In this lesson, we'll discuss Azure network security. Security is a key component of any enterprise deployment. It's important to consider all the security requirements for traffic and data traveling on your network. We're going to talk a little bit about the roles and responsibilities of security within an organization. We'll describe the benefits of using security groups and consistently applying security. And then we'll talk a little bit about common cloud security concepts. Everyone involved in a network, the infrastructure provider, the platform provider, the user and the local it organization has a role in security. Historically, an organization had to maintain security for devices connecting to their network. They needed tight controls over hardware in their data centers. Today, we have cloud providers with data centers throughout the world. We rely more on these service providers to backup the data and help us manage security. Well Azure provides infrastructure level security, we still have control using policies and security groups to manage access to the resources within the organization. One example of this is access to the Internet. Typically an application will have a front-end or UI that has web access, but the supporting data is behind a firewall in a database server without Internet access. We can allow access to the Internet using network security groups within Azure. The settings allow and deny permission so different servers within the security group can have access based on the ports that are open. For example, with web servers we would allow Internet access through ports 80 and 443 for HTTP and HTTPS traffic. However, assuming our database is a SQL Server it will use port 1433. We wouldn't want to open the database directly to the Internet, but we do need access from our own web servers to retrieve data from the database. We can apply this consistent application of port rules and security rules for network traffic using network security groups. Let's review an example of a basic security architecture. Here we have a typical on-premise network. In the back office we have servers, data center components, and a network. We would add a gateway to our Azure Virtual Network either with a peer-to-peer network or a VNET connection. We could define a firewall which would control access to the internal Azure network and we could also add a web tier subnet to separate the traffic from the Internet. A back office business tier would contain business logic and a data tier would secure the databases. All of these are segregated by subnets to control and secure access. With these VNETs and subnets we use monitoring and reporting to understand the data traversing the network and to control the flow of traffic within the Azure network. Now, let's look at some key considerations or best practices. To secure your network, you'll likely centralized core network management functions. It's important to consistently apply policies using groups as resources are added to the network. You'll also want to have tight control of security elements. Within your organization define clearly who has access to policies, who can apply policies and how these policies will be applied. When building your cloud network, you'll apply the same principles as in a typical local area or LAN network. Logically segment the subnets, for example, with a data tier, a web tier and an application tier. Each tier will have a different subnet so you can control the communication between all components. You'll also have the benefit of using the network access controls by applying access control groups directly to each of the subnets. This gives you an incredible opportunity to control the routing behavior of your applications and data and to maintain optimal security for your information and resiliency for your data within an Azure network. A best practice is to use a DMZ or perimeter network. This gives you wide control and confidence over which devices at the edge of your network are accessing the Internet and ensures that sensitive or controlled applications with private information are fully segmented from Internet access and potential threats. Another key feature of azure is using application security groups. You can apply security based on the type of application you deploy. Now this provides an increased granularity for the security applied to types of resources further segmenting your security controls. Security groups provide increased centralization over-logging, reporting and cost management through resource tags and resource tag management. Security groups also provide increased capabilities of traffic filtering to prevent access from sources that are not allowed.
