Secure a Storage Account

This 45-minute virtual IT Pro Challenges lab will teach three best practices to secure a Microsoft Azure storage account. If you run the lab on an Apple machine, you will need to have Microsoft Remote Desktop ready for the 3rd lab section. You will learn the following:

• Requiring access only through HTTPS.
• Generating a shared access signature (SAS), granting full access to queues and tables in a Web App.
• Setting firewall rules, limiting network access to an Azure virtual network.

Learners will gain hands-on experience in safeguarding a storage container’s contents while allowing customers with access permission to obtain and work with their data.

Should you know how to navigate through a Microsoft Azure Resource group that includes a storage account and a Web app, then you will be primed to take this virtual lab. Understanding some of the concepts around HTTPS and network security will reinforce your hands-on experiences in the lab. You will need to set aside a full 45-minutes as you cannot stop the lab in the middle and return to it. You can, however, attempt the lab more than once if needed. When you start the lab, you will see a preconfigured Azure Resource group. You will launch a virtual machine to complete the third exercise and have Microsoft Remote Desktop installed on an Apple.

System Administrators, Network Operations Specialists, and Cyber Security Engineers must know how to safeguard storage on the cloud to comply with regulations and to protect privacy. Microsoft Azure provides multi-level security solutions for blob storage: data protection, identity, and access management, and networking. HTTPS secures data while generating a shared SAS safeguards access. Firewalls reinforce network security. This lab advances knowledge of all three aspects to manage access to an Azure storage account.

Understanding the Scenario:

You are a system administrator for a company that provides web hosting services for customers. You need to secure a Storage Account that may hold sensitive data. You start by requiring a secure transfer for the Storage Account. You then generate a secure access signature (SAS) and configure a Web App to use the SAS. Finally, you limit access to the Storage Account to an Azure virtual network.

Require Secure Connections:

In this section, you log into the lab environment and set the preconfigured blob image to require a secure connection through HTTPS. HTTPS protocols are compatible with a REST API, that secures all access to Azure Storage Accounts. This RESTful API allows Azure to make requests for or receive data from any other machine. Using a ‘GET’ request to the storage account retrieves an image, and tests whether a secure connection is required. To get a valid result, you may need to refresh the browser; you can see the page with the new code instead of a cached version of the old code.

Generate a Shared Access Signature:

A SAS provides admittance to data resources in a storage account by another user, service, or account. In this exercise, you create a SAS connection string that links a preconfigured Web app to the storage account. You test this set up by navigating to the Web App page and generating and obtaining messages from the storage account.

Set Firewall Rules:

You set firewall rules allowing access to the storage account from a particular subnet, an Azure virtual network. You leave the Azure machine outside of this subnet. In checking your work, you validate an access denied message occurs when attempting to view the image blob on the Azure machine. Then you open the storage image in a VM passing trusted username and password credentials through the firewall. From the VM, you can see the blob image in the storage account.

Summary:

Successful completion of the lab will give you tools to secure storage data, access, and network connectivity. In this lab, you will master:

• Configuring secure connections.
• Generating a shared access signature (SAS).
• Limiting access to a Storage Account through firewall rules.

You will have learned the skills to use the tools to give customers confidence about the security of their contents stored in the Azure cloud.