Fortifying Your Cloud: Mastering Azure Networking Services to Protect Your Applications.

This session will provide an in-depth exploration of Azure network security services designed for secure application delivery. Participants will review various networking application delivery services and examine their features and limitations.

Additionally, the session will guide attendees through the appropriate security layer for hosting applications within the Azure cloud. Attendees can also look forward to a hands-on demonstration featuring Azure Front Door and other relevant services.

Enhancing Security in Containerised Applications using Azure Application Gateway for Containers

Azure Application Gateway for Containers

Innovative Use cases of Azure Virtual Network Manager in Landing Zones.

This session will comprehensively explore the Azure Virtual Network Manager (AVNM) service, analysing its features and capabilities in detail. Participants will discover how AVNM integrates seamlessly with Azure Landing Zones, enhancing network and security policy management and streamlining operational efficiency.

This session will comprehensively explore the Azure Virtual Network Manager (AVNM) service, analysing its features and capabilities in detail. Participants will discover how AVNM integrates seamlessly with Azure Landing Zones, enhancing network management and streamlining operational efficiency.
This exploration will highlight best practices and use cases with the pivotal role AVNM plays in modern cloud infrastructure.
Any prerequisites for attendees: Knowledge of Azure Cloud networking.

Securing the Modern cloud native workload using Defender for Cloud for container protection.

This session will delve into the security features of Microsoft Defender for Cloud, tailored for container workloads.

We will explore best practices for securing container environments, including vulnerability assessments, threat detection, runtime protection, and compliance management. Attendees will learn how Defender for Cloud enhances visibility into container workloads, enabling proactive monitoring and automated responses to potential threats. By the end of this discussion, participants will have practical insights and strategies to implement comprehensive security measures that safeguard their containerised applications, ensuring operational integrity and resilience against evolving cyber threats.

Zero Trust Network Architecture in Azure: From Perimeter Security to Identity-Centric Protection"

The castle-and-moat model of network security no longer holds up in a world of remote work, SaaS sprawl, and multi-cloud infrastructure. This session reframes network security around the Zero Trust principle of "never trust, always verify," and shows attendees exactly how to implement it in Azure.

We'll start with the architectural building blocks — Network Security Groups, Application Security Groups, and Azure Firewall Policies — and show how to use them for true micro-segmentation rather than broad, permissive rules. From there, we'll layer in identity signals from Azure AD Conditional Access, showing how network access decisions can become dynamic and context-aware rather than static. We'll also cover Just-in-Time VM access through Microsoft Defender for Cloud, eliminating standing access as an attack vector.

The session closes with a demo.

DDoS Protection & Resilience Planning in Azure

DDoS protection is often treated as a checkbox — "enable it and move on" — but building genuine resilience requires understanding attack types, detection thresholds, and how DDoS protection interacts with the rest of your architecture. This session provides that deeper understanding.

We'll start by comparing Azure DDoS Protection Basic (enabled by default, always-on) against the Standard tier, covering exactly what additional capabilities Standard provides — adaptive tuning, attack analytics, telemetry, and the cost protection guarantee that reimburses scale-out costs incurred during a documented attack. We'll break down the three main attack categories — volumetric, protocol, and resource-layer (application) attacks — and clarify why DDoS Protection Standard addresses the first two but must be paired with a Web Application Firewall to address the third.

From there, we move into resilience architecture: how to design applications with autoscaling, traffic distribution across regions, and Azure Front Door or Application Gateway in front of backend resources to absorb and filter malicious traffic before it reaches application infrastructure. We'll also cover attack response — what telemetry and alerts look like during an active attack, and how to build a DDoS response runbook so the team isn't improvising under pressure.

Identity-Driven Security: Integrating Azure AD Conditional Access with Network Controls

We'll begin with a review of Conditional Access policy fundamentals: the signals available (device compliance, sign-in risk, location, application context) and how they combine into policy decisions. The core of the session focuses on integrating these identity signals with network-layer boundaries — using Named Locations to align Conditional Access decisions with your network topology, and understanding how this integration changes the security calculus compared to network controls alone.

We'll also cover Continuous Access Evaluation (CAE), which allows access to be revoked in near real-time when risk conditions change — a critical capability for reducing the window of exposure after a credential compromise. The session concludes with a live demo showing an adaptive access policy in action: blocking a risky sign-in attempt based on the combination of identity risk score and network context.

Securing Azure Kubernetes Service (AKS): Network Policies, Private Clusters & Pod Security

AKS security is often treated as an extension of general Azure network security. Still, Kubernetes networking has its own model, its own failure modes, and its own set of tools — and getting it wrong can undermine every other security control in the environment.
This advanced session is built for platform and security engineers who need a comprehensive understanding of securing AKS networking.

We'll start by comparing AKS networking models — kubenet, Azure CNI, and CNI Overlay — and the security and scalability trade-offs of each.
From there, we dive into Kubernetes Network Policies, comparing Azure's native Network Policy Manager with Calico, and showing how to enforce pod-to-pod and namespace-level segmentation that mirrors the micro-segmentation principles used at the VNet layer.

We'll cover private AKS cluster architecture in depth, including how API server access works when the control plane has no public endpoint, and the DNS considerations that come with it. The session also addresses identity: comparing Workload Identity (the modern, recommended approach) against legacy pod-managed identities, and why this choice matters for both security and operational simplicity.
A demo session with cluster security settings.

Network Segmentation & Micro-Segmentation Strategies for Multi-Tier Applications

ne of the most consistent findings in cloud breach post-mortems is the same root cause: a compromised resource had far more network access than it needed. This session addresses that gap directly, focused on practical, implementable segmentation strategies for multi-tier applications.

