First, having a concern of cloud security is somewhat misconception today, especially to Azure which is in top 2 in cloud market. The concern would be: "Do Azure offer enough security feature to meet my security compliance and requirement?" And we can have a look into the list of features.
There are two options to establish a hybrid connection between your on-premises network and Azure virtual network:
- Azure VPN Gateway
- ExpressRoute
Azure VPN Gateway offers two types: Point-to-site (P2S) and Site-to-Site. Different types are used for different scenarios. While P2S lets you create a secure connection to Azure virtual network from an individual client computer (e.g. from on-premises database server to Azure Web App), S2S is more advanced and used for cross-premises and complex hybrid connection. P2S only requires a VPN gateway setup and a certificate to import to the on-premises client computer. S2S requires VPN device located in on-premises network that has public IP address assigned to it.
When it comes to protocol supported, both VPN types support industry-standard security protocol. PS2 support IKEv2 or SSTP and S2S supports IPsec & IKE. To make it clear, Microsoft also provides cryptographic requirement for Azure VPN gateway (https://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-about-compliance-crypto). There shouldn't be a concern when using Azure VPN. The concern would be which option (cryptographic algorithm and key strength) you use to strengthen the VPN connection. In terms of routing, S2S supports Routed Base policy to allow you to control traffic flow.
You should talk to your IT and network team, asking them about specific requirement for VPN connection, such as designated protocol, crypto requirement.
ExpressRoute is another option but this is not really designed for only security purpose. Azure ExpressRoute gives you a private connection from your on-premises directly to Microsoft datacenter via a connectivity provider. That said, connection doesn't go over the public Internet. There are number of different benefits:
- Since it is private, it gives a reliability and security. No one anonymously can capture your network packet (except the provider).
- Bandwidth is supported up to 10 Gbps.
- Redundancy. Each ExpressRoute circuit consists of two connections to two Microsoft Enterprise edge routers from the connectivity provider.
ExpressRoute is not available everywhere. Have a look here https://docs.microsoft.com/en-us/azure/expressroute/expressroute-locations
If you want to explain to your IT and network team about ExpressRoute, below are some good references:
For Azure App Service, you have three options today (as of this answer):
- Hybrid connection: it allows your web app to access on-premises systems over Azure Service Bus Relay. The connection uses TLS1.2 and shared access signature. Make sure the certificate is as expected strong as possible.
- VNET integration: allows your web app to access to on-premises system over Point-to-site VPN. Site-to-Site is not supported.
- Dedicated virtual network: this option allows you to create an Azure virtual network for your web application. The Azure App Service plan must be Isolated. With an isolated virtual network, you can establish VPN to your on-premises network.
Are there good use cases to demonstrate that even if security of the
Web or Mobile application is compromised then our on premise resources
are still protected by Azure VPN?
It depends on the compromising level and how you organize identity access. If only web or mobile admin's password is compromised, chances are the web is only defaced. Your virtual network is still not compromised. The only case when your network is compromised in the hybrid environment is when your Azure global administrator account is compromised and your pre-shared key of VPN is compromised. When being compromised, your on-premises network would be accessible to an unauthorized user and he could start penetrating your network.
Also, consider two things when implementing a network security architecture in hybrid scenario:
- Use Forced Tunneling: Azure allows you to force all Internet-bound traffic back to your on-premises via S2S VPN tunnel. This can be helpful if your environment already has Intrusion Detection System or Intrusion Protection System to inspect network. This option is only available when you use Isolated plan because Forced Tunneling works again subnet.
- Use User-defined Routing (UDR): UDR allows you to control system routing by overwriting the route by your custom one. For example, saying the network before going out needs to be routed to a defense system (virtual appliance such as Barracuda, F5, other next-gen firwall...). UDR also works again virtual network and subnet. Hence, to use it, the App Service Plan must be Isolated.
There are more things to talk about practical network security design in Azure, including strategy and tactic. However, you only have concern about VPN to your on-premises, and the stack you use is PaaS-based so I just focus on VPN and sort of network for Web App.
If your IT and network team brings out specific security concern more than general thought, do bring here and I'd be happy to discuss.
