Skip to content

Commit 89f53d7

Browse files
authored
Merge pull request #237644 from mbender-ms/avnm-sec-admin-update
virtual network manager - Update and refresh concept-security-admin.mddoc
2 parents 7cfc6cb + e8cfecb commit 89f53d7

File tree

1 file changed

+79
-49
lines changed

1 file changed

+79
-49
lines changed

articles/virtual-network-manager/concept-security-admins.md

Lines changed: 79 additions & 49 deletions
Original file line numberDiff line numberDiff line change
@@ -1,17 +1,17 @@
11
---
22
title: 'Security admin rules in Azure Virtual Network Manager'
3-
description: Learn about what security admin rules are in Azure Virtual Network Manager.
3+
description: Learn about what security admin rules are in Azure Virtual Network Manager. Understand how they work and how traffic is evaluated along with network security groups.
44
author: mbender-ms
55
ms.author: mbender
66
ms.service: virtual-network-manager
77
ms.topic: conceptual
8-
ms.date: 03/22/2023
9-
ms.custom: template-concept, ignite-fall-2021
8+
ms.date: 05/10/2023
9+
ms.custom: template-concept, ignite-fall-2021, engagement-fy23
1010
---
1111

1212
# Security admin rules in Azure Virtual Network Manager
1313

14-
Azure Virtual Network Manager provides two different types of configurations you can deploy across your virtual networks, one of them being a **security admin** configuration. A security admin configuration contains a set of rule collections. Each rule collection contains one or more security admin rules. Then you associate the rule collection with the network groups that you want to apply the security admin rules to. This article explains what security admin rules are and how they work.
14+
In this article, you'll learn about security admin rules in Azure Virtual Network Manager. Security admin rules are used to define global network security rules that apply to all virtual networks within a [network group](concept-network-groups.md). You learn about what security admin rules are, how they work, and when to use them.
1515

1616
> [!IMPORTANT]
1717
> Azure Virtual Network Manager is generally available for Virtual Network Manager and hub and spoke connectivity configurations.
@@ -20,66 +20,95 @@ Azure Virtual Network Manager provides two different types of configurations you
2020
> This preview version is provided without a service level agreement, and it's not recommended for production workloads. Certain features might not be supported or might have constrained capabilities.
2121
> For more information, see [Supplemental Terms of Use for Microsoft Azure Previews](https://azure.microsoft.com/support/legal/preview-supplemental-terms/).
2222
23-
## Security admin rules
23+
## What is a security admin rule?
2424

25-
A security admin rule allows you to enforce security policy on resources that match a rule's condition set. For example, you can define a security admin rule to block network traffic to virtual networks over a high-risk port such as Remote Desktop Protocol (RDP). These rules only apply to resources within the scope of the Azure Virtual Network Manager instance. For example, security admin rules don't apply to virtual networks not managed by a virtual manager instance.
25+
Security admin rules are global network security rules that enforce security policies defined in the rule collection on virtual networks. These rules can be used to Allow, Always Allow, or Deny traffic across virtual networks within your targeted network groups. These network groups can only consist of virtual networks within the scope of your network manager instance; thus, security admin rules cannot apply to virtual networks not managed by a network manager.
2626

27-
### The order of evaluation
27+
Here are some scenarios where security admin rules can be used:
2828

29-
Security admin rules are evaluated before network security rules. Depending on the type of security admin rule you create, they can interact differently with network security group rules. When this happens, organizations can set enforced security policies alongside the teams' network security groups that address their own use cases. This diagram illustrates the order of evaluation of traffic.
29+
| **Scenario** | **Description** |
30+
| --- | --- |
31+
| **Restricting access to high-risk network ports** | Security admin rules can be used to block traffic on specific ports commonly targeted by attackers, such as port 3389 for Remote Desktop Protocol (RDP) or port 22 for Secure Shell (SSH). |
32+
| **Enforcing compliance requirements** | Security admin rules can be used to enforce compliance requirements. For example, blocking traffic to or from specific IP addresses or network blocks. |
33+
| **Protecting sensitive data** | Security admin rules can be used to restrict access to sensitive data by blocking traffic to or from specific IP addresses or subnets. |
34+
| **Enforcing network segmentation** | Security admin rules can be used to enforce network segmentation by blocking traffic between virtual networks or subnets. |
35+
| **Enforcing application-level security** | Security admin rules can be used to enforce application-level security by blocking traffic to or from specific applications or services. |
3036

