Thank you folks for joining us today
Hope you are having a wonderful day where you are. We have a packed agenda for you today
so let's get started. In the next hour, we want to cover the key core components
of the Azure security model and see how we do categorize the layer of security
that Microsoft provided in the Azure platform and the tools around there that can help you
protect your resources in Azure. So you can center the security posture for your business
That's the center of gravity for today's talk. In one hour, this is a very broad topic for security, right
And as you know, there are multiple layers to security. So without further ado, let's get started
and talk about the security landscape. Microsoft's focus on security does not go unnoticed
So media covers Microsoft initiatives everywhere. As you know, threats have become more sophisticated
from a single access to organize destructive attacks by crime, syndicates, and nation states seeking financial gain
or political objectives. So Microsoft stands for trust and more than ever
Microsoft is making investments to keep us all secure and Microsoft is committed to delivering cloud-based services
that deliver best-in-class security, privacy, and reliability. So I have often get asked how Microsoft can prove
that it's truly committed to security. So the best answer that I can tell you
is Microsoft run their business in the same multi-tenant cloud services as they run our businesses
So if Microsoft is not focused on security and privacy in the cloud
then they are threatening the future of the company, right? So I have a guest question for you, Paul question
If you can guess how many targeted cyber attacks does the average organization faces each year
Could you please answer that, Paul question, to see if you can guess how many targeted cyber attacks
does the average organization faces each year? We'll give a couple of seconds to Tanvi to answer that question
before we show the results. So I hope everyone answered that question
So let's see the results. So we have around... The last question is actually 106
So we have around 31% of attack and these are the answers to the question, right
So exactly 106 cyber attacks that the average organization faces each year
I think 14 years ago, Bill Gates recognized this would be a challenge for the industry
when he declared that machine computing and trustworthiness were the top priority
Since then, Microsoft has made incredible strides but this work is not done yet
So cybersecurity, as you know, is in the news everywhere. And in today's cloud-first, mobile-first world
it's clear that increasing trust and managing security is critical Increasing trust and managing security
is something many organizations and individuals deeply struggle with. As you can see in the slide
we have around 15 million in the average annual amount companies pay as a result of cybercrime
And over 1 million new pieces of malware are created each year
As a matter of fact, there are malware as a service and ransomware as a service authors
host the ransomware code on a portal where affiliates can easily deploy it from a dashboard
Yes, and also 140 plus days between infiltration and detection on average
So as a result of that, the cost to global markets are staggering
So over 3 trillion in productivity and market growth destroyed last year
due to security breaches alone. So the trust lost by individuals, customers, employees, and citizens
cuts much deeper and even more challenging to restore. This is really painful
So the technology is the plane in which these attacks have occurred
while at the same time, it is the plane in which they can be fought
So when I hear of a major attack and talk to companies where it could be customers
competitors, partner or service provider, I have to ask two questions. What can we collect to learn
And how can we help? The question for Microsoft is how can we help
That's what today is about. So as you can see on this slide
the insights have caused us to re-evaluate our security posture. Most organizations have an approach
that looks at how to protect, detect, and respond. This model actually hasn't changed in the last 20 years
However, the basics still matter. But what I think at Microsoft is how they do them
If you look at the protect side, so if you look at the protect side
they look at how to appropriately secure identity, data, application, devices, and infrastructure
whether it be in the cloud or on-premises. This requires an approach to security
that considers all your endpoints from sensor to data center. If we look at the detect side
in the past they used to rely on malware signatures to recognize
They used to need intelligence. However, we have a base approach to threat detection
that can rapidly recognize entirely new threats. They need to be able to use those insights
to immediately act on them. On the response side, many of us have invested in protecting against threat
but I would argue that Microsoft is collectively under-invested in responding to them
So doing this will mean assuming breach at any point and continue operating with this readiness mentality
As a former director of FBI, James Comey said, there are two kinds of big companies
those who have been hacked and those who don't know they have been hacked
So we have to assume breach, but today, of course, we live in the post-breach world
So let's see how Microsoft, by going to cloud, can resolve a lot of these..
