Confidentiality – Ofofo | Knowledge Base

Encrypt data in transit and at rest

Use Azure Disk Encryption to encrypt data stored on Azure virtual machine disks and Azure Backup to encrypt backup data.

Azure Disk Encryption is a feature that enables you to encrypt the OS and data disks of your Azure virtual machines (VMs) using the BitLocker feature of Windows and the DM-Crypt feature of Linux. The encryption keys are stored in Azure Key Vault, which provides a secure and centralized repository for encryption keys. To use Azure Disk Encryption, you can follow these steps:

Create an Azure Key Vault: If you don't already have an Azure Key Vault, create one using the Azure portal, Azure CLI, or Azure Powershell.

Create an encryption key: In the Azure Key Vault, create an encryption key that will be used to encrypt the disks of your VMs. You can use a key that's generated by Azure Key Vault, or you can import your own key.

Enable Azure Disk Encryption: In the Azure portal, go to the virtual machine that you want to encrypt, and select "Encryption" in the left-side menu. Click on "Encrypt" to start the encryption process. You can also use Azure CLI or Azure Powershell to enable Azure Disk Encryption.

Monitor the encryption status: You can monitor the encryption status in the Azure portal by going to the virtual machine, selecting "Encryption", and checking the status. Once the encryption is complete, the status will change to "Encrypted".

To use Azure Backup to encrypt backup data, you can follow these steps:

Create a Recovery Services Vault: If you don't already have a Recovery Services Vault, create one using the Azure portal, Azure CLI, or Azure Powershell.

Configure backup settings: In the Recovery Services Vault, configure the backup settings for your virtual machine. You can choose to encrypt the backup data using the encryption key stored in Azure Key Vault.

Start the backup process: Once the backup settings are configured, you can start the backup process. The backup data will be encrypted using the encryption key in Azure Key Vault before it's stored in Azure.

Restore data: When you need to restore the data, you can do so from the Recovery Services Vault. The encrypted data will be decrypted using the encryption key in Azure Key Vault before it's restored to the virtual machine.

Use Azure Key Vault to manage encryption keys and certificates for encryption in transit, such as SSL/TLS certificates for HTTPS.

Azure Key Vault is a service that provides centralized storage for sensitive information such as encryption keys and SSL/TLS certificates. Here are the steps to use Azure Key Vault to manage certificates for encryption in transit:

Create an Azure Key Vault: First, you need to create an Azure Key Vault instance in the Azure portal.

Import or Generate a certificate: You can either import an existing SSL/TLS certificate or generate a new certificate within the Key Vault.

Assign permissions to the certificate: You can assign specific permissions to the certificate, such as allowing a particular application or service to access the certificate.

Configure your application to use the certificate: You need to configure your application to use the certificate from the Azure Key Vault for encryption. For example, if you're using an Azure App Service, you can configure it to use the certificate for SSL/TLS encryption.

By using Azure Key Vault, you can ensure that the encryption keys and certificates are securely stored and managed, and only authorized entities can access them. The positive impact on Confidentiality, Integrity and Availability (CIA) will depend on how the Key Vault and certificates are used within the application. However, generally, the use of Azure Key Vault and SSL/TLS certificates can help to improve the confidentiality of data in transit and the integrity of the communication channel.

Implement multi-factor authentication (MFA) for privileged access

Use Azure Active Directory (AD) for user authentication and MFA to provide an extra layer of security for privileged access.

Azure Active Directory (AD) is a cloud-based identity and access management service that can be used to manage user authentication and authorization. Here are the steps to use Azure AD for user authentication and MFA:

Create an Azure AD tenant: If you haven't already, you'll need to create an Azure AD tenant in the Azure portal.

Add users to Azure AD: You'll need to add users to your Azure AD tenant so that they can be authenticated.

Enable Multi-Factor Authentication (MFA): You can enable MFA for users in your Azure AD tenant to provide an extra layer of security for privileged access. MFA can be enabled for specific users or for all users in the tenant.

Configure your application to use Azure AD for authentication: You'll need to configure your application to use Azure AD for authentication. For example, if you're using an Azure App Service, you can configure it to use Azure AD for authentication.

By using Azure AD and MFA, you can ensure that only authorized users have access to your application, and that access is secure. This can help to improve the confidentiality and integrity of your data, as well as the availability of your application. Additionally, using Azure AD and MFA can help you to comply with various regulations and standards that require strong authentication and authorization.