You are a cybersecurity consultant for a FinTech company that handles sensitive financial data, including customer transactions, account details, and personal information. The company wants to ensure that all sensitive data is encrypted both at rest and in transit to comply with industry regulations and protect against data breaches.
Project Objective: Implement encryption for data at rest and in transit using Azure Cloud services to ensure the security and integrity of the company’s financial data.
For all the resources in this lab, we are using the East US region.
In this lab, you will complete the following exercises:
Note: Please ensure that you have created an Azure Account with active subscription credit (https://portal.azure.com/), or Subscribe to Azure Student Package (https://aka.ms/student-account).
In this exercise, you will complete the following tasks Create an Azure Storage.
In this task, you will Create an Azure Storage account.
Navigate to the Azure portal at (https://portal.azure.com).
In the search bar at the top of the portal, type “Storage account” and select it from the search results.
Click Create.
In the Create a storage account blade, under the Basics tab, fill in the following items:
| Setting | Value |
|---|---|
| Subscription | your subscription |
| Resource group | CyberP-Project |
| Storage account name | demoproject01 |
| Region | (US) East US |
| Primary service | Azure Files |
| Performance | Standard |
| Redundancy | Locally-redundant storage(LRS) |
Click Next, notice the Advanced tab, leave as default.
Click Next, notice the Networking tab, leave as default.
Click Next, notice the Data protection tab, leave as default.
Click Next, notice the Encryption tab, leave as default.
Click Next, notice the Tag tab, leave as default.
Click Review + create. Click on Create.
Result: You used the Azure Portal to create an Azure Storage Account.
In this exercise, you will complete the following tasks:
Note: As part of Azure security, Storage service encryption is enabled by default (Secure by design). Go through the steps to understand better.
In the search bar at the top of the portal, type “Storage Accounts” and select it from the search results.
In the Storage accounts, select “demoproject01” from the list.
On the left blade, select Security + Networking then select Encryption.
Ensure that Microsoft-managed keys is selected, and if you prefer to use your own encryption, select Customer-managed keys and configure Azure Key vault.
Click Save.
You have sucessfully enabled Azure Storage Service Encryption.
In this exercise, you will complete the following tasks:
Navigate to your
On the left pane, click on Data storage then click on Container.
Click + Container.
Place in a name for the new container, type financial-data.
Observe the Advanced tab, then click on Create.
You’re brought back to the Container blade, refresh the containers.
Notice your newly created conatainer.
Click on the container you just created.
In the financial-data blade, Click Upload.
Click on Browse for files, then select any small sized file in your system.pload
Click Upload, Notice the Access Control (IAM) tab, where you can set specific permission for other user.
On the Overview tab, notice your file got uploaded into Azure.
The current Authentication method is Access key, notice you can also switch to Microsoft Entra user account.
Note: The file will be automatically encrypted at rest by Azure Storage Service Encryption.
In this exercise, you will complete the following tasks:
Navigate back to your
On the left pane, click on Settings then click on Configuration.
Observe the different Configurations, ensure that the Secure transfer required is set to Enabled.
Notice the Alow Blob anonymous access configuration. (For more security, leave as Disabled, but try out the other options).
Note: This ensures that all data transfers to and from your storage account use HTTPS, encrypting data in transit.
On a new tab, Go to the Azure Storage Explorer download page
Download and install the application for your operating system (Windows, macOS, or Linux).
Open Azure Storage Explorer and accept License Agreement.
Click Sign in with Azure, then select Azure. Click Next.
You will be redirected to your browser to sign in, follow the prompt and sign in.
Back to Azure Storage Explorer, Select the subscription click Open Explorer.
Click on the drop-down close to your subcription, and see storage account.
On the right pane, click Connect to Azure resources.
You are required to provide an account name and a connection string.
Go to the Azure portal, click on Storage accounts from the dashboard and select demoproject01.
In the demoproject01 blade. On the left pane, select Security + networking and click Access keys.
Copy both the Storage account name and Connection string for key1, and paste in your Storage Explorer.
Your Storage Explorer is refreshed and you can now see your storage containers.
Click on Blob Containers drop-down, and select financial-data.
Result: The file is now securely downloaded using HTTPS.
In this exercise, you will complete the following tasks:
Navigate back to your
On the left pane, click on Monitoring then click on Diagnostic settings.
Click on demoproject01 from the list.
Click + Add diagnostic setting.
For the Diagnostic setting name, type proj-diag. Under Metrics select Transaction, under Destination details select Send to Log Analytics workspace.
Click Save.
Result: Diagnostics settings has been enabled to capture logs and metrics and can be analyzed in the Log Analytics workspace.
Regularly review access logs to ensure there are no unauthorized access attempts.
Use Azure Security Center to get recommendations and insights.
Outcome: By implementing these steps, the FinTech company ensures that their sensitive financial data is securely stored and transmitted, complying with industry regulations and protecting against potential data breaches. This project scenario highlights the importance of data encryption in maintaining the security and integrity of critical information.
You have successfully completed this project, ensure you share your experiences and screenshots on LinkedIn using hashtag #cloudprojectwithcyberpreacher #CPwCP.
Note: Ensure to delete every resources created during this project, to ensure cost management.