Skip to content

Commit 0667708

Browse files
author
Michael Bender
committed
Update msdate
1 parent d3cba19 commit 0667708

File tree

1 file changed

+0
-3
lines changed

1 file changed

+0
-3
lines changed

articles/virtual-network-manager/concept-enforcement.md

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -24,23 +24,20 @@ With [network security groups (NSGs)](../virtual-network/network-security-group-
2424
Let’s look at a few common models of security management without security admin rules, and their pros and cons:
2525

2626
### Model 1 - Central governance
27-
2827
In this model, NSGs are managed by a central governance team within an organization.
2928

3029
| Pros | Cons |
3130
| ---- | ---- |
3231
| The central governance team can enforce important security rules. | Operational overhead is high as admins need to manage each NSG, as the number of NSGs increases, the burden increases. |
3332

3433
### Model 2 - NSGs are managed by individual teams.
35-
3634
In this model, NSGs are managed by individual teams within an organization without a centralized governance team.
3735

3836
| Pros | Cons |
3937
| ---- | ---- |
4038
| The individual team has flexible control in tailoring security rules based on their service requirements. | The central governance team can't enforce critical security rules, such as blocking risky ports. </br> </br> Individual team might also misconfigure or forget to attach NSGs, leading to vulnerability exposures.|
4139

4240
### Model 3 - NSGs are created through Azure Policy and managed by individual teams.
43-
4441
In this model, NSGs are still managed by individual teams. The difference is the NSGs are created using Azure Policy to set standard rules. Modifying these rules would trigger audit notifications.
4542

4643
| Pros | Cons |

0 commit comments

Comments
 (0)