Security gaps threatened the company’s cloud migration, but crisis was averted with services from Lightstream.
A desire to stay innovative, modern, and operationally effective—three critical attributes in today’s competitive construction industry—led a large design-build construction company in the Midwest to explore the cloud. The company’s IT leadership team chose Microsoft Azure as their platform and purchased Prisma Cloud, a multi-cloud security offering from Palo Alto Networks, to provide added security protection for their cloud environments.
Once its Azure environment was implemented, the company began migrating applications. The team’s goal was to move as many applications as possible to the cloud, knowing some applications would have to remain on-premises, and their operating environment would result in a hybrid configuration.
After months of moving applications and deploying them into production, however, the company discovered problems. A security assessment revealed there were serious security gaps in the way Azure and Prisma Cloud had been implemented. If not addressed, the gaps would allow external entities to gain access to their environment, leaving the company’s systems vulnerable to breaches. This forced the company to stop its cloud migration and move applications back into its own data center.
With its cloud migration on hold, the company looked for a solution to solve its security problems and contacted Lightstream for help.
Once engaged, Lightstream Azure Cloud experts began gathering information. They reviewed the company’s business requirements, technology environment (infrastructure, data services, security landscape, application portfolio, and operations tools), and processes to gain a clear understanding of the company’s operating environment.
Next, the team evaluated the company’s existing Azure environment. They reviewed the company’s core cloud configurations, standards and governance, identity and access management (IAM), network interconnectivity, security, and monitoring, provided recommendations for changes to address issues, and then created an operational run-book with as-built documentation.
The next step was to review the Palo Alto Networks NGFW (next-generation firewall) configuration. The team reviewed the overall design of the appliances, assessed the Azure routing configurations, network placement, and connectivity, and recommended changes to remediate issues and ensure high availability.
The last step was to address the Palo Alto Networks Prisma Cloud implementation. The team evaluated the existing deployment, including policies and settings for resource configurations, user activities, network traffic, and host vulnerabilities, and made changes to resolve problems and ensure the environment operated correctly.
Remediation of Security Gaps and Reduced Business Risk
After completing the project with Lightstream, the company was able to eliminate its security gaps. External entities were no longer able to gain access to the company’s Azure environment through the known security vulnerabilities. This increased the confidence in the company’s cloud platform and lowered the risk of security breaches to the organization.
Secure Azure Environment with Next-Generation Firewalls
The company gained a secure Azure environment protected by Palo Alto Networks NGFWs in a high availability configuration. This enabled the company to resume migrating applications safely to the cloud and ensured its firewalls would be resilient.
Successful Prisma Cloud Implementation
With help from Lightstream experts, the company was able to overcome its initial problems and successfully implement Palo Alto Networks Prisma Cloud in its environment. This provided added security protection for the company’s cloud infrastructure and cloud-native applications.
Microsoft Azure and Palo Alto Networks NGFW design and implementation services from Lightstream help the company overcome edge security issues and deploy ERP in the cloud.
Dairy is a complex, regulated industry. Since the 1930s, the U.S. government has regulated milk prices. Minimum prices are set for fluid milk (based on several factors, including the price of butter, cheese, nonfat dry milk, and dry whey), and all processors must pay it. Different prices are set for milk used as an ingredient in dairy products, though the process is the same: the government sets the price, and processors pay it.
In addition, milk is a perishable product. As a result, the government sets strict standards on its use. Processors are unable to stockpile product to meet fluctuating consumer demand, which in recent years has been shifting to dairy alternatives like oat and soy milk.
These market realities put pressure on dairy processors. To address these challenges, a large dairy co-operative in the Pacific Northwest decided to expand its operations beyond its regional customer base with the goal of becoming a national brand. But to do that, the company first needed to modernize its systems by moving away from its on-premise legacy enterprise resource planning (ERP) system to Microsoft Dynamics 365 to establish a more flexible operating platform.