We start with the "why" — explaining the blast radius concept and how flat networks amplify the impact of a single compromised resource. From there, we build up segmentation patterns layer by layer: using Network Security Groups for baseline traffic control, Application Security Groups for logical grouping that scales better than IP-based rules, and Azure Firewall Policies for centralized, auditable cross-segment traffic control.

Using a representative 3-tier application (web, application, and data layers), we'll design and implement segmentation live — isolating each tier so that a compromise in the web layer cannot directly reach the data layer. We'll test the enforcement in real time, showing blocked and allowed traffic paths. Attendees leave with a segmentation design checklist applicable to their own application architectures, regardless of specific tech stack.

Microsoft Defender for Cloud: Building a Cloud Security Posture Management (CSPM) Strategy

Many organisations treat cloud security posture as a periodic audit exercise — a spreadsheet reviewed once a quarter. This session makes the case for continuous posture management and shows exactly how to build it using Microsoft Defender for Cloud.

We'll start by demystifying Secure Score: how it's calculated, why not all recommendations carry equal weight, and how to build a prioritised remediation roadmap instead of chasing every finding indiscriminately. From there, we'll explore the regulatory compliance dashboards, showing how Defender for Cloud maps controls to frameworks like ISO 27001, PCI-DSS, and NIST — a significant time-saver for compliance-driven organisations.

The session then moves into the Defender CSPM plan specifically, covering agentless scanning, attack path analysis, and how these capabilities help security teams understand not just "what's misconfigured" but "what's actually exploitable" given the broader environment. We close with a practical discussion on shifting posture management left — integrating policy checks into CI/CD pipelines so misconfigurations are caught before deployment rather than after.

Private Link & Private Endpoints: Eliminating Public Exposure for PaaS Services

It's a familiar story: a misconfigured storage account or database left with a public endpoint becomes the entry point for a breach. Private Link and Private Endpoints solve this problem by bringing PaaS services directly into your virtual network — but getting DNS resolution right is where most implementations go wrong.

This session walks through the full architecture of Private Endpoints, including how they attach as NICs within a subnet and how traffic is routed privately without ever touching the public internet. The core of the session is dedicated to Private DNS Zone design — how resolution works in single-VNet scenarios, how it changes in hub-spoke topologies, and how to extend private resolution to on-premises networks via conditional forwarders. We'll also address more advanced scenarios: cross-subscription and cross-tenant Private Link connections, and how to handle Private Endpoints in multi-tenant SaaS architectures.

The session includes a live demo locking down an Azure SQL Database and Storage Account — removing public network access entirely and validating connectivity end-to-end. Attendees will leave with a repeatable pattern for auditing and remediating public PaaS exposure across their subscriptions.

Azure Bastion & PIM: Eliminating Standing Privileged Access to Cloud Resources

Two of the most persistent findings in cloud security assessments are public management ports (RDP/SSH exposed to the internet) and standing administrative access (accounts that are always "admin," whether they need to be or not). This session tackles both problems together, since they're frequently two sides of the same risk.

We'll start with Azure Bastion: how it provides browser-based, SSL-secured RDP/SSH access to VMs without ever assigning a public IP to the VM itself, and how it fits into a broader network architecture (including cost and scaling considerations for large environments — Bastion SKUs, session limits, and native client support). From there, we shift to identity: Privileged Identity Management (PIM), and how it transforms admin access from an always-on standing privilege into a just-in-time, time-bound, and optionally approval-gated activation.

We'll walk through configuring PIM for both Azure AD roles and Azure resource roles, setting up approval workflows, and configuring access reviews to catch privilege creep over time.
The session closes with a live demo combining both controls — an administrator activating PIM for a limited window and connecting to a VM via Bastion, with no public IP and no standing access involved at any point.

Governance at Scale: Enforcing Network Security Baselines with Azure Policy & Landing Zones

As organisations grow beyond a handful of subscriptions, manually reviewing every deployment for security compliance becomes impossible — and relying on after-the-fact audits means misconfigurations are often live in production before anyone notices. This session makes the case for "guardrails, not gates": governance that's built into the platform itself rather than bolted on afterward.

We'll start with Azure Policy fundamentals — policy definitions, initiatives, and effects (Deny, Audit, DeployIfNotExists, Modify) — and how each effect type is appropriate for different governance scenarios. From there, we move into practical network security baselines: policies that deny public IP creation on VMs, enforce mandatory NSG association on subnets, require specific Azure Firewall routing, and mandate encryption in transit.

The session then zooms out to the Cloud Adoption Framework Landing Zone model, showing how these individual policies are assembled into a coherent governance architecture applied automatically at subscription vending time — so every new subscription inherits the right guardrails from day one, rather than security being retrofitted later. We'll cover management group hierarchy design, policy assignment scope, and handling policy exemptions for legitimate edge cases without undermining the overall baseline.

Unlocking Security: Embracing Zero Trust with Azure Firewall for Robust Defense in Depth!

This session will highlight the latest enhancements and capabilities designed to strengthen security posture and provide greater visibility into the Azure cloud network environment.

Abstract:
Highlights include the following
- Introduction
- Customer Controlled Updates
- Azure firewall features
- Azure Firewall diff SKUs
- Azure Monitor: Basic Plan
- Ingestion Time Transformation
- Security Copilot in Embedded Experience
- Private IP DNAT
- Demo.

This session will highlight the latest enhancements and capabilities designed to strengthen security posture and provide greater visibility into the Azure cloud network environment. Whether you're new to Azure Firewall or looking to stay current, this session will equip you with the insights needed to protect your cloud workloads effectively and aligned with Zero Trust. Learn how to strengthen your network posture with real-time threat detection, granular access controls, and intelligent traffic filtering.