SK

Microsoft Azure platform offers a vast number of services and solutions, offering massive possibilities to solve business problems combining various Azure services and products. Microsoft cloud computing platform is likely to be less expensive and more flexible, more reliable, and more secure than on-premises servers and solutions.

Security is a key focus of Microsoft Azure who invests enormous amounts of money into securing its infrastructure – more than 1 billion USD (yes, that is 1,000 millions of USD) of investment in security, research, development, and cybersecurity experts annually. With such an enormous amount of investment in security, there are few companies that can afford financial resources, expertise, and infrastructure at such a large scale.

Microsoft knows that telling everyone how large investments have been made or which latest-and-greatest state-of-the-art security technologies have been implemented is not enough to win customers. That is why Microsoft recognized the importance of conforming to global privacy and compliance standards across regulated industries and markets globally. Microsoft offers the broadest and the deepest set of compliance offerings of any cloud service provider.

Many industries have recognized the high compliance and security standards that Microsoft Azure provides to their customers, which is an extremely crucial element in the trust relationship. Having the possibility to choose from so many products and services, customers sometimes have difficulties choosing the right product or service and object that going “to the cloud” might not always be the easy path. While it is impossible to single out a product or a service unique for an industry, there are some products and services that are more attractive to industry.

Financial institutions such as banking and insurance companies work with sensitive, personal, and business financial customer data that must be secure. Moreover, the substantial number of various documents differ in sensitivity and privacy nature which is an additional burden to personnel. Manually selecting and classifying large volume of files, emails, and different type of data according to its sensitivity and privacy characteristics is not easy as the classification needs to be unified and fast.

Microsoft Azure Information Protection, or sometimes abbreviated as AIP, is a cloud-based solution that solves the problem of manual classification and protection of sensitive data and applies the classification labels and protection to data automatically, unobtrusively, and quickly. Implementing Azure Information Protection can help employees so they can focus on their primary tasks while sensitive data is protected while they work.

Implementing Azure Information Protection is beneficiary in many aspects, especially if a company implemented General Data Protection Regulation (GDPR) processes, they could become more efficient and cost-effective, while Data Loss Prevention (DLP) policies can achieve better data classification results.

The benefits of automating classification and protection using AIP are obvious during all phases of data information protection lifecycle. Sensitive documents across a range of locations can be discovered faster, based on the rules you define. Classification and labelling of sensitive data can be done more efficiently and automatically while keeping the possibility for manual intervention as well. Applying flexible protection actions, such as restricting access and encryption is welcome as it helps cover different protection levels. Azure Information Protection offers to monitor over protected data enabling you to gain insight into how the data is distributed, consumed and to take remediation steps if necessary.

Companies do not have to be fully cloud-based to implement Azure Information Protection. Customer data can be managed fully in the cloud, but many organizations have not yet moved entirely to the cloud, but still have data stored on-premises, while others are yet to begin their cloud transformation and keep their data on-premises completely.

Organizations that have data on-premises can take advantage of Microsoft AIP deploying Azure Information Protection Scanner to discover data against their on-premises repositories, like file shares and SharePoint libraries.

Microsoft Azure Information Protection, as many Microsoft technologies are, can be spotted in other Microsoft products, which brings us to a product that can be attractive to the public, governmental bodies and institutions and non-governmental organizations, or NGOs, as well.

These governmental and non-governmental organizations also work with sensitive data that must be protected. Very often, employees work late and after hours and, in many cases, carry sensitive documents outside protected, on-premises environment. Furthermore, employees use a variety of operating systems, cloud-based repositories and online storage locations, access organizational resources from distinct locations and countries. These environments do not have unified security standards and levels and what is even more critical, when outside organizational boundaries, it is exceptionally difficult to control distribution and dissemination of organizational data and how employees treat sensitive data.

Microsoft Cloud App Security can help address these problems and many more as well. To quote Wikipedia, “Shadow IT, also known as Stealth IT or Client IT or Fake IT, are Information technology (IT) systems built and used within organizations without explicit organizational approval, for example, systems specified and deployed by departments other than the IT department.

Examples of these unofficial data flows include USB flash drives or other portable data storage devices, MSN Messenger or other online messaging software, Gmail or other online e-mail services, Google Docs or other online document sharing and Skype or other online VOIP software—and other less straightforward products: self-developed Access databases and self-developed Excel spreadsheets and macros. Security risks arise when data or applications move outside protected systems, networks, physical location, or security domains.

