The cloud has given all businesses the capability to easily spin up new technology and services, removing the need for upfront investment in physical kit. But as easy as something can be spun up in the cloud, it can easily be torn down.
What does it take to delete your Microsoft Cloud?
Deleting your cloud is not a click of a button, but it only takes a couple. The process of deleting is as easy as selecting all of the cloud resources and hitting the delete button. Microsoft will delete those resources and they will then become unrecoverable unless you have a special type of backup (more on that later).
It’s as easy as that, but there are a few prerequisites that need to be highlighted. First, you need to have a delete permission in the Microsoft cloud. Generally, there is a type of account that has this permission by default for everything - a “Super Administrator”, and in the Microsoft world this is known as – the “Global Administrator”. The Global Administrator is the most powerful account in the Microsoft Cloud environment. It is the most destructive type of account one person could have to your environment and requires the most level of control.
Any other privileged account with the deletion permission, combined with the scope of your entire Microsoft Cloud environment is potentially as destructive as the Global Administrator.
How is this different from the days of old?
The reality is that it's not different at all from the days before the cloud. Typically, before the cloud, all your servers would have been virtual, with many servers running on one physical server. It’s the same scenario that someone, who had access to your virtual servers running in a data centre, could just have easily clicked "Select All > Delete".
The risk has changed somewhat though. Typically, access to your virtual server management in the data centre days was not internet-facing. By default, the cloud management console is.
How do you reduce risk and prevent your cloud from being deleted?
Just like IT did in the historical data centre days, prevention is about reducing the access that any one person can have, and layering controls, under the assumption that any one control can fail.
For the Microsoft Cloud, we start with the Global Administrator, the “Super Administrator”. This role, whilst giving full access to the Microsoft Cloud environment, is not needed for the day-to-day administration of cloud environments.
We also have the delete permission to contend with. The delete permission is typically granted to many other non-Global Administrator roles and can be applied in many different ways across the Microsoft Cloud.
So, what should be the 4 steps to grant this level of permission? These should be;
- Documented justification should be required for its use
- Approval should be required
- Access should be fixed for a limited time and then removed after this period
- Any work carried out should be recorded and associated with a named individual
The steps above help to govern and provide a level of assurance around destructive permissions in the Microsoft Cloud environment, but there are some other steps we can follow.
Layering Protections
Layering different approaches means you’re not relying on just one facet of protection. An additional element to protect the deletion of your Microsoft Cloud environment is the use of backups. Backups are your last line of defence in a scenario where someone has either maliciously or accidentally deleted your cloud resources.
But, can a Global Administrator or someone with delete permissions on backups just delete the backups? That is true, and it is why we have a feature called immutability. Immutability stores the backups in a way that not even a Global Administrator could delete the backups.
Can’t we just block any delete or a Global Administrator?
Yes, you can technically do this, but there are always exceptions and valid scenarios when IT needs this level of access such as:
- A server needs to be decommissioned
- Service limits need to be increased
- Some new services need to be provisioned
In summary, whilst the risk remains largely the same as the data centre days, the cloud does provide some more unique challenges. These can be overcome with good processes, solid controls and a layered approach. Your IT managed service provider should be continually managing its own usage of these privileged accounts to ensure that your risk exposure to a mass delete of your environment remains low.
