IAM to ZT, PQC

• BLUF: These 3 tasks—(1) managing IAM, (2) enabling continuous monitoring, and (3) enforcing data protection—are foundational actions for Enterprise Architects to secure Azure cloud environments effectively

• 3 Common Tasks -- EA -- Azure Cloud Security.

  1. Implementing Identity and Access Management (IAM). -- BLUF: Establish an IAM framework to secure Azure environments. This involves ensuring only authorized users and services have access to resources, following the principle of least privilege.

     • Steps:

       1. * Assess and Define Access Requirements: Identify which users, groups, and service principals need access to specific Azure resources, and determine the minimum permissions required for their roles24.

       2. * Configure Entra ID (aka Azure AD), RBAC, and MFA: Set up Azure Active Directory (AD) to manage identities. Implement Role-Based Access Control (RBAC) to assign appropriate permissions. Enforce MFA for all privileged accounts to add an extra layer of security24.

       3. * Implement Conditional Access Policies: Create and enforce conditional access policies based on user location, device compliance, and risk level. Regularly review and update access policies to accommodate organizational and threat landscape changes24.

  2. Setting Up Continuous Monitoring and Threat Detection. -- BLUF: Continuous monitoring is essential for identifying and responding to threats in real time. Ensure the right tools and processes are in place for ongoing security posture management.

     • Steps:

       1. * Deploy Monitoring Tools: Implement Azure-native solutions like MS Defender for Cloud, Azure Security Center, and MS Sentinel (SIEM-SecInfoEventMgmt) for real-time monitoring and threat detection24. 

       2. * Configure Alerts and Automated Responses: Set up alerts for suspicious activities, policy violations, and potential threats. Automate responses to common incidents where possible, such as isolating compromised resources or blocking malicious IP addresses 24.

       3. Review and Respond to Security Incidents: Regularly analyze security logs and alerts. Coordinate with incident response teams to investigate and remediate detected threats, and update security configurations as needed24.

  3. Enforcing Data Protection and Encryption Policies. -- BLUF: Protecting sensitive data. Ensure data is encrypted both at rest and in transit, and that encryption keys are securely managed.

     • Steps:

       1. Identify Sensitive Data and Regulatory Requirements: Classify data according to sensitivity and compliance obligations (e.g., GDPR, HIPAA)35.

       2. Enable and Configure Encryption: Enable Azure’s built-in encryption for data at rest (e.g., Azure Storage, SQL Database). Ensure Transport Layer Security (TLS) is enforced for data in transit between services and users34.

       3. * Manage Encryption Keys Securely: Use Azure Key Vault to securely store and manage encryption keys and secrets. Regularly audit key usage, rotate keys, and enforce access controls on key management operations34.

Azure IAM (Identity and Access Management) -- to -- Zero Trust (ZT).

• BLUF: 

  1. IAM: To secure access to resources in the cloud. Ref: https://learn.microsoft.com/en-us/entra/fundamentals/  

  2. ZT: A security framework built on the principle of "Never Trust, Always Verify."

  3. Microsoft's Operational Roadmap (Step-by-Step): https://www.edtechirl.com/p/microsoft-zero-trust-assessment-workshop  

• R&R for an IAM Architect:

  1. As an IAM Architect, design and implement identity and access management (IAM) solutions using MS Entra ID (aka Azure AD).

  2. Your role involves analyzing business requirements, developing identity strategies, and architecting Entra ID solutions tailored to organizational needs.

  3. You'll collaborate closely with cross-functional teams to integrate Entra ID solutions into existing infrastructure while ensuring security, scalability, and compliance.

  4. Additionally, you'll provide expertise in Entra ID best practices, troubleshooting, and continuous improvement initiatives to enhance overall system performance and user experience.

  5. This role requires a deep understanding of identity management principles, Microsoft Entra technologies, and proficiency in system integration.

• Value & Benefits:

  1. Scalability and Security: Azure provides a robust and scalable platform for managing user access in the cloud.

  2. Integration with Other Azure Services: AAD integrates seamlessly with other Azure services, simplifying identity management across your cloud environment.

  3. Compliance: Azure helps meet compliance requirements for data privacy and security regulations.

• Principles of IAM: (3)

  1. Least privilege: Grant users only the minimum permissions required to perform their tasks. This reduces the attack surface and potential damage from compromised accounts.

