WEBVTT

1
00:00.000 --> 00:08.400
Next, let's jump in and take a look at what security features we have that may

2
00:08.400 --> 00:08.980
be a little

3
00:08.980 --> 00:15.320
bit different in Microsoft's Azure compared to Amazon's AWS.

4
00:15.320 --> 00:19.640
Now again, a lot of these are going to be either very similar or almost

5
00:19.640 --> 00:20.600
identical, maybe

6
00:20.600 --> 00:24.650
some name differences and maybe a few minor features here and there that are

7
00:24.650 --> 00:25.560
different.

8
00:25.560 --> 00:27.400
And that's what we're going to be taking a look at.

9
00:27.400 --> 00:33.320
So let's go ahead and jump in and take a look at the Azure offerings.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

9
00:27.400 --> 00:33.320
So let's go ahead and jump in and take a look at the Azure offerings.

10
00:33.320 --> 00:37.310
So like many of the other providers, Azure does offer several different

11
00:37.310 --> 00:38.640
security features.

12
00:38.640 --> 00:43.510
We're going to be focusing on three in particular that are a little bit unique

13
00:43.510 --> 00:44.560
or specific to

14
00:44.560 --> 00:45.880
Azure.

15
00:45.880 --> 00:48.400
The first is going to be network layer control.

16
00:48.400 --> 00:53.800
So we'll talk about this one first, then we'll talk a bit about route control

17
00:53.800 --> 00:54.320
and then

18
00:54.320 --> 00:58.000
we'll talk about some of their security appliances that they offer.

19
00:58.000 --> 01:02.120
Again, these are going to be similar to other offerings, but they of course
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

19
00:58.000 --> 01:02.120
Again, these are going to be similar to other offerings, but they of course

20
01:02.120 --> 01:02.880
have their own

21
01:02.880 --> 01:04.600
specific products.

22
01:04.600 --> 01:09.800
So starting off with our network layer security or network layer control, we

23
01:09.800 --> 01:10.720
have network

24
01:10.720 --> 01:14.080
security groups or NSGs.

25
01:14.080 --> 01:18.720
Now much like our security groups in AWS, these are stateful.

26
01:18.720 --> 01:22.440
So return traffic is automatically allowed.

27
01:22.440 --> 01:25.080
These do five tuple matching.

28
01:25.080 --> 01:29.210
We talked about this before as well, where it can use either source and

29
01:29.210 --> 01:31.720
destination IP,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

29
01:29.210 --> 01:31.720
destination IP,

30
01:31.720 --> 01:37.000
source and destination port or the protocol identifier itself.

31
01:37.000 --> 01:42.880
Now one of the sort of unique features here is it has augmented security rules.

32
01:42.880 --> 01:48.230
Now these are a little bit difficult to understand, but the summary idea is

33
01:48.230 --> 01:49.440
that we can take

34
01:49.440 --> 01:54.870
some simple rules and actually put these together into sort of a more

35
01:54.870 --> 01:57.240
complicated rule, but

36
01:57.240 --> 02:01.840
it handles all of these simple rules in one rule.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

36
01:57.240 --> 02:01.840
it handles all of these simple rules in one rule.

37
02:01.840 --> 02:04.760
So ultimately it's more efficient.

38
02:04.760 --> 02:09.960
We also support service tags that we can use to help identify traffic.

39
02:09.960 --> 02:12.920
This can be based on IP groups.

40
02:12.920 --> 02:18.280
And of course, we can also do the same thing based on applications.

41
02:18.280 --> 02:23.680
So we have application security groups as well as network security groups.

42
02:23.680 --> 02:29.600
Another feature that Azure offers is your route control and tunneling.

43
02:29.600 --> 02:32.720
So route control is fairly straightforward.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

43
02:29.600 --> 02:32.720
So route control is fairly straightforward.

44
02:32.720 --> 02:35.480
We've talked about this a little bit already, right?

45
02:35.480 --> 02:39.440
We only allow traffic where it's desirable.

