#005 | Beyond the Cloud – Spin-Off | Cloud Security | C03-09 – Network Security

[en-gb] ⚠️ Important Disclaimer

1️⃣ Some time ago, I recorded a course on cloud security in Microsoft environments for a Brazilian university called IGTI. This course was part of a Cloud Computing bootcamp and helped many students who were just starting their careers in the field. (After the institution shut down, the content became unavailable.)

🎯 So, I decided to remaster, sanitize, and re-release this content for free on YouTube, with the goal of continuing to support those who are beginning their journey in Cloud and Cloud Security.

2️⃣ The original course is in Portuguese (pt-BR), but throughout the series I’ll also publish articles in English (en-US) so the content can reach more people — at least until the new courses in English are recorded and ready.

3️⃣ Important: this series is not certification prep and not a silver bullet.
The goal here is to share structured knowledge, with a hands-on, accessible approach focused on:

• Cloud beginners,
• Security enthusiasts, and
• Anyone looking to better understand how Azure actually handles security.

4️⃣ Microsoft has rebranded some of its products — for example, Azure Security Center is now Defender for Cloud, and Azure Active Directory is now Entra ID. Some lessons may still refer to the old names, but don’t worry — the core concepts, technical foundations, and functionalities remain the same. Focus on the architecture and principles being taught.

Hope you enjoy it! Big hug!

Gustavo Magella

---

🎬 Watch Episode #03 of 09 Now

🔗 Click here to watch on YouTube – Episode 03 of 09.
(And yes, hit that subscribe button. I’m watching… 👀)

---

[en-us] Beyond The Cloud – Spin-Off | Chapter 03: Network Security in Azure

Hey, what’s up folks!?

Welcome to Chapter 03 of the Beyond The Cloud – Spin-Off series. Today, we’re diving deep into Network Security in Azure. It’s time to talk about VNets, NSGs, Azure Firewall, and DDoS Protection.

If you think this chapter is just about blocking ports — hold on tight. It’s about building layered defenses that work.

🚀 Virtual Networks: The Backbone of IaaS

Before we dive into security tools, let’s go back to basics. Virtual Networks (VNets) are the backbone of Azure IaaS. Every VNet is logically isolated, even within the same subscription or region. They are composed of:

• CIDR address blocks;
• Subnets;
• Private IP allocations;

You can create multiple VNets and subnets, but by default, they won’t talk to each other. That isolation is powerful — and it’s where network security begins.

---

🛡️ NSGs: The First Line of Defense

Azure Network Security Groups (NSGs) are stateless filters that operate at the NIC or subnet level. They don’t remember the session state — they simply evaluate:

• Source/Destination IPs;
• Source/Destination Ports;
• Protocols;

And apply Allow/Deny rules accordingly.

Key rules:

• NSG priority order matters. Lower numbers = higher priority.
• As soon as a rule matches, evaluation stops.
• Default deny rules are at the bottom of every list.

Attach NSGs to:

• NICs: More granular, per VM;
• Subnets: Broader protection across segments;

Use service tags or application security groups (ASGs) for dynamic, maintainable rules.

---

🔥 Azure Firewall: Stateful and Powerful

While NSGs are great, Azure Firewall is where serious control begins. It’s a fully managed, stateful firewall as a service (FWaaS) that supports:

• Threat intelligence-based filtering;
• Application and network rule collections;
• FQDN and domain filtering;
• TLS inspection and IDPS (in Premium tier);

This beast is:

• Highly available (HA by design);
• Compliant (SOC, PCI DSS, ISO… you name it);
• Scalable without appliances or third-party NVAs;

If you need deep packet inspection, centralized control, or scalable governance — Azure Firewall is your tool.

---

🚨 DDoS Protection: Don’t Be Caught Off Guard

Think NSG + Firewall are enough? Not against volumetric DDoS attacks.

Azure DDoS Protection comes in two flavors:

• Basic: Enabled by default, free, decent for most scenarios;
• Standard: Paid (~$3k/month), includes telemetry, analytics, mitigation reports, and attack insurance;

Azure’s global backbone and machine learning models analyze traffic patterns and scrub malicious traffic before it hits your resources.

When paired with a well-architected environment, DDoS Protection keeps uptime sacred.

---

🪖 Practical Checklist

✅ NSG applied to all subnets and NICs (Don’t skip this — even if NSGs are stateless, they are your first line of defence!);
✅ Use explicit deny rules and mind the priority (Low number = high power. Don’t mess this up.);
✅ Never expose RDP/SSH directly to the internet (Seriously. No excuses. Use Bastion or VPN.);
✅ Azure Firewall deployed for centralised inspection and policy enforcement (It’s not cheap, but neither is downtime.);
✅ DDoS Standard enabled on critical production workloads (And yes, it can save your bacon.);
✅ Regularly monitor logs and metrics (Because if you’re not watching, no one is.);
✅ Use service tags and ASGs to simplify rule management (Unless you like chasing changing IPs.);
✅ Combine NSG, Azure Firewall, and DDoS — layers matter (Single point of failure? Not here.);

---

📊 My Tech Two Cents

• NSG = Security gate with a clipboard.
• Azure Firewall = Security officer with camera, logs, and orders.
• DDoS Protection = Riot squad at the perimeter.

