In 2021, the effects of ransomware and data breaches were felt by all of us. This trend will likely continue in 2022 as attackers continue to seek out vulnerabilities in our most critical systems. One thing is clear, the threat isn’t going away.
We must strive to be vigilant to ensure that we are doing all we can to ensure our data and infrastructure is secure. Security is not a target. We can’t check a box indicating our workload is “secure”. Rather, security is an ongoing journey guided by the security principles defined in frameworks like the Well-Architected Framework.
Last May, Colonial Pipeline shut its entire network which supplies nearly half of the U.S East Coast’s fuel supply after a ransomware attack. Investigators say the attackers accessed the network through an exposed password on a VPN account. It’s almost hard to fathom that such a trivial-sounding vulnerability (a single password) could lead to a disruption on such a massive scale that Colonial Pipeline would be forced to pay their attackers a reported ransom of $5 million.
There was a time when network was considered the primary perimeter for security. With the doubling of employees working from home in 2021, utilizing an identity and access management solution like Azure Active Directory (Azure AD) as a centralized identity management is more important than ever. Enable Azure AD Multi-Factor Authentication (MFA) immediately to add a critical second layer of security to all sign-ins.
Leveraging identity management should also apply to machine-to-machine communication as well. Phasing out encrypted keys and credentials from your application should be a first-tier priority. Again, you can refer to the Security pillar of the Well-Architected framework for service-specific guidance on how to do this.
Let’s look at an example. Suppose you have a storage account used to retrieve blob data using an encrypted key. Understanding the risks of encrypted keys and the challenges involved in rotating them, it is recommended you migrate authentication to a managed identity tied to Azure AD. Here is a tutorial to show you exactly how to do it.
Even if your passwords and keys aren’t stored in your local config files, you still may have valuable data stored in plaintext that should be secured. Configuration entries such as table names, API endpoints, and timeouts provide valuable information to attackers and should be secured alongside your keys and credentials in a service like Azure App Configuration. Here is a tutorial on how to get started accessing configuration from ASP.NET Core.
A security event is destructive to your customer confidence and may expose your company to potential liability. While it’s tempting to continually focus on building out new features to stay competitive, it’s important that security remediation be a persistent presence in your backlog. If you are struggling to find security tasks or not sure where to start, checkout the Threat Modeling Tool from Microsoft. The Threat Modeling Tool will create a number of mitigations and reports you can import into Azure DevOps so you can incorporate into your sprint planning.