  2. Zero Trust (ZT): Never assume trust; always verify identity through strong authentication methods like Multi-Factor Authentication (MFA).

  3. Segregation of duties: Separate administrative tasks from regular user tasks to prevent unauthorized access or modification.

• Features (of IAM & ICAM-Identity, Credential, and Access Management): (ICAM 101 by DHS)

  1. User Registration and Authentication: ICAM systems allow users to register for accounts and verify their identities through login processes (username/password, MFA).

  2. Authorization and Access Control: ICAM defines what resources users can access and what actions they can perform within those resources.

  3. Single Sign-On (SSO): Users can access multiple applications with a single login, improving convenience and security.

  4. User Provisioning and Deprovisioning: ICAM streamlines adding and removing user access when they join or leave an organization.

  5. User Lifecycle Management: ICAM manages user accounts throughout their lifecycle, including password resets and profile management.

• Implement IAM for ZT: (6)

  1. Identify users and resources: List all the users (employees, contractors, external partners) who need access to Azure resources and categorize the resources they need access to (VMs, storage accounts, databases).

  2. Create User Accounts or Groups: Use MS Entra ID (aka Azure AD) to create user accounts or groups for identified users. MS Entra ID acts as your central identity store.

  3. Assign Roles (Permissions): Assign Azure roles to users or groups. Roles define the specific permissions users have on resources (e.g., Reader, Contributor, Owner).

  4. Enable MFA (Multi-Factor Authentication): Enforce strong authentication through MFA for all users to add an extra layer of security during login.

     • Add: Conditional Access Policy: Set up conditional access policies in MS Entra ID (aka Azure AD) to restrict access based on factors like location, device, or time of day.

  5. MS Entra ID Governance (aka Azure AD): This service helps manage user access lifecycles, including provisioning (to supply & make available), access reviews, and privileged access management.

  6. Monitor/Track Access & Usage: Use Azure Monitor to track access attempts and resource usage to identify suspicious activity.

     • Additional Security: 

       1. (IAM) Azure Sentinel (SIEM): Security information and event management (SIEM) tool that collects security data from across your Azure resources and provides insights for threat detection and response.

       2. (ZT) MS Defender for Cloud: Cloud security posture management solution that continuously monitors your resources for threats and vulnerabilities.

  7. Review access regularly (Audit): Regularly review user permissions and resource access to ensure they are still aligned with current needs

• Common Tasks: (3) (How2)

  1. * Create New User Accounts & Granting Access (to a new employee):

     • * Create a new user account in MS Entra ID (aka Azure AD).

     • * Assign & Audit appropriate Role(s) (e.g., Reader) to the user account based on their job requirements.

     • * Enforce/Enable MFA on the new user account -- STEPS (4): (1) Sign in to the Azure portal with a global administrator account. (2) Navigate to AD/MS Entra ID > Security > Authentication methods. (3) Select Methods and choose the MFA method you prefer (e.g., phone call, mobile app notification). (4) Configure the chosen MFA method and enforce it for all users or specific groups.

     • * Create Conditional Access Policy -- STEPS (6): (1) Sign in to the Azure portal with a global administrator account. (2) Navigate to AD/MS Entra ID > Security > Conditional Access. (3) Click New Policy to create a new policy. (4) Define the conditions under which access will be granted or blocked (e.g., location, device, user risk). (5) Choose the access control action (e.g., grant access, require MFA). (6) Assign the policy to the relevant users or groups.

     • * Enforce Additional Security Measures: (2)

       1. Strong Passwords: Enforce strong password policies with complexity requirements and regular password changes.

       2. Limited Privileges: Assign users only the minimum permissions required for their tasks. Avoid assigning broad "Owner" roles unless absolutely necessary.

  2. Terminating Access (of an employee):

     • Disable the employee's account via MS Entra ID (aka Azure AD) to prevent further access.

     • Remove the user account from any assigned roles.

  3. Conduct Operational Reviews, Monitoring, & Tracking:

     • Use Azure Monitor to track access attempts and resource usage to identify suspicious activity.

     • Review access regularly (Audit): Regularly review user permissions and resource access to ensure they are still aligned with current needs.

     • (IAM) Azure Sentinel: Security information and event management (SIEM) tool that collects security data from across your Azure resources and provides insights for threat detection and response.

