3

I am Using Sitecore version 9 on Azure PaaS, Is there any official Sitecore security hardening guide for Azure PaaS ?, I can see some documentation as below link -

But not specific for Azure PaaS in detail.

Appreciate if someone provides some prior learning and experience

1

Sitecore 9+ PaaS deployments via ARM templates are in my opinion somewhat "secure by default" in that they use a mixture of client certificate authentication and decently strong passwords for all databases and secrets for communication between components. Also the SQL server only allows connections from Azure IP's making it somewhat harder to attack.

My personal list of additional security measures as mentioned on my blog is as follows:

  • Limit access to your CM, Processing, Reporting environments using IP restrictions.
  • Consider also changing the SQL server to only accept connections from whitelisted IP's. Note that you'll need to write a script to do that for you as it would be a very time consuming manual process.
  • Limit access to Sitecore pages on CD servers. Either use URL Rewrite rules or deny anonymous access.
  • Set good passwords on all CMS accounts — especially admin accounts.
  • Set good passwords on all SQL user accounts. (As mentioned this is done by default on ARM deployments)
  • Enable HTTPS only connections (e.g. via a URL rewrite rule).
  • Set the Secure flag on all cookies.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.