Between its reliability and its robust scalability, Azure has become an integral part of many organizations' cloud architecture. Unfortunately, like all cloud platforms, there are security risks to keep in mind. And while there are countless Azure security tips online, sifting through them is a time sink, and it’s hard to know which sources to trust.
To streamline the process, we’ve collected the top 5 Azure cloud security best practices in one place. Read on to find out how to secure your Azure deployment. But before turning to the Azure security best practices checklist, let’s take a quick look at a few key concepts.
Azure Security Best Practices [Cheat Sheet]
This cheat sheet explores detailed aspects of Azure best practices, from role-based access control (RBAC) to cloud security posture management, that you can adapt to secure your Azure subscriptions.
Download Cheat Sheet
Azure security: A refresher
When it comes to Azure, the bottom line is security shouldn’t be an afterthought that’s retrofitted into your environment once your workloads are in production. Instead, apply Azure security controls across all phases of the software development life cycle, starting from the first code commit all the way to deployment. Along with software supply chain security, you should also consider the different security controls that can be integrated into Azure infrastructure using infrastructure as code (IAC).
The first step is knowing which aspects of Azure your team is responsible for securing. As with any other cloud service provider, Azure follows a shared responsibility model. That means the cloud platform provides the necessary security controls, but it’s up to the customer to implement the controls applicable for their workloads. Where your responsibilities start and end also depends on your deployment model. For example, in IaaS deployments the customer is responsible for OS layer security, network layer security, application layer security, and identities. In the case of PaaS services, customers are responsible only for application layer security.
While the shared responsibility model is a standard approach, it doesn’t make the process of ensuring Azure security any smoother for customers. Identifying the areas that fall under your purview can be challenging. There are many such areas that are extremely important to consider, including access management, layered security, intrusion detection and protection, data protection, and compliance, to name a few.
38TB of data accidentally exposed by Microsoft AI researchers
Wiz Research found a data exposure incident on Microsoft’s AI GitHub repository, including over 30,000 internal Microsoft Teams messages – all caused by one misconfigured SAS token
Read more
Best practices and recommendations
To ensure your Azure deployments are secure, follow these Azure cloud security best practices:
1. Train your teams on cloud security
If you’re shifting from on-premises security to cloud security, some major differences should factor into your Azure approach. Unlike on-prem, it’s not enough to focus on just perimeter security. Azure, like all cloud platforms, requires teams to turn their attention to context-based security. And the shared responsibility model, which we’ve previously discussed, is a concept that didn’t exist in on-premises deployments fully owned and managed by organizations. These differences necessitate in-depth training.
Targeted personnel for this training should extend well beyond your security team to include anyone who’ll be accessing and using Azure resources. Of course, security roles and responsibilities also change over time, which calls for collaboration across multiple teams. Team members should be trained to work closely together to understand evolving threat vectors and to preserve the baked-in security configurations for the cloud services that they use. This last point is especially important because oftentimes misconfigurations open platforms up for attacks more than any other factor.
BingBang: AAD misconfiguration led to Bing.com results manipulation and account takeover
How Wiz Research found a common misconfiguration in Azure Active Directory that compromised multiple Microsoft applications, including a Bing management portal
Read more
2. Define your security posture management process
New attack patterns emerge by the day in the cloud, which is why it’s critical to establish a process for maintaining your Azure security posture at all times. That’s where continuous monitoring comes in. Continuous monitoring prevents breaches and misconfigurations that would have otherwise gone unnoticed. To keep overhead low, pick a continuous monitoring solution that has easy instrumentation and offers customization for your organization’s needs.
Use tools like Microsoft Defender for Cloud to get basic visibility into your Azure cloud security posture. The secure score feature helps quantify your security posture and can be used as a starting point. Still, it’s a good idea to incorporate specialized tools for cloud security posture management (CSPM).
In addition to getting better visibility into your security posture, put a process in place for the remediation of identified vulnerabilities. Because security is not a one-person job, empower each team using Azure to remediate vulnerabilities by clarifying your expectation that security is everyone’s responsibility.
CSPM Buyer's Guide
When choosing a CSPM for your organization, it is important to understand the solutions available today, and the key requirements you should look for in a CSPM to meet your unique needs. This buyer’s guide aims to help you understand current market offerings by evaluating the capabilities of legacy and modern CSPM tools, so you can improve your security posture by choosing the right CSPM solution for your organization.
