Category Archives: Azure Security

Speaking with Thomas Naunheim at GermanyClouds Meetup about Azure Governance Best Practices

In the past Thomas Naunheim and I do a lot of architecture and designing prinicple for integrating Azure in company environments. We have the idea to create a Azure Governance Best Practices session in the last couple of months to give the community our insights and best practices for Starting/Integrating Azure environments. The goal is to give you insights, where you can find the best documentations to start with a Cloud journey and which technical Azure features help to bring and hold your environment in an compliant and secure state.

The session contains the following topics:

  • Cloud Adoption Framework
  • Well-architecture Framework
  • Insights about Azure Policies and Azure Security Center
  • Azure Enterprise Scale architecture
  • Azure Ops
  • Identity and Access Management

We are exited to hold the session at the GermanyClouds Meetup on november 26. Did you interested in this topics or you are in the beginning or implementig phase, join us. We will happy to see you there and get your questions.

The session will not been recorded.

Azure Bastion now supports VNET Peering

Update 2 on 01/12/2021

Microsoft has changed the #AzureBastion minimum subnet size from /27 to /26. Installed #Azure Bastion are unaffected, but new deployments require the new subnet size. Please remember this.

Update – 12/2020

Azure Bastion is now available in West Germany Central.

Azure Bastion is a service to avoid deployment own Jumphosts and reach Azure VMs over the Management Ports (SSH and RDP) in a secure way without the need to assign Public IPs directly to Azure VMs.

Azure Bastion got a really big improvement and now supports Azure VNET Peering. This includes all VNET peering models, inside a single subscription and VNET peering across different subscriptions.

Continue reading Azure Bastion now supports VNET Peering

IdentitySummit 2020 is over – Thank you

Our 1st IdentitySummit is over and we had a amazing Summit with our powerfull Speakers and our attendees.

We (Azure Bonn Orga Team) started planning the Summit in March 2020. The Orga Team from the AzureBonn Meetup consists of Melanie Eibl, Thomas Naunheim and René de la Motte. The idea came from Thomas (our Identity Expert) and we can say that was a wonderful idea.

We meet together at the Debeka Innovation Center (DICE) in Koblenz to organize and streaming all the sessions from one central place. The current Corona situation has unfortunately not made a complete live event possible, so we have met under the rules in force to ensure a smooth process and bring a little live feeling.

Now after 6 session in 2 parallel Tracks we can say it was worth every minute of planning – Why?

The answer is simple: First of all because of our great speakers. Each session was planned with a minimum of 300, and each session went deep into the relevant topics, showing what needs to be considered, the pitfalls and best practices available.

Continue reading IdentitySummit 2020 is over – Thank you

Howto Setup and Monitor the Break Glass Account in your Tenant

19/01/2022 – Update 1

I´ve updated the article because the actual sign-in query only logs all login attempts of the break glass account (successfully, unsuccessfully, etc.) . I added the different IDs so that you can setup the alert mail based on a indivudal filter. Thank you goes out to Eric Soldierer for this note. I also updated some changed services that had left their preview status.

In the past I do a lot of Azure Governance workshop and one interesting topic is how to handle the Break Glass Account. Before we going deeper, first we take a look was is the Break Glass Account. For each Administrator role in Azure or Office365 is it best practice to use MFA to secure the account and get a better security for the Tenant. To realize this, normally we use Conditional Access and create a rule, that every Admin require MFA for login. But what can we do, when:

  • the MFA service is down
  • we create a Conditinal Access that with a wrong rule set and lost sign-in access
  • we do not regulary update our control list and the admin account goes lost

For this cases we need a Break glass account, an additional account with a high security password, to enter the Tenant in an emergeny case. For this account, there are some recommendations:

  • only use a generic account
  • create a complex password with more than 16 characters
  • up to 256 characters possible – the limit of 16 character is removed
  • for compliance reason divide the password into two parts
  • save each part in a different location
  • create a security group that contains the break glass accounts
  • create two break glass accounts with no standard username like breakglass@ or emergency
  • use the Tenant name for the account
  • do not use a custom domain name
  • in futher it will be possible to use FIDO2 security key for break glass (right now is in preview and not recommended for such critical scenario)

Now we can discuss in some ways a security gap – a service account with Global admin rights that do not require MFA for login. Now you see, why it is so important to monitor this accounts and get notified when they will be used for login.

Continue reading Howto Setup and Monitor the Break Glass Account in your Tenant

Connect and Secure Azure PaaS services to Virtual Networks with Private Link

Azure allows to use IaaS and PaaS solution together over the same network. But all Azure PaaS services using a public interface for connection. When configure the PaaS firewall to allow traffic only from internal VNETs the public interface still exists. With Azure Private Link there is a new service to disable the public interface and add a private endpoint to secure connect to PaaS from your own VNET.

When configuring the internal service Firewall to block all traffic from outside the VNET, the Firewall make a mapping from internal VNET traffic to the Public IP and block all other IP- Adress ranges – and here comes the new Azure Service Private Link into play. This blog post will cover how Private Link works and how to configure this service for your environment including own DNS solution to get a complete private based Azure VNET.