So going to cloud can resolve a lot of... Okay. Can resolve a lot of these issues
and can address a lot of these concerns. Cloud providers have best resources and investment
to manage global data centers, attract security talent and global security experts
to provide compliance for those data and infrastructure and that compliance can then be inherited
by the clients who use that cloud. So with those security experts
and with the global geographical scale, so with those security experts
and with the global geographical scale, Microsoft is able to respond and detect new and emerging threats quickly
and help you protect more resources against those threats. So that would be a big point
of why people are going to cloud and security is now becoming a benefit
of adopting the cloud. However, it is important to know that just because you are in the cloud
doesn't mean you don't have responsibilities to secure your resources. So how does Microsoft think of this responsibility
And this slide actually shows you the way Microsoft is constructing these three components
of security as we think of protecting cloud resources. Number one, this is something a cloud provider
should give you, and this is what Microsoft invests in, is a secure foundation
The secure foundation that lets you build your apps, data, resources, and your business in a secure way
That foundation is managed by Microsoft and because it is managed by Microsoft globally for Azure
you are able to reduce cost and complexity. Then the second component of it
as you build your apps and resources and put your workload in Azure
Microsoft provides you with built-in tools, built-in controls, but configuring that security
and configuring those controls is your responsibility. So this is the cloud responsibility model
With a secure foundation, the infrastructure security is managed by Microsoft. That can help protect your resources
but then those controls that Microsoft provides, that is your responsibility to manage and configure
And lastly, the important part of this is unique intelligence. Whatever Microsoft do
are able to process trillions of signals across various services like Office 365
Azure, Windows, and all of that. Microsoft synthesizes all those signals and gives you actionable insights
Those insights are integrated into products and services and how does that help you
Because then when those insights, you are able to move ahead of these emerging threats
you are able to detect these threats early and with Microsoft tools
are able to respond to threats as quickly as possible. So that's the shared responsibility model
So let's dive now into these tools and see how can we leverage that secure platform
Azure includes a robust networking infrastructure to support your application and service connectivity requirements
Network connectivity is possible between resources located in Azure, between on-premises and Azure host resources
and to and from the internet and Azure. In this section, we will focus on the security
from a network perspective and describe how you can use Azure network capabilities
to build highly secure cloud services. We all learn that everything begins at the bottom
with the physical layer. Likewise, when it comes to IT security, physical security is the foundation
for our overall strategy. Data centers managed by Microsoft have extensive layers of protection
access approval, and the facility perimeter and the building perimeter inside the building
and on the data center floor. This layer approach reduce the risk of authorized users
gaining physical access to data and data center resources. Both data centers are built above the ground
Here you have seen the news about the upcoming data center evolution under the sea
A self-sustaining underwater data center, a new project called Matic that Microsoft is actively working on
reaches phase two last week. So I encourage you to check the link shared on the slide
to learn more about the project. Matic is a very exciting project
So Azure itself is also protected through active monitoring and intelligence gathering across the internet
Microsoft continuously performs threat intelligence research into the dark web to identify
and mitigate potential risks and attacks. Putting this investment together, Microsoft provides a layer security model
This diagram on the slide shows various layers of security Azure provides to us
These layers are both native to the Azure platform itself and customer-defined features
First, to look at the inbound from the internet, the right-hand side
Azure distributed demand of service because it helps protect against large-scale attacks against Azure
The next layer is customer-defined public IP address endpoints which are used to determine which traffic can pass
through the cloud services to the virtual network. And the native Azure virtual network isolation
ensures complete isolation from all other networks and that traffic only flows
through user-configured paths and methods. These paths and methods are the next layer
where network security group and user-defined routing and network virtual appliances can be used to create security boundaries
to protect the application deployment in the protected network. We will go through each layer in detail
in the upcoming slide and see how come they help us. So let's start with the first layer
Azure distributed demand of service need of protection layer protects Azure as a platform from large-scale attacks
It also monitors outbound traffic and cross-Azure region between region traffic. This DDoS protection layer
has no user-configurable attribute and is not accessible to the user. Using network virtual appliances from a security partner
we will see in the next slide, on the virtual network, additional layers of resilience
can be transferred by you against a smaller-scale attack that doesn't risk the platform level protection
If you took an example of DDoS, if an internet-facing IP address
