Azure network and infrastructure review
We look at how traffic moves around your Azure network, where the boundaries between workloads sit and whether the controls in place would stop unauthorised access and lateral movement between systems.
Network segmentation and microsegmentation
This part of the review covers your virtual network topology and subnet design along with your Network Security Group (NSG) rules and Application Security Groups (ASGs). Where the network is flat and traffic can move freely between workloads that should be kept apart, we set out a segmentation plan that limits how far an attacker could get after a breach.
DDoS protection and WAF
We check which DDoS Protection tier you're on and how the Web Application Firewall (WAF) is configured on your Application Gateway and Front Door profiles. Internet-facing and NHS-facing services need this layer, yet it's often missing altogether or left in detection-only mode, where it logs attacks without blocking them.
Private Endpoint coverage
We list PaaS services such as storage accounts, databases and Key Vaults that can still be reached through a public endpoint even though Private Link is available for them. With Private Endpoints in place, traffic between your virtual network and those services stays on the Microsoft backbone and never crosses the public internet.
Other Azure reviews
- Security & compliance
- Identity & access
- Endpoint & VM security
- Architecture & operations
- Cost optimisation
Also on AWS? See our AWS network and infrastructure review.