Objects to secure in the cloud

- [Instructor] Now we are getting familiar with the tools we use to manage all of our security settings in Azure or even our resources stored in Office 365. But what we need to talk about now is the what, not necessarily the how. We'll get to the how of how we secure our resources, but first I wanna get to which resources do we need to secure. So here I'm in my Azure security portal or dashboard that I specifically created to manage all my security settings. Now this dashboard here, I've added a tile that contains all of my existing resources and I can actually hover over each resource to see what type of resource it is and each one of these resources will have some security settings at least.

For example, here I have an app service, and when I click on my app service, I can go down into my settings. And in my settings I'll see my SSL settings, or my secure socket layer settings, where I'll be able to enable things such as HTTPS access to encrypt the connection. Now sometime a security setting is deep into the configuration of an object. Sometimes we have security settings that make up the entire properties of the object.

It really depends on which object we're managing in our Azure portal. So I'm gonna go back to my dashboard here, again these are my resources that exist in Azure. But I wanna talk about all the various resources that I can add to Azure and why I would want to secure any one of those resource. So what I'm gonna do is click here on create resource, and when I click on create resource, I see all the various types of resources that I can create in my Azure portal. So let's talk about the security settings and why I would want to secure some of these resources.

The first thing I'm gonna do is click here on compute. Now compute is where I can go ahead and create my virtual machines now, a virtual machine object, a server that is hosted in Azure is one of the most popular deployment option for an Azure environment. And this is the infrastructure as a service setting that we were talking a little bit earlier in the course, or the type of deployment or the type of manner in which you would use an Azure subscription. Now what would I need to configure in terms of security for my virtual machines? Well there are many, many different things that I would have to do.

One of things that I need to do is secure the operating system for example so, that actually means going into the server and configure settings while I'm logged in, depending on the various version of the server or the type of operating system I'm deploying, there could be a number of security settings that I'd have to deploy from the server itself. However, from Azure I can go ahead and specify the access security. Who can access that virtual machine, who can connect to it? What type of connection would they use? If I'm using an RDP or a remote desktop protocol connection to that server, is it going to be encrypted? What type of security is there going to be on that access? So virtual machines and managing the access to those virtual machines, is one of the most important security settings that I'm gonna be able to set from Azure.

Now once you deploy your virtual machines, one of the things you'll wanna do is, configure networking settings now. Actually if you've gone into the various Azure courses, you see that there are some prerequisite networking settings that must be in place before you deploy the virtual machines. But you must think of the security access to those virtual machine in conjunction with deploying your network configurations. We have another course in the library which deals specifically on networking for Azure.

Now all of the networking settings will allow you also to configure things such as access points. Where we can define how a specific user or group of user or how a network will access another network, and that access, which type of encryption will it use, which type of protocol will it use, all of those things can be defined through access points and these various access points are configured through the various networking functionalities and networking objects that we create in Azure.

As well of course we have our data now our data is configured and secure through our storage objects. And one of the first storage objects that we create in Azure is a storage account. And then we define the type of storage account that we have and also the type of access and security settings for that storage account. So we need to secure our servers, our access to the servers. And the data that is being stored to even store the servers themselves, or store files that are being accessed by our users or our servers.

Now that is one type of deployment if I'm using an Azure infrastructure as a service, specifically that I will use in term of security settings. But a lot of organizations may not necessarily use Azure for infrastructure as a service, they may use it specifically to store websites or web apps. Now a web app is the relatively new name that we use in Azure to define the websites or the websites that run various types of code in the background to perform tasks, and those would be hosted in Azure as well.

Now there are some security related tasks to that web app, which needs to be performed by a developer. And the developer needs to apply various security principles. However if you deploy a web app, you can then specify things such as HTTPS or secure socket layer as I mentioned earlier, which encrypts all connectivity to that web app. And there's a number of security settings that we can set for web apps in Azure and we will look at some of those a little bit later on in the course. If you have an infrastructure in Azure which is deployed as a PAS or platform as a service, you may have actual Azure SQL databases that are stored directly in Azure and then you need to manage the security of that data that is in that database as well as the security access to those databases.

Now when Azure was first made available, the first type of databases that were available were Azure SQL databases, being a Microsoft technology. Now there are multiple types of databases that you can create in Azure, such as Cosmos DB, Postgres, MySQL, and others that will allow you to map to your various data storage needs. So whether they'd be managing the servers that access the data, the data themselves, or the databases, we have a multitude of objects that need to be secured.

But there are also security specific objects that we can create in Azure or specifically security services. For example, I have the identity management or the privileged identity management that is offered through Azure AD. Some enhanced type of specifying access to resources. There are various tools for rights management services, to encrypt specific sets of data. Now there's a number of those security services that you can deploy in Azure, and most of those are subsets of Azure active directory, or specifically they require an Azure active directory deployment to already be in place.

And then as a subset of that you can use that Azure AD deployment to improve the encryption data governance or any other type of data related security settings on the data and the resources that are hosted in your Azure environment.