was attacked by a large-scale DDoS attack, Azure would detect the resources of the attacks
and scrub the offending traffic before it reaches its intended destination. In almost all cases
the attacked endpoint isn't affected by the attack. In the rare cases, that endpoint is affected
so no traffic is affected to other endpoints, only the attacked endpoint
Most other customers and services would see no impact from the attack
It is critical to note that our DDoS is only looking for large-scale attacks
It is possible that your specific service could be overwhelmed before the platform level protection thresholds are exceeded
For example, if you have a website running on an extra small VM size
that web server could be taken offline by a DDoS attack before Azure platform level protection resisted a threat
So, you need to pay attention to make sure that your web server is considered of a higher scale
Now, DDoS protection offers two services, basic and standard. The basic protection is integrated into the Azure platform
by default at no additional cost. The scale and capability of the globally deployed Azure network
provide defense against common network layer attacks through always-on traffic monitoring and real-time mitigation
DDoS protection basic requires no user configurable or application changes. DDoS protection basic helps protect all Azure services
including the default services as well, like Azure DNS. However, standard protection
provides enhanced DDoS mitigation features. It is automatically tuned to help protect your specific Azure resources
in a virtual network. Protection is simple to enable on any new
or existing virtual network. It requires no application or resource changes from your side
It has several advantages over the basic service tier, including logging, alerting, and permitting
So, the next layer is the native virtual network isolation. It is a traffic isolation boundary on the Azure platform
Virtual machines in one virtual network cannot communicate directly to VMs in a different virtual network
even if both virtual networks are created by the same customers. Isolation is a critical property
that ensures your virtual machines and communication remains private within a virtual network
Here is an example of a virtual network isolation. An Azure virtual network is a representation
of your own network in the cloud. It is a logical isolation of the Azure cloud
dedicated to your subscription. You can use virtual networks to provision and manage virtual private network VMs in Azure
and optionally link by using virtual net peering with VNets, with other VNets in Azure
or with your on-premises infrastructure to create a hybrid or cross-premises solution
Each virtual network you create has its own classless intra-domain routing, CIDR block
and can be linked to other VNets and on-premises networks as long as the CIDR block do not overlap
You also have control over DNS server settings for a virtual network
so you can also specify your DNS server and segmentation of the VNet into different subnets
Here is a scenario where you can see on this slide, we have a single virtual network with two different subnets
So the front-end subnet has 10.0.1.0.24 as a web server, and the back-end subnet with 10.0.2.0.24
As you can see, we have the front-end server are completely on different subnets
and each subnet has its dedicated network security group. We will discuss it now in the next slide about NFV
This is how you can scale, control your services with a single virtual network
We mentioned a network security group. You can limit network traffic to resources
in a virtual network using a network security group. NFV, for short, allows you to create rules
accesses at the desired level of granularity. Network interfaces, individual virtual machines
or virtual subnets. You can control access by permitting or denying communication between the workloads
within a virtual network. So from systems on your network, via cross-premises connectivity
or direct internet communication. Each network interface has zero or one associated network security group
Each network interface exists in the virtual network subnet. A subnet can also have zero
or one associated network security group. And as a general best practice
I suggest you bind network security groups to subnets rather than to individual virtual network interfaces
CART or Linux, to reduce complexity and troubleshooting effort. When applied to a subnet
security rules are applied to all resources in that particular subnet. The next one is user-defined routes or UDRs
You can create custom routes in Azure to override Azure's default system routes
or to add additional routes to a subnet route table as shown in this diagram
In Azure, you create a route table, then associate the route table
to zero or more virtual network subnets. Each subnet can have zero or one route table
associated to it. For example, if you create a route table and associate it to a subnet
the routes within it are combined with or override the default route
Azure adds to a subnet by default. The next layer mentions about network virtual appliances
That you can combine them with Azure's distributed denial-of-service, DDoS, for additional layer of security
Network virtual appliances, known as security appliances, such as firewalls, load balancers
and intrusion detection systems, intrusion prevention systems, are available in the Azure marketplace
and BGM image gallery. So these virtual machine images allow you to bring the networking, security
and other functions of your favorite provider, such as Check Point, Fortinet
Palo Alto, to name a few, to Azure for a familiar experience
So you can use the skills your security team already has. So network appliances support network functionality
and services in the form of virtual machines in your virtual network and deployment
You can deploy these applications into virtual networks and specifically as their security boundaries
