From c403c12fdbfc79b903222984658d7265374fb67e Mon Sep 17 00:00:00 2001 From: John Collinson <13622412+johncollinson2001@users.noreply.github.com> Date: Tue, 8 Oct 2024 15:06:47 +0100 Subject: [PATCH] Security design (#12) Created security design. --- .github/pull_request_template.md | 1 + docs/assets/nhs-logo.png | Bin 4806 -> 0 bytes docs/assets/security-design.drawio.svg | 702 +++++++++++++++++++++++++ docs/design.md | 114 +++- 4 files changed, 816 insertions(+), 1 deletion(-) delete mode 100644 docs/assets/nhs-logo.png create mode 100644 docs/assets/security-design.drawio.svg diff --git a/.github/pull_request_template.md b/.github/pull_request_template.md index 121d144..e7e21db 100644 --- a/.github/pull_request_template.md +++ b/.github/pull_request_template.md @@ -1,4 +1,5 @@ + ## Description Please provide a brief summary of the changes made in this pull request. diff --git a/docs/assets/nhs-logo.png b/docs/assets/nhs-logo.png deleted file mode 100644 index 656ed07b61bef6c57cd84cae3744c85bf572d14e..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 4806 zcmV;%5;^UOP)KLZ*U+IBfRsybQWXdwQbLP>6pAqfylh#{fb6;Z(vMMVS~$e@S=j*ftg6;Uhf59&ghTmgWD0l;*T zI709Y^p6lP1rIRMx#05C~cW=H_Aw*bJ-5DT&Z2n+x)QHX^p z00esgV8|mQcmRZ%02D^@S3L16t`O%c004NIvOKvYIYoh62rY33S640`D9%Y2D-rV&neh&#Q1i z007~1e$oCcFS8neI|hJl{-P!B1ZZ9hpmq0)X0i`JwE&>$+E?>%_LC6RbVIkUx0b+_+BaR3cnT7Zv!AJxW zizFb)h!jyGOOZ85F;a?DAXP{m@;!0_IfqH8(HlgRxt7s3}k3K`kFu>>-2Q$QMFfPW!La{h336o>X zu_CMttHv6zR;&ZNiS=X8v3CR#fknUxHUxJ0uoBa_M6WNWeqIg~6QE69c9o#eyhGvpiOA@W-aonk<7r1(?fC{oI5N*U!4 zfg=2N-7=cNnjjOr{yriy6mMFgG#l znCF=fnQv8CDz++o6_Lscl}eQ+l^ZHARH>?_s@|##Rr6KLRFA1%Q+=*RRWnoLsR`7U zt5vFIcfW3@?wFpwUVxrVZ>QdQz32KIeJ}k~{cZZE^+ya? z2D1z#2HOnI7(B%_ac?{wFUQ;QQA1tBKtrWrm0_3Rgps+?Jfqb{jYbcQX~taRB;#$y zZN{S}1|}gUOHJxc?wV3fxuz+mJ4`!F$IZ;mqRrNsHJd##*D~ju=bP7?-?v~|cv>vB zsJ6IeNwVZxrdjT`yl#bBIa#GxRa#xMMy;K#CDyyGyQdMSxlWT#tDe?p!?5wT$+oGt z8L;Kp2HUQ-ZMJ=3XJQv;x5ci*?vuTfeY$;({XGW_huIFR9a(?@3)XSs8O^N5RyOM=TTmp(3=8^+zpz2r)C z^>JO{deZfso3oq3?Wo(Y?l$ge?uXo;%ru`Vo>?<<(8I_>;8Eq#KMS9gFl*neeosSB zfoHYnBQIkwkyowPu(zdms`p{<7e4kra-ZWq<2*OsGTvEV%s0Td$hXT+!*8Bnh2KMe zBmZRodjHV?r+_5^X9J0WL4jKW`}lf%A-|44I@@LTvf1rHjG(ze6+w@Jt%Bvjts!X0 z?2xS?_ve_-kiKB_KiJlZ$9G`c^=E@oNG)mWWaNo-3TIW8)$Hg0Ub-~8?KhvJ>$ z3*&nim@mj(aCxE5!t{lw7O5^0EIO7zOo&c6l<+|iDySBWCGrz@C5{St!X3hAA}`T4 z(TLbXTq+(;@<=L8dXnssyft|w#WSTW<++3>sgS%(4NTpeI-VAqb|7ssJvzNHgOZVu zaYCvgO_R1~>SyL=cFU|~g|hy|Zi}}s9+d~lYqOB71z9Z$wnC=pR9Yz4DhIM>Wmjgu z&56o6maCpC&F##y%G;1PobR9i?GnNg;gYtchD%p19a!eQtZF&3JaKv33gZ<8D~47E ztUS1iwkmDaPpj=$m#%)jCVEY4fnLGNg2A-`YwHVD3gv};>)hAvT~AmqS>Lr``i7kw zJ{5_It`yrBmlc25DBO7E8;5VoznR>Ww5hAaxn$2~(q`%A-YuS64wkBy=9dm`4cXeX z4c}I@?e+FW+b@^RDBHV(wnMq2zdX3SWv9u`%{xC-q*U}&`cyXV(%rRT*Z6MH?i+i& z_B8C(+grT%{XWUQ+f@NoP1R=AW&26{v-dx)iK^-Nmiuj8txj!m?Z*Ss1N{dh4z}01 z)YTo*JycSU)+_5r4#yw9{+;i4Ee$peRgIj+;v;ZGdF1K$3E%e~4LaI(jC-u%2h$&R z9cLXcYC@Xwnns&bn)_Q~Te?roKGD|d-g^8;+aC{{G(1^(O7m37Y1-+6)01cN&y1aw