>> Learn about Azure security best practices
in this episode of Azure tips and tricks.
In this video, we'll go over seven Azure Security best practices.
The first one is encrypt data at rest and in-flight.
If an attacker gains access to your database,
let's say an Azure SQL Database,
you can still protect your data.
It is protected by the Transparent Data Encryption feature or TDE,
which is enabled by default.
Azure manages the encryption keys and you can also bring your own.
This feature is available in
Azure SQL and Azure Synapse Analytics.
A similar feature is enabled in Azure Database for
PostgresSQL and for Azure Database for MySQL.
You should also make sure that data that travels
over the wire in-flight data is secured.
You secure this with TLS or Transport Layer Security.
For most services, secure data transport is
enabled by default or you can enable it yourself.
The best practices to remember are always encrypt data
at rest and always encrypt in-flight data.
The next best practice is restrict access to your database.
You only want people and services
that you choose to access your database.
In all Azure databases,
you can configure the firewall,
which is enabled by default and blocks IP addresses
that are not allowed.
This is great for development and testing.
For production, you can wrap your database in a virtual network
and use Azure Private Link to connect
to it from the services that you need to.
This shield your database from the outside world.
The best practices to remember are;
enable database firewalls and maintain them strictly,
and in production, shield databases from
the outside world using Azure Private Link.
The next best practice is restrict access to your VMs.
If you are using a virtual machine in Azure,
you probably want to use RDP or SSH to connect to it.
Opening the RDP or SSH port creates a security vulnerability.
So you should leave these ports closed when you create a VM.
Instead, you can deploy your VM in
a virtual network and use Azure Bastion to securely connect to it.
When you use Azure Bastion,
your VM doesn't need a public IP address,
which shields it from the outside world.
The best practices to remember are;
keep the RDP and SSH port of your VMs disabled,
and use Azure Bastion to connect to your VMs.
Next up is protect your application secrets.
You shouldn't store secrets like API keys and
connection strings in application code
where every developer can see them.
You should store them in a central place,
in Azure, that is Azure Key Vault.
This contains the secrets,
keys and certificates for your applications,
and you can securely connect to Azure Key Vault from
your services using Azure managed service identity.
This allows you to connect to Key Vault without
using an API key or connection string.
The best practices to remember are;
store application secrets in a central place like Azure Key Vault,
and use a built in mechanism like managed
service identities to connect to Azure Key Vault.
Next is use a separate Azure subscription for production.
For production environments, the best practice is
to create a separate Azure subscription.
This helps you to keep your production data and
other assets out of your dev test environments,
and you can also easily apply two different sets of
policies across the resources into two subscriptions.
Also, you should use role-based access control or RBAC,
to control which people have access to which resources.
You can apply RBAC to all Azure resources,
including resource groups and subscriptions.
The best practices to remember are;
implement role-based access control
and use a separate Azure subscription for production.
The next best practice is implement a web application firewall.
Your web applications are under constant attack.
They get hit by things like
SQL injection attacks and cross-site scripting attacks.
To deal with these attacks,
you should implement a gateway service like Azure Front Door
or Application Gateway that can route and filter your traffic.
In these services, you should enable
the web application firewall feature.
This detects a text and can block and report them.
The best practices to remember are;
implement a gateway service like
Azure Application Gateway or
Azure Front Door in front of your web applications,
and enable the web application firewall feature
to protect you against attacks.
The final best practice is use Azure Security Center.
If there's only one best practice that you
adopt from this video, it should be this one.
Use Azure Security Center.
This is an Azure service that
tells you what your security state is,
what you can improve, and how to do that.
You can use Azure Security Center to
periodically check the security of
your resources and to be
alerted when something needs your attention.
Security Center helps you to implement
security best practices by telling you where they
need to be implemented and allows you to
directly implement them from the Security Center.
The best practice to remember is,
use Azure Security Center.
Security is a complex topic.
A great way to get started with it in Azure is to
use Azure Security Center. Stay safe.