I would like to emphasize the last sentence: “Security risks arise when data or applications move outside protected systems, networks, physical location, or security domains. “

According to studies, Shadow IT makes up more than 65% of cloud services introducing unknown and unmanaged risks into the environment. Cloud App Security can help you identify which cloud applications and services are being used across your organization. You can get an insight into whether these cloud services are approved for use, are being accessed beyond the trusted organizational environment and whether are managed or unmanaged by IT organizational department.

It is important to be sure whether all applications employees use meet security policies and standards set by the internal IT department and relevant compliance or industry requirements. Using Cloud App Security, you can assess compliance and risk of discovered cloud applications against more than 70 risk factors and allow IT department to make informed decisions and actions about which applications or cloud services should employees be able to use or blocked entirely.

You can then set up policies to detect changes in user behaviour, usage pattern of cloud services and applications, and set alerts to be notified when these behavioural anomalies happen, such as mass download, unusual usage pattern, time or many other data and information exfiltration attempts.

Additionally, Cloud App Security (or CAS) incorporate tight integration with other Microsoft technologies, like Azure Information Protection. Data Protection Policies (or DLP) can be enforced more efficiently as you can use CAS to identify files that contain sensitive information and provide immediate remediation actions including encrypting files, removing external sharing permissions, or placing files in quarantine. Also, you can impose scanning of files as soon as it is uploaded to a cloud application and automatically apply labels and relevant encryption or restrictions.

Being a Cloud Security Expert makes me more familiar with related industries than others, but that does imply by any means that these recommendations and products are not relevant to other industries. Recent studies show an increase of threats to software and hardware manufacturers, and this is where Azure Sentinel helped a company where I was engaged as a Cloud Security Consultant. Being one of the biggest software development companies, this company had most of their workloads moved to Azure, but their security posture was not yet at adequate levels.

Azure Sentinel was a solution to their growing Azure infrastructure and as a built-in security information event management (SIEM) and security orchestration, automated response (SOAR) solution was a perfect match. It is a cloud-based threat intelligence and security analytics solution suited not only for your cloud-based workloads and products but to the entire enterprise as well. It collects data across all organization, users, applications, devices and investigates threats powered with artificial intelligence, empowering you to respond more rapidly, reducing the chance for data loss.

To be able to analyse data, you first need to connect to your data resources through connectors. Azure Sentinel includes many connectors for Microsoft and third-party solutions, including Office 365, Azure Active Directory, Microsoft Cloud App Security, Amazon Web Services, and more. To onboard non-Microsoft solutions, you can use common even format, Syslog or REST-API.

Azure Sentinel also features strong search and query hunting tool, based on MITRE framework. MITRE ATT&CK™ is a globally accessible knowledge base of adversary tactics and techniques based on real-world observations. To provide an insight into attacks, you can create custom detection rules based on queries, using KQL, or Kusto Query Language.

Finally, you have been introduced to three powerful and comprehensive cloud-based security products which are applicable and usable in any industry, organizational type, or size. Do not rely only on one Microsoft Azure technology or product – Microsoft Azure has many security products and features that can protect your organization or company at many levels.

Today, using Microsoft Azure, setting up computing environments is easier than ever. You can create multiple networks, subnets, virtual machines, and other numerous networking components in an eyeblink. Managing these complex networks and topologies can become cumbersome and difficult over time. Trying to grasp what-connects-to-what and where exactly that load balancer or subnet is, becomes increasingly difficult in larger environments. Especially when the time comes to troubleshooting and diagnosing problems in such large networks.

Microsoft has an ace up in the sleeve that is here to help us with these daunting tasks and its name is Network Watcher. It is not just a Big Brother or All-seeing-eye (like Sauron’s eye, if you’re into Lord of The Rings) but it is a friendly tool that jumps to help in the dark times when it comes to monitoring, troubleshooting, and diagnosing problems with our networks.

As Microsoft constantly updates and enhances Azure components and services, this also applies to Network Watcher as well and you will notice additions and functionality enhancements over time.

Okay, what is Network Watcher so special about? How can it help you?

There are a lot of features in it, but before you can use them, you must enable Network Watcher in a subscription and the region where it will be used. If you have multiple subscriptions, it must be enabled for each subscription and region where it will be used.

The Monitoring section is a home to Topology tool. Well, you can call it a tool or a feature, but its power becomes evident as soon as you have even slightly complex network infrastructure. It draws a network topology map of your Azure resources and presents it in a nice, graphical way, containing resource-specific icons, resource names, connections between resources and network names.