including the perimeter network subnet to complete a multi-tiered secure network environment
If you look at this, there are those features and capabilities that we discussed
With several examples, you can build on how a perimeter and hybrid network architecture
could be co-constructed in Azure, as shown in this diagram. If we look at the perimeter setup
we have example one, where you can build a perimeter network to help to protect applications
by leveraging the network security group only. If we look at example two
we can build a network to help protect applications with network virtual appliances
and combine with network security groups. Oh, yes. And as we are the existing network virtual appliances
And example three, we take it a step further. We build a perimeter network to help protect networks
with network virtual appliances, and use a defined route and network security group
So this is on the perimeter side. So if we look on the hybrid side
we can have a hybrid connection by leveraging side-to-side VPN between on-premises and to Azure
In example five, you can add a hybrid connection with side-to-side and Azure VPN gateway
So maybe what's the difference between example four and example five? For example, you have a network virtual appliance
For example, you have Palo Alto and you bring your own devices, and you have Palo Alto on-premises
you can build a side-to-side VPN using the existing firewall on your on-prem
If you want to leverage Azure, it has also VPN gateway. And with example five
you can also build a side-to-side VPN. And the last example six
add a hybrid connection with ExpressSoft for a complete security. Microsoft recommends leveraging
except example six, where possible by using ExpressSoft to make sure you are directly connected
without any internet communication, without any interruption. So this is completely secure tunnel
between your on-premises to Microsoft. We move now to web application firewalls
Web application firewall is a feature of application gateway that provides centralized protection
of your web application from common exploits and vulnerabilities. Web application firewall is based on rules
from the OASP core ruleset 2.0 or 2.9. As you know, we know all web applications are increasingly targets
of malicious attacks that exploit common known vulnerabilities. Common among these exploits are SQL injection attacks
cross-site scripting attacks, to name a few. So preventing such attacks in application code
can be challenging and may require rigorous maintenance, patching, and monitoring at multiple layers of the application topology
So with centralized web application firewall helps you to make security management much simpler
and give you better assurance to application against threats or imposition. A web application firewall solution
can also react to a security threat faster by patching a known vulnerability at a central location
versus securing each of individual web applications. So existing application gateway can be converted to a web application firewall
enable gateway easily. Now, how to enable the web application firewall rule
The WAF rule can be considered to run in two modes, detection mode and prevention mode
When configured to run in detection mode, application gateway monitors and logs
all threats alerted into a log file. Logging diagnostics for application gateway
should be performed only using the diagnostics section. You also need to ensure that
the web application firewall log is selected and turned on. When running in detection mode
web application firewall does not block incoming records. However, when configured to run in the prevention mode
application gateway actively blocks intrusions and attacks detected by its own. So the attacker receives a 403 unauthorized access exception
error, and the connection is terminated. The prevention mode continues to log such attacks
in the web application firewall logs. Again, for a monitoring site, you can also monitor the health of your application gateway
It's very important. You can monitor the health of the application firewall
and the application that it protects are provided through logging and integration with Azure Monitor
Azure Security Center, and the Log Analytics. And if you look at the Azure Monitor
each application gateway log is integrated with Azure Monitor. This allows you to track diagnostics
information including web application firewall alerts and logs. This capability is provided within the application gateway resource
and the portal under, as you can see in this screenshot, under the diagnostics logs tab
or through the Azure Monitor service directly. On the logging side, web application gateway provides detailed reporting
on each threat it detects. Logging is integrated with Azure diagnostics logs
and others are recorded in a JSON format. These logs can be integrated with log analytics
And we will see in the upcoming slides how Azure Security Center can also be integrated
with the web application firewall to collect those logs. Now, we move to the network log session
Session that helps you to gain insight in your network office. So, network office helps you to see what is happening behind the scene
All the logs, it all provides tools to monitor diagrams, to view metrics
and enable or disable logs for resources in Azure virtual network. As you start adding resources to a virtual network
it can become difficult to understand what resources are in a virtual network
and how will they relate to each other. The topology capability on the left side
enables you to generate a visual diagram of the resources in a virtual network
and the relationships between the resources. Network office provides also the ability to diagnose
your most common VPN gateway and connection issues, allowing you not only to identify the issue
but also to use the detailed logs created to help further investigate
As we discussed earlier, network security group allows or denies inbound or outbound traffic
to a network interface card in a virtual machine or entire server
