Azure Security Class: Introduction
The ReadMe: Please read this first!
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
⚙️ Part of my series on Automating Cybersecurity Metrics. The Code.
🔒 Related Stories: Azure Security | Multicloud Security | Data Breaches
💻 Free Content on Jobs in Cybersecurity | ✉️ Sign up for the Email List
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
I’ve been releasing my Azure class slides as time allows as explained in this post.
This Azure class is one of the last classes I developed. The copyright has been altered. Check the slides as they are published.
There’s no right or wrong way to create a class. Everyone has a different perspective and different information to share. In some ways I think it is a better than some of my earlier classes. Here’s why:
Time is money
People don’t have time for a week long class and neither did I. This class is broken up in two hour increments over 6 days. I gave my client the calendar and they could pick whatever days worked for them. Teams have work to do and companies can’t just afford to shut down a whole team for a week for training. In addition, this format let me review each of the sets of slides before each class to make sure it was accurate.
Money is money
This format allowed me to spend less time on materials (no labs and all the related software) and offer the class for a much reduced price. This in turn allowed my clients to send more people to the class. Similar material to what would be in a lab is baked into the slides with steps students can take to perform certain actions in the cloud, though this is a much shorter class than some of my others.
No in-class labs
Did you do homework in class during school? I didn’t. I did my homework after school. Then if I had questions I’d have to ask the teacher or professor before or after class or during office hours. I really disliked in-class labs when I took classes because I’m kind of slow to be honest. The material was all new to me and everyone else had a lot more experience with it, it felt like, when I first took my security classes. When I taught classes I found some students were way ahead bored by the end of the lab and others were mad that you didn’t give them enough time.
My solution was do your labs as homework. Shorter classes. Less time paying me to stand around and watch you do a lab. In the end, when I finally perfected my labs, it was super boring to watch the students do them and no one had questions — because they were so easy to follow and complete! The students got through them without my help and learned a lot. But it just felt like wasted time to do that in class.
That said, these slides don’t really have full-on labs. If I did have full on labs, though, I’d probably break up the classes into smaller bits. Maybe each of the topics below would be a separate class. Then I’d have one or two labs per day for people to do between classes.
You can probably find free labs and tutorials for any topic in this class online. These slides just give you pointers to the high level information you’ll need to know so you know what components to consider in your cloud security architecture or what you need to audit or assess if you’re on that side of cybersecurity.
Condensed format
People can only handle so much information at once. Yes, we’d all love to know everything there is to secure every cloud provider in one week. Wouldn’t that be nice? There’s just too much information. This is an introduction to Azure that covers a lot of ground in 6 classes, 2 hours each, a class per week. Students get a bit of information, can go back and apply it, and come back with real world questions. There are tons of links to delve further into whatever topic applies to you most much deeper than what is presented in these slides.
I had people in classes not so interested in networking, for example, because their job was to manage IAM. This gives then an overview of networking and so they understand it and any points where IAM intersects without going into every aspect of building a secure network architecture.
On the other hand you have auditors that need to know a little bit of everything. They get a broad overview of many aspects of securing Azure with links to delve into the details where needed.
Also, I talk fast and like to give people their money’s worth. If you are going to try to deliver these slides in two hours, you better test it first. I found myself running over because I tried to do too much in too little time but I felt that most of these core aspects of security could not be skipped.
Demo
At the end of each day I would demo some interesting things. Perhaps I’d show something related to data breaches occurring related to that security control or how to implement something in the slides. I don’t have whatever I demo’d in the slides, unfortunately. Use your imagination — read up on data breaches and demonstrate something that occured in a recent data breach or security incident and how to prevent it.
This material is for beginners
If you are an expert or even know the basics of Azure security don’t be surprised if you know a lot of this material already. This if for people new to the platform.
This material is outdated!
Get Teri Radichel’s stories in your inbox
Join Medium for free to get updates from this writer.
Please remember this material is outdated. Follow the links where they work for up to date information (and if they don’t work you’ll see why it is hard to maintain cloud class materials.) For example, review the statistics yourself to determine what is the biggest cause of data breaches as described on day one. Do your homework!