First, select a Subscription, then select a Resource Group and you will be presented a topology of the whole Resource Group. if you have many resource groups, networks, subnets, virtual machines and other resources, the topology diagram might be too big to work with. In this case, you’ll want to narrow the view down to a particular Virtual Network.

Now, with the specific Virtual Network selected, the topology diagram is much smaller and easily understood. For added convenience, you can also download the topology diagram you are viewing and save it in Scalable Vector Graphics (SVG) format. This file format support many modern and popular programs such as most of the popular browsers, Microsoft Visio, Adobe Illustrator, Adobe Photoshop, CorelDraw and many more.

But this is not all! If you click on a resource in the topology diagram, it will open a settings blade for that resource. How convenient – if you need to make change to a resource or view its settings you don’t have to navigate away from the current blade. The resource is just a click away and when you are done with the task, simply close the resource blade and you’ll be back in the Network Watcher Topology view.

The Connection Monitor is the tool that can help you establish the reliability, reachability, speed, and latency of your network infrastructure, as well as changes in the topology. In addition, it will tell you what the problem might be and how to fix it.

To monitor the connectivity between two resources, click +Add and the blade opens. Here you specify the unique name of the monitor, as well as the Source and the Destination of the resources, that is – virtual machines, you are monitoring. The Source can be any virtual machine from any resource group within previously selected subscription. As a Destination, you can select a virtual machine or specify the resource manually. The manual choice can point to any URL, FQDN or IPv4 of your choice, whether located in Azure or anywhere on the Internet. And yes, it does not have to be a virtual machine, it can be a physical machine or a cloud service, if it can answer back on the service ports. Of course, the Destination resource is supposed to be reachable, but you can create a monitor even if it’s not reachable and monitor the reachability and availability as you proceed with the troubleshooting process. When you specify the destination port, the monitor assumes the source and destination ports are the same. If that is not the case, in Advanced settings, specify a custom source port and probing interval. If you do not specify the probing interval, the default value is 60 seconds and the minimum value is 30 seconds.

Once created, the Monitor will, guess what? Yes, monitor the connectivity 😊 between the source and the destination! No, it is not so trivial – it will show the graph of the monitoring activity for the past 1, 6 or 12 hours or even for 1, 7 or 30 days. The graph shows average packet round trip time and percent of the packets that never reached the destination. As trivial as it might seem at first, the data gathered presents invaluable information about your network and gives you an incredible insight in how the network behaves.

Additionally, it shows the information in grid view and in topology view, with the resources’ IP addresses, connections and names.

The next Network Monitor hero in line is Security Group View which can show you the information related to the Network Security Groups associated to a virtual machine. Especially useful if you have many NSG rules, this view can save you a lot of headaches – it shows you effective NSG rules, so you know exactly which rule is preventing or allowing inbound or outbound traffic. It’ll show you the list and the information about the associated subnets and attached network interfaces.

Another common connectivity issues arise in the networking, not only related to on-premises hardware but also to its virtual, cloud-based counterpart – a VPN connection. VPN Troubleshoot tool in Network Watcher can assist in resolving connectivity issues related to VPN connections. It needs a storage account, to be more precise, it needs a Container with access permissions defined where it will store diagnostic data gathered during the troubleshooting process. Once created, the hunt for VPN connectivity problems can begin.

With storage and region defined, click on Start troubleshooting to begin. In few minutes, it will tell you what the problems are or what the problems might be, depending on the complexity of the problem itself. It returns the Status of the troubleshooting process – that is, the reason the connection is lost, for example – and the actions recommended to solve the connectivity problem, with corresponding links to further enhance the knowledge about the steps.

To perform a deeper troubleshooting process, that goes beyond the infrastructure itself and relates to the monitoring resources, you have the Packet Capture capability available. Without the need to install the monitoring software on either monitoring node, this convenient feature can be started in just few clicks.

The capture configuration allows to store the captured network packets in the Azure storage account and locally, in a .cap file. It allows tweaking the capture process a little, setting maximum bytes per captured packet, maximum bytes per session and setting a capture session duration time.

Moreover, fine tuning can be done by creating a capture filter, by protocol or local or remote IP addresses. Once the capture process is done, you can further examine and dissect .cap file in your favourite program.

And last but not the least, there is also a detailed overview of resource diagnostic logs. The diagnostics is not enabled by default and if you are in the process of setting up a network and expect connectivity issues to occur, it would be good to enable logging to be able to gather data and analyse it further.

This was an introduction of some of the Network Watcher features and is not a definitive list of its capabilities or functionality. Hope it was interesting and valuable and hope to see you at the next article. Until then, I wish you successful troubleshooting process using Azure Network Watcher!