To appropriately secure your attack surface, you require better monitoring and governance of your resources, services, and their endpoints.

This represents the attack surface of your organization which can be exploited by an attacker. With all network security controls in place, and each one implemented in a different dashboard, it becomes challenging for customers to have a single view of their entire Azure Network Security state, and that is what this workbook aims to solve.Īs your footprint in the Azure Cloud grows, the number of services and the infrastructure, application and automation resources involved in these services increases significantly which results in the number of endpoints which are exposed internally and externally, with or without the required security controls. This communication internally within Azure and to Azure from external networks is protected with resource specific ACLs and with the cloud native network security services such as DDoS Protection, Web Application Firewall (WAF), Network Security Groups (NSG) and Firewall in Azure. These interactions depend on the underlying networking services provided by the Azure cloud to communicate with other tiers and with its users. In addition to the networking endpoints of an overarching service that your users interact with, the different resources in an infrastructure or application service interact with each other through their own networking endpoints. These resources are generally a part of a larger infrastructure or an application service that your organization provides to its internal and external users.

Microsoft Azure enables you to deploy a variety of infrastructure, web application and automation resources. Written in collaboration with Arviv (Program Manager, Microsoft Defender for Cloud Product Team)

Waf network