This class does not heavily cover Office and Email Security
I am not even sure what you call the portion of Microsoft that covers office apps and online mail platforms that replace Exchange anymore because Microsoft keeps changing product names. It was Office 365 and now it’s Microsoft 365 but now that includes Azure as well. I’m covering the portion of Azure in this class related to building and deploying applications and storing data in the cloud platform. I don’t go into a lot of the details for Microsoft productivity apps and email, though all of the general topics and IAM is applicable to those products.
If I was updating my class slides today I’d probably include this toolset from Black Hills Information Security that includes a lot of ways to test the security of your email system as well as some tests for app registrations and OAUTH.
This material does not cover very much application security
This class is about the Azure cloud platform, not the applications you build. When I perform penetration tests, I perform network vulnerability scans, application security scans, and cloud security scans. I also do a lot of manual testing and reverse engineering, focusing on whatever the particular goal of my client is for that test. I also have over 30 years of experience now building software and architecting systems.
This class only touches on application security. This class does not really cover too much about how to secure your code or the things I test in relation to applications on penetration tests. For that, refer to my many other blog posts on those topics, and my video from RSA 2020 on serverless security.
Here’s my intro slide, the rest to follow in subsequent posts. Subscribe for emails to get the links as I post them. I’ll post Day One in the next post today. The paywall will be removed after a bit.
This class is arranged in two hour classes over 6 days. The class doesn’t have labs but the content walks through steps you can try after class and points to the myriad of tutorials for free in the Azure documentation where you can try out different functionality. Feel free to try out the tutorials between classes and ask questions at the next class.
The topics we’ll cover include the following arranged by different types of security controls and functions:
Identity and Access Management: One of the biggest risks you’ll face in a cloud environment is related to credentials and permissions. Attackers steal credentials or credentials are misused either maliciously or erroneously to expose data and cause security incidents. We’ll cover Azure Active Directory, account structure, and how permissions work on Azure.
Networking: Networking is one of your best defenses — even in terms of reducing blast radius when credentials are lost, stolen or misused. We’ll introduce various Azure controls and how to use them to prevent and reduce the impact of data breaches.
Storage, Secrets, and Key Vault: On day three we’ll look at how and where data is stored in the cloud and how to protect it, including using Azure Key Vault.
Compute and App Security: Generally the point of the cloud is not just to store data but to build distributed, resilient applications. We’ll cover the different types of compute and application security controls on day 4.
Governance and Architecture: Governance and Architecture go hand-in-hand to secure cloud environments so we cover these topics together on Day 5. You’ll want to think about the overall structure of your accounts, policies, and how you use them to prevent non-compliant resource from entering your account and how to find them when they exist.
Operations and Risk: On day 6 we look at keeping your cloud environment running securely and managing risk. Once you’re up and running in the cloud you need to you handle security incidents effectively and maintain your desired level of risk through monitoring, audits, security assessments, and penetration tests.
Follow for updates.
Teri Radichel | © 2nd Sight Lab 2025
About Teri Radichel:
~~~~~~~~~~~~~~~~~~~~
⭐️ Author: Cybersecurity Books
⭐️ Presentations: Presentations by Teri Radichel
⭐️ Recognition: SANS Award, AWS Security Hero, IANS Faculty
⭐️ Certifications: SANS ~ GSE 240
⭐️ Education: BA Business, Master of Software Engineering, Master of Infosec
⭐️ Company: Penetration Tests, Assessments, Phone Consulting ~ 2nd Sight LabNeed Help With Cybersecurity, Cloud, or Application Security?
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
🔒 Request a penetration test or security assessment
🔒 Schedule a consulting callFollow for more stories like this:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
❤️ Sign Up my Medium Email List
❤️ Twitter: @teriradichel
❤️ LinkedIn: https://www.linkedin.com/in/teriradichel
❤️ Mastodon: @teriradichel@infosec.exchange
❤️ Facebook: 2nd Sight Lab
❤️ YouTube: @2ndsightlab
