Kategorie: Microsoft Azure

Safeguarding your cloud resources with Azure security services

While cloud security continues to be a top concern, we recently shared insights from a survey that show overall concern has dropped significantly since 2015. We’re now at a stage where half of organizations contend the cloud is more secure than their on-premises infrastructure. In conversations I have with our customers and partners, I hear increasingly about how using the cloud improves an organizations’ security posture. As many organizations push forward on their digital transformation through increased use of cloud services, understanding the current state of cloud security is essential.

Maintaining a strong security posture for your cloud-based innovation is a shared responsibility between you and your cloud provider. With Microsoft Azure, securing cloud resources is a partnership between Microsoft and our customers, so it’s essential that you understand the comprehensive set of security controls and capabilities available to you on Azure. 

Microsoft Azure is built on a foundation of trust and security. With significant investments in security, compliance, privacy, and transparency, Azure provides a secure foundation to host your infrastructure, applications, and data in the cloud. Microsoft also provides built-in security controls and capabilities to further help you protect your data and applications on Azure. These can be classified broadly into four categories:

Manage and control user identity and access: Comprehensive identity management is the linchpin of any secure system. You must ensure that only authorized users can access your environments, data, and applications. Azure Active Directory serves as a central system for managing access across all your cloud services, including Azure, Office 365, and hundreds of popular SaaS and PaaS cloud services. Its federation capability means that you can use your on-premises identities and credentials to access those services, and Azure Multi-Factor Authentication provides for the most secure sign-on experience.

Increase network and infrastructure security: Azure provides you the security-hardened infrastructure to interconnect Azure VMs as well as make connections to on-premises datacenters. Additionally, you can extend your on-premises network to the cloud using secure site-to-site VPN or a dedicated Azure ExpressRoute connection. You can strengthen network security by configuring Network Security Groups, user-defined routing, IP forwarding, forced tunneling, endpoint ACLs, and Web Application Firewall as appropriate.

Encrypt communications and operation processes: Azure uses industry-standard protocols to encrypt data in transit as it travels between devices and Microsoft datacenters, and when it is stored in Azure Storage. You can also encrypt your virtual machine disks using Azure Disk Encryption. Azure Key Vault enables you to safeguard and control cryptographic keys and other secrets used by cloud apps and services. Azure Information Protection will help you classify, label, and protect your sensitive data.

Defend against threats: Microsoft enables actionable intelligence against increasingly sophisticated attacks using our network of global threat monitoring and insights. This threat intelligence is developed by analyzing a wide variety of signal sources and a massive scale of signals. (For example, customers authenticate with our services over 450 billion times every month, and we scan 200 billion emails for malware and phishing each month.) Our approach to protect the Azure platform includes intrusion detection, distributed denial-of-service (DDoS) attack prevention, penetration testing, behavioral analytics, anomaly detection, and machine learning. You can leverage additional services to develop a strong threat prevention, detection, and mitigation strategy.

Azure Active Directory Identity Protection helps you protect and mitigate against the risks from compromised identities. It offers a cloud powered, adaptive machine learning based identity protection system that can detect cyber-attacks, mitigate them in real time, and automatically suggest updates to your Azure AD configuration and conditional access policies. Services like Antimalware for Azure and Azure Security Center use advanced analytics to not only help in detecting threats but also prevent them. Azure Security Center helps you get a central view of the security state of all your Azure resources in real time, including recommendations for improving your security posture. You can use Operations Management Suite to extend the threat prevention, detection and quick response across Azure and other environments (on-premises, AWS). Log Analytics service will give you real-time insights to readily analyze millions of records across all of your workloads regardless of their physical location.

These are just a few examples of the broad set of security controls and services available to you with Azure. Over the past year, we have expanded the portfolio with many new security services and ongoing enhancements.

