Security gaps threatened the company’s cloud migration, but crisis was averted with services from Lightstream.
A desire to stay innovative, modern, and operationally effective—three critical attributes in today’s competitive construction industry—led a large design-build construction company in the Midwest to explore the cloud. The company’s IT leadership team chose Microsoft Azure as their platform and purchased Prisma Cloud, a multi-cloud security offering from Palo Alto Networks, to provide added security protection for their cloud environments.
Once its Azure environment was implemented, the company began migrating applications. The team’s goal was to move as many applications as possible to the cloud, knowing some applications would have to remain on-premises, and their operating environment would result in a hybrid configuration.
After months of moving applications and deploying them into production, however, the company discovered problems. A security assessment revealed there were serious security gaps in the way Azure and Prisma Cloud had been implemented. If not addressed, the gaps would allow external entities to gain access to their environment, leaving the company’s systems vulnerable to breaches. This forced the company to stop its cloud migration and move applications back into its own data center.
With its cloud migration on hold, the company looked for a solution to solve its security problems and contacted Lightstream for help.
Once engaged, Lightstream Azure Cloud experts began gathering information. They reviewed the company’s business requirements, technology environment (infrastructure, data services, security landscape, application portfolio, and operations tools), and processes to gain a clear understanding of the company’s operating environment.
Next, the team evaluated the company’s existing Azure environment. They reviewed the company’s core cloud configurations, standards and governance, identity and access management (IAM), network interconnectivity, security, and monitoring, provided recommendations for changes to address issues, and then created an operational run-book with as-built documentation.
The next step was to review the Palo Alto Networks NGFW (next-generation firewall) configuration. The team reviewed the overall design of the appliances, assessed the Azure routing configurations, network placement, and connectivity, and recommended changes to remediate issues and ensure high availability.
The last step was to address the Palo Alto Networks Prisma Cloud implementation. The team evaluated the existing deployment, including policies and settings for resource configurations, user activities, network traffic, and host vulnerabilities, and made changes to resolve problems and ensure the environment operated correctly.
Remediation of Security Gaps and Reduced Business Risk
After completing the project with Lightstream, the company was able to eliminate its security gaps. External entities were no longer able to gain access to the company’s Azure environment through the known security vulnerabilities. This increased the confidence in the company’s cloud platform and lowered the risk of security breaches to the organization.
Secure Azure Environment with Next-Generation Firewalls
The company gained a secure Azure environment protected by Palo Alto Networks NGFWs in a high availability configuration. This enabled the company to resume migrating applications safely to the cloud and ensured its firewalls would be resilient.
Successful Prisma Cloud Implementation
With help from Lightstream experts, the company was able to overcome its initial problems and successfully implement Palo Alto Networks Prisma Cloud in its environment. This provided added security protection for the company’s cloud infrastructure and cloud-native applications.
Microsoft Azure and Palo Alto Networks NGFW design and implementation services from Lightstream help the company overcome edge security issues and deploy ERP in the cloud.
Dairy is a complex, regulated industry. Since the 1930s, the U.S. government has regulated milk prices. Minimum prices are set for fluid milk (based on several factors, including the price of butter, cheese, nonfat dry milk, and dry whey), and all processors must pay it. Different prices are set for milk used as an ingredient in dairy products, though the process is the same: the government sets the price, and processors pay it.
In addition, milk is a perishable product. As a result, the government sets strict standards on its use. Processors are unable to stockpile product to meet fluctuating consumer demand, which in recent years has been shifting to dairy alternatives like oat and soy milk.
These market realities put pressure on dairy processors. To address these challenges, a large dairy co-operative in the Pacific Northwest decided to expand its operations beyond its regional customer base with the goal of becoming a national brand. But to do that, the company first needed to modernize its systems by moving away from its on-premise legacy enterprise resource planning (ERP) system to Microsoft Dynamics 365 to establish a more flexible operating platform.
Midway through the project, however, the company ran into security problems. It turned out the company didn’t fully understand how to implement native cloud security controls available in Microsoft Azure and did not have proper edge security protection in place to satisfy governance and compliance regulations. After months of trying to correct the problem with the help of a 3rd -party firm, the company was unable to deploy its ERP solution and was faced with either seeking additional help or shutting down the project.
