Network Segmentation, NSGs, Bastion and Key Vault

What it is

Inside Azure, good security means keeping things apart, controlling who may talk to whom, reaching servers safely and keeping secrets out of code. This topic covers four tools for that: virtual networks for segmentation, network security groups for traffic rules, Azure Bastion for administrative access, and Azure Key Vault for secrets.

How it works

Network segmentation

Segmentation splits a network into smaller parts so that a problem in one part cannot spread to the others. In Azure, a virtual network is your private network, and it is divided into subnets. You might place web servers in one subnet, application servers in another and databases in a third, and then control the traffic between them. If an attacker reaches a web server, the database subnet is still protected. Segmentation limits the blast radius of a breach, which fits the Zero Trust idea of assuming breach.

Network security groups (NSGs)

A network security group contains security rules that allow or deny network traffic to resources in a virtual network. It can be attached to a subnet or to a single network interface.

Each rule has:

• A priority number, where the lowest number is checked first.
• A source and a destination, such as an address range or a service tag.
• A port and a protocol.
• An action, allow or deny, and a direction, inbound or outbound.

A rule might allow HTTPS (port 443) from the internet to the web subnet, and another might allow the database port only from the application subnet. NSGs have default rules that allow traffic inside the virtual network and deny inbound traffic from the internet, and you add your own rules above them. Application security groups let you write rules for groups of servers by role instead of by address.

NSGs filter on address, port and protocol. They cannot filter by domain name or inspect web requests, which is the job of Azure Firewall and WAF.

Azure Bastion

Administrators often need to reach virtual machines using remote desktop or SSH. Opening those ports to the internet is dangerous. Azure Bastion is a managed service that lets you connect to a virtual machine from the Azure portal over TLS, with no public IP address on the machine and no RDP or SSH port open to the internet. The machines stay private, and the connection is protected.

Azure Key Vault

Applications need secrets such as passwords, connection strings and encryption keys. Storing them in code or in files is risky. Azure Key Vault is a secure store for them.

Access to a vault is controlled by identity, so an application with a managed identity can read a secret with no password in its code. Keys can be protected by hardware security modules in the Premium tier. Every access is logged. Features such as soft delete and purge protection help recover from accidental deletion.

Which tool for which job?

A worked scenario

A company builds a three tier application. It puts the web, application and database tiers in separate subnets. An NSG on the database subnet allows connections on the database port only from the application subnet, and denies everything else. Administrators connect to the virtual machines through Azure Bastion, so no machine has a public address for remote desktop. The application reads its database password from Key Vault using a managed identity, so the password never appears in the source code.

The default NSG rules

Every NSG starts with default rules that you cannot delete, but can override with rules of lower priority numbers.

Because DenyAllInBound is last, traffic from the internet is blocked unless you add an allow rule.

How Bastion is deployed

Azure Bastion is deployed into its own subnet, named AzureBastionSubnet, in the virtual network. Administrators open the virtual machine in the Azure portal, choose Connect and then Bastion, and a remote session opens in the browser. The virtual machine needs no public IP address, and the NSG does not have to allow RDP or SSH from the internet.

Controlling access to Key Vault

Access to a Key Vault is governed by Azure role based access control or by access policies. An application with a managed identity is given just the permission it needs, such as reading secrets, and nothing more. Because every operation is logged, security teams can see which identity read which secret and when. Soft delete keeps a deleted vault or secret recoverable for a retention period, and purge protection prevents it from being erased early.