Microsoft is committed to continued innovation in helping you protect your data, applications, and identities in the cloud. Innovations we have delivered most recently include:

New capabilities and enhancements in Azure Security Center available for preview this month include Just In Time network access to VMs, automatic discovery and recommendations for application whitelisting, and expanded Security Baselines with more than 100 recommended configurations defined by Microsoft and industry partners. Our research team continues to monitor the threat landscape and innovate on detection algorithms. Some new threat detections available to customers include Brute Force detections, outbound DDoS and Botnet detections, as well as new behavioral analytics for Windows and Linux VMs.
Preview of Storage Service Encryption for File Storage. IT organizations can lift and shift their on-premises file shares to the cloud using Azure Files by simply pointing the applications to the Azure file share path. Azure Files now offer enhanced protection with the ability to encrypt data at rest.
Azure SQL Database Threat Detection is already available in preview. Last week the team announced that it will be generally available in April 2017. Azure SQL Database Threat Detection provides an additional layer of security intelligence built into the Azure SQL Database service that uses machine learning to continuously monitor, profile, and detect suspicious database activity to help customers detect and respond to potential threats.

With these tools, organizations are able to securely transition to the cloud while also complying with regulatory requirements. Read how Ricoh USA Inc. discovered that Azure exceeds the level of security it could previously offer its customers.

Azure has a vibrant partner ecosystem, so it’s also easy to bring your trusted cloud security vendor with you, enabling you to leverage your existing security solutions. Find partner security solutions in Azure Marketplace.

Microsoft Azure at RSA 2017

For those of you attending RSA Conference this week in San Francisco, we hope to connect with you at the show. You can:

See the keynote by Brad Smith, President and Chief Legal Officer at 8:35AM PST. You can stream it live if you’re not at RSA.
Attend our sessions:

A Vision for Shared, Central Intelligence to Ebb a Growing Flood of Alerts: SP03-T09
How to Go from Responding to Hunting with Sysinternals Sysmon: HTA-T09
Critical Hygiene for Preventing Major Breaches: CXO-F02
Advances in Cloud-Scale Machine Learning for Cyber-Defense: EXP-T11
Learnings from the Cloud: What to Watch When Watching for Breach: STR-W11

Visit Booth 3501 in the North Expo Hall and learn how Microsoft solutions work together to improve your organization’s security posture. See the complete Microsoft schedule for RSA 2017. Hope to see you in San Francisco!

Quelle: Azure

Azure Application Insights JavaScript SDK: reliability and performance improvements

Recently, we have improved the robustness of web page monitoring in Application Insights, and introduced the ability not to use cookies. Transmission is now more reliable in the face of throttling and network issues, and when a page is about to unload.

With Azure Application Insights you can monitor performance and usage of your apps. With a little snippet of JavaScript you can get timings of page loads and AJAX calls, counts and details of browser exceptions and AJAX failures, as well as users and session counts. To learn more how to get started you can visit our documentation.

New JavaScript SDK features

In addition to internal improvements we have fixed some bugs, cleaned up the SDK, and added a couple more features:

Add snippet.js to NPM package:

Snippet.js is a file used for those who want to use application insights from a separate file instead of using inline JavaScript using a Gulp pipeline. By RehanSaeed. Thanks Muhammed Rehan!

Option to disable cookies

This was an ask from some of our users. Now you can disable cookies, but some features will be lost. Without cookies every page view will count as a new user and session. For more configuration options please see our Application Insights SDK JavaScript API

Enable dependency correlation headers

These are now turned off by default, but you can enable them manually. To correlate dependencies with server request set disableCorrelationHeaders in your config file to false. If you opt in to this feature you will then be able to see the server request that correlate with your client side AJAX calls.

JavaScript SDK Improvements

The below improvements have been made that elevate our JavaScript SDK without any additional work when onboarding

Security

The JS SDK has fully switched to https. We now use https to send all telemetry and to download the library. Also, for all secure sites the SDK will create cookies with a secure flag – more on set-cookie documentation. 

Transmission

One of the biggest goals for Application Insights JavaScript SDK is to provide as much functionality as possible, while not degrading the instrumented page in any way. This includes performance and user experience. Because transmission reliability is a crucial part of the SDK, we’ve recently made a few improvements in this area.

Telemetry is now sent more reliably when:

1. The Application Insights portal is imposing throttling, or is temporarily unable to accept data.

Retry and error handling features are helping to improve transmission reliability. In the case of network issues, the SDK will retry sending the telemetry data with an exponential backoff.

2. The user navigates to a new page within the same site, shortly after your code sends a telemetry event. Previously, events not yet sent were lost when the page was unloaded. Events are now kept in a session buffer that is preserved across pages in the same site.

Beacon API

JavaScript SDK also provides experimental support for a Beacon API. The Beacon API is designed to transmit telemetry when the browser is not busy with time-critical operations. All data is delivered even if the user navigates away or closes a browser tab.

