Security is not a one-size-fits all solution, it requires a customized, multi-layered approach with continuous monitoring.
The core principles of cybersecurity are Confidentiality, Integrity, and Availability.
- Confidentiality: the data is protected from unauthorized users
- Integrity: the data remains accurate and complete
- Availability: the data can be accessed by its intended users
Achieving these security best practices depend upon the assets and services being protected, the constraints, level of compliance, and risk tolerances of the company. As such, IT security policies can vary greatly from one environment to the next.
Securing Azure resources can be broken down into these major disciplines:
- Identity access management (IAM)
- Data security
- System security
- Network security
In this article we will introduce a checklist for Azure cloud security best practices.
The Azure Security Center offers a central location to manage security tooling and reports. It provides the resources you need to get started on your security roadmap, but it is not an all-in-one solution. To access the Security Center, sign into your account and select Security Center on the left side.
The Center for Internet Security (CIS) provides an excellent framework for securing Azure resources according to industry best practices. The security recommendations are divided into two levels.
Level 1 provides basic security recommendations that should be enforced in most environments.
Level 2 provides advanced recommendations that should be enforced for increased security.
This checklist is a supplemental introduction to your security roadmap and should not serve a standalone IT security policy.
- Restrict access to the Azure AD administration portal
In Azure Active Directory select Users or Groups, then User settings.
Ensure Restrict access to Azure AD administration portal is set to Yes.
- Guests – Remove guest users or limit their permissions
In AD Users, select All Users, and in the Show drop down select Guest Users only to view the guests.
- Passwords – Require two methods for password resets and notify users on reset
In AD Users, select Password reset, Authentication methods, and set Number of methods to 2.
- Reconfirm user authentication methods every 180 days
In AD Users, under Password reset, select Registration, and make sure Number of days before users are asked to reconfirm… set to 180 days.
- Enable MFA
In Azure AD Users, select Multi-factor authentication and make sure the status is Enabled for Admins, Owners, or Contributors.
- Block remembering MFA
Under Multi-factor authentication, select users, Manage users settings, and checkmark Restore MFA on all remembered devices.
- Guests – Restrict invitations through administrators only
In AD Users, select User settings, go to External users, Manage external collaboration settings, and set Members/Guests can invite to No.
- Restrict Security Group creation to administrators
In Azure AD, select Groups, go to General settings, and make sure Users can create security groups is set to No.
- Disable self-service group management
In Azure AD, Groups, select General settings, ensure Self-service group management enabled is set to No.
- Disable users from registering apps
In AD Users, go to User settings, make sure User can register applications is set to No.
- Enable automatic provisioning of monitoring agent
In Security Center select Security Policy and check mark your subscription. Click Install agents.
- Policies – Enable system updates: updates OS
In Security Center, Security Policy, select subscription under Policy Management.
Select Enable Monitoring in Azure Security Center
In Compute and Apps, find the policy “System updates should be installed on your machines” and make sure it’s AuditIfNotExists or Audit.
- Enable security configurations: applies and recommends security hardening rules
In Security Policy, Policy Management, select subscription under Policy Management.
Enable Vulnerabilities in security configuration on your virtual machine scale sets should be remediated
- Enable Endpoint Protection: protects VMs from malware
- Enable Disk Encryption: encrypts data on the disk
- Enable Network Security Groups: allow or denies network traffic
- Enable Web Application Firewall: secures traffic to web applications
- Enable Vulnerability Assessment: performs vulnerability and health monitoring assessments and recommendations
- Enable Storage Encryption: encrypts Azure Blobs and Files
- Enable JIT Network Access: locks down inbound traffic to VMs
- Enable Adaptive Application Controls: whitelists safe applications running on VMs
- Enable SQL Auditing and Threat Detection: identifies malicious behavior on SQL DBs
- Enable SQL Encryption: Enables transparent data encryption on SQL DBs
- Set Security Contact Email and Phone number
Make sure contact info is added in Cost Management + Billing.
- Send emails on Alerts
In Security Center, Pricing & settings, click Email notifications and enable for high severity alerts and subscription owners
- Upgrade to a Standard tier
Extends the Security Center to private workloads and other cloud platforms for unified management
Enables advanced threat detection (Azure Defender)
- Require security-enhanced transfers: enables HTTPS on network communications and API transfers
Select your account in Storage Accounts and under Settings select Configuration. Set Secure Transfer required to Enabled.
- Encrypt Files and blob object storage
Under your Storage Account Settings, select Encryption and make sure the storage account is being encrypted.
- Make blob containers private: restricts blob access to authorized users
Select your storage account and go to Containers under BLOB Service. Ensure Public access level is set to Private.
