Checklist for Sitecore Security Hardening using Azure PaaS

Question

I am Using Sitecore version 9 on Azure PaaS, Is there any official Sitecore security hardening guide for Azure PaaS ?, I can see some documentation as below link -

• https://doc.sitecore.com/sdnarchive/upload/sitecore7/75/sitecore_security_hardening_guide-sc75-usletter.pdf
• https://doc.sitecore.com/developers/90/platform-administration-and-architecture/en/securing-xp.html
• https://doc.sitecore.com/developers/91/sitecore-experience-management/en/securing-microsoft-azure-resources-for-a-sitecore-deployment.html

But not specific for Azure PaaS in detail.

Appreciate if someone provides some prior learning and experience

Answer 1

Sitecore 9+ PaaS deployments via ARM templates are in my opinion somewhat "secure by default" in that they use a mixture of client certificate authentication and decently strong passwords for all databases and secrets for communication between components. Also the SQL server only allows connections from Azure IP's making it somewhat harder to attack.

My personal list of additional security measures as mentioned on my blog is as follows:

• Limit access to your CM, Processing, Reporting environments using IP restrictions.
• Consider also changing the SQL server to only accept connections from whitelisted IP's. Note that you'll need to write a script to do that for you as it would be a very time consuming manual process.
• Limit access to Sitecore pages on CD servers. Either use URL Rewrite rules or deny anonymous access.
• Set good passwords on all CMS accounts — especially admin accounts.
• Set good passwords on all SQL user accounts. (As mentioned this is done by default on ARM deployments)
• Enable HTTPS only connections (e.g. via a URL rewrite rule).
• Set the Secure flag on all cookies.