The network security group's slow log capability in network workshops allows you to log your source
and destination IP address, port, protocol, and whether traffic was allowed or denied by network security group
You can analyze logs using a variety of tools, such as Power BI and a traffic analytics capability
Now, the virtual network service endpoint, this was introduced in 2017, last year
to ensure Azure service resources can be secured to your virtual network
Securing service resources to a virtual network provides improved security by fully removing
public Internet access to resources and allowing traffic only from your virtual network
For example, today, any routes in your virtual network that force Internet traffic to your own primitives
or virtual appliances, known as forced tunneling, also force Azure service traffic
to take the same route as the Internet traffic. So service endpoints will actually provide optimal routing for Azure traffic
By taking always, the endpoint always takes the traffic directly from your virtual network
to the service on the Microsoft Azure backbone network, so it stays on the backbone network of Microsoft Azure
keeping traffic on the Azure backbone allows you to continue auditing and monitoring outbound Internet traffic
from your virtual network through forced tunneling without impacting service traffic. So you no longer need to reserve public IP addresses in your virtual network
to secure Azure resources through IP firewall. There are no NAT or gateway devices required to set up the service endpoint
So service endpoints are configured through a simple click on a subnet
on your particular submechanic. Very simple to enable it. There is no additional overhead to maintain the endpoint
As of today, this feature is only available for Azure Storage, Azure SQL Database, Azure Codemod VB, and Azure SQL Data Warehouse
And there is no additional charge for using service endpoints. So I highly encourage you to look at it and start using it
Now we will move from the networking security to data and storage security
First, we look at the Azure VM disk encryption. Azure disk encryption is a new capability that helps you encrypt
your Windows and Linux IIS virtual machine disks. So Azure disk encryption leverages the industry standard for Windows
using the BitLocker feature and the VMCrypt feature of Linux to provide volume encryption for the OS
and the data disks. The solution is integrated with Azure Key Vault
we will see it now in the upcoming slides, to help you control and manage the disk encryption keys and secrets
in your Key Vault subscription. The solution also ensures that all data on the virtual machine disks
are encrypted at rest in your Azure storage. So Azure disk encryption for Windows and Linux VM is now generally available
It was public preview and now it's GA. In all Azure public regions for standard VM storage and with premium storage
Even if you have SBB or a storage standard and SBB premium storage
you can use the benefits of disk encryption. We will see now the Azure Key Vault
We mentioned that Azure Key Vault helps you to safeguard cryptographic keys
and secrets used by the cloud applications and services. So by leveraging the Azure Key Vault
you can encrypt keys and secrets, such as password, authentication key, storage account key, data encryption key
and certificate files using key protected hardware security models. So you can leverage the SSM provided
encrypting even the hardware level of software. If you look at the developer side
always we have between the dev and the ops team, the developer wants to write an application for Azure
that uses key for signing and encryption. But they want these keys to be external from the application
so that the solution is suitable for an application that is geographically distributed
They want these keys and secrets to be protected without having to write the code again
They want these keys and secrets to be easily used from the application
with optimal performance. So Azure Key Vault streamlines the key management process
and enables you to maintain control of keys that access and encrypt your data
Developers now can create keys for development and testing in minutes and then seamlessly migrate them to production keys
The security administrator can run and revoke permission to keys as needed
As mentioned, Azure Key Vault helps you to safeguard your keys and secrets
by the cloud application and services that can encrypt and secret using a hardware security model
And what's expected is that recently, Microsoft needs to bring your own key as well
Because, okay, they don't want you to leverage the Microsoft-generated key. They want you to bring their own key
So this in March, March 7, so two months back, Microsoft made the first service encryption to bring your own key generally available
So now, for added assurance, you can also import or generate keys
by Microsoft-authored key using the PIR. It's 140 level 2 validated hardware and firmware module
This is great news as now you can create your own nice key to encrypt Azure storage account
Azure storage account can be enabled with encryption at rest for quite a while
But till now, Microsoft owned the key. Now you can bring your own key or generate your key
This is really very important integration. So with highly available and stable secure storage for RSA cryptographic key
backed also by either software or hardware. However, Azure Key Vault is also in two services here
You should be aware of the standard and the premium tier. With the standard tier, you can only use software protected keys
However, for reduction use, I highly recommend to use a hardware premium SKU for Azure Key Vault
and store the key on a hardware instead of software. Look now, let's look at the storage encryption
Azure storage encryption encrypts the data at rest. How to protect your data to meet your organization security and online commitment