46
02:39.440 --> 02:43.440
And we do this by controlling what routes are learned where.

47
02:43.440 --> 02:47.960
If you're familiar with things like MPLS VPNs, that's pretty much the

48
02:47.960 --> 02:49.320
fundamental principle

49
02:49.320 --> 02:52.200
behind MPLS VPNs as well.

50
02:52.200 --> 02:56.140
We have security through the fact that we don't have reachability to things we

51
02:56.140 --> 02:56.560
're not

52
02:56.560 --> 02:58.520
supposed to have access to.

53
02:58.520 --> 03:03.560
So route control is a fairly common way of implementing some security.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

53
02:58.520 --> 03:03.560
So route control is a fairly common way of implementing some security.

54
03:03.560 --> 03:08.460
Of course, the opposite of that, if we do our routing incorrectly, we could

55
03:08.460 --> 03:08.860
certainly

56
03:08.860 --> 03:14.680
very easily allow unwanted traffic to go to places that we don't want it to go.

57
03:14.680 --> 03:18.380
Now Azure does give us full control over the routing.

58
03:18.380 --> 03:24.280
So we can definitely have user defined routes just like we saw in AWS.

59
03:24.280 --> 03:30.820
And another sort of unique or interesting feature here is forced tunneling.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

59
03:24.280 --> 03:30.820
And another sort of unique or interesting feature here is forced tunneling.

60
03:30.820 --> 03:37.230
Basically what this does is if one of your servers in Azure has to go out to

61
03:37.230 --> 03:38.660
the Internet.

62
03:38.660 --> 03:44.660
This can actually prevent that unwanted direct Internet access.

63
03:44.660 --> 03:51.050
What it does instead, so this is the alternative here, it forces that outbound

64
03:51.050 --> 03:52.140
traffic to go

65
03:52.140 --> 03:55.940
through some form of an outbound device.

66
03:55.940 --> 04:00.200
So maybe that device is doing filtering or maybe it's doing proxying, but we're
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

66
03:55.940 --> 04:00.200
So maybe that device is doing filtering or maybe it's doing proxying, but we're

67
04:00.200 --> 04:01.000
not allowing

68
04:01.000 --> 04:04.180
the traffic to go out directly.

69
04:04.180 --> 04:09.340
And then like we said, Azure does offer some security appliances.

70
04:09.340 --> 04:12.660
The first of which is the Azure firewall.

71
04:12.660 --> 04:17.480
This again is a cloud native stateful inspection firewall.

72
04:17.480 --> 04:20.740
We would expect nothing less in this day and age.

73
04:20.740 --> 04:23.380
It does offer threat protection.

74
04:23.380 --> 04:29.060
So things like DDoS attacks and SQL injection attacks.

75
04:29.060 --> 04:30.980
These things are going to be protected.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

75
04:29.060 --> 04:30.980
These things are going to be protected.

76
04:30.980 --> 04:33.540
It does offer high availability.

77
04:33.540 --> 04:38.980
So H a is one of the offered features as is high scalability.

78
04:38.980 --> 04:43.120
All of these things can be handled very easily by the firewall.

79
04:43.120 --> 04:47.680
The other sort of interesting thing here is this will not only protect your

80
04:47.680 --> 04:48.500
north south

81
04:48.500 --> 04:54.940
traffic, which is what we would expect, but it also protects East West traffic.

82
04:54.940 --> 05:00.870
Again, remembering that's the traffic between the devices also referred to as
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

82
04:54.940 --> 05:00.870
Again, remembering that's the traffic between the devices also referred to as

83
05:00.870 --> 05:01.860
horizontal

84
05:01.860 --> 05:03.300
traffic.

85
05:03.300 --> 05:08.360
Now the Azure firewall is offered in three different protection levels.

86
05:08.360 --> 05:10.760
Of course, priced accordingly.

87
05:10.760 --> 05:17.310
The first one is the standard, which does offer layer three through layer seven

88
05:17.310 --> 05:18.780
filtering.