31-
:::image type="content" source="media/concept-security-admins/traffic-evaluation.png" alt-text="Diagram showing order of evaluation for network traffic with security admin rules and network security rules.":::
37+
With Azure Virtual Network Manager, you have a centralized location to manage security admin rules. Centralization allows you to define security policies at scale and apply them to multiple virtual networks at once.
38+
## How do security admin rules work?
3239

33-
There are three kinds of actions – Allow, Always Allow, and Deny. If you create a security admin rule to *Allow* a certain type of traffic, this rule is evaluated first. When a security admin rule allows traffic, it's then evaluated by network security group rules. It leaves room for network security group rules down the line to handle this type of traffic differently as needed. If you create a security admin rule to *Always Allow* or *Deny* a certain type of traffic, the rule is evaluated first. Then it terminates the network security group evaluation of this traffic – meaning the evaluation is stopped. If the security admin rule is *Always Allow*, the traffic doesn't hit network security groups, and instead delivers directly to virtual machines or other resource. This action can be useful when administrators want to enforce traffic and prevent denial by network security group rules. For example, administrators may want to force the organization to consume software updates from certain ports. When *Deny* is used, evaluation and therefore traffic is stopped without being delivered to the destination. This means that you can use security admin rules to set definitive security rules that can't be overridden with other rules.
34-
Security admin rules don't depend on network security groups in order to exist. This means that administrators can use security admin rules to create default security rules. Even if application owners misconfigured or forgot to establish network security groups, your organization is protected by default!
40+
Security admin rules allow or deny traffic on specific ports, protocols, and source/destination IP prefixes in a specified direction. When you define a security admin rule, you specify the following conditions:
3541

36-
> [!IMPORTANT]
37-
> When security admin rules are deployed, the eventual consistency model is used. This means that security admin rules will be eventually applied to the resources contained in a virtual network after a short delay.  Resources that are added to a virtual network that already has security admin rules applied on it will eventually receive those same security admin rules with a delay as well.
42+
- The priority of the rule
43+
- The action to be taken (allow, deny, or always allow)
44+
- The direction of traffic (inbound or outbound)
45+
- The protocol to be used
3846

39-
### Management at scale
47+
To enforce security policies across multiple virtual networks, you [create and deploy a security admin configuration](how-to-block-network-traffic-portal.md). This configuration contains a set of rule collections, and each rule collection contains one or more security admin rules. Once created, you associate the rule collection with the network groups requiring security admin rules. The rules are then applied to all virtual networks contained in the network groups when the configuration is deployed. A single configuration provides a centralized and scalable enforcement of security policies across multiple virtual networks.
48+
### Evaluation of security admin rules and network security groups (NSGs)
4049

41-
Azure Virtual Network Manager provides a way to manage your security policies at scale with security admin rules. When you apply a security admin configuration to a [network group](./concept-network-groups.md), a network group can contain dozens or hundreds of VNets, and all of the resources in the network groups’ scope have those security admin rules applied to them.
50+
Security admin rules and network security groups (NSGs) can be used to enforce network security policies in Azure. However, they have different scopes and priorities.
4251

43-
New resources are protected along with existing resources. For example, if you add new VMs to a virtual network in the scope of a security admin rule, the VMs are automatically secured as well. Shortly after you deploy these VMs, security admin rules will be applied and protect them.
52+
Security admin rules are intended to be used by network admins of a central governance team, thereby delegating NSG rules to individual application or service teams to further specify security as needed. Security admin rules have a higher priority than NSGs and are evaluated before NSG rules.
4453

45-
When new security risks are identified, you can deploy them at scale by creating a security admin rule to protect against the new risk and applying it to your network groups. Once this new rule is deployed, all resources in the scope of the network groups will be protected now and in the future.
54+
NSGs, on the other hand, are used to filter network traffic to and from individual subnets or network interfaces. They're intended to be used by individual application or service teams to further specify security as needed. NSGs have a lower priority than security admin rules and are evaluated after security admin rules.
4655