     • (ZT) MS Defender for Cloud: Cloud security posture management solution that continuously monitors your resources for threats and vulnerabilities.

ICAM (Identity, Credential, and Access Management) -- to -- Zero Trust (ZT).

• PROs & CONs: (Link) -- BLUF: ICAM principles and Zero Trust principles are complementary approaches to security, but they have some key differences:

  1. ICAM Principles (Pros & Cons):

     • Focus: ICAM focuses on establishing strong identity management practices and access controls. It ensures the "right person" has access based on their role and responsibilities.

     • Verification: ICAM verifies identities and access rights, often using methods like MFA.

     • Perimeter Focus: ICAM can still rely on a network perimeter as a first line of defense, although strong internal access controls are crucial.

  2. Zero Trust Principles (Pros & Cons):

     • Focus: Zero Trust assumes everyone and everything is a potential threat, regardless of location (inside or outside the network). It verifies access requests continuously.

     • Verification: Zero Trust verifies not only identity but also the context of access requests (device, location, time, etc.) using Multi-Factor Authentication (MFA) and other techniques.

     • Perimeter Focus: Zero Trust minimizes the concept of a network perimeter. Access is granted based on verification at each step, not just initial network entry.

     • In compliance with and adhere to standards: CISA ZTMM v2, EO M-22-09, TIC 3.0, NIST CSF, NIST SP 800-53r5, and NIST SP 800-207. 

• Analogy of ICAM & ZT: -- Imagine a high-security building. ICAM is like having a strong ID check at the entrance, but trusting people once they're inside based on their department badges. Zero Trust is like constantly verifying someone's ID and access needs throughout the building, regardless of where they are. 

  1. -- In short: ICAM provides a foundation for secure access control. Zero Trust builds on this foundation by adding a continuous verification layer. 

  2. -- ICAM is a Starting Point: ICAM is a good starting point for implementing a Zero Trust Architecture (ZTA). Many of the technologies used in ICAM (like Azure Entra ID, aka AAD and MFA) are also essential for Zero Trust.

  3. -- Compliance & Mandate: (1) EO 14028 from the POTUS, (2) OMB M-22-09, and using (3a) CISA's ZTMM, or (3b) DoD/DISA ZT Framework. 

• * ICAM Principles w/ Azure (7): -- BLUF: These ICAM principles help organizations create a more secure environment and protect sensitive information from unauthorized access. -- (1) Least Privilege (2) Strong Authentication (3) Separation of Duties (4) Accountability (5) Identity Lifecycle Management (6) Data Classification (7) Regular Reviews and Audit.

  1. Least Privilege: Users should only be granted the minimum level of access required to perform their jobs. This minimizes the potential damage if a user's credentials are compromised.

     • Azure Role-Based Access Control (RBAC) is the primary mechanism for enforcing least privilege. It allows you to assign specific roles (e.g., "Virtual Machine Contributor," "Reader") to users, groups, or applications at a specific scope (e.g., a subscription, a resource group, or an individual resource).

     • MS Entra Privileged Identity Management (PIM) is a crucial tool for implementing Just-In-Time (JIT) access. Instead of having permanent, high-privilege roles, PIM allows you to grant temporary, time-bound access to a role when a user needs it, and then revokes it automatically.

     • AuthS: U.S. Department of Defense's Trusted Computer System Evaluation Criteria (TCSEC), published in 1985 

  2. Strong Authentication: Multi-factor authentication (MFA) should be used to verify a user's identity beyond just a username and password. This adds an extra layer of security to prevent unauthorized access.

     • MS Entra ID using Multi-Factor Authentication (MFA) feature are central to this. You can enforce MFA for all users, specific groups, or based on risk levels.

     • MS Entra ID Conditional Access Policies in Microsoft Entra ID are the policy engine that can require strong authentication based on a wide range of conditions, such as the user's location, the device they are using, and the application they are trying to access.

     • Passwordless authentication options like Windows Hello for Business, FIDO2 security keys, using the Microsoft Authenticator app go beyond traditional passwords to provide stronger, more user-friendly authentication methods.

     • AuthS: NIST Special Publication 800-63.

  3. Separation of Duties: Critical tasks should not be solely controlled by one person. Distributing responsibilities helps prevent fraud and errors.