Use them together. Layer your defenses. Respect priorities in rule evaluation. And never, ever, rely on defaults alone.

Next up: Chapter 04 — we tackle general security services in Azure:

• Azure Backup;
• Dedicated Hosts;
• Azure Key Vault;
• Defender for Cloud;
• Microsoft Sentinel;

Until then, patch those ports and protect those packets! 🌹️❤️

Gustavo Magella

---

[pt-br] ⚠️ Um aviso importante:

🎬 Assista o Capítulo 03

🔗 Assista agora no YouTube – Capítulo 03 de 09
(E se inscreve no canal, senão vou saber que você pulou essa parte… rs)

---

[pt–br] Beyond The Cloud – Spin-Off | Capítulo 03: Segurança de Redes no Azure

E aí seus trens bonitows!?

Chegamos no Capítulo 03, e o papo agora é segurança de rede no Azure. Hora de desbravar a camada de defesa que separa seu ambiente da bagunça lá fora.

---

🚀 VNets: A espinha dorsal do IaaS

Toda arquitetura IaaS começa com a rede. E no Azure, a tal da VNet é isolada por padrão. Mesma subscription, mesmo resource group, tanto faz: se você não conectar, ela não fala com ninguém.

Cada VNet tem:

• Bloco CIDR;
• Subnets;
• IPs privados;

---

🛡️ NSG: O primeiro checkpoint

O NSG é como um guarda com uma planilha na mão. Ele analisa:

• IP de origem/destino;
• Porta de origem/destino;
• Protocolo;

E libera ou bloqueia. Simples assim.

Lembretes:

• Prioridade menor = regra executada primeiro;
• Match encontrado = para tudo;
• Sempre tem um deny all lá no fim;

Associe NSGs a:

• NICs (por VM);
• Subnets (por segmento);

Use tags de serviço ou Application Security Groups para dinamismo.

---

🔥 Azure Firewall: Controle total

Firewall como serviço, com inspeção de pacotes, TLS, IDPS e filtragem por FQDN. Esse é o Azure Firewall Premium. Ele é:

• Stateful (reconhece contexto de conexão);
• Altamente disponível;
• Escalável e gerenciado;
• Certificado (SOC, PCI, ISO…);

Recomendo fortemente se você precisa de um controle centralizado e fino sobre o tráfego de rede.

---

🚨 Azure DDoS Protection: Não vacile

Ataque volumétrico? NSG e firewall não seguram.

O DDoS Protection vem em duas versões:

• Basic: grátis e já vem habilitado;
• Standard: pago, com métricas, alertas, relatórios e até “seguro contra ataque”;

A Microsoft analisa padrões globais de tráfego e bloqueia requisições maliciosas antes de chegarem ao seu ambiente.

---

🪖 Checklist Rápido

✅ NSG aplicado em todas as subnets e NICs (Não deixe de aplicar uma NSG, pois mesmo que stateless, você precisa ser protegido);
✅ Use regras explícitas de deny e organize a prioridade (Menor número, mais forte — não erra nisso);
✅ Nunca exponha RDP/SSH na internet (Use Bastion ou VPN. SEM DESCULPAS);
✅ Azure Firewall como camada de inspeção e controle centralizado (Sai caro, mas downtime custa mais);
✅ DDoS Standard em workloads sensíveis e críticas (Você não vai querer aprender isso do jeito difícil);
✅ Monitore logs, métricas e alertas com frequência (Se você não olhar, ninguém vai);
✅ Use service tags e ASGs para facilitar o gerenciamento (Ou prepare-se para caçar IPs mudando o tempo todo);
✅ Camadas, sempre. NSG + Firewall + DDoS (Zero Trust não é uma figurinha de WhatsApp);

---

📊 My Tech Two Cents

• NSG = porteiro do condomínio
• Azure Firewall = segurança com monitoramento
• DDoS Protection = tropa de choque na entrada

Use tudo junto. Não deixe brechas. Priorize suas regras. E não confie no padrão.

---

No Capítulo 04 a gente vai falar de:

• Azure Backup;
• Dedicated Hosts;
• Azure Key Vault;
• Defender for Cloud;
• Microsoft Sentinel;

Fechando mais uma camada da arquitetura segura na nuvem!

Um bjo no coração e até a próxima! 🌹️❤️

Gustavo Magella