- Regenerate access keys periodically
Under Storage Account, select Activity log. Click Timespan drop down and set it to a 90 day range to see keys being used.
Use Azure Key Vault to regenerate these keys.
- Shared Access Signature tokens – Set a one hour expiration
Select your Storage account and go to Shared access signature. Set the expiration time to one hour after creation.
- Require tokens to be shared only via HTTPS
Under Shared access signature set Allowed protocols to HTTPS only.
Azure SQL Database
- Enable auditing: tracks DB events and writes them to an audit log
In SQL Databases, select your DB instance and select Auditing under Security. Make sure Auditing is ON.
- Retain audit logs for more than 90 days
Select Auditing and select Configure under Audit log destination. Set the retention longer than 90 days.
- Enable threat detection: detects malicious activities to the DB
In the DB instance, under Security, click Advanced Data Security and click Enable.
- Retain threat detection logs for more than 90 days
Select Auditing and select Configure under Audit log destination. Set the retention longer than 90 days.
- Enable all threat detection types
- Send security alerts
In the DB instance, select Auditing & Threat Detection, Database settings, View Advanced Data Security server settings, and enable Send Alerts
- Email service and administrators
Select Advanced Data Security, under Advanced Threat Protection Setting select Email service and co-administrators
- Ensure regular automatic database backups
Logging and Monitoring
- Stream Activity Log to Event Hub: allows logs to be monitored and archived
In Monitor, select Activity Log and ensure a Log Profile is set. If not, select Export to Event Hub.
- Retain activity logs for 365 days or more
In Activity Log, adjust the Retention slider to 365 days or more.
- Create a log alerts – “Creating a policy assignment”: alerts when policies are created
In Monitor, select Alerts, click + New alert rule. Click on Resource and select Policy from Filter by resource type.
“Creating, updating, or deleting a Network Security Group”: alerts when NSGs are created/updated/deleted
Click + New alert rule. Click on Resource type and select Network security group from Filter by resource type.
“Creating or updating an SQL Server firewall rule”: alerts when SQL network access
Click + New alert rule. Click on Resource type. Select SQL servers from Filter by resource type.
- Enable Azure Sentinel
Enable Azure Sentinel for integrated SIEM alerting for security events.
- Restrict RDP and SSH access from the internet: access VMs via VPN, ExpressRoute, or Bastion Host
On your VM, open the Networking pane, restrict RDP(3389)/SSH(22) rules
- Restrict SQL Server access from the internet
Go to SQL Databases, for each server, click on Set server Firewall.
Make sure no rule has a Start IP of 0.0.0.0 and End IP of 0.0.0.0 or any other wide IP range
Allow only trusted IPs to connect
- Restrict web application traffic with Web application firewalls: protects applications from common exploits and vulnerabilities
Enable WAF when you create an Application Gateway.
- Enable Network Watcher: logs inbound and outbound IP traffic
In All servers, select Network Watcher, select Regions, and Enable Network Watcher.
- Retain NSG flow logs for longer than 90 days: allows deeper history analysis of traffic
In Networking, select Network Watcher, select NSG flow logs under Logs, ensure retention is greater than 90 days.
- Enable Auto Provisioning
In Security Center, select Pricing & Settings, click on Data Collection and make sure Auto Provisioning is ON.
- Ensure disks are encrypted
On the Virtual Machine page, go to Settings, select Disks and ensure OS and Data disks have encryption set to Enabled.
- Ensure only approved extensions are installed
On the Virtual Machine page, go to Settings, select Extensions, and evaluate the installed extensions
- Ensure OS updates are applied
In Security Center, open Recommendations under Resource Security Hygiene. Make sure “Apply system updates” is not listed.
- Ensure VMs have an updated and running endpoint protection solution
In Security Center review for Endpoint protection issues in Resource Security Hygiene.
Recommended extension: Microsoft Antimalware for Azure Cloud Services and Virtual Machines
- Azure Backup – Ensure regular automated backups
Enable Azure Backup and configure the backup source (Azure VMs, SQL Server, or File Shares), as well as desired frequency and retention period.
- Azure Key Vault – Make sure all keys have an expiration date
In Azure Key Vault, select Key Vaults, click on Keys, and make sure each key has an appropriate EXPIRATION DATE listed
Make sure all secrets have an expiration date
Select Key Vaults, click on Secrets, ensure each secret has an appropriate EXPIRATION DATE listed
- Set resource locks on critical resources: can make resources undeletable or readonly
Open the resource, resource group, or subscription and select Settings. Open Locks and click Add. Select CanNotDelete or ReadOnly.
These are general security controls to secure your Azure environment, in the next few articles we will dive deeper into the various disciplines of Azure security.
Learn more about the CIS Azure benchmark.
Read more on Microsoft Security Best Practices.