     • Azure Role-Based Access Control (RBAC) supports this principle by allowing you to create custom roles with specific, limited permissions. For example, you can create one role for "application deployment" and another for "database administration," and ensure that no single user is assigned both roles.

     • MS Entra Privileged Identity Management (PIM) helps enforce separation of duties by requiring multiple people to approve a privileged access request. For example, a request for a highly privileged role might require approval from both the user's manager and a security administrator.

     • MS Entra Identity Governance includes features like Entitlement Management which can prevent a user from requesting an access package if it would grant them a combination of roles that violates separation of duties policies.

     • AuthS: Sarbanes-Oxley Act (SOX) for internal financial controls. 

  4. Accountability: Users should be held accountable for their actions within the system. This includes tracking access attempts and monitoring activity logs.

     • Azure Activity Log records all management-plane events, such as a user creating or deleting a virtual machine or modifying a network security group. This provides an audit trail of who did what, when, and where.

     • MS Entra ID Sign-in Logs and Audit Logs track all user sign-in attempts and changes to the directory (e.g., a user being added to a group, or a policy being modified).

     • MS Sentinel and Azure Monitor can ingest these logs from various Azure services to provide a centralized view for security analysis and reporting. You can use these services to analyze user behavior, detect anomalies, and generate alerts.

     • AuthS: NIST.

  5. Identity Lifecycle Management: User identities should be created, managed, and deactivated throughout their lifecycle within the system. This ensures that access is granted and revoked appropriately.

     • MS Entra ID Governance is the primary service. It includes: (1) Entitlement Management to automate access request workflows, approvals, and expiration. This is especially useful for managing access for external partners and temporary employees. (2) Access Reviews to automate the process of reviewing user access to groups and applications, ensuring that no one has more access than they need. (3) Lifecycle Workflows which can automate the provisioning and de-provisioning of users from applications based on their joiners, movers, and leavers (JML) status.

     • AuthS: NIST's ICAM-related guidelines.

  6. Data Classification: Data should be classified based on its sensitivity. This helps determine the appropriate level of security controls needed for each type of data.

     • MS Purview is the key service for data classification and governance. Its Data Map automatically scans and classifies data across the entire data estate, including Azure services and on-premises data sources.

     • MS Purview Information Protection (formerly Azure Information Protection) allows you to apply sensitivity labels to data. These labels can be used to automatically apply security controls, such as encryption and access restrictions, based on the data's classification (e.g., "Confidential," "Highly Confidential").

     • MS Defender for Cloud can use data classifications to prioritize security recommendations and alerts for sensitive data stores.

     • AuthS: General Data Protection Regulation (GDPR) and the Health Insurance Portability and Accountability Act (HIPAA). 

  7. Regular Reviews and Audits: Security controls and access permissions should be regularly reviewed and audited to identify and address any vulnerabilities.

     • MS Entra Access Reviews in Identity Governance allows you to create recurring campaigns to review user access to groups, applications, and roles.

     • MS Defender for Cloud provides continuous security posture management and recommendations based on security benchmarks and best practices. It helps you identify misconfigurations and vulnerabilities.

     • MS Sentinel: A cloud-native Security Information and Event Management (SIEM) and Security Orchestration, Automation, and Response (SOAR) solution. -- Allows for ongoing threat hunting and analysis of logs from across your environment to detect threats that may have bypassed initial security controls. You can also use it to automate audit-related tasks.

     • AuthS: ISO 27001 and NIST 800-53.

• * ZT Principles w/ Azure (6): -- BLUF: Zero Trust is a security paradigm that moves away from the traditional "castle and moat" approach to network security. Zero Trust is about no user or device is inherently trustworthy, regardless of location (inside or outside the network). In the past, organizations relied heavily on a strong perimeter defense (the moat) to secure their systems, trusting anything that made it inside (the castle).

  1.  Never Trust, Always Verify & Context-Aware Access (4): This core principle underpins the entire Zero Trust philosophy. Every access request, regardless of user or device, is continuously verified throughout a session.

     • MS Entra ID is the identity and access management service that acts as the central control plane for all access requests.

     • MS Entra ID Conditional Access is a key feature of Microsoft Entra ID. It's the policy engine that evaluates a variety of contextual signals—such as user identity, location, device health, and application—to make real-time decisions about access requests. This service requires explicit verification for every access attempt.