zoqc{T`P^XJqPBbIW6s}d4{z_f5Om?vMgNQEJG?v2T=KYd^0M3I6IZxbny)%vZR&LD zJpPl@Psh8QyPB@KTx+@RdcC!KX7}kEo;S|j^u2lU7XQ}Oo;f|;z4Ll+_r>@1-xl3| zawq-H%e&ckC+@AhPrP6BKT#_XdT7&;F71j}Joy zkC~6lh7E@6o;W@^IpRNZ{ptLtL(gQ-CY~4mqW;US7Zxvm_|@yz&e53Bp_lTPlfP|z zrTyx_>lv@x#=^!PzR7qqF<$gm`|ZJZ+;<)Cqu&ot2z=00004XF*Lt006O$eEU(80000WV@Og>004R=004l4008;_004mL004C` z008P>0026e000+nl3&F}000N!NklJH@4$T zTpE&LD5MiZOfO7Z=nT`o(g}T_?oi65oiYqeJB0F(&M+Yl?Jy)1n1Mpt#uRFYLY%m9 ztlBtIlQ^~`OSWa}E=wzEwLGk>*t`E(NuKb8&-g)ej?X!}-}(RV`~D*lJkO)uhLBBEiSkY_P*;{AD1r%pq@`h*)HGzE;e z_VJURk3Nl5l`<|Hy)~#|Ac9f$b~q!m%E-)mj^n8V_JnjU*h#1%e0)(lvS+7>YPvQ-x zHnJQJ**wR8;|=RBd;zP?A)Ikk|G zik01{YOc`;!2&9oEI|PAMG&aZX+Q}5dd!bI?N^_0JFT=pOr@62aw9YAXU2o~HtGnX zoO~8|exd>(t_4!JLTQnJ;qpS*^<&xNt(+-8Q_tu%O0K~FeHIY-29x^t$Ga5-z+beA ze5kkfq2Ahx4Au4Jjp#K`ZfWo&y4` z+o1s1m<^3&sP<;?WGyWu-FW`_}iLv0U53hxTQTBfY z#Ip~!n6ygimMQiQrKec#S|EjE__aiKel1-cK|qOy5IWFmKnOXlG&q{c75ZMfc+L~5 zs+?3-2*iD@#=$Pznem{=#{XkBJk(<=GUXz`lsvFd-F1M{>+=R-+TMh<3}9BgDz=A%caIAw-Z@O zT6R116iFQIw2IV70HPEGSL6xeRt(*ZRx+swp;sPlZ?|jZ|38+_|Ky!H*K=cUeiWzz zh|5rkA&9n_p$@stq9K1cGwn~vr1Ta~8NWL~Y~d8GihTFEzOH6{*;&zz{L`nVzw=u! zjyS|XT!I3)chmU|?YH4XG@0SN5~d^-L{EzzA+!|9?10HDF&+2Vwc|g!@4H`dG3xR} z@Qd>cZ~ZG!SwzfXBLX3G3ZOOJ3XT zffQx^Y*({RwWTza21SAA&rh$(0|82g-Kc6Z!zhGPIVlSAX1pYDPaSHQeC6O9PjyJC zy(rjA$ug;d$%}1~|V*Rv5>uTO~uL5d`|y1I^EW*$J2S zkn2-aP7s@yi)JG&7UaK9g}joSV$`Hi>fTyQhoQ8Tc`ICbcEDwQeq0^A=I&I}ZT)YAA+hU>Rfbd5$%aSri zrBv)|5|>+GcI?1P$s8}JGJTsDpO}{l}y$$fn z@pOJR09fEwn^vSUfhapU9}h;^V3ZBU*yR{YQ>5LfvK!QPqpIGdKI}GEQj%^1Vz=%7 gP-GW~?d`t<01c9WvEiL1tpET307*qoM6N<$f@D%3;s5{u diff --git a/docs/assets/security-design.drawio.svg b/docs/assets/security-design.drawio.svg new file mode 100644 index 0000000..3caa8ad --- /dev/null +++ b/docs/assets/security-design.drawio.svg @@ -0,0 +1,702 @@ + + + + + + + +
+
+
+ Tenant +
+
+
+ + + Tenant + + + + + + + + + +
+
+
+ Owner +
+
+
+ + + Owner + + + + + + + +
+
+
+ Tenant Admin +
+
+
+ + + Tenant Ad... + + + + + + + +
+
+
+ Subscription +
+
+
+ + + Subscription + + + + + + + + + +
+
+
+ Owner +
+
+
+ + + Owner + + + + + + + + +
+
+
+ Assign +
+ Roles +
+
+
+ + + Assign... + + + + + + + + +
+
+
+ Deploy +
+ Resources +
+
+
+ + + Deploy... + + + + + + + +
+
+
+ Deployment +
+ Service Principal +
+
+
+ + + Deploymen... + + + + + + + +
+
+
+ Tenant +
+
+
+ + + Tenant + + + + + + + + + +
+
+
+ Authorise +
+ Operations +
+
+
+ + + Authorise... + + + + + + + +
+
+
+ Security Admin +
+
+
+ + + Security... + + + + + + + +
+
+
+ Resource +
+ Guard +
+
+
+ + + Resource... + + + + + + + +
+
+
+ + Resource Group + +
+
+
+ + + Resource Group + + + + + + + + +
+
+
+ + Resource Group + +
+
+
+ + + Resource Group + + + + + + + +
+
+
+ Backup Vault +
+
+
+ + + Backup Vault + + + + + + + + + +
+
+
+ Write +
+
+
+ + + Write + + + + + + + + +
+
+
+ Read +
+
+
+ + + Read + + + + + + + +
+
+
+ Managed +
+ Identity +
+
+
+ + + Managed... + + + + + + + + +
+
+