Midway through the project, however, the company ran into security problems. It turned out the company didn’t fully understand how to implement native cloud security controls available in Microsoft Azure and did not have proper edge security protection in place to satisfy governance and compliance regulations. After months of trying to correct the problem with the help of a 3rd -party firm, the company was unable to deploy its ERP solution and was faced with either seeking additional help or shutting down the project.
Prior to contacting Lightstream, the company had attempted to implement Palo Alto Networks NGFW (next-generation firewall) in Azure to provide edge security for its users. The company’s IT team was committed to the solution and its capabilities, but they had struggled with the implementation.
Once engaged, the Lightstream team reviewed the company’s requirements. They evaluated the existing Palo Alto NGFW configuration, executed an ingress and egress assessment, developed a security plan for implementing the company’s ERP system in the cloud using Azure native controls and Palo Alto NGFW as the edge inspection point, and architected the design to ensure high availability and resiliency. This was done by performing a customized Cloud Foundation Framework engagement.
After the design was completed, Lightstream built the Azure environment per the design blueprint, including VNets, network security groups, platform logging, and all native security controls. Then, the team implemented the Palo Alto NGFWs in a high availability configuration.
The final step was testing and validation. Lightstream’s Azure Cloud engineering experts helped test traffic flow, routing, and connectivity, as well as security functionality to ensure the solution provided the edge security protection the company needed.
Next-Generation Edge Security Protection
The company now has next-generation security to protect its systems. This includes IPS (intrusion prevention system) that examines network traffic to prevent vulnerability exploits, APT (advanced persistent threat) intelligence and detection, and other security capabilities that help keep data safe from cyber attacks.
Successful Migration to Microsoft Dynamics 365
With edge security in place, the company was able to move forward with its ERP project. Now, the company has replaced its legacy ERP solution with Microsoft Dynamics 365, providing the enhanced computing platform the company needs to expand its operation.
Cloud Managed Services Empower MasterControl through Business Optimization, Cost Control and Enhanced Security within AWS
As a leading provider of Enterprise Quality Management Software (EQMS), MasterControl prides itself on maintaining the highest standards of quality and operational excellence. In fact, the organization’s cloud-based QMS system is titled MasterControl Quality Excellence™. With some of the largest regulatory agencies and life-science companies in the world depending on MasterControl to help them expedite the process of providing people with life-changing products, they can’t afford to leave quality and compliance to chance.
MasterControl is an innovator in the use of cloud technology and started down the path of public cloud with AWS in 2010. They eventually became overwhelmed with the day-to-day contractual management of AWS and sought out a technology provider that could help them streamline processes, fine-tune security and contain costs. They found that partner in Lightstream, an AWS Advanced Consulting Partner that offers a variety of services to assist organizations in assessing, designing and managing their AWS environment.
Over the years, Lightstream has helped MasterControl to find better ways to grow their business with AWS while controlling costs. Lightstream’s assistance with onboarding new accounts and achieving savings discounts has enabled the company to overcome obstacles as they bolstered software development initiatives. AWS and Lightstream supported MasterControl as the company expanded into Europe and Asia Pacific, which expansion was made much faster and more seamless due to the cloud.
As most business leaders know, this magnitude of expansion is almost always accompanied by growing pains. MasterControl’s IT team found that it was being stretched thin and no longer had time or sufficient resources for the ongoing monitoring needed to detect potential cloud security issues. They had to find ways to manage security and reduce cloud spending as they worked to establish a strong global presence. Travis Ruiz, Director of Cloud Services at MasterControl, once again collaborated with long-time partner Lightstream to come up with a solution.
Lightstream knew that its Cloud Managed Services offering could provide MasterControl with enhanced financial optimization along with the security oversight that is critical in order for the company to prosper even during times of crisis. Cloud Managed Services helps companies to improve the day-to-day administration and management of their cloud infrastructure through a flexible mix of consulting, integration and managed services. Lightstream’s gold level service package identifies changes that must be made in MasterControl’s cloud environment for security, technical and financial optimization. Lightstream then implements the changes necessary to remediate the financial aspects of those optimizations, while MasterControl’s in-house team is able to remediate any security and technical issues Lightstream detects.
