AZURE PAAS SECURITY

 

What is pass security?

Azure security is a shared responsibility between the cloud provider and the customer. The PaaS customer is responsible for securing its applications, data, and user access. The PaaS provider guarantees the operating system and physical infrastructure.

• End-to-end security on Azure

One of the best reasons you must use Azure for your applications and services is to take advantage of its wide range of security tools and capabilities. These tools and abilities help you build seal solutions on the Azure platform. In addition, Microsoft Azure gives confidentiality, integrity, and availability of customer data while enabling transparent accountability.

• Azure Platform

Microsoft Azure is a cloud platform that includes infrastructure and application services, with advanced analytics and integrated data services, as well as developer tools and services, hosted in Microsoft’s public cloud data centers. Customers use Azure for many scenarios and resources, from basic computing, networking, and storage, to web and mobile application services to complete cloud scenarios such as the Internet of Things. These scenarios can be used with open source technologies and deployed as a hybrid cloud or hosted within a customer’s data center. Azure provides cloud technology as a building block to help companies save costs, innovate quickly, and proactively manage systems.

Microsoft Azure is the best and only cloud computing provider that offers a secure and consistent application platform, with infrastructure as a service, for teams to work with different levels of cloud skills and different levels of project complexity, with analytics and Integrated data services that discover data intelligence wherever it is, whether in Microsoft or third-party open frameworks, tools, and platforms, giving you the option to integrate the cloud with on-premises resources as well as deploy Azure cloud services on data local centers. As part of the Microsoft dependable Cloud, customers trust Azure to provide the industry’s highest level of security, reliability, compliance, and privacy, as well as a broad network of people,

With Microsoft Azure, you can:

• Accelerate cloud innovation.
• Drive apps & business decisions with insights.
• Freely build and deploy anywhere.
• Protect your business.

• Technical security features to meet your responsibility

Microsoft Azure provides services that help meet your security, privacy, and compliance needs. The following image helps explain various Azure services available to you to build a secure and compliant application infrastructure based on industry standards.

• Manage and control user identity and access

Azure helps protect personal and business information by allowing you to manage user credentials and identities and control access points.

• Azure Active Directory

Microsoft information and access management solutions help IT secure access to applications and resources in the corporate data center and the cloud, enabling additional levels of validation such as multi-factor authentication and Conditional Access policies. In addition, monitoring suspicious activity through alerting, auditing, and advanced security reporting helps reduce potential security issues provides single sign-on to thousands of cloud applications, and access to web applications running locally. 

The security benefits of Microsoft Azure AD (Azure Active Directory) include the ability to:

• Create and manage a unique identity for every user in your hybrid enterprise, keeping users, groups, and devices in sync.
• Provide single sign-on access to your apps, involving thousands of pre-integrated SaaS apps.
• Helps application access security by enforcing rules-based Multi-Factor Authentication for on-premises and cloud applications.
• Providing secure remote access to on-premises web applications through Azure AD Application Proxy.

The following are critical Azure identity management features:

• Single sign-on
• Multi-factor authentication
• Machine learning-based reporting, alerts, and security monitoring
• Consumer identity and access management
• Device registration
• Privileged Identity Management
• Identity protection

 

• Single sign-on

SSO (single sign-on) means accessing all the apps and resources you need to do business, just logging in once using one user account. If signed in, you can access all the apps you need without having to authenticate (e.g., enter a password) a second time.

Many organizations rely on software-as-a-service (SaaS) applications, such as Microsoft 365, Box, and Sales force, to increase end-user productivity. Historically, IT staff had to individually create and update user accounts on each SaaS application, and users needed to remember a password for each SaaS application.

Azure AD extends – premises Active Directory to the cloud, allowing users to use their primary organizational accounts to connect to corporate resources and domain-joined devices and to web and SaaS applications users need for their work.

Users don’t need to manage multiple usernames and passwords, and application access can be automatically provisioned or unconfirmed based on organization groups and your employment status. In addition, Azure AD introduces access governance and security controls that allow you to centrally manage user access to SaaS applications.

• Multi-factor authentication

Azure AD Multi-Factor Authentication (MFA) is an authentication method that requires more than a verification method and includes a critical second layer of security to user inputs and transactions. MFA helps secure login to data and applications while meeting user demand for a simple sign-in process. It provides strong authentication through various verification options – phone calls, text messages, mobile app notifications, third-party verification codes, and Oath tokens.

• Machine learning-based reporting, alerts, and security monitoring

Security monitoring and alerts and machine learning-based give that identify irregular access patterns can help protect your business. In addition, you can use Azure Active Directory access and usage reports to gain visibility into your organization’s directory health and security. With the help of this information, a directory administrator can better determine where potential security risks may be, so they can make appropriate plans to mitigate those risks.

• In the Azure portal, reports fall into the following categories:

Anomaly Reports: Contains incoming events that we have identified as abnormal. Our goal is for you to be aware of these activities and to be able to determine whether an event is suspicious or not.

• Built-in Apps Reports: Provides an overview of how cloud apps are used in your business. Azure AD offers integration with the help of thousands of cloud applications.
• Error Reports: Indicate errors that can occur when provisioning accounts for external applications.
• User-Specific Reports: Display input/device activity data for a specific user.

Activity logs: contain a record of all events audited in the last 24 hours, seven days, or thirty days, as well as group activity changes and logging and password reset activities.

• Consumer information and access management:

Azure AD B2C is a highly available, world information management service for consumer-facing applications. That scales to hundreds of millions of identities. It can be integrated with mobile and web platforms. Your customers can log into all of your apps through customizable experiences using their existing social accounts or creating new credentials.

In the past, app developers who wanted to subscribe and connect clients to their apps would have written their code. And they would have used local systems or databases to store usernames and passwords. Azure AD B2C gives your business a better way to integrate consumer information management into applications with a secure, standards-based platform and a large set of extensible policies.

If you use Azure AD B2C, consumers can sign up for your apps using their existing social media accounts. This include (Facebook, Google, Amazon, and LinkedIn) or creating new credentials (email address and password or username and password).