【云计算】Azure认知搜索的Azure安全基线

此安全基线将Microsoft云安全基准1.0版的指导应用于Azure认知搜索。Microsoft云安全基准测试提供了有关如何在Azure上保护云解决方案的建议。内容按Microsoft云安全基准和适用于Azure认知搜索的相关指南定义的安全控制进行分组。

您可以使用Microsoft Defender for Cloud监控此安全基线及其建议。Azure策略定义将列在Microsoft Defender for Cloud门户页面的“法规遵从性”部分。

当某个功能具有相关的Azure策略定义时，它们会在此基线中列出，以帮助您衡量是否符合Microsoft云安全基准控件和建议。某些建议可能需要付费的Microsoft Defender计划来启用某些安全场景。

The security profile summarizes high-impact behaviors of Azure Cognitive Search, which may result in increased security considerations.

For more information, see the Microsoft cloud security benchmark: Network security.

Description: Service supports deployment into customer's private Virtual Network (VNet). Learn more.

Configuration Guidance: This feature is not supported to secure this service.

Description: Service network traffic respects Network Security Groups rule assignment on its subnets. Learn more.

Configuration Guidance: This feature is not supported to secure this service.

Description: Service native IP filtering capability for filtering network traffic (not to be confused with NSG or Azure Firewall). Learn more.

Feature notes: For outbound connections through a private endpoint, refer to: Make outbound connections through a private endpoint

Configuration Guidance: Deploy private endpoints to establish a private access point for the resources. Block all connections on the public endpoint for your search service. Increase security for the virtual network, by enabling you to block exfiltration of data from the virtual network.

Reference: Create a Private Endpoint for a secure connection to Azure Cognitive Search

Description: Service supports disabling public network access either through using service-level IP ACL filtering rule (not NSG or Azure Firewall) or using a 'Disable Public Network Access' toggle switch. Learn more.

Configuration Guidance: Azure Cognitive Search supports IP rules for inbound access through a firewall, similar to the IP rules you'll find in an Azure virtual network security group. By leveraging IP rules, you can restrict search service access to an approved set of machines and cloud services. Access to data stored in your search service from the approved sets of machines and services will still require the caller to present a valid authorization token.

Reference: Configure an IP firewall for Azure Cognitive Search

For more information, see the Microsoft cloud security benchmark: Identity management.

Description: Service supports using Azure AD authentication for data plane access. Learn more.

Configuration Guidance: No additional configurations are required as this is enabled on a default deployment.

Description: Local authentications methods supported for data plane access, such as a local username and password. Learn more.

Feature notes: Avoid the usage of local authentication methods or accounts, these should be disabled wherever possible. Instead use Azure AD to authenticate where possible.

Configuration Guidance: Cognitive Search uses key-based authentication as its primary authentication methodology. For inbound requests to a search service endpoint, such as requests that create or query an index, API keys are the only generally available authentication option you have.

Reference: Use API keys for Azure Cognitive Search authentication

Description: Data plane actions support authentication using managed identities. Learn more.

Configuration Guidance: Use Azure managed identities instead of service principals when possible, which can authenticate to Azure services and resources that support Azure Active Directory (Azure AD) authentication. Managed identity credentials are fully managed, rotated, and protected by the platform, avoiding hard-coded credentials in source code or configuration files.

Reference: Authorize access to a search app using Azure Active Directory

Description: Data plane supports authentication using service principals. Learn more.

Configuration Guidance: There is no current Microsoft guidance for this feature configuration. Please review and determine if your organization wants to configure this security feature.

Description: Data plane access can be controlled using Azure AD Conditional Access Policies. Learn more.

Configuration Guidance: Define the applicable conditions and criteria for Azure Active Directory (Azure AD) conditional access in the workload. Consider common use cases such as blocking or granting access from specific locations, blocking risky sign-in behavior, or requiring organization-managed devices for specific applications.

Description: Data plane supports native use of Azure Key Vault for credential and secrets store. Learn more.

Configuration Guidance: This feature is not supported to secure this service.

For more information, see the Microsoft cloud security benchmark: Privileged access.

Description: Service has the concept of a local administrative account. Learn more.

Configuration Guidance: This feature is not supported to secure this service.

Description: Azure Role-Based Access Control (Azure RBAC) can be used to managed access to service's data plane actions. Learn more.