Lightstream negotiated an Enterprise Discount Plan (EDP) with AWS on behalf of MasterControl in order to achieve a considerable expense reduction. Cost optimization measures have been amped up with additional savings plans and in-depth reviews and revisions to its Reserved Instances contracts. Extensive tagging features and Lightstream Connect customized reporting were established to help the company save time and gain greater visibility while analyzing expenditures and appropriately allocating costs.
Since Lightstream began providing Cloud Managed Services to the company in 2017, MasterControl has been able to meet their stringent budget constraints, even during the worldwide Covid-19 pandemic. Like most organizations, MasterControl faced many challenges in 2020 as customers weren’t as active as they once were, which was negatively impacting the company’s revenue stream.
Despite this, they’ve managed to stay on track with the help of an eight percent discount on AWS costs along with additional savings. A dedicated team at Lightstream has ongoing interaction with MasterControl’s executive officers, regularly delivering detailed reports and savings summaries that demonstrate how Lightstream is helping the company reduce expenses.
MasterControl’s internal IT team is able to focus on keeping its cloud environment safe and secure with the help of Lightstream’s ongoing monitoring, analysis and reports that give insight into potential technical and security threats and concerns that must be remediated.
While MasterControl’s cloud journey with AWS propelled the company’s international growth, Lightstream has ensured business optimization and significant ROI along the way. Lightstream has helped MasterControl to scale down spending without lowering their high standards for quality, compliance and security. The company has managed not only to remain viable during this tumultuous time, but it’s starting to grow again even in the face of an economic downturn.
As MasterControl continues its steady expansion, Lightstream is unwavering in its promise to add value and foster growth within the AWS cloud environment. Lightstream stands ready to support MasterControl well into the future, with ever-broadening service offerings that can continue to help it succeed in its quest to maintain the highest standards of quality, safety and operational excellence.
What MasterConrol had to say:
“We appreciate that Lightstream goes above and beyond to enrich our AWS cloud environment. Our long-term partnership with them has allowed us to keep customer success and innovation at the core of our operating philosophy without compromising on the cost and efficiency of our cloud infrastructure. We’re on track for continued growth with cloud technology firmly at the center of our product and services map.”
-Travis Ruiz, director of cloud services at MasterControl
Industry: Trade Union
The United Brotherhood of Carpenters is one of North America’s largest building trade unions, with over a half-million members. The union leads the way in training, educating and representing the next generation of skilled construction professionals.
- Development of Cloud migration plan to Azure.
- Meet security and regulatory compliance requirements for migrating core legacy applications, including Personify running on Windows Server and SQL Server.
- Provide ongoing Azure optimization and management.
- Lightstream Cloud Foundation Framework Workshop and guided Foundation Build aligned with Cloud Adoption Framework (CAF).
- POC stand up, Security Planning and Design, Network Architecture and Design, App Validation, Automation and Implementation.
- Lightstream Cloud Managed Services for ongoing Azure management and optimization of financial, technical, security and operational aspects of environment.
- Successful workloads migration to Azure.
- Compliant governance and security posture for workload environment enabling UBC to safely deploy applications via Infrastructure-as-Code.
- Ongoing management and optimization including 65% cost savings through RI management and successful networking providing full direct interoperability between on-premise resources, Azure resources via ExpressRoute and AWS resources via Direct Connect.
With its scalable structure, pay-as-you-go pricing, and 99.95% SLAs, it’s no wonder Microsoft Azure is a long-time leader in the IaaS space. Its popularity is also due to the fact that it not only offers -Infrastructure as a Service (IaaS) but also Software as a Service (SaaS) and Platform as a Service (PaaS). With Azure, clients can use the services purely in the cloud or combine them with any existing applications, data center or infrastructure already in place. But with all of this flexibility and reliability comes responsibility. It is critical that IT professionals understand Azure’s shared responsibility model as well as which security tasks are handled by the cloud provider and which tasks are handled by you.
