Using a Layered Approach to Security Design

Organizations are concerned about securing their sensitive data from harmful intent due to the proliferation of BYOD culture and different work habits. Any architecture must have security as a fundamental component. In addition to being expensive and damaging to a company’s brand, data breaches can result in the loss of jobs and a long-term impact on consumer trust. Today’s organisations must support both internal and external access to data and services.

Using Security in Depth, implement a multi-layered method

Security in-depth is an approach that uses many levels of security to protect a system or network. The goal is to thwart an attacker’s ability to gain access to sensitive information and offer timely alerts based on telemetry. By reducing the likelihood of an intruder succeeding, each successive layer of defence increases the level of security.

1- Data

A company’s most important resource is its data. As long as there is no legal or regulatory mandate, it is in a company’s best interest to secure the data’s security.

Most of an organization’s data is housed in cloud storage, along with connected discs on virtual computers, databases, tapes, email productivity, and SaaS apps, all of which are hosted on the internet. In a cloud shared responsibility model, it is the job of the company to guarantee that relevant access, security, and compliance requirements are fulfilled.

2- Applications

On a cloud platform, applications and the data they contain serve as the primary repository for business value. To limit the number and severity of security problems in the application, the development team should apply security practises and technologies.

You should be answering these questions for each application or component:

• Are you using Azure AD, TLS (with mutual authentication), or any modern security standard certified by your security team to authenticate connections?

• This safeguards the application and its data from illegal access:
• User-to-application interaction (if applicable)
• An application’s several components and other services (if applicable)

• Do you only allow users who need it to be able to write or modify data in the app? A security risk of unauthorised data change is reduced as a result.
• A SIEM such as Microsoft’s Azure Monitor or a comparable tool should have the ability to log and feed the application’s activity. This aids the security staff in detecting and investigating assaults more rapidly.
• Is the security team-approved encryption used to safeguard mission-critical data? This prevents data from being copied while it is at rest.
• There must be an encryption method in place to protect both inbound and outbound network communication. This helps guard against data tampering while it’s being transported.
• Is there a way to access other apps, databases, or services through the application? This identifies whether or not an attack can be used to attack other systems using your application.

3- Compute

Virtual machine access should be protected. Windows and Linux machine system updates can be managed by using Azure’s cloud-based update management service or any other update management solution. With update management in place, you can easily examine the status of available updates, schedule the installation of required updates, analyse deployment outcomes, and generate alerts to verify that updates have been effectively applied. Updates are installed. Scheduled. In order to minimise the danger of an attacker causing damage to a business, this layer ensures that the computing resources are extremely secure and that suitable credentials are granted.

4- Network

Using network security groups to guard against unauthorised access to your Azure subnets, implementing secure connectivity to on-premises networks, granting only the bare minimum of access, and ensuring that a firewall instance is in place to filter and inspect any egress traffic are all part of the network layer’s primary responsibilities.

5- Perimeter

It is important to safeguard your network’s resources at the perimeter from network-based threats. 

The following is an important question to consider:

• Is the application protected from DDoS attacks utilising services such as Azure DDoS protection, Akamai, or similar? This prevents attacks aimed at making the application unusable by overloading it.

For large-scale attacks to occur, Azure DDoS or any similar solution must be used.

6- Affiliation & Access

Providing the necessary access and privileges, as well as recording that information, are the primary goals of this layer. The following are some suggested best practises for this layer:

• At some point in the future, all users should be forced to switch to MFA or passwordless authentication.
• Internet-facing services should be able to disable unsafe protocols. Cloud-hosted services are vulnerable to attacks based on the use of outdated authentication techniques.
• Not all accounts with the highest privilege access to on-premises resources should be synchronised with those in the cloud directory.
• Do not separate your on-premises systems from your cloud services by using a single identity provider for all of them.
• Users should be able to access the system only if they meet certain requirements.