For this feature, Azure storage automatically encrypts your data before processing it to Azure storage
and decrypts the data before retrieval as well. So the handling of encryption at rest, decryption and key management in storage service encryption, SSE
is transparent to us. So all data written to Azure storage is encrypted through 256-bit AES encryption
one of the strongest now block ciphers available today in the market
Storage Azure service encryption is enabled for all new and existing storage accounts
So it cannot be disabled because your data is secured by default
You don't need to modify your code or application to take advantage of the storage encryption
And now you might ask, okay, so what about performance? The storage encryption, service encryption does not affect Azure storage performance at all
Both performance is standard and premium is enabled by default at the time of creating the storage account
So all the Azure storage services are supported, including a block storage, queue storage, table storage
and Azure files. We mentioned in the networking section about virtual network for firewalls
We can leverage that feature as well, which helps you to allow traffic only from selected virtual network
With this, you can create a secure network boundary for your unmanaged and managed disks in a storage account
You can also grant access to on-premises network and other trusted internet traffic
by using network rules based on IP address ranges. So Azure storage firewall and virtual network service Anton, combined together
as discussed earlier, allow you to create network rules that allow traffic only from selected virtual network
and internet, thus creating a secure network boundary for your data. So if you look now at the virtual, how to combine that with storage
you can see now that it is shown in this storage update
You can select to allow, under the exception, to allow access to one or more virtual networks
You may also consider to allow access to one or more public IP addresses
So this is very simple. You can add other things. You can have a single IP address to allow for a specific Microsoft service
A good example also is that Azure Backup Storage can also leverage the feature
where with storage firewall and virtual network, you have also the ability to perform and continue with scheduled
ad hoc Azure virtual machine backup and restore from this virtual network configured storage account
So after you configure the firewall and virtual network settings for your storage account
you need to select allow trusted Microsoft services to access this storage account
as an exception, to enable Azure Backup Service to access the network-assisted storage account
without using internet, to allow only the service. It will communicate within the backbone service of Microsoft
These new network-focused features allow you to define network access-based security, ensuring that only requests coming from approved Azure virtual network or specific public IP address
to a specific storage account. So you can combine existing authorization mechanisms with the new network boundaries
to better secure your data. We mentioned earlier about Azure Security Center
Well, actually Azure Security Center is a broad topic and really deserves a dedicated hour on its own
In this section, I will last just 15 minutes, I will try to give you a quick overview of Azure Security Center
and highlight the important features that you should look at. So Azure Security Center provides a unified security management and advanced threat protection
across hybrid cloud workloads. With Security Center, you can apply security policies across your workloads
This will help you to limit exposure to threats and detect and respond to attacks
Using the unified visibility control, you can dynamically discover and manage the security
of your hybrid cloud workload in a single cloud-based console view. We will see it later, I have a demo about how this all works
With the adaptive threat prevention, you can enable actionable adaptive protection that identifies and mitigates risk to reduce exposure to attacks
And with the intelligence detection and response, you can use advanced analytics
and Microsoft Intelligent Security Graph to rapidly detect and respond to evolving cyber attacks
So now let's see, have a quick overview about this is the Security Center overview blade
Provide a quick view into the security process of your Azure and non-Azure workloads
By meaning non-Azure workloads mean hybrids, other clouds, enabling you to discover
and assess the security of your workload and to identify and mitigate risk
The built-in dashboards provide tips and insights into security alerts and vulnerabilities that require attention
As you can see, as the Security Center has to prevent, detect and respond to threats
you will increase visibility into and control over the security of your Azure resources
And to help you also to centralize, you have one central policy management
It will continuously secure assessment. It will give you a phenomenal, phenomenal recommendation to do
It will give you also advanced cloud defense. It will prioritize alerts and incidents so you can immediately respond
And it will also be integrated with your security solution patterns that you already have
We talked previously about web application firewalls. We would know that web application firewalls can also be integrated into Azure Security Center
Security Centers can use the environment to detect unprotected web applications. It can now recommend you to protect these vulnerable resources
You can directly create web application firewalls from the Azure Security Center
You don't need to go to web applications. You can directly create them from the same console
These web application firewall instances are integrated with Azure Security Center and will send alerts and hash information back for reporting
And just now, two weeks ago, in preview, the Azure Security Team announced support between Security Center
