A.8.20 Networks Security
Control Objective
Networks and network devices shall be secured, managed and controlled to protect information in systems and applications.
Policy Statement
anDREa enforces absolute logical segregation and perimeter defense across its cloud-native networks. Because anDREa operates without a traditional physical location or internal hardware network, the scope of network security focuses entirely on our Infrastructure-as-a-Code (IaC) deployment models within Microsoft Azure, strict ingress/egress boundaries, and automated configuration monitoring.
1. Core Core Cloud Network Architecture (myDRE Standard Services)
The myDRE platform utilizes a structured, multi-tenant virtual cloud topology engineered for complete isolation:
- Logical Isolation: Each myDRE Workspace operates within one or more dedicated Azure Virtual Networks ($Vnets$), bound to isolated IP address spaces.
- Azure Service Endpoints: All deployed platform resources (Virtual Machines, Web Apps, and Storage Accounts) are bound to Azure Service Endpoints, ensuring traffic remains entirely within the Microsoft backbone fabric and away from the public internet.
- Network Security Groups (NSGs): Every Workspace is mapped to a dedicated Azure subnet regulated by an automated NSG. anDREa’s deployment code natively instantiates these NSGs with a hardened baseline of traffic filtering rules. Granular NSGs are additionally applied directly at the individual Virtual Machine (VM) network interface level.
- Virtual Machine Access Routing: * Default (Azure Bastion): Windows and Linux VMs are natively accessed via Azure Bastion, using encrypted browser-based sessions.
- Direct Windows Access (RDP): Windows VMs can optionally be accessed via standard Remote Desktop Protocol (RDP) over port 3389 only if a Public IP is explicitly assigned to that VM and permitted by the tenant allowlist.
- Linux Access Bounds: Direct public SSH access from the internet to Linux VMs is blocked. Linux environments must be accessed via Azure Bastion or by utilizing an authorized Windows VM inside the same workspace subnet as a secure stepping stone.
2. Optional Architecture Enhancements
To accommodate specific customer enterprise security constraints, anDREa provides modular network expansions:
- Port 3389 Abstraction: For client organizations that block outbound port 3389, anDREa deploys an optional Azure Bastion tier, tunneling RDP sessions securely over standard HTTPS/HTML (Port 443).
- Controlled External Connectivity: By default, myDRE Workspaces operate in an air-gapped state with no public internet access. Organizations can optionally activate a forward-proxy architecture to enable granular Domain Allowlisting alongside basic IP restrictions.
3. Continuous Security Monitoring & Threat Detection
All active network elements, subnets, and host nodes are constantly supervised by the integrated Microsoft Defender for Cloud suite, which executes:
- Real-time automated threat detection across all network interfaces, fabric elements, and virtual nodes.
- Adaptive application and network traffic controls to dynamically block evolving vectors.
- Continuous configuration compliance assessments against regulatory architectures (ISO 27001 / NIS 2).
- High-priority alerting for critical network vulnerabilities requiring immediate containment.
4. Network Asset Inventory & Lifecycle Governance
To prevent misconfiguration vulnerabilities, all virtual network infrastructure components are managed as strict inventory assets under Infrastructure-as-Code (IaC) controls:
- Automated Asset Auditing: Critical network assets—including Virtual Networks, Subnets, NSGs, Application Gateways, and Azure Firewalls—are automatically discovered and cataloged inside the Tenant Configurations or the Asset Overview. Every item is assigned an explicit, accountable Asset Owner.
- Configuration Drift Mitigation: Secure network configurations are permanently codified within our DevOps repositories. Any manual modification or system alteration that deviates from this code baseline is automatically flagged as "configuration drift" and escalated as a high-priority security incident.
- Controlled Network Mutations: All modifications to firewalls, routing tables, or NSG rule sets must be processed through the formal A.08.32 - Change management framework. Changes must be pushed via IaC pipelines to ensure a clear audit trail and rapid rollback capability.
Exception Rule: If an emergency forces an ad-hoc manual configuration change, the modification must be documented immediately in an internal ticket, logged manually under Tenant Configurations, and subjected to rapid review.
- Biannual Maintenance Reviews: The absolute necessity, security posture, and access lists for all established network rules are re-evaluated and signed off bi-annually by the Asset Owner within the Periodic Controls Security tracking system.
5. Corporate Endpoint Connectivity & Device Controls
While anDREa has no central office network, remote employee connection points are secured at the device layer:
- Technical access controls, Wi-Fi encryption mandates, and secure corporate VPN configurations are governed under A.06.07 - Remote working.
- The Security Team maintains absolute authority over corporate assets; all
@andrea-cloud.commanaged devices can be instantaneously located or wiped via the centralized Google Workspace Device Manager. - Initial device authorization and secure provisioning follow the strict protocols defined in Enrolling a Device (anDREa Employees).