Prior to contacting Lightstream, the company had attempted to implement Palo Alto Networks NGFW (next-generation firewall) in Azure to provide edge security for its users. The company’s IT team was committed to the solution and its capabilities, but they had struggled with the implementation.
Once engaged, the Lightstream team reviewed the company’s requirements. They evaluated the existing Palo Alto NGFW configuration, executed an ingress and egress assessment, developed a security plan for implementing the company’s ERP system in the cloud using Azure native controls and Palo Alto NGFW as the edge inspection point, and architected the design to ensure high availability and resiliency. This was done by performing a customized Cloud Foundation Framework engagement.
After the design was completed, Lightstream built the Azure environment per the design blueprint, including VNets, network security groups, platform logging, and all native security controls. Then, the team implemented the Palo Alto NGFWs in a high availability configuration.
The final step was testing and validation. Lightstream’s Azure Cloud engineering experts helped test traffic flow, routing, and connectivity, as well as security functionality to ensure the solution provided the edge security protection the company needed.
Next-Generation Edge Security Protection
The company now has next-generation security to protect its systems. This includes IPS (intrusion prevention system) that examines network traffic to prevent vulnerability exploits, APT (advanced persistent threat) intelligence and detection, and other security capabilities that help keep data safe from cyber attacks.
Successful Migration to Microsoft Dynamics 365
With edge security in place, the company was able to move forward with its ERP project. Now, the company has replaced its legacy ERP solution with Microsoft Dynamics 365, providing the enhanced computing platform the company needs to expand its operation.
Industry: Trade Union
The United Brotherhood of Carpenters is one of North America’s largest building trade unions, with over a half-million members. The union leads the way in training, educating and representing the next generation of skilled construction professionals.
- Development of Cloud migration plan to Azure.
- Meet security and regulatory compliance requirements for migrating core legacy applications, including Personify running on Windows Server and SQL Server.
- Provide ongoing Azure optimization and management.
- Lightstream Cloud Foundation Framework Workshop and guided Foundation Build aligned with Cloud Adoption Framework (CAF).
- POC stand up, Security Planning and Design, Network Architecture and Design, App Validation, Automation and Implementation.
- Lightstream Cloud Managed Services for ongoing Azure management and optimization of financial, technical, security and operational aspects of environment.
- Successful workloads migration to Azure.
- Compliant governance and security posture for workload environment enabling UBC to safely deploy applications via Infrastructure-as-Code.
- Ongoing management and optimization including 65% cost savings through RI management and successful networking providing full direct interoperability between on-premise resources, Azure resources via ExpressRoute and AWS resources via Direct Connect.
With its scalable structure, pay-as-you-go pricing, and 99.95% SLAs, it’s no wonder Microsoft Azure is a long-time leader in the IaaS space. Its popularity is also due to the fact that it not only offers -Infrastructure as a Service (IaaS) but also Software as a Service (SaaS) and Platform as a Service (PaaS). With Azure, clients can use the services purely in the cloud or combine them with any existing applications, data center or infrastructure already in place. But with all of this flexibility and reliability comes responsibility. It is critical that IT professionals understand Azure’s shared responsibility model as well as which security tasks are handled by the cloud provider and which tasks are handled by you.
Here are -five common security mistakes that typically result from a rushed build/setup process and inadequate management, as well as tips on and how you can avoid them when designing, deploying, and managing your Azure cloud solution.
1. Misconfiguration of Roles & Administration
Misconfiguration is a common occurrence in situations where an Azure solution is implemented without proper planning.
One aspect of misconfiguration is the assignment of roles to users. It is recommended that you follow the principle of least privilege and select a role that provides the user only with the amount of permission they need to do their job. Failing to follow this best practice leads to excess access permission which can easily be avoided by taking the time to properly assign these roles at the outset.
The old adage that “too many cooks spoil the broth” applies to countless scenarios, and Azure is no exception. Assigning too many administrators, failing to establish lease permissions for those administrators, and not enabling Azure’s Multi-Factor Authentication (MFA) are risky oversites. MFA provides an extra layer of security by requiring administrators to provide authentication via phone call, text, or mobile app before they can log into the portal. This helps prevent the administrator’s account from being compromised or misused.
2. Weak, Mismanaged Passwords
This misstep may seem obvious, but regardless of how many times people are warned against setting weak passwords, far too many people still use them. According to Microsoft, they see over 10 million username/password pair attacks every day across their platforms. Failing to assign strong passwords and requiring them to be frequently updated creates vulnerabilities that are easily avoidable.