+ + Restore +
+ Backups + +
+
+
+ + + Restore... + + + + + + + + +
+
+
+ Monitor +
+ Backups +
+
+
+ + + Monitor... + + + + + + + +
+
+
+ Backup +
+ Admin +
+
+
+ + + Backup... + + + + + + + +
+
+
+ Storage +
+ Account +
+
+
+ + + Storage... + + + + + + + +
+
+
+ Managed +
+ Disk +
+
+
+ + + Managed... + + + + + + + +
+
+
+ + + Other +
+ Resources + +
+ +
+
+
+ + + Other... + + + + + + + + +
+
+
+ Owner +
+
+
+ + + Owner + + + + + + + +
+
+
+ Subscription +
+ Admin +
+
+
+ + + Subscript... + + + + + + + + +
+
+
+ Authorise +
+ Operations +
+
+
+ + + Authorise... + + + + + + + +
+
+
+ 1 +
+
+
+ + + 1 + + + + + + + +
+
+
+ 2 +
+
+
+ + + 2 + + + + + + + +
+
+
+ 3 +
+
+
+ + + 3 + + + + + + + +
+
+
+ 4 +
+
+
+ + + 4 + + + + + + + +
+
+
+ 7 +
+
+
+ + + 7 + + + + + + + +
+
+
+ 6 +
+
+
+ + + 6 + + + + + + + +
+
+
+ Azure Monitor +
+
+
+ + + Azure Moni... + + + + + + + +
+
+
+ Backup +
+ Monitor +
+
+
+ + + Backup... + + + + + + + +
+
+
+ 5 +
+
+
+ + + 5 + + + + + + + + +
+
+
+ Monitor +
+ Backups +
+
+
+ + + Monitor... + + + + + + + + + Text is not SVG - cannot display + + + + \ No newline at end of file diff --git a/docs/design.md b/docs/design.md index aa9b35b..2167218 100644 --- a/docs/design.md +++ b/docs/design.md @@ -1,3 +1,6 @@ + + + # Design ## Overview @@ -25,7 +28,7 @@ The following diagram illustrates the high level architecture: 1. The **backup vault** accesses resources to be backed up through a **System Assigned Managed Identity** - a secure way of enabling communication between defined resources without managing a secret/password, which is assigned the necessary roles to the resources that require backup. -1. **Backup administrators** are a group of identities that will have time limited read only access to the **backup vault** in order to access and restore backups as required. Assignment of the role will be secured by **PIM** - Privileged Identity Management, which requires a second identity to authorise the role assignment, which is then assigned on a time limited bases. The **backup administrators** will also be responsible for monitoring and auditing backup activity via **Azure Monitor** (see **point 6** for more details). +1. **Backup administrators** are a group of identities that will have time limited read only access to the **backup vault** in order to access and restore backups as required. The **backup administrators** will also be responsible for monitoring and auditing backup activity via **Azure Monitor** (see **point 6** for more details), although this task may be delegated to service staff performing the role of **backup monitors**. 