In today’s digital landscape, where businesses increasingly rely on cloud services to drive innovation and efficiency, ensuring robust cybersecurity measures is paramount. As organisations embrace the transformative potential of the cloud, they must also address the evolving challenges of securing their digital assets and sensitive data from malicious threats. At the forefront of cloud security strategies stands the firewall—a cornerstone of network defence that acts as a barrier between trusted internal networks and untrusted external networks, such as the internet.
Even in the Zero Trust world we find ourselves in today where the perimeter cannot be trusted, or on occasions may not be present at all, in the context of the Azure cloud environment, Azure Firewall remains a powerful solution designed to fortify network security and safeguard cloud workloads against a myriad of cyber threats.
At a high level, we cover the following ground in this article:
Fundamentally, the purpose of a firewall is to regulate and monitor the flow of network traffic, enforcing predetermined security policies to mitigate risks and protect against unauthorized access, malware, and other malicious activities. By analysing incoming and outgoing traffic based on predefined rules, firewalls serve as a gatekeeper, allowing legitimate data to pass through while blocking or filtering potentially harmful content.
Deploying a firewall, such as Azure Firewall, within the Azure cloud environment offers a multitude of benefits for businesses seeking to bolster their security posture:
By leveraging Azure Firewall within the Azure cloud environment, businesses can fortify their network defences, mitigate cybersecurity risks, and uphold the integrity and confidentiality of their digital assets. With its robust features, scalability, and integration capabilities, Azure Firewall empowers organisations to embrace the transformative potential of the cloud while maintaining rigorous security standards.
When it comes to securing digital assets within your Azure environment, you are presented with a variety of tools and services to fortify their defences against cyber threats. Among these are Azure Firewall, Web Application Firewall (WAF), and Network Security Groups (NSGs), each offering distinct capabilities tailored to address specific security requirements. Let’s delve into a comparative analysis of these three Azure security solutions:
Azure Firewall serves as a cloud-native, fully stateful firewall as a service, designed to protect Azure virtual network resources by regulating inbound and outbound traffic based on user-defined rules. Azure Firewall has a comprehensive list of features and capabilities:
Web Application Firewall (WAF) is a security solution specifically designed to protect web applications from common web-based attacks, such as SQL injection, cross-site scripting (XSS), and cross-site request forgery (CSRF). WAFs have a more focused set of features and capabilities:
Network Security Groups (NSGs) are a basic networking security feature in Azure, providing inbound and outbound security rules to control network traffic to and from Azure resources within a virtual network. Whilst more limited compared to the previous two technologies, the features remain very capable:
In summary, Azure Firewall, Web Application Firewall, and Network Security Groups each serve distinct security purposes within the Azure environment, offering varying levels of protection and customisation options. By understanding the unique features and capabilities of each solution, organisations can design and implement robust security architectures tailored to their specific security requirements and compliance standards.
Firewalls are commonly regarded as a foundational security control, providing essential protection for network infrastructure by regulating inbound and outbound traffic based on predetermined rules. However, there are scenarios in which deploying a firewall within the Azure environment might not be the most suitable approach. Let’s explore some of these:
While firewalls play a crucial role in network security, there are instances in which deploying a firewall within your Azure environment may not be appropriate or necessary. Alternative architecture patterns and the technologies discussed earlier such as WAFs and/or NSGs may allow you to secure your workloads and data, particularly if supported with other capabilities such as access control and encryption. It’s essential for you to carefully assess your specific architectural requirements, security considerations, and compliance obligations to determine whether deploying a firewall aligns with your overall security strategy and objectives.
Azure Firewall serves as a pivotal component in safeguarding your Azure cloud workloads, providing top-tier threat protection seamlessly integrated into the Azure infrastructure. Azure Firewall is available in three variants, and it is imperative to ensure you select the correct one to appropriately balance organisations risk appetite with security features and cost. We’ll delve into its three distinct variants (SKUs) in the following sections, but first Microsoft at a high level recommend the following:
Azure Firewall Standard offers a comprehensive suite of features to bolster network security. Azure Firewall Standard provides a fully stateful firewall as a service, ensuring robust threat protection for your cloud workloads running in Azure. It offers both east-west (Azure to Azure, OR Azure to on-premise) and north-south (Azure to Internet) traffic inspection, catering to various security requirements. Microsoft’s official Azure Firewall Standard Features.
