In the past I do a lot of Azure Governance workshop and one interesting topic is how to handle the Break Glass Account. Before we going deeper, first we take a look was is the Break Glass Account. For each Administrator role in Azure or Office365 is it best practice to use MFA to secure the account and get a better security for the Tenant. To realize this, normally we use Conditional Access and create a rule, that every Admin require MFA for login. But what can we do, when:
the MFA service is down
we create a Conditinal Access that with a wrong rule set and lost sign-in access
we do not regulary update our control list and the admin account goes lost
For this cases we need a Break glass account, an additional account with a high security password, to enter the Tenant in an emergeny case. For this account, there are some recommendations:
only use a generic account
create a complex password with more than 16 characters
for compliance reason divide the password into two parts
save each part in a different location
create a security group that contains the break glass accounts
create two break glass accounts with no standard username like breakglass@ or emergency
use the Tenant name for the account
do not use a custom domain name
in futher it will be possible to use FIDO2 security key for break glass (right now is in preview and not recommended for such critical scenario)
Now we can discuss in some ways a security gap – a service account with Global admin rights that do not require MFA for login. Now you see, why it is so important to monitor this accounts and get notified when they will be used for login.
Azure allows to use IaaS and PaaS solution together over the same network. But all Azure PaaS services using a public interface for connection. When configure the PaaS firewall to allow traffic only from internal VNETs the public interface still exists. With Azure Private Link there is a new service to disable the public interface and add a private endpoint to secure connect to PaaS from your own VNET.
When configuring the internal service Firewall to block all traffic from outside the VNET, the Firewall make a mapping from internal VNET traffic to the Public IP and block all other IP- Adress ranges – and here comes the new Azure Service Private Link into play. This blog post will cover how Private Link works and how to configure this service for your environment including own DNS solution to get a complete private based Azure VNET.
This is a challenging time for everyone and I hope you are well. Many community conferences cancelled or moved to an online event. The online events give the oppurtunity to learn and discuss in an different way. The European Sharepoint Conference (ESPC) Team has announced the Azure Week between 25.05. – 29.05.20 as a webinar week.
The Azure Week has an great lineup with very useful sessions. Thomas Maurer open the week with a session about Modern Azure Cloud operations for IT Ops and I have the pleasure to close the week with a session about Azure Policy with Azure Security Center.
In this session we will dive into the many aspects of Azure Policy and Azure Security Center and see how they work together.
In the past I have taken several Azure exams, and yesterday I took the Azure Security exam Az-500. I am really glad that I passed the exam. In this article I will give you a brief overview of the topics I saw in the exam and what materials I used to prepare for the exam. I can say directly that the best way to succeed in the exam is practice.
Azure Bastion is a new service to reaches Azure VMs in a secure way without needing a Jump host in the same VNET or to publish an Public IP for a VM.
Azure Bastion is in public preview since end of June 2019. Now the service is General Available (since Microsoft Ignite 2019) and many limitations are gone. This article will short introduce the service, the new features and how easy is it to enroll the service in the environment to reach Azure VMs (Windows or Linux) over a secure way.
There are many new features and enhancements announced for Azure from the last Microsoft Ignite. I have written about many of them in the 1st part of this Article. This article will focus of the missed announcement in the first article.
Keep in mind our Meetup appointments in the next week in Thueringen and Cologne/Bonn.
Vor einigen Wochen hat Yubico zahlreiche Passwordless-Kits kostenlos zur Verfügung gestellt. Um weitere Menschen von den zahlreichen Vorteilen des Passwordless Logins mit dem integrierten FIDO (Fast IDentity Online) Standard, in Yubico Devices, zu überzeugen. Vor ein paar Tagen habe ich mein Starterpaket erhalten – an dieser Stelle vielen Dank für die Zusendung. Das Starterpaket enthielt direkt 2 Keys den YubiKey 5 NFC (USB + NFC) und den YubiKey 5C (USB Type-C). Direkt nach dem Erhalt habe ich mit der Einrichtung begonnen – die sich sehr einfach gestaltet.
Dieser Artikel stellt die Voraussetzungen und die Konfiguration des Azure Active Directorys vor, um die Kennwortlose (Passwordless) Funktion zu nutzen.
SIEM (Security Information and Event Management) Systeme sind in den meisten Unternehmen bereits für Security Zwecke im Einsatz. Eine rein Cloudbasierte Variante hat Microsoft vor ca. 6 Monaten als Public Preview unter den Namen Azure Sentinel vorgestellt. Azure Sentinel hat unzählige Konnektoren und basiert im Backend auf Log Analytics. Seit heute ist Azure Sentinal allgemein verfügbar und Microsoft hat die Preise und die SLA veröffentlicht. Diese Artikel gibt einen Überblick über die enthaltenen Services, welche Preismodelle vorhanden und welche Features kostenfrei verfügbar sind.