any groups or
organizations)
In the first phase of migrating
application to Cloud it is imminent that security should be considered as a
whole. Cloud compels architects to consider security from a different angle.
Security, privacy,
and compliance should be considered together and shouldn’t be underestimated.
Data breach of a company reduces the trusts of its customers. There are ample illustration
of these incidents over recent times.
The below picture depicts different
categories of security, privacy, and compliance. It is essential to understand
the various responsibilities between Azure (or AWS) (green colored) and the company
(yellow colored.)
 |
| Security Categories |
Security: -
(#1 through #6) Both Cloud
provider and company are responsible. Different types of security are discussed
below. Azure’s physical perimeter, personnel background, etc. takes of the security.
Continuous monitoring, etc. provides a robust Physical security. Azure constantly
monitor’s all hardware persistently. Resiliency is built into all different hardware
assets such as machines, network gears, etc. Azure leverages machine learning
and uses the already proven complex algorithms used by bing, xbox live, etc. to
detect anomalies in its operations. As an illustration, if two authentications
have taken place in a span of minutes from two geographically far reached
places which defies laws of physics then this is considered an anomaly. For
IaaS, security of the virtualized OS is the responsibility of Azure. For PaaS
such as Azure SQL DB, Document DB, Redis, Service Bus, etc. security of the
software platform is the responsibility of Azure.
#7 IaaS: NSG, Vnet, ACL: - Your
application should set up a DMZ with proper ACLs implements via NSG rules. Don’t
expose either application servers or backend servers to public J
#8 Application access: - The mechanism
which is already in place for end user to access the web applications shouldn’t
be changed in this phase. SSL certs should be reused.
#9 Infrastructure Authentication:
- Securely connecting to Azure infrastructure by company personnel is a
paramount to security. Azure provides various options to connect on-perm infrastructure
to Azure. Both private and public Internet could be used. At the least using
public Internet ensure usage of secure SSH. Site-to-Site (public IP and vpn
device or RAS is needed) and Point-to-Site (only VPN client) are other two form
of encrypted connection over public Internet. ExpressRoute (Exchange Provider, and
Network provider) is a private connection to Azure. For production
point-to-site is not recommended.
Data Security (#10 through #13):
- User data and application generated data (such as logs) should take into
security both at rest and in motion. Logs pushed to and stored in Azure Storage
should be only to authorize personnel. Azure Storage provides Shared Access
Signature at a container level to provide this granular level.
Compliance:-
(#14 and #15)
Azure has certified and compliant
with more than a dozen auditor and industry standards such as ISO 27001/27002,
SOC 1/SSAE 16/ISAE 3402 and SOC 2, Cloud Security Alliance CCM, FedRAMP, FISMA,
FBI CJIS (Azure Government), PCI DSS Level 1, United Kingdom G-Cloud,
Australian Government IRAP, Singapore MTCS Standard, HIPAA, EU Model Clauses,
Food and Drug Administration 21 CFR Part 11, FERPA, FIPS 140-2, CCCPPF, and,
MLPS.
You should also conduct your
own audit. Auzre provides SOC report to your auditor.
Privacy: -
(#16 and #17)
Azure ensures that data within a
region never leaves the region from regulation perspective. User data is not
available to any Azure operational personnel. Any activity pertinent to user
data happens with complete Company’s knowledge and involvement. PII user data should be stored using proper encrypted
mechanism such as AES 256 encryption.
No comments:
Post a Comment