In setting up Azure services, Microsoft recommends the following to IT administrators:
- Maintain an 8-character minimum length requirement (and longer is not necessarily better).
- Eliminate character-composition requirements.
- Eliminate mandatory periodic password resets for user accounts.
- Ban common passwords, to keep the most vulnerable passwords out of your system.
- Educate your users not to re-use their password for non-work-related purposes.
- Enforce registration for multi-factor authentication.
- Enable risk based multi-factor authentication challenges.
3. Not Enabling or Managing Logging
Failing to turn on the logging feature is another common misstep in the building process. First, logging must be turned on to permit access visibility. But it doesn’t stop there. The Azure Activity Log must be regularly monitored to gain insight into who is accessing and managing your Azure subscription and to track all create, update, delete, and action activities performed. In addition, an investment in Sentinel – Azure’s cloud-native security information and event manager (SIEM) platform – can go a long way, as it uses built-in artificial intelligence to quickly analyze large volumes of data across an enterprise.
4. Misconfiguration of Security Controls
Haste and -lack of expertise in the configuration of your security tools can mean huge exposure risks for your organization. Failing to enable Azure’s security center and its highly valuable native security tools is a big no-go as it leaves your data open to breaches.
Network Security Groups (NSGs) are the foundation of all network security designs in Azure, and therefore should always be applied to safeguard subnets of a virtual machine-based web application deployment. In a typical design, there is a virtual network and subnets. The subnets should not be assigned to a public IP that could open unwanted ports. NSGs control access by permitting or denying network traffic via communication between different workloads on a vNET, network connectivity from on-site environment into Azure, or direct internet connection.
5. Lack of Oversight
IT administrators often view their Azure cloud solution as just a data center, but it’s essential to remember that this isn’t a case of “set it and forget it.” In fact, your job is far from over once the migration or build is complete; ongoing management and security are critical to the success of your Azure environment.
Proper management of your solution requires a multi-faceted approach. In addition to maintaining compliance with organizational and regulatory security requirements, you must continuously monitor the machines, networks, storage, data services, and applications to protect against potential security issues. Prioritize security alerts and incidents so you can zero in on the most critical threats first. Troubleshooting will be easier if you track changes and create alerts to proactively monitor critical components. Managing update schedules will ensure that your solution is equipped with the latest tools to support ongoing operations.
The bottom line is that your Azure solution is only as strong as the team supporting it. Therefore, IT professionals must do everything in their power to remediate security vulnerabilities before attackers have a chance to take advantage of them. If security and technical expertise and staffing have become obstacles to the effective implementation of your cloud strategy, turn to Lightstream’s Cloud Managed Services (CMS) for help overcoming these challenges.
Managed Services for Network and Cloud Simplify Billing, Improve Bandwidth Speed and Reduce Costs
Consumers have choices, especially when it comes to fast-casual dining. When people are considering restaurant options, they are looking for fast service, convenience and tasty food delivered with quality and excellence at an affordable price. And they won’t settle for less. Restaurant executives understand this. As a result, they continually strive to deliver high quality, innovative service to their customers, to stay ahead of the competition.
In today’s connected world, consumers increasingly browse menus online and place orders remotely. Restaurants need a high-performing voice and data network to accommodate these demands.
In 2015, Lightstream began working with an international fast casual restaurant chain to address several network challenges. At the time, the company had over 2,000 restaurants and was struggling with an expensive, complex telecommunications network. They were experiencing connectivity issues at the stores, and it was costing tens of thousands of dollars every month in wireless cost overruns.
When Lightstream first engaged, the team began with a thorough review of the company’s existing network infrastructure and service providers. Each store was configured with a primary connection for voice and data with a wireless 4G connection for backup, and the company used hundreds of different providers across the country.
At the restaurant level, the company’s network was designed for uninterrupted service. If the primary connection went down, service immediately switched over to the 4G network. The change happened seamlessly—users were oblivious to the failover, and service continued as usual. The network, however, was not monitored closely. The company often was unaware when a switchover occurred, and stores could operate on the 4G network for a long time, causing wireless costs to skyrocket.
Because the company had hundreds of different telecom providers, the finance organization was overwhelmed with invoices flowing in from across the organization from the various vendors. Consequently, sorting through invoices every month was time-consuming and inefficient, requiring painstaking research to ensure the billing was accurate.
