tips on hardening security with Azure security

1-Classifying data that should be encrypted is commonly based on the impact it can have on customers if it is exposed.

2-Network security groups are fully customizable and give you the ability to fully lock down network communication to and from your virtual machines.

3-Azure Disk Encryption protects your virtual machine VHDs from exposure but does not provide protection from network-based attacks.

4-Azure Security Center can monitor all your services, both in Azure and on-premises.

5-Never trust any data that could have been modified.

6-Parameter fields used in parameterized queries are treated as data, not code, protecting against injection vulnerabilities. For more information on how to implement parameterized queries please see the OWASP Query Parameterization Cheat Sheet.

7-Although data sent to a 3rd party API needs to be validated to ensure the data is good, we do not need to encode it for output.

8-Data sent to the screen needs to be output encoded to ensure it is never interpreted as code.

9- the cloud provider provides physical security to compute resources. However, it's your responsibility to patch and secure your operating systems and software, as well as configure your network to be secure.

10-Encrypting your data at all times, both as it sits in your database and as it travels over the network, minimizes the opportunity for an attacker to access your data in plain text.

11-DDoS protection helps prevent DDoS attacks.

12-Azure Key Vault is a centralized cloud service for storing application secrets, referred to as a secret store.

13-SSO centralizes user identity, so you can disable an inactive account in a single step.

14-Azure RBAC roles are used to manage access to virtual machines, storage, and other Azure resources. Azure AD roles are used to manage access to Azure AD resources such as user accounts and passwords.

15-The User Access Administrator manages access to Azure resources.

16-Billing Administrator is an Azure AD role that allows you to make purchases, manage subscriptions and support tickets, and monitor service health. Azure AD roles apply to only one scope, the directory.

17-The Owner role gives full access to all resources under the scope that has been assigned to it.

18-A robust security system for your organization can't depend on the good will of former employees.

19-Users with Owner or User Access Administrator access can grant other users permission to manage a management group or subscription.

20-You can download published audit reports and other compliance-related information related to Microsoft’s cloud service from the Service Trust Portal.

21-Role-based access control (RBAC) provides fine-grained access management for Azure resources, enabling you to grant users only the rights they need to perform their jobs. RBAC is provided at no additional cost to all Azure subscribers.

22-Azure Policy is a service in Azure that you use to create, assign, and, manage policies. These policies enforce different rules and effects over your resources, so those resources stay compliant with your corporate standards and service-level agreements (SLAs).

23-You can obtain details about how Microsoft uses personal data in the Microsoft Privacy Statement.