Implementing encryption in transit

Another security concern that organizations have is the encryption of data as it moves from one location to another. The Azure platform implements a data link layer encryption method to encrypt all Azure data traffic within an Azure region or between Azure regions. This encryption uses the IEEE 802.1AE MAC Security (MACsec) standards and requires no action on our part.

However, we will also want to enforce transport-level encryption when data is moved outside network boundaries not controlled by Microsoft. Azure Storage has a Secure transfer required option that we can configure to accept requests only from secure connections that support encryption.

When this option is configured, the Blob service will only accept HTTPS requests and will reject HTTP requests. With the option configured, the Files service will also reject insecure connections made over SMB 2.1 and SMB 3.0 without encryption. Figure 10.8 shows this setting enabled for an existing...