Configuration Guidance: Azure provides a global role-based access control (RBAC) authorization system for all services running on the platform. In Cognitive Search, you can use Azure roles for:

• Control plane operations (service administration tasks through Azure Resource Manager).
• Data plane operations, such as creating, loading, and querying indexes.

Reference: Use Azure role-based access controls (Azure RBAC) in Azure Cognitive Search

Description: Customer Lockbox can be used for Microsoft support access. Learn more.

Configuration Guidance: In support scenarios where Microsoft needs to access your data, use Customer Lockbox to review, then approve or reject each of Microsoft's data access requests.

For more information, see the Microsoft cloud security benchmark: Data protection.

Description: Tools (such as Azure Purview or Azure Information Protection) can be used for data discovery and classification in the service. Learn more.

Configuration Guidance: This feature is not supported to secure this service.

Description: Service supports DLP solution to monitor sensitive data movement (in customer's content). Learn more.

Configuration Guidance: This feature is not supported to secure this service.

Description: Service supports data in-transit encryption for data plane. Learn more.

Configuration Guidance: No additional configurations are required as this is enabled on a default deployment.

Reference: Azure Cognitive Search data in transit encryption

Description: Data at-rest encryption using platform keys is supported, any customer content at rest is encrypted with these Microsoft managed keys. Learn more.

Configuration Guidance: No additional configurations are required as this is enabled on a default deployment.

Reference: Azure Cognitive Search default data encryption using service-managed keys

Description: Data at-rest encryption using customer-managed keys is supported for customer content stored by the service. Learn more.

Configuration Guidance: If required for regulatory compliance, define the use case and service scope where encryption using customer-managed keys are needed. Enable and implement data at rest encryption using customer-managed key for those services.

Reference: Configure customer-managed keys for data encryption in Azure Cognitive Search

Description: The service supports Azure Key Vault integration for any customer keys, secrets, or certificates. Learn more.

Configuration Guidance: Use Azure Key Vault to create and control the life cycle of your encryption keys, including key generation, distribution, and storage. Rotate and revoke your keys in Azure Key Vault and your service based on a defined schedule or when there is a key retirement or compromise. When there is a need to use customer-managed key (CMK) in the workload, service, or application level, ensure you follow the best practices for key management: Use a key hierarchy to generate a separate data encryption key (DEK) with your key encryption key (KEK) in your key vault. Ensure keys are registered with Azure Key Vault and referenced via key IDs from the service or application. If you need to bring your own key (BYOK) to the service (such as importing HSM-protected keys from your on-premises HSMs into Azure Key Vault), follow recommended guidelines to perform initial key generation and key transfer.

Reference: Configure customer-managed keys for data encryption in Azure Cognitive Search

Description: The service supports Azure Key Vault integration for any customer certificates. Learn more.

Configuration Guidance: This feature is not supported to secure this service.

For more information, see the Microsoft cloud security benchmark: Asset management.

Description: Service configurations can be monitored and enforced via Azure Policy. Learn more.

Configuration Guidance: Use Microsoft Defender for Cloud to configure Azure Policy to audit and enforce configurations of your Azure resources. Use Azure Monitor to create alerts when there is a configuration deviation detected on the resources. Use Azure Policy [deny] and [deploy if not exists] effects to enforce secure configuration across Azure resources.

Reference: Azure Cognitive Search Policies

For more information, see the Microsoft cloud security benchmark: Logging and threat detection.

Description: Service has an offering-specific Microsoft Defender solution to monitor and alert on security issues. Learn more.

Configuration Guidance: This feature is not supported to secure this service.

Description: Service produces resource logs that can provide enhanced service-specific metrics and logging. The customer can configure these resource logs and send them to their own data sink like a storage account or log analytics workspace. Learn more.

Configuration Guidance: Enable resource logs for the service to view the Azure Cognitive Search operations logs, search metrics, and etc.

Reference: Azure Cognitive Search resource log

For more information, see the Microsoft cloud security benchmark: Backup and recovery.

Description: The service can be backed up by the Azure Backup service. Learn more.

Configuration Guidance: This feature is not supported to secure this service.

Description: Service supports its own native backup capability (if not using Azure Backup). Learn more.

Feature notes: Because Azure Cognitive Search isn't a primary data storage solution, Microsoft doesn't provide a formal mechanism for self-service backup and restore. However, you can backup and restore the index using your own code. Refer to: Back up and restore alternatives

Configuration Guidance: This feature is not supported to secure this service.