     • Multi-Factor Authentication (MFA), enforced through Conditional Access, ensures that users verify their identity with more than one method.

     • MS Entra ID Protection uses machine learning to detect suspicious sign-in activities and user vulnerabilities, allowing for risk-based access policies.

  2. Least Privilege Access (3): Users and devices are granted only the minimum level of access required to perform their tasks. This minimizes the potential damage if credentials are compromised.

     • Azure Role-Based Access Control (RBAC) is a foundational service for implementing least privilege. It allows you to define granular roles and scopes, ensuring users and applications only have the permissions they absolutely need to perform their tasks on Azure resources.

     • MS Entra Privileged Identity Management (PIM) provides Just-In-Time (JIT) access. This means that privileged roles are not permanently assigned. Instead, they are activated for a limited time when a user needs to perform a specific task, and then they are automatically revoked.

  3. Continuous Monitoring (3): Zero Trust employs ongoing monitoring of user activity and system health to detect anomalies and potential threats.

     • MS Defender for Cloud is a Cloud Security Posture Management (CSPM) and Cloud Workload Protection Platform (CWPP) service. It provides continuous security monitoring, threat protection, and recommendations across your Azure and hybrid environments. It helps you assess security posture and identify and respond to threats.

     • Azure Monitor collects, analyzes, and acts on telemetry data from your Azure and on-premises environments. It is essential for gathering logs and metrics, which can be used to detect anomalies and trigger alerts.

     • MS Sentinel is a cloud-native Security Information and Event Management (SIEM) and Security Orchestration, Automation, and Response (SOAR) solution. It uses AI to analyze security data from various sources, including Microsoft Defender for Cloud and Azure Monitor, to detect threats and automate responses.

  4. Microsegmentation & Least Privilege Network Access (4): Networks are segmented into smaller, more secure zones. This limits the blast radius of a potential breach, preventing attackers from easily moving laterally within the network.

     • Azure Virtual Networks (VNets) are used to create isolated, private networks in the cloud. You can use VNets and subnets to logically separate your resources.

     • Network Security Groups (NSGs) are security filters that control traffic to and from resources within a VNet. NSGs are the primary tool for creating micro-perimeters by defining granular allow/deny rules for specific IP addresses, ports, and protocols.

     • Azure Firewall provides network security for your virtual networks. It's a managed, cloud-native network security service that protects your Azure Virtual Network resources by providing built-in threat intelligence and filtering rules.

     • Application Security Groups (ASGs) let you group virtual machines and define network security policies based on workload rather than explicit IP addresses, simplifying the management of security rules for microsegmented environments.

PQC (Post-Quantum Cryptography).

• BLUF: PQC, also referred to as "Quantum-Resistant" or "Quantum-Safe Cryptography," to develop algorithms resistant to attacks by quantum computers. 

• Value & Benefits: (6)

  1. Rapid Adaptability: The system should be designed to allow easy and quick changes to its cryptographic components. This enables swapping out outdated or compromised algorithms with newer, more secure ones.

  2. Minimal Disruption: The process of updating cryptographic elements shouldn't significantly impact the system's operation. Ideally, the transition should be seamless for users and applications.

  3. Focus on Security: The ultimate goal of Crypto-Agility is to maintain a robust security posture. By readily adapting to new threats and vulnerabilities in cryptographic algorithms, the system stays protected from potential attacks.

  4. Enhanced Security: Crypto-Agility allows organizations to proactively address evolving threats by adopting stronger cryptographic mechanisms as they become available.

  5. Long-Term Data Security: Crypto-Agility ensures the confidentiality and integrity of data even as the underlying infrastructure and technologies change over time.

  6. Competitive Advantage: By staying ahead of the curve with robust cryptography, organizations can maintain a competitive edge and build trust with their users.

• Principles (using Azure): (5)

  1. Embrace Industry Standards: Azure adheres to recognized cryptographic standards established by organizations like NIST (National Institute of Standards and Technology) and CISA. This ensures compatibility with future advancements and allows for smoother transitions to new algorithms when needed.