The Beacon API only allows to queue data for transmission, and the actual transmission is handled by the browser outside of our control. Thus, the JavaScript SDK cannot receive a confirmation from the Application Insights backend that all telemetry was received and processed correctly.

If a default JavaScript SDK configuration doesn’t fully work for you and you suspect that not all events are tracked or that transmission is impacting the performance of your page, you can try using the Beacon API.  The feature is currently disabled, but you can enable it by setting ‘isBeaconApiDisabled’ to false – see config. If you decide to send your data using the Beacon API, the SDK will automatically turn off Session Storage Buffer and Retry features.

Performance.now in Session Class

After working with the PowerBI and Edge team we have moved to using performance.now in session calls. This improves the performance of our library’s date/time handling.

Feedback

If you have any questions or experiencing any problems with the JavaScript SDK, feel free to open an issue on GitHub.

Special Thanks

Special thanks to Kamil Szostak for help preparing this post.
Quelle: Azure

What’s new in Azure Active Directory B2C

Over the past few weeks, we have introduced new features in Azure AD B2C, a cloud identity service for app developers. Azure AD B2C handles all your app’s identity management needs, including sign-up, sign-in, profile management and password reset. In this post, you’ll read about these features:

Single-page app (SPA) support
Usage reporting APIs
Friction-free consumer sign-up

Single-page app (SPA) support

A single-page app (SPA) is a web app that loads a single HTML page and dynamically updates the page as the consumer interacts with the app. It is written primarily in JavaScript, typically using a framework like AngularJS or Ember.js. Gmail and Outlook are two popular consumer-facing SPAs.

Since JavaScript code runs in a consumer’s browser, a SPA has different requirements for securing the frontend and calls to backend web APIs, compared to a traditional web app. To support this scenario, Azure AD B2C added the OAuth 2.0 implicit grant flow. Read more about using the OAuth 2.0 implicit grant flow or try out our samples:

A SPA, implemented with an ASP.NET Web API backend
A SPA, implemented with a Node.js Web API backend

Both samples use an open-source JavaScript SDK (hello.js). Note that the OAuth 2.0 implicit grant flow support is still in preview.

Usage reporting APIs

A frequent ask from developers is to get access to rich consumer activity reports on their Azure AD B2C tenants. We’ve now made those available to you, programmatically, via REST-based Azure AD reporting APIs. You can easily pipe the data from these reports into business intelligence and analytics tools, such as Microsoft’s Power BI, for detailed analyses. With the current release, 4 activity reports are available:

tenantUserCount: Total number of consumers in your Azure AD B2C tenant (per day for the last 30 days). You can also get a breakdown by the number of local accounts (password-based accounts) and social accounts (Facebook, Google, etc.).
b2cAuthenticationCount: Total number of successful authentications (sign-up, sign-in, etc.) within a specified period.
b2cAuthenticationCountSummary: Daily count on successful authentications for the last 30 days.
b2cMfaRequestCountSummary: Daily count of multi-factor authentications for the last 30 days.

Get started using the steps outlined in this article.

Friction-free consumer sign-up

By default, Azure AD B2C verifies email addresses provided by consumers during the sign-up process. This is to ensure that valid, and not fake, accounts are in use on your app. However, some developers prefer to skip the upfront email verification step and doing it themselves later. This friction-free sign-up experience makes sense for certain app types. We’ve added a way for you to do this on your “Sign-up policies” or “Sign-up or sign-in policies”. Learn more about disabling email verification during consumer sign-up.

Feedback

Keep your great feedback coming on UserVoice or Twitter (@azuread, @swaroop_kmurthy). If you have questions, get help on Stack Overflow (use the ‘azure-active-directory’ tag).
Quelle: Azure

Preview the new enhancements to Azure Security Center

While the cloud may have initially raised some security concerns among enterprises, Microsoft is changing those dynamics. By tapping into the collective power of millions of cloud customers, Microsoft can help each customer more effectively defend against the increasing volume and sophistication of attacks. Azure Security Center has released a number of new capabilities that leverage this collective intelligence to not only detect threats, but also do a better job of preventing them.

Advanced cloud defenses  

Some traditional security controls deliver important protection from threats, but have proved to be too costly to configure and maintain. By applying prescriptive analytics to application and network data, learning the behavior of a machine or a group of machines, and combining these insights with broad cloud reputation, Azure Security Center empowers customers to realize the benefits of these controls without introducing any management overhead.

