Describe general security and network security features

 Describe general security and network security features

Azure General security:

When you ask anyone who is considering migrating to the cloud about their worries, the majority will cite security. But, exactly, what does "security" imply? Security has several facets, and it begins with ensuring that your resources are properly set for security. Even if you have done everything correctly, you may still be vulnerable to malicious actors. Employees acquire access to critical data and systems, posing a risk from inside. Employees that are malicious can compromise security, and there's also the possibility that a well-intentioned employee can accidentally create a security problem.

·         Azure Security Center:

Most businesses have someone whose job it is to learn best practises and guarantee that the business follows them. Because of the enormous number of services accessible in Azure, knowing those best practises might be difficult. This work is made considerably more difficult by the fact that Azure is always growing and evolving.

Fortunately, Azure Security Center can not only keep you up to date on best practises, but it can also guide you through the actions you need to do to maintain your resources set in a safe manner. Security Center can also assist you in maintaining the security of your on-premises resources.

·         Key Vault:

The majority of apps make use of confidential or sensitive data. An application that utilises a database, for example, has to know how to connect to the database, and this information is kept in a connection string. A username and password that secures the database may be contained in the connection string, and keeping that username and password in a plain text file would be an apparent security issue.

Secrets, keys, and certificates can be safely stored with Azure Key Vault. Once an item is saved in Key Vault, security policies may be applied to control which people and programs have access to it. Key Vault is protected with encryption keys, however neither the encryption keys nor the encrypted data are visible to Microsoft.

·         Azure Sentinel:

Many firms employ tested and proven frameworks to secure data and resources, such as SOAR (Security Orchestration, Automation, and Response) or SIEM (Security Information and Event Management) (Security Information and Event Management). In fact, several businesses employ SOAR and SIEM in tandem.

SOAR and SIEM implementation might be difficult. Many firms use security specialists to establish security measures in their operations. Microsoft wants SOAR and SIEM to be simple to set up, even for non-security professionals. Azure Sentinel is the product of their efforts.

·         Azure Dedicated Host:

When you build a virtual machine, it operates on a host computer, whether it's in Azure or elsewhere. The virtual machine is generated on the host computer, which is a physical computer with its own operating system. The VMs you create in Azure are devoted to you, but the host machine frequently contains VMs allocated to other customers running on it.

Many individuals benefit from a dedicated VM on a shared host machine, but if you work in an industry or for a firm that has compliancy criteria that can't be satisfied with a shared host computer, you may have some apps that you can't shift to the cloud. Fortunately, Azure Dedicated Host offers a solution.

When you utilise an Azure Dedicated Host to host your VMs, the actual host computer that hosts your VMs is only for your usage. On that host computer, no other customer VMs will run. Naturally, Azure Dedicated Host isn't the cheapest method to host VMs, but if your compliance needs demand absolute isolation of your VMs, the expense of a dedicated host machine is justified.

Azure Network security:

The network is yet another aspect of security. Securing the network necessitates a distinct set of tools and abilities. Businesses frequently hire experts to assist with network security, much as they do when planning data and resource security. However, with Azure, a substantial portion of network security is handled for you. Even so, you'll need to take certain precautions to protect yourself.

·         Defense in depth:

Take a trip back to mediaeval times and imagine what it was like to live in a castle for a minute. In many respects, these were not friendly times, and there was constantly a hostile army attempting to gain access to the citadel. Moats were erected around castles to keep invaders out. The moat's goal was to keep an opposing force from digging beneath the wall and obtaining access.

 

Archers along the castle's high wall would constitute a significant threat to attackers approaching the castle even before they reached the moat. If an enemy force managed to get past the archers and across the moat, they would be confronted by a high wall and a solid gate. They might be able to make it if they work hard enough.

·         Network Security Groups (NSGs):

 

You may use a Network Security Group (NSG) to filter traffic on your network and apply rules to it. An NSG has many Azure-provided built-in rules that enable your virtual network's resources to connect with one another. The NSG may then be customised to regulate traffic into and out of the network, as well as between network resources.

·         Azure Firewall:

A firewall, in computer terms, is an appliance that allows network traffic to flow into and out of a specific network. A firewall's job is to allow only desired traffic onto the network while rejecting any communication that might be harmful or originates from an unknown source. Using rules that describe a source and destination IP address range and port combination, a firewall enforces network control.

By default, all traffic is rejected in a conventional firewall arrangement. A rule must match the traffic in order for the firewall to enable it to get through. Create a firewall rule that enables communication to ports 80 and 443 if you want to allow someone on the public Internet to access a web application you have operating on a specific server (the ports for HTTP and HTTPS traffic). The rule is then set up to deliver that traffic to your web server.

The Azure Marketplace has a number of firewalls from third parties, but Microsoft also has its own firewall, Azure Firewall. Azure Firewall is a PaaS solution in Azure that's simple to use and has a 99.95% uptime guarantee. You don't have to worry about traffic surges creating delay or downtime for your apps since Azure Firewall adjusts according to your networking requirements.

·         Azure DDoS Protection:

Distributed denial of service (DDoS) attacks can affect cloud services that are accessible from the Internet through a public IP address. DDoS assaults can exhaust an application's resources and, in certain cases, render it entirely unusable until the attack is neutralised. DDoS assaults may also be used to exploit application security holes and target systems that the application connects to.

 

DDoS Protection is a feature of Azure that helps guard against DDoS attacks. Azure Virtual Networks has a function called DDoS Protection.