To resolve these challenges, Lightstream consolidated the company’s entire telephony infrastructure, replacing them with lower cost, higher bandwidth connectivity options, and streamlined the number of providers. In addition, Lightstream added network monitoring and event management services, so that any network outages or anomalies and would be identified and resolved without any added burden on the company’s IT organization.
Since that initial engagement in 2015, the company has grown to 3,000 restaurants, and the organization’s infrastructure has evolved. Today, SD-WAN is deployed across the infrastructure, and the company has invested heavily in moving workloads to the cloud.
As the company has grown over the years and its needs have changed, Lightstream has expanded its relationship providing network monitoring, event management, telephony, field services (installation, cabling, and wiring) and cloud infrastructure optimization.
Reduced Costs / Increased Bandwidth
Working with Lightstream’s technical experts, the company consolidated its voice and data network, reducing the number of circuits and carriers and increasing bandwidth to the stores at the same time. This substantially simplified billing—reducing the number of monthly invoices from well over 100 down to one. All of this has generated millions of dollars in cost savings.
Reduced Connectivity Problems / Improved Service Availability
In 2015, the company was struggling with excessive wireless overage charges. Lightstream’s Network Managed Services for network monitoring and event management helped solve those problems, improving service availability and reducing wireless overage costs by a factor of ten. Network Managed Services includes proactive monitoring and carrier management, managed services through the support of our 24/7 network operations center, dedicated customer service managers and optional field services.
Cloud Infrastructure Optimization
The company has invested heavily in the cloud. Currently nearly half of its revenue comes through digital sales which depend on the cloud infrastructure.
In 2017, cloud costs accounted for about $150,000 annually. Today, due to the growth of digital sales, cloud costs have increased by a factor of more than 100. To keep costs in check and to optimize cloud investments, the company utilizes Lightstream’s Cloud Managed Services to help them gauge monthly trends and capture billing anomalies within their environment. This helps them avoid wasteful spending accounting for nearly one million dollars annually in savings. Cloud Managed services helps clients manage the day-to-day administration and management of their cloud infrastructures with a flexible mix of consulting, integration and managed services.
Digital sales are expected to grow as consumers are demanding more digital access than ever before. As a result, the company continues to invest heavily in cloud and rely on services from Lightstream to help optimize cloud infrastructure costs, while delivering better user experiences for their customers.
Cloud Foundation and Managed Services help architect an Azure environment to securely support a new line-of-business application
A regional bank in the Pacific Northwest was facing a challenge. The company had 200 locations and aggressive growth plans to triple its business in the next two years. To accomplish its objectives, and offer more modern customer experiences, the organization needed to make changes to its applications and infrastructure.
The company operated two data centers in an active-passive architecture. Maintaining the active-passive configuration meant every time hardware or software was installed at the primary location, a duplicate was installed at the backup site.
Operating two data centers in this way was expensive. The company found that it was buying 2-3 times the amount of capacity it really needed, leaving a lot of costly resources stranded and unused. For this reason, the bank wanted to move applications to the cloud and eventually eliminate the need for a second on-premise data center.
To begin, the company selected a customer-facing application to move to Microsoft Azure. The goal was to integrate the new 3rd-party SaaS application while purchasing no additional hardware, adhering to security and regulatory compliance, and improving business continuity.
But the company had no previous experience working with Azure or with managing cloud environments.
Seeking help with the move to Azure, the bank engaged Lightstream in 2019. To gather data about the company’s technical environment and to establish a baseline, Lightstream consultants performed a Cloud Foundation Workshop. The workshop helped the company better understand Azure and the basics of cloud operations and security.
When the workshop concluded, the Lightstream team worked with the company to design a secure architecture to support the SaaS application. The effort included writing custom integration code that enabled the SaaS provider to securely access line-of-business application data in Azure and creating re-factored SQL databases in Azure to support a SaaS solution. The design allowed the company to successfully move the application and created an architecture, process, and procedure for moving more applications into Azure without needing to re-write, re-architect, or re-engineer the environment for every subsequent application.
Cloud Architecture to Support Strategic Business Goals
Beginning with a Lightstream Cloud Foundation Workshop, the company was able to design and implement a secure cloud architecture. This enabled bank operations to support a new customer-facing line-of-business application while providing visibility for operational and security teams. And it established a baseline process for moving more applications to Azure as business needs arise.
