You are working as an Azure security consultant for a financial institution that deals with sensitive customer information. The organization needs to ensure the confidentiality and integrity of data stored in Azure services. a) Given the scenario, provide a detailed comparison between Azure Storage Service Encryption
Scenario:
You are working as an Azure security consultant for a financial institution that deals with sensitive customer information.
The organization needs to ensure the confidentiality and integrity of data stored in Azure services.
a) Given the scenario, provide a detailed comparison between Azure Storage Service Encryption (SSE) with a Microsoftmanaged key and SSE with a customer-managed key. Analyze the advantages and considerations of each approach,
considering the organization's regulatory requirements.
b) Based on the security requirements of the financial institution, recommend a strategy for implementing Azure Backup
for virtual machines used to process financial data. Include the steps you would take to set up and configure Azure Backup,
emphasizing data protection and disaster recovery aspects.
About Azure Storage service-side encryption
Data in Azure Storage is encrypted and decrypted transparently using 256-bit AES encryption ,one of the strongest block ciphers available, and is FIPS 140-2 compliant. Azure Storage encryption is similar to BitLocker encryption on Windows.
Azure Storage encryption is enabled for all storage accounts, including both Resource Manager and classic storage accounts. Azure Storage encryption cannot be disabled. Because your data is secured by default, you don't need to modify your code or applications to take advantage of Azure Storage encryption.
Data in a storage account is encrypted regardless of performance tier (standard or premium), access tier (hot or cool), or deployment model (Azure Resource Manager or classic). All new and existing block blobs, append blobs, and page blobs are encrypted, including blobs in the archive tier. All Azure Storage redundancy options support encryption, and all data in both the primary and secondary regions is encrypted when geo-replication is enabled. All Azure Storage resources are encrypted, including blobs, disks, files, queues, and tables. All object metadata is also encrypted.
- You can specify a customer-managed key to use for encrypting and decrypting data in Blob Storage and in Azure Files.1,2 Customer-managed keys must be stored in Azure Key Vault or Azure Key Vault Managed Hardware Security Model (HSM). For more information about customer-managed keys.
- You can specify a customer-provided key on Blob Storage operations. A client making a read or write request against Blob Storage can include an encryption key on the request for granular control over how blob data is encrypted and decrypted. For more information about customer-provided keys.
Step by step
Solved in 3 steps