     • -- TOOL (3): Azure Key Vault: This service acts as a secure repository for managing cryptographic keys and secrets. It adheres to industry standards for key management practices defined by organizations like NIST. (2) Use of Standardized Algorithms: When offered, Azure services utilize well-established and recognized cryptographic algorithms like AES (Advanced Encryption Standard) and RSA (Rivest–Shamir–Adleman). (3) Integration with Standards-Compliant Tools.

  2. Leverage Modular Design: Azure services are designed with modularity (reusability, flexibility, and scalability in mind). This isolates cryptographic functions, making it easier to update specific algorithms without affecting the entire system. -- Tools (5):

     • -- TOOLS (5): (1) Azure Resource Manager (ARM): ARM is a service that allows for deployment, management, and orchestration of Azure resources. It promotes modularity by enabling the creation of resource groups that logically group related services. This isolation allows for updates to cryptographic components within a specific resource group without impacting unrelated services. (2) Azure Functions and Azure App Service: These serverless computing platforms allow developers to build applications using code modules. Cryptographic functions can be encapsulated within separate modules, facilitating updates or replacements without affecting the entire application. (3) Azure Key Vault: This service acts as a secure central repository for managing cryptographic keys and secrets. It can be integrated with other Azure services in a modular fashion. Updates to key management practices within Key Vault won't necessarily require changes in dependent services as long as the overall key access interface remains consistent. (4) Azure SDKs (Software Development Kits): Azure offers SDKs in various programming languages that provide libraries and tools for interacting with Azure services. These SDKs are often designed with modularity in mind, allowing developers to choose specific cryptographic functionalities without relying on the entire library. (5) Azure Service Fabric (Optional): This microservices platform allows for building and deploying distributed applications consisting of independent microservices. Each microservice can potentially handle specific cryptographic tasks, promoting modularity and independent updates. (While Service Fabric is a powerful tool, it might be overkill for simpler scenarios).

  3. Emphasize Key Management for Crypto-Agility: Azure Key Vault provides a secure central repository for managing and rotating cryptographic keys. This allows for regular key updates, a crucial aspect of maintaining cryptographic agility. -- BENEFITS (4): (1) Centralized Repository (2) Access Control (3) Key Rotation (4) Auditing and Logging.

     • -- TOOLS (3): (1) Azure Key Vault: This service is specifically designed for secure storage, access control, and lifecycle management of cryptographic keys and secrets. (2) Azure Managed HSM (Hardware Security Module): While not the primary focus for key management, Azure Managed HSM offers an even higher level of security for managing sensitive cryptographic keys. It can be integrated with Key Vault for additional protection. (3) Azure PowerShell, Azure CLI, and Azure SDKs: These tools allow developers to interact with Key Vault programmatically, facilitating automation of key management tasks like rotation and access control.

  4. Automate Where Possible: Azure offers features for automated key rotation and certificate management. This reduces manual intervention and streamlines the crypto-agility process. -- BENEFIT (3): (1) Reduced Errors: Automation minimizes the risk of errors that can occur during manual key rotation or certificate renewal. (2) Improved Efficiency: Automating routine tasks frees up IT staff to focus on other critical security tasks. (3) Enhanced Scalability: Automated processes can easily scale to accommodate a growing number of keys and certificates.

     • -- TOOLS (4): (1) Azure Key Vault: (a) Automated Key Rotation: Define policies within Key Vault to automatically rotate cryptographic keys at predefined intervals (b) API Access and SDKs: Azure Key Vault provides programmatic access through APIs and SDKs (Software Development Kits) for various programming languages. (2) Azure Automation: This service allows for building and running automated tasks and workflows. (3) Azure Managed Service Identity (MSI): MSI simplifies authentication for Azure resources by automatically assigning identities to them. (4) Azure Functions: This serverless computing platform allows developers to build event-driven, short-lived functions. These functions can be triggered by events like key expiration in Key Vault, automatically initiating actions like key rotation, or notifying administrators.

  5. Promote Transparency and Visibility: Azure provides clear documentation and resources on its cryptographic practices. This empowers users to understand the security posture of their data and make informed decisions.

     • ~ NOTE: Azure does not have a single dedicated tool(s) to promote transparency and visibility in cryptography. However, Microsoft achieves this through a combination of resources and practices: (1) Online documents by Microsoft (https://learn.microsoft.com/en-us/azure/): (a) Supported Cryptographic Algorithms (b) Key Management Practices (c) Security Best Practices based on Azure. (2) Azure Security Blog: (https://azure.microsoft.com/en-us/blog/): (a) Review New Cryptographic Features (b) Security Best Practices. (3) Service-Specific Documentation. (4) Transparency Reports.