Download PDF
3. Integrate native cloud security controls
Not sure where to begin when it comes to implementing a comprehensive security strategy for Azure? Start with the quick wins. You can easily leverage the built-in security controls to set up a first line of defense against attacks.
Azure offers many out-of-the-box security controls that can be fine tuned to meet your unique requirements. Essential features such as threat detection, native firewalls, network security, and DDoS protection are available in Azure and can be used to build your baseline security. These features protect from common attack vectors, like network infiltration and known vulnerability exploitation.
If it simplifies your processes, you can also think about extending your existing firewall capabilities to Azure during the initial adoption phase. For example, you could move your on-premises network devices to Azure as virtual appliances if you have portable licenses. Then you can slowly migrate to more cloud native or specialized solutions as applicable.
One reminder: To do your part in the shared responsibility model, spend some time mapping your application requirements to available security capabilities in Azure.
Azure Security vs. AWS Security: A Comparative Analysis
To help you make an informed decision, we've crafted a comprehensive comparison of AWS and Azure security, empowering you to select the cloud provider that seamlessly integrates with your unique needs.
Read more
4. Streamline identity access management (IAM)
Identity access management (IAM) solutions are the foundation of cloud security. Without IAM tools in place, an attacker can essentially get the keys to your kingdom through a compromised admin credential.
The cloud native IAM service in Azure is called Microsoft Entra ID. When you use Microsoft Entra ID with role-based access control (RBAC), you can grant granular access to Azure resources. Stick to the principle of least privilege and the zero-trust approach when assigning access permissions through RBAC. These security models restrict permissions to allowed activities on specific resources, preventing attackers from gaining broader access, even if a user’s credentials are compromised.
You can also leverage multi-factor authentication (MFA) to add on an additional security layer. That’s not enough? Take things one step further by implementing just-in-time or context-aware access control. Here’s one example: Administrative access can be assigned to a user for a specific activity for a specific time frame. After that, admin access automatically expires.
Organizations with IAM services like Microsoft Active Directory can integrate those existing solutions with Microsoft Entra ID and implement RBAC for their users. Integration eliminates the overhead that comes with revamping your entire identity management system as you adopt Azure. Azure also supports single sign-on (SSO), providing a seamless user experience.
5. Take a layered security approach
Defense-in-depth, also known as layered security, focuses on implementing comprehensive security controls at different layers of your architecture: for example, at the application layer, the operating system layer, the network layer, and the access control layer.
Simply put, a layered security approach eliminates a single point of failure. Even if the security measures at one level fail, the attack vector can be stopped at the next layer:
For network security: Take advantage of multiple services, such as Azure Firewall, network security groups, and DDoS protection.
For the data layer: Consider the security of data at rest and in motion by using encryption and certificates.
For the application layer: Start at the code layer with appropriate processes in place for code review and testing, in addition to other considerations like API management and web application firewalls (WAFs).
For threat detection and prevention: Use services like Microsoft Defender for Cloud, Azure Advanced Threat Protection, and Microsoft Sentinel.
If a breach is identified, immediately take action according to your incident response processes. After threat remediation, you can rely on Azure Backup, Azure Site Recovery, and Azure Archive Storage to bring your applications back online without missing a beat.
Concerned about compliance? Native tools like Azure Policy and Azure Blueprints (which offers resource locks) will give you peace of mind.
By 2025, 99% of cloud-security failures are forecast to come from customers.
Gartner
Going beyond the basics
In this article, we’ve discussed the top 5 basic security considerations for Azure to get you started. These fundamentals of Azure security are crucial, but it's vital to understand that the security threats of today call for a higher level of vigilance. That's where Wiz comes in.
Wiz is a comprehensive cloud security platform that helps organizations protect their Azure workloads. It is a 100% API-based solution that can be deployed in minutes without the need for any agents. Wiz provides complete coverage of every workload, including VMs, containers, serverless, and PaaS.
Wiz goes beyond simple configuration checks to model the effective security posture of your Azure environment. This means that Wiz can identify and prioritize risks that may not be immediately apparent, such as toxic combinations of issues that could make your environment vulnerable to attack.
Wiz also provides automation to help you fix security issues quickly and efficiently. Wiz can route issues to the right people in the right application to fix them, and it can automatically track resolution. This helps to create a culture of security across teams and ensure that security risks are addressed promptly. Schedule a demo with our Azure experts to see the Wiz platform in action.
Learn why CISOs at the fastest growing organization choose Wiz to get complete visibility into their entire Azure environment.
