Start Secure, Stay Secure: Full-Lifecycle Application Security with Azure

How to start and operate secure applications on Microsoft Azure

1. Start Secure, Stay Secure: Full-Lifecycle Application Security with Azure Dinusha Kumarasiri

2. Dinusha Kumarasiri, MVP Microsoft MVP for Microsoft Azure Microsoft Certified Trainer (MCT) Enterprise Architect at NCS Australia Cloud Enthusiast Love to share what I learn dinushaonline.blogspot.com @kumarasiri048 dinushak Dinusha Kumarasiri

3. Agenda Evolution of Application Landscape Modern Application Security Challenges Start Secure: Strategy, Design & Build Stay Secure: Deploy & Operate dinushaonline.blogspot.com @kumarasiri048 dinushak Dinusha Kumarasiri

4. Evolution of Application Landscape Network perimeter-based security controls Implicit trust inside the network Physical datacenter security Legacy security protocols Security Lense

5. Evolution of Application Landscape Diversity of endpoints Scattered application components Shared security responsibility Identity becomes the primary Perimeter APIs is the main integration layer Security Lense

6. The Modern Application Security Challenges Expansion of attack surface Inconsistent security controls across environments More entry points for threat actors to exploit Misconfigurations & data control SaaS & Cloud services deployed outside central IT oversight Insecure settings & accidental exposure of data Evolving threat landscape AI-Powered attacks How do we protect AI solutions? Regulatory & compliance pressure Compliance with multiple frameworks (ISO, SOC, PCI DSS, etc..) Data residency & sovereignty challenges Lack of controls on identity Compromised credentials (Phishing, MFA fatigue attacks, token theft) Complexity of using multiple identity providers (Entra, Okta, etc..)

7. Start Secure dinushaonline.blogspot.com @kumarasiri048 dinushak Dinusha Kumarasiri Strategy, Design & Build

8. Design: Security Requirements & Threat Modelling Identify risks early, align to compliance from the start Threat Modelling Microsoft Threat Modeling Tool To identify potential threats of an application Spoofing identity Tampering with data Repudiation Information disclosure Denial of service Elevation of privilege Impersonate a user/service Entra ID with conditional access, Managed Identity Modify data in transit or at rest Storage service encryption, Key Vault, TLS/HTTPS Deny a transaction or making difficult to trace Azure Monitor Logs, Immutable retention Sensitive data leakage Microsoft Purview Disrupting service availability to legitimate users DDoS Protection, Front Door rate limiting Gaining higher access levels than permitted RBAC, Privileged Identity Management , Access Reviews Microsoft Defender for Cloud Baseline: Microsoft cloud security benchmark Additional: Custom or built-in security standards

9. Design: Security Requirements & Threat Modelling

10. Design: Zero Trust with Defense in Depth Plan your application to Never trust, Always verify! Verify explicitly MFA, Device compliance, Location-based checks Entra ID Conditional Access Policies to detect suspicious sign-ins Entra ID Protection Validate incoming requests at the entry point Azure Front Door + WAF Authenticate among azure components Managed Identities Use Least Privilege Access Granular permission on Azure resources Azure Role-Based Access Control (RBAC) Just-in-time access to privileged roles Privileged Identity Management (PIM) Security trimming, row level security Azure Cognitive Search, Azure SQL Assume Breach Network micro segmentation. Network security VNETs, Subnets & NSGs Keep network traffic private whenever possible Private Endpoints Enforce governance over the entire estate Azure Policy Assess security posture & compliance Microsoft Defender for Cloud Collects, correlates & analyzes logs to detect anomalies Azure Monitor

11. Design: Secure Data & API Design Build APIs & data flows with Confidentiality, Integrity & Availability in mind Observability Policy Business Continuity Scalability Data Security Define data classification labels with Microsoft Purview Encryption, access restrictions & watermarks to labels Encrypt data in transit & rest Default platform encryption, Azure Disk Encryption, TLS, mTLS Control access with Azure RBAC & Azure Key Vault Connection strings, encryption keys Immutable retention & lifecycle policies in Azure Blob Storage Hot -> Cool -> Archive, Immutable for compliance & holds API Security Expose APIs through Azure API Management Authentication, throttling, monitoring, developer experience Protect APIs with OAuth 2.0/ OIDC via Entra ID Entra app registrations. Entra ID issues JWT tokens Implement Azure Front Door/Application Gateway with WAF Access restrictions on app service(s)

12. Microsoft Purview

13. Develop: Secure Coding & Dependency Management Prevent vulnerabilities in custom code & third-party components Static Application Security Testing (SAST) GitHub advanced security GitHub advanced security for Azure DevOps Analyze the code without running the app Supports many languages Integrate at pull request level for pre-merge checks Scheduled branch scans Injection attacks Cross-Site Scripting Hardcoded secrets Insecure cryptography Open redirects

14. Stay Secure dinushaonline.blogspot.com @kumarasiri048 dinushak Dinusha Kumarasiri Operate & Govern

15. Continuous Monitoring & Threat Detection Continuously monitor app behaviour for anomalies Azure Monitor Defender for Cloud Application Insights Azure Dashboards Collect metrics, logs & telemetry Application performance management within Azure Monitor Requests, dependencies, exceptions & response times Visualize collected telemetry & metrics Supports multiple sources Threat detection & security posture management

16. Incident Response & Recovery Minimize damage & recover securely after an incident Microsoft Sentinel Azure Business Continuity Centre Cloud native Security Information & Event Management (SIEM) system Security Orchestration, Automation & Response (SOAR) Detects incidents and automate responses based on playbooks Central hub for BC & DR Recovery & backup vaults

17. Operational Governance & Compliance Azure Advisor – Security Score Defender for Cloud – Security Posture Defender for Cloud – Compliance

18. Resources Microsoft Security Development Lifecycle (SDL) Practices Microsoft Threat Modeling Tool Zero Trust

19. Thank You! dinushaonline.blogspot.com @kumarasiri048 dinushak Dinusha Kumarasiri