56+
Security admin rules are currently applied at the virtual network level, whereas network security groups can be associated at the subnet and NIC level. This table shows these differences and similarities:
57+
58+
| **Rule Type** | **Target Audience** | **Applied On** | **Evaluation Order** | **Action Types** | **Parameters** |
59+
| --- | ---- | ---- | ---- | ---- | ---- |
60+
| **Security admin rules** | Network admins, central governance team | Virtual networks | Higher priority | Allow, Deny, Always Allow | Priority, protocol, action, source, destination |
61+
| **Network security group rules** | Individual teams | Subnets, NICs | Lower priority, after security admin rules | Allow, Deny | Priority, protocol, action, source, destination |
62+
63+
Security admin rules can perform three actions on traffic: *Allow*, *Always Allow*, and *Deny*. If you create an *Allow* rule, it's evaluated first, followed by network security group rules. This action allows network security group rules to handle the traffic differently if needed.
64+
65+
If you create an *Always Allow* or *Deny* rule, traffic evaluation is terminated after the security admin rule is evaluated. With an *Always Allow* rule, the traffic goes directly to the resource and terminates further (and possibly conflicting) evaluation by NSG rules. This action can be useful for enforcing traffic and preventing denial by network security group rules. With a *Deny* rule, the traffic is stopped without being delivered to the destination. Security admin rules don't depend on NSGs, so they can be used to create default security rules on their own.
66+
67+
:::image type="content" source="media/concept-security-admins/traffic-evaluation.png" alt-text="Diagram showing order of evaluation for network traffic with security admin rules and network security rules.":::
68+
69+
By using security admin rules and NSGs together, you can enforce network security policies at both the global and individual levels, ensuring that your virtual networks are secure and compliant with your organization's security policies.
70+
71+
> [!IMPORTANT]
72+
> When security admin rules are deployed, the eventual consistency model is used. This means that security admin rules will be eventually applied to the resources contained in a virtual network after a short delay.  Resources that are added to a virtual network that already has security admin rules applied on it will eventually receive those same security admin rules with a delay as well.
73+
74+
## Benefits of security admin rules
75+
76+
Security admin rules provide many benefits for securing your organization's resources. By using security admin rules, you can enforce allowed traffic and prevent denial by conflicting network security group rules. You can also create default security admin rules that don't depend on NSGs to exist. These default rules can be especially useful when application owners misconfigure or forget to establish NSGs. Additionally, security admin rules provide a way to manage security at scale, which reduces the operational overhead that comes with a growing number of network resources.
4777

4878
### Protect high-risk ports
4979

5080
Based on the industry study and suggestions from Microsoft, we recommend customers restrict the traffic from outside using security admin rules for this list of high-risk ports. These ports are often used for the management of resources or unsecure/unencrypted data transmission and shouldn't be exposed to the internet. However, there are times when certain virtual networks and their resources need to allow traffic for management or other processes. You can create exceptions where needed. Learn how to [blocking high-risk ports with exceptions](how-to-block-high-risk-ports.md) for these types of scenarios.
5181