1. The solution requires a user account with elevated subscription contributor permissions that can create the backup resources (such as the backup **resource group** and **backup vault**) and assign roles to the resources that require backup. This identity should be implemented as a **federated credential** of an **app registration**, which is like a passport that lets you access different services without needing to manage a separate password. The identity also needs writer access to a dedicated **Storage Account** in order to read and write the **terraform** infrastructure state. See the [deployment identity](usage.md#deployment-identity) section for more details. @@ -33,6 +36,115 @@ The following diagram illustrates the high level architecture: 1. Some resources such as Azure SQL and Azure Key Vault are not directly supported by Azure **backup vault**, but can be incorporated via a supplementary process that backs up the data to Azure Blob Storage first. In the case of Azure SQL, a typical scenario could be an Azure Logic App that takes a backup of Azure SQL on a regular basis and stores the data in Azure Blob Storage. It is the aspiration of this solution to provide guidance and tooling that teams can adopt to support these scenarios. +## Security Design + +The following diagram illustrates the security design of the solution: + +![Security Design](assets/security-design.drawio.svg) + +See the following links for further details on some concepts relevant to the design: + +* [Azure Multi-user Authorisation (MUA) and Resource Guard](https://learn.microsoft.com/en-us/azure/backup/multi-user-authorization-concept) +* [Backup Operator Role](https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles/storage#backup-operator) +* [Azure Privileged Identity Management (PIM)](https://learn.microsoft.com/en-us/entra/id-governance/privileged-identity-management) + +### Actors + +> NOTE: The roles listed below are not an exhaustive list, and are only those which are of relevance to the backup solution. + +1. Tenant Admin + + The tenant admin, aka the "global administrator", is typically a restricted group of technical specialists and/or senior engineering staff. They have full control over the Azure tenant including all subscriptions and identities. + + The actor holds the following roles: + + * Tenant Owner + * Tenant RBAC Administrator + + The following risks and mitigations should be considered: + + | Risks | Mitigations | + |-|-| + | Backup instance tampered with. | Use of PIM for temporary elevated privileges. | + | Backup policy tampered with. | Use of MUA for restricted backup operations. | + | Role based access tampered. | Dedicated admin accounts. | + | No other account able to override a malicious actor. | | + +1. Subscription Admin + + The subscription admin is typically a restricted group of team leads who are deploying their teams solutions to the subscription. They have full control over the subscription, including the backup vault and the backup resources. + + The actor holds the following roles: + + * Subscription Owner + * Subscription RBAC Administrator + + The following risks and mitigations should be considered: + + | Risks | Mitigations | + |-|-| + | Backup instance tampered with.                       | Use of PIM for temporary elevated privileges. | + | Backup policy tampered with. | Use of MUA for restricted backup operations. | + | Role based access tampered. | | + +1. Deployment Service Principal + + The deployment service principal is an unattended credential used to deploy the solution from an automated process such as a pipeline or workflow. It has the permission to deploy resources (such as the backup vault) and assign the roles required for the solution to operate. + + The actor holds the following roles: + + * Subscription Contributor + * Subscription RBAC Administrator limited to the roles required by the deployment + + The following risks and mitigations should be considered: + + | Risks | Mitigations | + |-|-| + | Backup instance tampered with.                       | Use of PIM for temporary elevated privileges. | + | Backup policy tampered with. | Use of MUA for restricted backup operations. | + | Role based access tampered. | Secret scanning in pipeline. | + | Poor secret management. | Robust secret management procedures. | + +1. Backup Admin + + The backup admin is typically a group of team support engineers and/or technical specialists. They have the permission to monitor backup telemetry, and restore backups in order to recover services. + + The actor holds the following roles: + + * Subscription Backup Operator + +1. Backup Monitor + + The backup monitor is typically a group of service staff. They have the permission to monitor backup telemetry in order to raise the alarm if any issues are found. + + The actor holds the following roles: + + * Monitoring Reader + +1. Security Admin + + The security admin is typically a group of cyber security specialists that are isolated from the other actors, by being in a different tenant or a highly restricted subscription. They have permissions to manage Resource Guard, which provide multi user authorisation to perform restricted operations on the backup vault, such as changing policies or stopping a backup instance. + + The actor holds the following roles: + + * Subscription Backup MUA Administrator + + | Risks | Mitigations | + |-|-| + | Elevated roles note revoked.                       | Use of PIM for temporary elevated privileges. | + | | Robust and well documented processes. | + + **NOTE: MUA without PIM requires a manual revocation of elevated permissions.** + +1. Backup Vault Managed Identity + + The backup vault managed identity is a "System Assigned" managed identity that performs backup vault operations. It is restricted to just the services defined at deployment, and cannot be compromised at runtime. + + The actor holds the following roles: + + * Backup Vault Resource Writer + * Reader role on resources that require backup + ## Terraform Design The following diagram illustrates the terraform design: