IT Security

Security at Every Layer of the Architecture

We treat security as a property of the architecture, not as configuration bolted on afterwards. The layers interlock, and if one fails, the next one holds.

Back to the IT Security overview

Network security in Azure

The layout decides: what cannot be reached does not have to be defended.

We lay out Azure environments as a hub-spoke topology: a central hub for connectivity and inspection, separate spokes for workloads, stages and tenants. Network security groups govern traffic between the subnets, while Azure Firewall filters everything passing through the hub, outbound connections included. Data services such as Storage, SQL or Key Vault are attached through private endpoints so they no longer expose a public interface. Azure DDoS Protection secures the remaining public entry points. Your sites are connected through ExpressRoute or site-to-site VPN, depending on bandwidth, latency requirements and the lines already in place.

Azure Firewall
Network Security Groups
Private Endpoints
Azure DDoS Protection
ExpressRoute

Protecting applications and APIs

The protection sits in front of the application, not inside it.

In front of your applications sits an Azure Application Gateway with a Web Application Firewall that checks requests against the OWASP Top 10 before they reach your code. Azure Front Door distributes traffic globally, terminates TLS at the edge and stops known attack patterns early. For interfaces we use Azure API Management: authentication, rate limiting and quotas live there instead of being scattered across individual services. Between internal services we enforce mTLS, so a compromised service cannot automatically talk to every other one. Which rules block and which only log at first is a decision we make with you based on real traffic data rather than on default profiles.

Azure Application Gateway
Web Application Firewall
Azure Front Door
Azure API Management

Identity as the perimeter

Standing full access is the most expensive shortcut in any Azure environment.

Zero Trust starts with identity: in a cloud environment it is the boundary that gets defended, no longer the network alone. Every access is verified, regardless of whether it originates inside your own network. Microsoft Entra ID is the central authority for users, services and applications. Conditional Access decides per request based on device, location, risk and sign-in method, while role-based access control limits what is possible afterwards. Privileged Identity Management grants administrative roles only for a limited time and only on request, so standing full access disappears. Applications and pipelines work with workload identities and managed identities, so no secrets sit in configurations or repositories.

Microsoft Entra ID
Conditional Access
Privileged Identity Management
Managed Identities

Attack scenarios and defence

Security architecture becomes concrete when you hold it against real attacks.

For every scenario we clarify three things: which path the attack takes, which control in Azure intercepts it, and what we configure to make that happen. The five patterns below cover the bulk of what environments in industry and mid-sized companies actually face. They are not a list to tick off, but the basis for deciding where effort belongs. Which of them your environment is missing is what the initial assessment shows.

Five attack patterns, each with its attack vector, the Azure control that catches it, what we configure, and the observable sign that this control is missing.
Scenario	Attack vector	Azure control that catches it	What DEVDEER configures	How you notice it is missing
DDoS	Volumetric load or targeted requests against public endpoints until gateway or application stop responding.	Azure DDoS Protection on the virtual network, Azure Front Door as the upstream edge, rate limiting in Azure API Management.	Protection plan on every public IP address, alerting on mitigation events, load tests against the agreed thresholds.	Your application turns sluggish or is intermittently unreachable, with no release or code defect that would explain it.
Credential stuffing	Automated sign-in attempts using credentials from third-party leaks against your login screens and APIs.	Microsoft Entra ID with Conditional Access, sign-in risk evaluation, multi-factor authentication and smart lockout.	Policies per user group and application, legacy authentication protocols switched off, sign-in logs analysed in Microsoft Sentinel.	The sign-in logs show waves of failed sign-ins across many accounts, and individual accounts get locked out although their users changed nothing.
Injection attacks	Manipulated input that gets executed in SQL queries, commands or templates and exposes data.	Web Application Firewall in the Azure Application Gateway with the OWASP rule set, parameterised data access, SAST and DAST in the CI/CD pipeline.	Rule set in log mode first, then blocking, every exception documented; scans as a mandatory step before each merge.	Database errors and aborted queries show up in the logs for inputs that could not have come from any of your forms.
Supply chain attacks	Compromised or tampered packages and build tools that reach production through your pipeline.	Dependency scanning in the CI/CD pipeline, signed artefacts, private registries, managed identities instead of secrets in pipelines.	Pinned versions, automated review of new dependencies, separated build and deployment permissions, findings tracked through DELTA.	A build pulls a package version nobody asked for, and nobody can say who approved it.
Ransomware	Encryption of data and backups after accounts have been taken over or system access has been exploited.	Microsoft Defender for Cloud, immutable backups in Azure Backup, network segmentation, Privileged Identity Management.	Separate backup targets with their own permission scope, regular restore tests, defined containment paths in the incident process.	Backups run through, but nobody can say when a restore was last actually tested.

Penetration tests and security assessments

A report only security people can read changes nothing.

A penetration test starts with the scope definition: which systems, which accounts, which time windows, and what is explicitly off limits. We then examine the environment from an attacker's perspective, from the outside and, where agreed, additionally with a regular user account. You receive a report with reproducible steps, a rating by severity and impact, and a concrete remediation proposal for each finding. For internal discussion it includes a short overview that reads without prior security knowledge. Once the findings are fixed, a retest checks only the reported items again and puts the status of every finding on record.

Detection and response

Detection needs one place that sees everything.

Microsoft Sentinel collects logs from Azure, Microsoft Entra ID, endpoints and applications in a single location. Microsoft Defender for Cloud assesses the configuration of your resources in parallel and reports deviations before they are exploited. For the alerts we define together what responds automatically and what wakes a person. In a real incident, an incident process with andon cord escalation takes over: anyone involved may stop the line, and escalation runs without a detour through meetings. Every incident is followed by a blameless post-mortem whose measures flow back into architecture and automation. Alongside that we train your teams with fire drills and phishing campaigns, so the processes hold when it counts.

Microsoft Sentinel
Microsoft Defender for Cloud

DEVDEER DELTA

DELTA examines your source code repositories and tracks every vulnerability it finds across cycles under a persistent identifier. That way you see not just today's state, but also what was fixed, what came back and which patterns a team produces repeatedly. The snapshot turns into a trend line that can carry decisions about effort and training.

Trend table

Trend table with demonstration data: six audits between 09.04. and 21.08., one returner and one fix report that the audit on 16.07. disproved.
Finding	09.04.	21.04.	19.05.	24.06.	16.07.	21.08.	Status
SEC-01Sign-in only checks whether the cookie exists	found in this audit	found in this audit	found in this audit	found in this audit	found in this audit	found in this audit	Open
SEC-07Missing CSRF check in the form handler	found in this audit	found in this audit	✓confirmed as fixed	no entry in this audit	no entry in this audit	no entry in this audit	Fixed
SEC-11Reflected XSS in the search parameter	found in this audit	not found in this audit	found in this audit	found in this audit	found in this audit	found in this audit	Returner
SEC-21Hard-coded credentials in the deploy script↳ Reported as fixed on 24.06. — disproved by the audit on 16.07.	no entry in this audit	found in this audit	found in this audit	found in this audit	found in this audit	found in this audit	Open

found — the finding was in this audit
not found — this audit did not see it, it may still be there
fixed — no longer traceable in the complete run
no entry — the finding was not yet recorded or already closed

Compliance as a Result of the Architecture

Security is the foundation, compliance the evidence. When access is granted by role, keys are managed centrally and changes are logged without gaps, that evidence emerges from day-to-day operations instead of from a special effort before the audit. We set up architecture and processes so that the requirements of NIS2, TISAX and ISO 27001 can be served from them. What an individual standard demands in detail is something we work out in the project.

Policy-as-code and audit trails in the CI/CD pipeline – for traceable security without extra effort.
Central monitoring with Azure Monitor and Log Analytics, extended with Microsoft Sentinel and Defender for Cloud on request – alerting and tracking of security events in one place.
Key management via Azure Key Vault – managed or customer-specific, but always verifiable.
Working with data protection officers from day 1 – not only at handover.

What is missing in your environment is what the assessment shows.

We look at the six layers in your subscription and tell you which ones hold and where the gaps sit.