• Implement PQC / A Roadmap / An Approach as the Landscape Matures / via Azure: (5)

  1. Stay Informed:

     • Microsoft Azure Quantum Team: Follow the work of the Microsoft Azure Quantum team (https://azure.microsoft.com/en-us/solutions/quantum-computing) They are actively involved in researching and implementing PQC solutions.

     • Industry Standards: Keep up-to-date with the National Institute of Standards and Technology (NIST) PQC Project (https://csrc.nist.gov/projects/post-quantum-cryptography) as standards are finalized.

  2. Inventory and Assessment:

     • Software Inventory: Create a comprehensive list of all software applications and systems within your Azure environment that rely on cryptography.

     • PQC Dependency Analysis: Evaluate each software component to determine its reliance on existing cryptographic algorithms. Identify which applications might be vulnerable to quantum computers and require PQC migration.

  3. Early Adoption Strategies (Optional):

     • Microsoft Research PQC Libraries: Microsoft Research offers some early access libraries for experimenting with PQC algorithms (https://quantum.microsoft.com/en-us/our-story/quantum-cryptography-overview). However, these are for research purposes and not officially supported for production use.

  4. Potential Future Approaches (Based on Evolving Standards):

     • Azure Integration of PQC Libraries: As PQC standards mature, Microsoft might integrate these algorithms directly into Azure services. This would likely involve updates or new functionalities within Azure Key Vault, Azure Functions, and other relevant services.

     • Third-Party PQC Solutions: Vendors might develop PQC solutions that integrate with Azure services. These solutions could provide libraries or tools for implementing PQC algorithms within your Azure applications.

  5. Ongoing Monitoring and Updates:

     • PQC implementation is an ongoing process. Stay informed about updates from Microsoft, industry standards, and potential security vulnerabilities.

     • As PQC solutions mature and become production-ready, plan for migration and updates to your Azure environment.

• Common "Future" Tasks: (3)

  1. PQC Key Management: When PQC algorithms become production-ready, Azure Key Vault likely will play a central role in managing PQC keys. This might involve functionalities for:

     • Secure storage of PQC private keys.

     • Secure key generation and derivation using PQC algorithms.

     • Automated key rotation for PQC keys to maintain cryptographic strength.

  2. PQC Algorithm Integration in Azure Services: As PQC standards solidify, Azure services might offer options to leverage PQC algorithms for specific cryptographic tasks. This could involve integrating PQC libraries within services like:

     • Azure Functions: Developers could potentially use PQC algorithms for digital signatures or encryption within serverless functions.

     • Azure Key Vault: Integration of PQC algorithms might allow for signing or encrypting data stored within Key Vault using PQC for enhanced security.

  3. Hybrid PQC Solutions: In the initial stages of PQC adoption, a hybrid approach might be used. This could involve:

     • Utilizing existing, secure quantum-resistant key exchange protocols alongside PQC algorithms for key establishment.

     • Leveraging third-party PQC libraries or tools that integrate with Azure services for specific PQC functionalities.

Crypto-Agility.

• BLUF: Crypto-Agility: The ability of a system to adapt its cryptographic mechanisms swiftly. This adaptation involves switching between cryptographic algorithms, key management practices, and other encryption methods without disrupting the overall system functionality.

• Principles: (3)

  1. Least privilege: Grant users only the minimum permissions required to perform their tasks. This reduces the attack surface and potential damage from compromised accounts.

  2. Zero Trust (ZT): Never assume trust; always verify identity through strong authentication methods like Multi-Factor Authentication (MFA).

  3. Segregation of duties: Separate administrative tasks from regular user tasks to prevent unauthorized access or modification.

• Implement IAM & ZT: (6)

  1. Identify users and resources: List all the users (employees, contractors, external partners) who need access to Azure resources and categorize the resources they need access to (VMs, storage accounts, databases).

  2. Create User Accounts or Groups: Use MS Entra ID (aka Azure AD) to create user accounts or groups for identified users. MS Entra ID acts as your central identity store.

  3. Assign Roles (Permissions): Assign Azure roles to users or groups. Roles define the specific permissions users have on resources (e.g., Reader, Contributor, Owner).