Continue reading Connect and Secure Azure PaaS services to Virtual Networks with Private Link

How I pass the Azure Security Exam Az-500

In the past I have taken several Azure exams, and yesterday I took the Azure Security exam Az-500. I am really glad that I passed the exam. In this article I will give you a brief overview of the topics I saw in the exam and what materials I used to prepare for the exam. I can say directly that the best way to succeed in the exam is practice.

Continue reading How I pass the Azure Security Exam Az-500

Azure Saturday Cologne 2019 – Azure Bastion Slides

Gestern fand der erste Azure Saturday in Köln statt. Organisiert wurde dieser von Jennifer, Raphael und Martin und es war ein gelungener Auftakt. Eine tolle Orga und eine absolut hervoragende Location bei der Gothar sorgten für einen gelungene Veranstaltung. Dazu noch viele verschiedene Speaker und eine große Themenbandbreite, die für viel Austausch und Networking sorgten.

Am Nachmittag durfte ich mit zwei Sessions selbst einen kleinen Teil zum Azure Saturday Cologne beitragen.

Continue reading Azure Saturday Cologne 2019 – Azure Bastion Slides

Setup Passwordless login Für Azure & Microsoft365 mit yubico 5 und FIDO2

Vor einigen Wochen hat Yubico zahlreiche Passwordless-Kits kostenlos zur Verfügung gestellt. Um weitere Menschen von den zahlreichen Vorteilen des Passwordless Logins mit dem integrierten FIDO (Fast IDentity Online) Standard, in Yubico Devices, zu überzeugen. Vor ein paar Tagen habe ich mein Starterpaket erhalten – an dieser Stelle vielen Dank für die Zusendung. Das Starterpaket enthielt direkt 2 Keys den YubiKey 5 NFC (USB + NFC) und den YubiKey 5C (USB Type-C). Direkt nach dem Erhalt habe ich mit der Einrichtung begonnen – die sich sehr einfach gestaltet.

Dieser Artikel stellt die Voraussetzungen und die Konfiguration des Azure Active Directorys vor, um die Kennwortlose (Passwordless) Funktion zu nutzen.

Continue reading Setup Passwordless login Für Azure & Microsoft365 mit yubico 5 und FIDO2

Cloud SIEM Azure Sentinel nun Allgemein Verfügbar

SIEM (Security Information and Event Management) Systeme sind in den meisten Unternehmen bereits für Security Zwecke im Einsatz. Eine rein Cloudbasierte Variante hat Microsoft vor ca. 6 Monaten als Public Preview unter den Namen Azure Sentinel vorgestellt. Azure Sentinel hat unzählige Konnektoren und basiert im Backend auf Log Analytics. Seit heute ist Azure Sentinal allgemein verfügbar und Microsoft hat die Preise und die SLA veröffentlicht. Diese Artikel gibt einen Überblick über die enthaltenen Services, welche Preismodelle vorhanden und welche Features kostenfrei verfügbar sind.

Continue reading Cloud SIEM Azure Sentinel nun Allgemein Verfügbar

Azure Bastion – Sicherer Azure VM Zugriff via SSH/RDP ohne Public IP

Update 2 on 01/12/2021

Microsoft has changed the #AzureBastion minimum subnet size from /27 to /26. Installed #Azure Bastion are unaffected, but new deployments require the new subnet size. Please remember this.

Update 1

11/10/2021 Artikel überarbeitet und weitere Links angefügt. Follow the link to a refreshed article in english

Azure Bastion ist ein ganz neuer Service im Azure Universum, der den Remote Zugriff auf eure Azure VMs via RDP/SSH deutlich vereinfacht und absichert.

Azure Bastion Architecture by Microsoft Docs

Bisher gab es zwei Möglichkeiten, um sich zu Azure VMs via RDP oder SSH zu verbinden.

  1. Es besteht Zugriff auf das VNET, in dem die Azure VM liegt. Dazu war eine VPN Verbindung zum VNET notwendig oder ein Jump Host der in Azure ausgerollt wurde.
  2. Oder die Azure VM erhielt eine öffentliche IP-Adresse, um RDP oder SSH nach außen zu veröffentlichen. Damit einhergehend öffneten sich eine Menge Sicherheitslücken.

Mit Azure Bastion gibt es nun eine 3. Möglichkeit.

Azure Bastion wird als Platform-as-a-Service bereitgestellt und ermöglicht eine nahtlose Verbindung über das Azure Portal zur entsprechenden Azure VM. Durch diese Funktion sind beide oben genannten Möglichkeiten obsolet und ein direkter Zugriff auf Azure VMs, ohne Public IP, ist immer möglich. Azure Bastion stellt auf seine Art einen entsprechenden Jump Host im jeweiligen VNET bereit und benötigt seinerseits eine Public IP für die entsprechende Funktionalität.

Continue reading Azure Bastion – Sicherer Azure VM Zugriff via SSH/RDP ohne Public IP