Application Whitelisting – Once compromised, an attacker will likely execute malicious code on a VM as they take action toward their objectives. Whitelisting legitimate applications helps block unknown and potentially malicious applications from running, but historically managing and maintaining these whitelists has been problematic. Azure Security Center can now automatically discover, recommend whitelisting policy for a group of machines and apply these settings to your Windows VMs using the built-in AppLocker feature. After applying the policy, Azure Security Center continues to monitor the configuration and suggests changes making it easier than ever before to leverage the powerful security benefits of application whitelisting.
Just-In-Time (JIT) Network Access to VMs – Attackers commonly target open network ports (RDP, SSH, etc.) with Brute Force attacks as a means to gain access to VMs running in the cloud. By only opening these ports for a limited time when needed to connect remotely to the VM, Azure Security Center can significantly reduce the attack surface and subsequently the risk that the VM will be compromised.

For an early preview, join the Azure Advisors community and then Azure Security Center Advisors group.

Advanced threat detection

Our security research and data science teams are constantly monitoring the threat landscape and adding new or enhancing current detection algorithms. Azure Security Center customers benefit from these innovations as algorithms are continuously released, validated, and tuned without the need to worry about keeping signatures up to date. Here are some of the most recent updates:

Harnessing the Power of Machine Learning – Azure Security Center has access to a vast amount of data about cloud network activity, which can be used to detect threats targeting your Azure deployments. For example:

Brute Force Detections – Machine learning is used to create a historical pattern of remote access attempts, which allows it to detect brute force attacks against SSH, RDP, and SQL ports. In the coming weeks, these capabilities will be expanded to also monitor for network brute force attempts targeting many applications and protocols, such as FTP, Telnet, SMTP, POP3, SQUID Proxy, MongoDB, Elastic Search, and VNC.
Outbound DDoS and Botnet Detection – A common objective of attacks targeting cloud resources is to use the compute power of these resources to execute other attacks. New detection algorithms are generally available in Azure Security Center, which clusters virtual machines together according to network traffic patterns and uses supervised classification techniques to determine if they are taking part in a DDoS attack. Also, in private preview are new analytics that detect if a virtual machine is part of a botnet. It works by joining network data (IPFIX) with passive DNS information to obtain a list of domains accessed by the VM and using them to detect malicious access patterns.

New Behavioral Analytics Servers and VMs – Once a server or virtual machine is compromised, attackers employ a wide variety of techniques to execute malicious code on that system while avoiding detection, ensuring persistence, and obviating security controls. Additional behavioral analytics are now generally available in Azure Security Center to help identify suspicious activity, such as process persistency in the registry, processes masquerading as system processes, and attempts to evade application whitelisting. In addition, new analytics have been released to public preview that are designed specifically for Windows Server 2016, for example activity related to SAM and admin account enumeration. Over the next few weeks, many of the behavioral analytics available for Windows VMs will be available for Linux VMs as well. Operations Management Suite Security users will also benefit from these new detections for non-Azure servers and VMs.
Azure SQL Database Threat Detection – Threat Detection for Azure SQL Database, which identifies anomalous database activities indicating unusual and potentially harmful attempts to access or exploit databases, announced upcoming general availability in April 2017. You can view alerts from SQL Database Threat Detection in Azure Security Center, along with additional details and actions for investigating and preventing similar threats in the future.

To take advantage of these and other advanced detection capabilities, select the Standard tier or free 90 Day Trial from the Pricing Tier blade in the Security Center Policy. Learn more about pricing.

Integrated partners   

Azure Security Center makes it easy for you to bring your trusted cloud security vendors with you to the cloud. Recent additions include:

Fortinet NGFW and Cisco ASA – In addition to solutions from Checkpoint and Barracuda, ASC now features integration with Fortinet and Cisco ASA next generation firewalls. ASC automatically discovers deployments where these solutions are recommended (based on the policy you set), streamlines deployment and monitoring, and integrates security alerts from these partner solutions – making it easier than ever to bring your trusted security solutions with you to the cloud.

Azure Security Center requires zero setup – simply open Security Center in the Azure Portal. Use the free version or upgrade to the 90 Day Trial to enable advanced prevention and threat detection.
Quelle: Azure