Here are -five common security mistakes that typically result from a rushed build/setup process and inadequate management, as well as tips on and how you can avoid them when designing, deploying, and managing your Azure cloud solution.
1. Misconfiguration of Roles & Administration
Misconfiguration is a common occurrence in situations where an Azure solution is implemented without proper planning.
One aspect of misconfiguration is the assignment of roles to users. It is recommended that you follow the principle of least privilege and select a role that provides the user only with the amount of permission they need to do their job. Failing to follow this best practice leads to excess access permission which can easily be avoided by taking the time to properly assign these roles at the outset.
The old adage that “too many cooks spoil the broth” applies to countless scenarios, and Azure is no exception. Assigning too many administrators, failing to establish lease permissions for those administrators, and not enabling Azure’s Multi-Factor Authentication (MFA) are risky oversites. MFA provides an extra layer of security by requiring administrators to provide authentication via phone call, text, or mobile app before they can log into the portal. This helps prevent the administrator’s account from being compromised or misused.
2. Weak, Mismanaged Passwords
This misstep may seem obvious, but regardless of how many times people are warned against setting weak passwords, far too many people still use them. According to Microsoft, they see over 10 million username/password pair attacks every day across their platforms. Failing to assign strong passwords and requiring them to be frequently updated creates vulnerabilities that are easily avoidable.
In setting up Azure services, Microsoft recommends the following to IT administrators:
- Maintain an 8-character minimum length requirement (and longer is not necessarily better).
- Eliminate character-composition requirements.
- Eliminate mandatory periodic password resets for user accounts.
- Ban common passwords, to keep the most vulnerable passwords out of your system.
- Educate your users not to re-use their password for non-work-related purposes.
- Enforce registration for multi-factor authentication.
- Enable risk based multi-factor authentication challenges.
3. Not Enabling or Managing Logging
Failing to turn on the logging feature is another common misstep in the building process. First, logging must be turned on to permit access visibility. But it doesn’t stop there. The Azure Activity Log must be regularly monitored to gain insight into who is accessing and managing your Azure subscription and to track all create, update, delete, and action activities performed. In addition, an investment in Sentinel – Azure’s cloud-native security information and event manager (SIEM) platform – can go a long way, as it uses built-in artificial intelligence to quickly analyze large volumes of data across an enterprise.
4. Misconfiguration of Security Controls
Haste and -lack of expertise in the configuration of your security tools can mean huge exposure risks for your organization. Failing to enable Azure’s security center and its highly valuable native security tools is a big no-go as it leaves your data open to breaches.
Network Security Groups (NSGs) are the foundation of all network security designs in Azure, and therefore should always be applied to safeguard subnets of a virtual machine-based web application deployment. In a typical design, there is a virtual network and subnets. The subnets should not be assigned to a public IP that could open unwanted ports. NSGs control access by permitting or denying network traffic via communication between different workloads on a vNET, network connectivity from on-site environment into Azure, or direct internet connection.
5. Lack of Oversight
IT administrators often view their Azure cloud solution as just a data center, but it’s essential to remember that this isn’t a case of “set it and forget it.” In fact, your job is far from over once the migration or build is complete; ongoing management and security are critical to the success of your Azure environment.
Proper management of your solution requires a multi-faceted approach. In addition to maintaining compliance with organizational and regulatory security requirements, you must continuously monitor the machines, networks, storage, data services, and applications to protect against potential security issues. Prioritize security alerts and incidents so you can zero in on the most critical threats first. Troubleshooting will be easier if you track changes and create alerts to proactively monitor critical components. Managing update schedules will ensure that your solution is equipped with the latest tools to support ongoing operations.
The bottom line is that your Azure solution is only as strong as the team supporting it. Therefore, IT professionals must do everything in their power to remediate security vulnerabilities before attackers have a chance to take advantage of them. If security and technical expertise and staffing have become obstacles to the effective implementation of your cloud strategy, turn to Lightstream’s Cloud Managed Services (CMS) for help overcoming these challenges.