Security & Data Announcements at Ignite 2017
A few weeks ago, Microsoft held another edition of its Ignite conference in Orlando, FL.
After going through most of the announcements and digesting them I found that there were a couple of interesting ones in the security & data space.
Let's have a closer look.
Introducing Virtual Network Service Endpoints (Preview)
With the introduction of Virtual Network Service Endpoints (Preview) you can now protect your Azure resources by moving them inside a VNET and thus restricting access to that VNET or subnet itself.
Currently, this is only supported for Azure Storage & Azure SQL Database/Warehouse but the end goal is to provide this for all services.
Source: Microsoft
By using VNET Service Endpoints you can now fully isolate your resources because you can now fully remove all access to the public internet by which you are limiting the risk of exposure.
It has been a long-awaited feature to isolated access, certainly for Azure Storage & Azure SQL Database, and I am excited & very happy that it's finally here!
Additional resources:
- Official documentation
- Support for VNET Service Endpoints for Azure SQL Database/Warehouse & Azure Storage
Introducing Azure Data Factory 2.0 (Preview)
This must be my favorite announcement - Azure Data Factory 2.0 (Preview), the next generation of data integration.
While Azure Data Factory 1.0 was limited to a data-slicing model only, it now supports different types of triggers such as webhooks.
With Azure Data Factory 2.0 comes the new Integration Runtime that provides you with the infrastructure to orchestrate data movement, activity dispatching & SSIS package execution, both in Azure & on-premises.
Source: Microsoft
But that's not all, there is more - Http activity support, integration with Azure Monitor, integration with Azure Key Vault, and much more! We'll dive deeper into this announcement in a later article.
Additional resources:
Azure DDOS Protection Service (Preview)
Distributed Denial-Of-Service attacks can be brutal and it is very easy to use. Nowadays, you can find it on the internet as a managed offering or even do it yourself just like Troy Hunt explains.
That's why Microsoft is announcing Azure DDOS Protection Service (Preview) that allows you to protect your Virtual Networks in order to secure your Azure resources even more.
Source: Microsoft
However, Microsoft Azure already brings you DDOS protection out-of-the-box. The difference here is that Azure DDOS Protection Service takes this a step further and give you more features & control.
Here is a nice comparison:
Source: Microsoft
Azure DDOS Protection Service is a turn-key solution which makes it easy to use and is integrated into the Azure Portal. It gives you dedicated monitoring and allows you to define policies on your VNETs. By using machine learning it tries to create a baseline of your traffic pattern and identifies malicious traffic.
Last but not least, it also integrates with Azure Application Gateway allowing you to do L3 to L7 protection.
Additional resources:
Taking Azure Security Center to the next level
Another example of the security investment by Microsoft are there recent announcements for Azure Security Center.
You can now not only use it for cloud workloads but also for on-premises workloads as well.
Define corporate security standards with Azure Policy (Limited Preview)
Azure Policy allows you to define corporate standards and enforce them on your Azure resources to make sure that the resources are compliant with your standards. They also come with some default rules, such as running at least SQL Server 12.0 and can be scoped to either a management group or resource group level.
By using initiative definitions, you can group one or multiple policy definitions as a set of requirement. An example could be an initiative that consolidates all SQL database related definitions.
To summarize, Azure Policy allows you to define security standards across multiple subscriptions and/or resource groups making it easier to manage your complete infrastructure.
It is currently in limited preview but sign-up for the preview in the Azure portal.
Introduction of Security Playbooks
With the addition of Security Playbooks you can now easily integrate certain playbooks in reaction to specific Security Center alerts.
It allows you to create & link an Azure Logic Apps which orchestrates the handling of the alert, tailored to your security needs.
Investigation Dashboard
Azure Security Center now provides a new visual, interactive investigation experience to analyze alerts and determine root cause analysis.
It visualizes all relevant information linked to a specific security incident, in this case an RDP brute force attack.
Source: Microsoft
It makes it a lot easier to get the big picture of the potential cause, but also the impact of the incident. By selecting certain nodes in the equasion it provides you with more information about that specific segment. This enables you to drill deeper and get a better understanding of what is going on.
However, these are only a subset of the announcements, you can find all of them in this blog post.
Additional resources:
- Announcement blog post
- Introduction to Azure Policy (Preview)
- Investigate Incidents and Alerts in Azure Security Center (Preview)
- Security Playbook in Azure Security Center (Preview)
Introducing SQL Vulnerability Assessment (VA)
SQL Vulnerability Assessment (VA) is a new service that comes with Azure SQL Database and SQL on-premises via SQL Server Management Studio (SSMS).
It allows you to discover, track and remediate potential database vulnerabilities. You can see it as a lite version of Azure Security Center focussed on SQL DBs that lists all potential vulnerabilities after running a scan.
Source: Microsoft
This is another example of Microsoft making security more approachable, even if you are not a security expert. After running a scan you will probably see some quick wins making your database more secure step by step.
Additional resources:
Summary
Microsoft made some great announcements at Ignite and this is only the beginning, there were a lot more of them and I recommend read more about them on the Azure blog or watch the Ignite sessions on-demand.
Personally, I recommend Mark Russinovich' interesting talk called "Inside Microsoft Azure datacenter hardware and software architecture" which walks you through how Azure datacenters work, their recent investments & achievements and what their future plans are.
Lately, the IT side of Azure is coming closer to the developer side where services such as Azure Networking is becoming easier to integrate with PaaS services such as Azure Storage & SQL DB. It looks like this is only the beginning and we can expect more of these kinds of integrations making it easier for both IT & Devs to build more secure solutions.
Last but not least, don't forget that the Azure Roadmap gives a clear overview of what service is at what stage. Here you can see all services that are in preview for example.
Thanks for reading,
Tom Kerkhove.