52-
|Port | Protocol | Description |
82+
| **Port** | **Protocol** | **Description** |
5383
| --- | ---- | ------- |
54-
|20| TCP |Unencrypted FTP Traffic |
55-
|21| TCP |Unencrypted FTP Traffic |
56-
|22| TCP |SSH. Potential brute force attacks |
57-
|23| TCP |TFTP allows unauthenticated and/or unencrypted traffic |
58-
|69 | UDP | TFTP allows unauthenticated and/or unencrypted traffic |
59-
| 111 | TCP/UDP | RPC. Unencrypted authentication allowed |
60-
| 119| TCP |NNTP for unencrypted authentication |
61-
| 135 | TCP/UDP | End Point Mapper, multiple remote management services |
62-
| 161| TCP |SNMP for unsecure / no authentication |
63-
| 162 | TCP/UDP | SNMP Trap - unsecure / no authentication |
64-
| 445| TCP |SMB - well known attack vector |
65-
| 512| TCP |Rexec on Linux - remote commands without encryption authentication |
66-
| 514| TCP |Remote Shell - remote commands without authentication or encryption |
67-
| 593 | TCP/UDP | HTTP RPC EPMAP - unencrypted remote procedure call |
68-
| 873| TCP |Rsync - unencrypted file transfer |
69-
| 2049 | TCP/UDP | Network File System |
70-
| 3389| TCP | RDP - Common brute force attack port |
71-
| 5800| TCP | VNC Remote Frame Buffer over HTTP |
72-
| 5900| TCP | VNC Remote Frame Buffer over HTTP |
73-
| 11211 | UDP | Memcached |
74-
75-
## Security admin rules vs. network security groups
76-
77-
Security admin rules are similar to network security group rules in structure and the parameters they intake, but they’re not the exact same construct. The first difference is intended audience. Admin rules are intended to be used by network admins of a central governance team. In this model, network security group rules are delegated to individual application or service teams to further specify security as needed. With these intentions, admin rules were designed to have a higher priority than network security groups and therefore be evaluated before network security group rules. Admin rules include another action type of *Always Allow*. This action allows the specified traffic through to its intended destination and terminates further (and possibly conflicting) evaluation by network security groups rules. Admin rules are also applied not only to a network group’s existing virtual networks but also to newly provisioned resources, as described in the previous section. Admin rules are currently applied at the virtual network level, whereas network security groups can be associated at the subnet and NIC level. This table shows these differences and similarities:
78-
79-
| Rule Type | Target Audience | Applied On | Evaluation Order | Action Types | Parameters |
80-
| --- | ---- | ---- | ---- | ---- | ---- |
81-
| **Security admin rules** | Network admins, central governance team | Virtual networks | Higher priority | Allow, Deny, Always Allow | Priority, protocol, action, source, destination |
82-
| **Network security group rules** | Individual teams | Subnets, NICs | Lower priority, after security admin rules | Allow, Deny | Priority, protocol, action, source, destination |
84+
| **20** | TCP | Unencrypted FTP Traffic |
85+
| **21** | TCP | Unencrypted FTP Traffic |
86+
| **22** | TCP | SSH. Potential brute force attacks |
87+
| **23** | TCP | TFTP allows unauthenticated and/or unencrypted traffic |
88+
| **69** | UDP | TFTP allows unauthenticated and/or unencrypted traffic |
89+
| **111** | TCP/UDP | RPC. Unencrypted authentication allowed |
90+
| **119** | TCP | NNTP for unencrypted authentication |
91+
| **135** | TCP/UDP | End Point Mapper, multiple remote management services |
92+
| **161** | TCP | SNMP for unsecure / no authentication |
93+
| **162** | TCP/UDP | SNMP Trap - unsecure / no authentication |
94+
| **445** | TCP | SMB - well known attack vector |
95+
| **512** | TCP | Rexec on Linux - remote commands without encryption authentication |
96+
| **514** | TCP | Remote Shell - remote commands without authentication or encryption |
97+
| **593** | TCP/UDP | HTTP RPC EPMAP - unencrypted remote procedure call |
98+
| **873** | TCP | Rsync - unencrypted file transfer |
99+
| **2049** | TCP/UDP | Network File System |
100+
| **3389** | TCP | RDP - Common brute force attack port |
101+
| **5800** | TCP | VNC Remote Frame Buffer over HTTP |
102+
| **5900** | TCP | VNC Remote Frame Buffer over HTTP |
103+
| **11211** | UDP | Memcached |
104+
105+
### Management at scale
106+
107+
Azure Virtual Network Manager provides a way to manage your security policies at scale with security admin rules. When you apply a security admin configuration to a [network group](./concept-network-groups.md), a network group can contain dozens or hundreds of VNets, and all of the resources in the network groups’ scope have those security admin rules applied to them.
108+
109+
New resources are protected along with existing resources. For example, if you add new VMs to a virtual network in the scope of a security admin rule, the VMs are automatically secured as well. Shortly after you deploy these VMs, security admin rules will be applied and protect them.
110+
111+
When new security risks are identified, you can deploy them at scale by creating a security admin rule to protect against the new risk and applying it to your network groups. Once this new rule is deployed, all resources in the scope of the network groups will be protected now and in the future.
83112

84113
## Security admin fields
85114

@@ -136,7 +165,8 @@ You can define specific common ports to block from the source or to the destinat
136165
| 80 | HTTP |
137166
| 443 | HTTPS |
138167
| 3389 | RDP |
168+
| 1433 | SQL |
139169

140170
## Next steps
141-
142-
Learn how to block network traffic with a [SecurityAdmin configuration](how-to-block-network-traffic-portal.md).
171+
> [!div class="nextstepaction"]
172+
> Learn how to block network traffic with a [Security admin configuration](how-to-block-network-traffic-portal.md).

0 commit comments

Comments
 (0)