89
05:18.780 --> 05:24.540
And it includes the threat intelligent feeds coming from Microsoft cyber

90
05:24.540 --> 05:26.180
security, meaning

91
05:26.180 --> 05:33.060
its intelligence and its information on handling threats is updated constantly.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

91
05:26.180 --> 05:33.060
its intelligence and its information on handling threats is updated constantly.

92
05:33.060 --> 05:38.760
Now there's another version called basic, which has all of the same features as

93
05:38.760 --> 05:39.620
the standard

94
05:39.620 --> 05:41.380
version we just discussed.

95
05:41.380 --> 05:46.220
However, it does not have the advanced features specifically.

96
05:46.220 --> 05:50.680
We're talking here about the threat intelligence feeds that are not going to be

97
05:50.680 --> 05:51.580
available in

98
05:51.580 --> 05:53.780
the basic version.

99
05:53.780 --> 05:59.450
Then to go up from the standard, we also have premium premium also has all of

100
05:59.450 --> 06:00.460
the features
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

100
05:59.450 --> 06:00.460
the features

101
06:00.460 --> 06:07.000
of standard, but also adds a signature base intrusion detection and intrusion

102
06:07.000 --> 06:08.060
prevention

103
06:08.060 --> 06:09.260
system.

104
06:09.260 --> 06:12.140
So this adds even more to the standard.

105
06:12.140 --> 06:17.580
So basic offers the least features premium offers the most.

106
06:17.580 --> 06:22.800
And finally, one of the other security features available from Azure is secure

107
06:22.800 --> 06:24.100
remote access.

108
06:24.100 --> 06:28.870
This is going to be available from workstations where they can come in with say

109
06:28.870 --> 06:29.980
, for example,

110
06:29.980 --> 06:37.140
remote desktop protocol, SSH, or you can actually set up a remote access VPN so
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

110
06:29.980 --> 06:37.140
remote desktop protocol, SSH, or you can actually set up a remote access VPN so

111
06:37.140 --> 06:38.220
they can connect

112
06:38.220 --> 06:42.420
into the Azure network as if they were in the office.

113
06:42.420 --> 06:47.410
Then of course, you probably also want to connect your on-prem network to the

114
06:47.410 --> 06:47.900
cloud

115
06:47.900 --> 06:49.820
over the internet.

116
06:49.820 --> 06:55.640
Now this could be as simple as just accessing some front-end web servers that

117
06:55.640 --> 06:56.660
are serving

118
06:56.660 --> 06:59.700
up the applications that your company needs.

119
06:59.700 --> 07:04.480
Now that's quite possible, but I would say the more common implementation would
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

119
06:59.700 --> 07:04.480
Now that's quite possible, but I would say the more common implementation would

120
07:04.480 --> 07:05.000
actually

121
07:05.000 --> 07:11.540
be to do a site-to-site VPN connecting your entire on-prem network to the cloud

122
07:11.540 --> 07:12.460
network.

123
07:12.460 --> 07:15.680
And again, this is talking about over the internet.

124
07:15.680 --> 07:20.380
So this would be using something like an IPsec secure VPN.

125
07:20.380 --> 07:24.780
We wouldn't want to be sending our traffic in the open over the internet.

126
07:24.780 --> 07:29.720
Finally, you can also connect those vnets together.

127
07:29.720 --> 07:32.760
This would be connecting two different regions.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

127
07:29.720 --> 07:32.760
This would be connecting two different regions.

128
07:32.760 --> 07:36.140
This can be done with a site-to-site VPN.

129
07:36.140 --> 07:42.180
And again, this would be going across the internet using an IPsec VPN.

130
07:42.180 --> 07:46.290
So in this video, we spent just a few minutes looking at some of the security

131
07:46.290 --> 07:47.060
features that

132
07:47.060 --> 07:51.760
are a little bit different or unique in Microsoft's Azure.

133
07:51.760 --> 07:55.900
Next up, let's take a look at some of the features we have in Google Cloud.

134
07:55.900 --> 08:05.900
[BLANK_AUDIO]