  4. Enable MFA: Enforce MFA for all users to add an extra layer of security during login.

     • Add: Conditional Access Policy: Set up conditional access policies in MS Entra ID (aka Azure AD) to restrict access based on factors like location, device, or time of day.

  5. Monitor/Track Access & Usage: Use Azure Monitor to track access attempts and resource usage to identify suspicious activity.

     • Additional Security: 

       1. (IAM) Azure Sentinel: Security information and event management (SIEM) tool that collects security data from across your Azure resources and provides insights for threat detection and response.

       2. (ZT) MS Defender for Cloud: Cloud security posture management solution that continuously monitors your resources for threats and vulnerabilities.

  6. Review access regularly (Audit): Regularly review user permissions and resource access to ensure they are still aligned with current needs.

• Daily Operational Duites: (3) (How2)

  1. Granting access (to a new employee):

     • Create a new user account in MS Entra ID (aka Azure AD).

     • Assign the appropriate Role(s) (e.g., Reader) to the user account based on their job requirements.

     • Enforce/Enable MFA on the new user account -- STEPS (4): (1) Sign in to the Azure portal with a global administrator account. (2) Navigate to AD/MS Entra ID > Security > Authentication methods. (3) Select Methods and choose the MFA method you prefer (e.g., phone call, mobile app notification). (4) Configure the chosen MFA method and enforce it for all users or specific groups.

     • Create Conditional Access Policy -- STEPS (6): (1) Sign in to the Azure portal with a global administrator account. (2) Navigate to AD/MS Entra ID > Security > Conditional Access. (3) Click New Policy to create a new policy. (4) Define the conditions under which access will be granted or blocked (e.g., location, device, user risk). (5) Choose the access control action (e.g., grant access, require MFA). (6) Assign the policy to the relevant users or groups.

     • Enforce Additional Security Measures:

       1. Strong Passwords: Enforce strong password policies with complexity requirements and regular password changes.

       2. Limited Privileges: Assign users only the minimum permissions required for their tasks. Avoid assigning broad "Owner" roles unless absolutely necessary.

  2. Terminating access (of an employee):

     • Disable the employee's account via MS Entra ID (aka Azure AD) to prevent further access.

     • Remove the user account from any assigned roles.

  3. Conduct Operational Reviews, Monitoring & Tracking:

     • Use Azure Monitor to track access attempts and resource usage to identify suspicious activity.

     • Review access regularly (Audit): Regularly review user permissions and resource access to ensure they are still aligned with current needs.

User Access Management (UAM) based on Azure.

• BLUF: To create a secure and efficient access management environment for your organization.

• Principles based on Azure focus: (10)

  1. Least Privilege: Users should only be granted the minimum level of access required to perform their jobs. This reduces the attack surface and potential damage if a user account is compromised.

  2. Multi-Factor Authentication (MFA):  Azure offers various MFA methods (phone calls, SMS, authenticator apps) to add an extra layer of security beyond just usernames and passwords.

  3. Conditional Access:  Azure allows defining access policies based on various factors like user location, device type, application access time, and risk level. This adds an extra layer of security by requiring additional verification steps when accessing resources under certain conditions.

  4. Just-in-Time (JIT) Access:  Grant access to resources only when needed and for a limited duration. This minimizes the window of opportunity for unauthorized access.

  5. Identity Governance: Implement a process for provisioning, managing, and reviewing user access on a regular basis. This ensures that access is granted to the right users and revoked when no longer needed.

  6. MS Entra ID (aka Azure AAD):  This is Azure's central identity and access management service. It allows managing user identities, groups, and access permissions for Azure resources and other cloud applications.

  7. Segregation of Duties (SoD):  Implement controls to prevent users from performing conflicting actions within the system. This reduces the risk of fraud or accidental data manipulation.

  8. Monitoring and Auditing:  Continuously monitor access logs to identify suspicious activity and ensure compliance with security policies. Azure provides various tools for logging and auditing access attempts.

  9. Automation:  Automate user provisioning, access approvals, and reviews to streamline processes and reduce human error.

  10. Embrace a Zero Trust Approach:   Assume no user or device is inherently trustworthy and always verify access requests. This aligns well with Azure's ZTA (Zero Trust Architecture) capabilities.