Key features of Azure Firewall Standard include:
Azure Firewall Premium extends its capabilities to meet the demands of highly sensitive environments. Microsoft’s official Azure Firewall Premium Features. Key features above and beyond Standard include:
Azure Firewall Basic caters to small and medium-sized businesses, offering essential protection at an affordable price point. Microsoft’s official Azure Firewall Basic Features. Highlights include:
You can centralise your firewall management across multiple subscriptions with Azure Firewall Manager, empowering you to apply consistent network policies and configurations effortlessly, ensuring a robust security posture across the board. Azure Firewall Manager simplifies firewall management by providing a centralised platform to define and enforce network security policies, allowing you to streamline security operations and maintain compliance with regulatory requirements. Microsoft’s official Azure Firewall Manager page.
Deploying a firewall within your network infrastructure is a critical step in fortifying your defences against cyber threats and safeguarding your digital assets. However, the effectiveness of a firewall implementation extends beyond the mere deployment of the device itself. It encompasses various aspects, including designing a secure network topology, defining a robust firewall rulebase, and adhering to Azure-specific guidance in cloud environments. In this section, we delve into essential best practices to ensure that your firewall deployment not only meets your security requirements but also aligns with industry standards and regulatory compliance.
The topics we will cover are:
In the following sections, we provide actionable insights and practical recommendations to guide you through the process of deploying and managing firewalls effectively. Whether you’re securing an on-premise network or transitioning to the cloud with Azure, adopting these best practices will bolster your security posture and strengthen your defence against cyber threats.
Defining an Azure network topology is fundamental to establishing a robust landing zone architecture that facilitates effective communication between applications while ensuring security and scalability. This section delves into various technologies and topology approaches for Azure deployments, focusing on Virtual WAN-based and traditional topologies.
Azure Virtual WAN offers a managed solution for large-scale interconnectivity requirements, reducing network complexity and modernizing organisational networks. Consider Virtual WAN topology when:
In contrast, a traditional hub-and-spoke network topology offers customised, enhanced-security networks in Azure, where routing and security are managed manually. Go for this topology when:
Azure landing zones recommend either Virtual WAN-based or traditional hub-and-spoke architectures. As business requirements evolve, Azure Virtual Network Manager facilitates topology changes without disrupting existing deployments. It supports three types of topologies across subscriptions:
Virtual Network Manager enables dynamic grouping of virtual networks, applying configurations to groups rather than individual networks. This approach streamlines management, connectivity, configuration, topology, and security rules, accommodating application migration, modernisation, and innovation at scale.
Design Considerations:
Design Recommendations:
By adhering to these recommendations, organisations can establish secure and scalable network topologies in Azure, facilitating seamless communication between applications while maintaining robust security controls. Please visit Define an Azure Network Topology for further information.
Effectively managing firewall rules is crucial for maintaining the security and integrity of your network infrastructure. By adhering to best practices, you can optimise rule sets to mitigate risks, enhance visibility, and streamline traffic management. The following are some key best practices.
By implementing these best practices, you can optimize your firewall rulebase to effectively mitigate threats, enforce security policies, and maintain regulatory compliance. Regularly review and update rule sets to adapt to evolving threats and operational requirements, ensuring continuous protection of your network infrastructure.
It is recommended that at least once a year, or after any substantial configuration change that the rulebase is reviewed. Network penetration testing such as Metis Security’s Infrastructure Security Assessment can anecdotally comment on firewall rules, however a comprehensive firewall security review is the recommended route as it has full visibility of the entire configuration. A comprehensive review of Azure Firewall rules and NSG configurations is included within our Azure Security Assessment.
When deploying Azure Firewall, adhering to architectural best practices is essential to ensure reliability, security, cost optimisation, operational excellence, and performance efficiency. Based on the five pillars of architecture excellence, outlined below are key recommendations tailored for Azure Firewall deployments:
Reliability:
Security:
Cost Optimisation:
Operational Excellence:
Performance Efficiency:
Azure Advisor Recommendations:
While there are no specific Azure Firewall recommendations within Azure Advisor, consider implementing the following:
By following these Azure-specific guidance recommendations, organisations can effectively deploy and manage Azure Firewall deployments, ensuring robust security, high availability, and optimal performance across their Azure environments.
The topic of firewalls in general and Azure Firewall in particular is vast, this article has attempted to cover the core aspects of the subject. The following blog posts, all sourced from the Azure Network Security Blog, may prove beneficial for those with a niche/focused requirement.
