destined to the corporate network flows through the VPN and to the corporate network. The virtual network gateway establishes an IPsec tunnel between the virtual network and the customer’s VPN device (which can be either a hardware VPN device or a software VPN such as Windows Server 2012 Routing and Remote Access Services), and routes traffic appropriately. Creating a virtual private network within Windows Azure provides the ability to more securely extend your on-premises network into Windows Azure. This connection can either be site-to-site or point-to-site. For more information on virtual network gateway configuration, see . Security Management and Threat Defense Securing By default, if a VM is created through the Windows Azure Management Portal, remote RDP and Powershell ports are opened. When a VM is created through management Powershell, RDP and Powershell ports must be explicitly opened. The Portal of VMs assigns RDP and Powershell port numbers using a random number to reduce the chances of a password dictionary attack. You can choose to keep the RDP and Powershell ports open to the Internet, but at a bare minimum, secure the VMs with strong passwords. In addition, consider using the general options to secure inbound from the Internet mentioned above. Protecting Windows Azure has a distributed denial-of-service (DDoS) defense system that against DDOS helps prevent attacks against Windows Azure platform services. It uses standard detection and mitigation techniques such as SYN cookies, rate limiting, and connection limits. Windows Azure’s DDoS defense system is designed not only to withstand attacks from the outside, but also from within. For attacks launched from the outside (Internet), IP addresses can be spoofed, although they are prevented from spoofing Windows Azure datacenter IP address ranges.
destined to the corporate network flows through the VPN and to the corporate network. The virtual network gateway establishes an IPsec tunnel between the virtual network and the customer’s VPN device (which can be either a hardware VPN device or a software VPN such as Windows Server 2012 Routing and Remote Access Services), and routes traffic appropriately. Creating a virtual private network within Windows Azure provides the ability to more securely extend your on-premises network into Windows Azure. This connection can either be site-to-site or point-to-site. For more information on virtual network gateway configuration, see . Security Management and Threat Defense Securing remote management of VMs By default, if a VM is created through the Windows Azure Management Portal, RDP and Powershell ports are opened. When a VM is created through Powershell, RDP and Powershell ports must be explicitly opened. The Portal assigns RDP and Powershell port numbers using a random number to reduce the chances of a password dictionary attack. You can choose to keep the RDP and Powershell ports open to the Internet, but at a bare minimum, secure the VMs with strong passwords. In addition, consider using the general options to secure inbound from the Internet mentioned above. Protecting against DDOS Windows Azure has a distributed denial-of-service (DDoS) defense system that helps prevent attacks against Windows Azure platform services. It uses standard detection and mitigation techniques such as SYN cookies, rate limiting, and connection limits. Windows Azure’s DDoS defense system is designed not only to withstand attacks from the outside, but also from within. For attacks launched from the outside (Internet), IP addresses can be spoofed, although they are prevented from spoofing Windows Azure datacenter IP address ranges.
Windows%20Azure%20Network%20Security%20Whitepaper%20-%20FINAL.docx