In addition, the cloud architecture positions the company to move forward with its redesigned disaster recovery strategy. The company can now confidently move more applications to Azure and reduce the need for additional hardware at its backup data center.
Ongoing Cloud Management and Optimization
Having limited experience with cloud environments was a concern for the company. To address this, the company uses Lightstream Cloud Managed Services for ongoing Azure management and optimization of financial, technical, security, and operational aspects of the environment.
Access to Specialized Technical Experts When Needed
Cloud expertise and specialized skills can be difficult to find and expensive to hire. Engaging Lightstream has enabled the company to get the benefit of cloud experts without adding people to its staff.
Improved Cross-IT Communication
One unexpected benefit of working with Lightstream has been the impact on cross-IT communication. Like many organizations, the company’s IT group operated in vertical silos. This often was a challenge, because technical problems often crossed silo boundaries and required cross-group communication and collaboration to resolve them. But effective communication between groups was sometimes hard to achieve and caused delays in finding the root cause of issues.
Lightstream Cloud Managed Services, while focused on supporting the company’s Azure environment, has provided a consistent presence to help solve technical problems. With technical expertise in all aspects of IT, including networking, storage, server, and security, and visibility of the company’s entire network, Lightstream’s technical experts have provided valuable insight and helped bridge communications between different parts of the IT organization.
To learn more about how Lightstream Cloud Foundation Workshop or Cloud Managed Services can help your business create a secure cloud architecture, reduce costs, and improve user experience, visit www.lightstream.tech/solutions/managed-services/.
Cloud Foundation Framework helps the company meet FedRAMP requirements and secure a new government contract.
Winning a government contract is a big achievement. It takes months, and sometimes years, of diligence and hard work. New business in the public sector brings many benefits, but it also creates new requirements and responsibilities for the service provider.
For one SaaS company, securing a new government contract was contingent on the company’s ability to meet FedRAMP (Federal Risk and Authorization Management Program), a strict set of federally-mandated requirements for cloud products and services. At the time, the company operated 15 data centers around the world and had no public cloud footprint. Though the company’s application was cloud-ready, it was designed to run only in a private cloud environment.
The company needed an ecosystem to run its software that complied with FedRAMP. But to establish that ecosystem within its own data centers would take a long time to achieve and require a substantial investment.
To address this challenge, the company decided to use Microsoft Azure Government, Microsoft’s cloud service designed specifically for government agencies. But to meet the contract requirements, the IT team needed to architect and build the Azure environment quickly and ensure it met all FedRAMP specifications. As a result, they reached out to Lightstream for help.
The first step was to assess the company’s existing environment—infrastructure, security requirements, application dependencies, and processes—and design Azure to meet both the application needs and FedRAMP requirements. This was done by performing a Cloud Foundation Framework engagement.
Next, Lightstream cloud experts built the new environment. The Azure platform was implemented using a design blueprint, which was created during the framework engagement and defined all the technical specifications for the new environment. The work included defining the Azure architecture, implementing all infrastructure (IaaS) components, networking services, Azure SQL, security, and app services needed to make the platform operational.
The final step was validating the environment. Lightstream specialists helped the company execute a proof of concept (POC) project. The company’s application was deployed to Azure and tested to ensure it functioned properly and met all FedRAMP specifications.
Successful Migration to Azure Government
Through the Cloud Foundation Framework engagement, the company was able to successfully migrate all its production instances to Azure and meet FedRAMP regulations. This enabled the organization to deliver on the requirements specified in the contract, expanding the company’s presence in the public sector space and increasing its revenue.
CMMC and FedRAMP-compliant Platform
The company’s Azure environment met all FedRAMP requirements and CMMC (Cybersecurity Maturity Model Certification) compliance. This established a platform the company can use to pursue more public sector business opportunities in the future, especially those that require CMMC compliance.
Positioning for Future Cloud Migration
With its cloud strategy firmly set, the company is now positioned to migrate additional workloads and data storage from its existing data centers to the cloud. This will enable them to leverage the cloud’s scalability, flexibility, and operational advantages to lower data center costs over time, address skill-gap challenges, and remove facility-based barriers to growth.
To learn more about how Lightstream Managed Services can help you architect, implement, and manage a hybrid cloud environment that meets your business needs, visit www.lightstream.tech/solutions/managed-services/.