“Policy Analytics is a new feature released in General Availability in May 2023, which provides insights, centralized visibility, and control to Azure Firewall, helping IT teams who have the challenge to keep Firewall rules up to date, manage existing rules, and remove unused rules.”
Blog Post“In this blog, we will look at how Azure DDoS Protection, Web Application Firewall and Azure Firewall can be deployed to achieve Zero Trust. The deployment is set up with end-to-end TLS encryption showcasing the ability of WAF and Azure Firewall to inspect encrypted traffic.”
Blog Post“In this blog post, I will discuss the various threat protection capabilities that customers are leveraging to safeguard their workload deployments in Azure using Azure Firewall. Azure Firewall is a cloud-native firewall-as-a-service solution that empowers customers to centrally govern and log all their traffic flows using a DevOps approach.”
Blog Post“Unlike simple network filtering, IDPS matches traffic patterns to a set of known malicious signatures. Azure Firewall supports more than 60,000 malicious signatures which are updated in real time. These signatures apply when malicious patterns are detected under the right conditions. ”
Blog Post“In collaboration with Illumio, the leader in Zero Trust Segmentation, Microsoft has built Illumio for Microsoft Azure Firewall – an integrated solution that extends the advantages of Zero Trust Segmentation into the Azure environment. A two blog series.”
Blog Post“In collaboration with Illumio, the leader in Zero Trust Segmentation, Microsoft has built Illumio for Microsoft Azure Firewall – an integrated solution that extends the advantages of Zero Trust Segmentation into the Azure environment. A two blog series .”
Blog Post“In today’s cybersecurity threat landscape, organisations face numerous challenges in securing their networks and data. A critical aspect of every organisation’s security strategy is ensuring secure and efficient outbound connectivity for users. This is where the Explicit proxy capability, available in network firewalls, emerges as a powerful tool to address these security concerns.”
Blog Post“The Embedded Workbook presents users with consolidated information through charts and logs. It is structured into distinct sections, covering Application rules, Network rules, DNS proxy, Intrusion Detection and Prevention System (IDPS), Threat intelligence, and Investigation. Designed to function across multiple tenants and subscriptions, it offers filtering capabilities for various firewalls.”
Blog Post“Some Azure Firewall customers may face challenges when they need to configure non-RFC-1918 address spaces to not SNAT through the Azure Firewall. This can cause issues with routing, connectivity, and performance.”
Blog Post“By default, Azure Firewall Policy is not backed up automatically. Since the Firewall Policy will contain your specific Firewall rules and settings, you will want to ensure that it is continuously backed up, so you do not lose your defined configuration. Therefore, we have created a Logic App that will run every three days to back up your Azure Firewall and Azure Firewall Policy.”
Blog Post“There are some organisations that require outbound network traffic to be inspected by multiple network security appliances, such as firewalls, before it is sent out to an internet destination. “
Blog Post“One common use case we see is customers needing to easily allow traffic communication through Azure Firewall to Office 365 endpoints that their users rely on for their day-to-day productivity. To make the process easier to allow traffic to Office 365, we have created a deployment template to automate this process for you.”
Blog PostIn conclusion, implementing a robust firewall solution and securing network topology are paramount in Azure cloud environments to safeguard data, applications, and infrastructure from evolving cyber threats. By leveraging Azure Firewall alongside Web Application Firewall and Network Security Groups, organisations can fortify their defences and enforce granular access controls, ensuring compliance with regulatory requirements and industry best practices.
While firewalls are considered a default security control, deploying them blindly without considering the specific requirements and network topology is unlikely to be appropriate. Organisations should carefully assess their needs, considering factors such as network integration, traffic routing, and user behaviour, to determine the most suitable approach.
Furthermore, securing network topology plays a crucial role in defining how applications communicate within the Azure environment. Whether adopting Virtual WAN-based or traditional hub-and-spoke architectures, organisations must prioritise reliability, security, cost optimisation, operational excellence, and performance efficiency to achieve a robust and scalable network infrastructure.
In essence, by adopting best practices for firewall deployment and network topology security, organisations can strengthen their defence posture, mitigate security risks, and enable seamless communication and collaboration within the Azure cloud environment. As the threat landscape continues to evolve, investing in comprehensive security measures is imperative to safeguarding critical assets and maintaining business continuity in today’s digital landscape.
Trusted Microsoft Cloud Security Advisor with 27 years experience | Empowering Businesses to Embrace Cloud Innovation with Confidence