and Azure App Service. This is the app service. So, Azure Security Center is not only for infrastructure as a service
It can also protect your app services. So, as you saw in the previous slide, Security Center can detect and alert on behavior for web application firewalls
However, web application firewalls typically perform rule-based string analysis to record uniform resource identifiers and successfully identify prevalent attacks
For example, SQL injection, cross-site scripting, and other HTTP violations. While successfully mitigating known attacks, the rule-based approach fails to keep up with the rate of new vulnerabilities
So, Security Center now analyzes app service internal logs to identify attack vulnerabilities on multiple targets
For example, attempts to access the same uniform resource identifier on various websites
This type of attack typically exhibits a pattern of scrolling to the same web page on multiple websites
searching for a particular vulnerable page or plugin. So, Security Center can detect and alert on behavior that may pass through the web application firewall instrument
This is really exciting to protect your app service. So, just in time, we have access
This is the most frequent attack that we see is attack on RDP, the brute force attack, or management force
Microsoft provides you with capability that you don't need to have these ports open, even for your legitimate administrative purposes
You don't need to have these ports open. With Azure Security Center, you can only make these ports available for administrative purposes
for your virtual machine, only when they are required. So, just in time access to management port, that's something you should do on your virtual machine today
You can specify rules for how users can connect to virtual machines when needed
Access can be requested from the Security Center or via PowerShell. As long as the request complies with the rule, access is automatically granted for the requested time
We see it now in just a couple of minutes in the demo
The next interesting feature is integration. Security Center with the existing security solution
By integrating Azure Security Center, you can also collect, source, and analyze security data from a variety of sources, including connected partners
Solutions like network firewall that you already have now, checkpoints like Apollo Alto and McAfee
You can integrate them in Azure Security Center and collect those logs
So, you can also use your existing solution with Azure Security Center
This is also a very, very interesting feature in Azure Security Center about onboarding
You can also be used to secure your workloads that are running on your premises now
So, you don't need to worry if you have on-premises workload, you can take also benefit of Azure Security Center
Or, if your workload is in another cloud, such as Amazon AWS and Cloud Google, Azure Security Center can also help you with hybrid security
So, you can get a unified view of security across all your on-premises and cloud workloads
You can apply security policies and continuously assess the security of your hybrid workload to ensure compliance with security standards
You can collect, source, and analyze security data from a variety of sources, including firewall and other partners integrated solutions
This, however, requires the Azure Security Standard E. The standard capabilities of Azure Security Center are not applied to your non-Azure Azure computers
The standard capabilities are applied to all your Azure VM and non-Azure computers
So, whatever it is, whether it is on-premises or in other clouds
And, if you are leveraging as well the OMS, the Operation Management Suite can also be integrated with Azure Security Center
You can start using Security Center to unify security management and fault protection across Azure, on-premises, and other clouds
Security Center will automatically discover and monitor security for computers already shared, already completely connected to OMS, security and compliance
You can easily connect additional computers by installing the Microsoft monitoring agent, as we discussed in the previous slide
So, Azure Security Center now includes the same security management capabilities currently available in the OMS security compliance solution
In addition, Security Center offers security policies to ensure compliance with your company and the regulatory security standards
It will also give you actionable security recommendations to help mitigate security vulnerabilities, automatic discovery and monitoring of new Azure resources
It will also give you additional security assessments for Azure services, including monitoring of your virtual machine, network, storage, and SQL configuration
The adaptive application and adjust-in-time access controls for Azure virtual machines, where a security incident can streamline investigation for rapid effect response
So, let's now jump to a quick demo to show you Azure Security Center in action
Let me share my screen. So, what I am showing you here is Azure Security Center, and that is your starting point for your Azure security
I am in the Azure portal, and you can see here Azure Security Center is just part of that Azure portal
If you look at the compute, you can have continuous monitoring of your security across compute, networking, storage, and data and applications
Under compute, you can see exactly what are my virtual machines doing, what are the actionable recommendations I can take
I can deploy an endpoint protection from here, right here with Microsoft on the malware service for Azure
I can really do a security configuration to get information on missing system updates, so lots of things can be redone from Azure Security Center
I can do also similar things for networking. I can get you to an internet-facing endpoint, looking at recommendation, defining network security group, access control rules
I can enable encryption. I can enable threat detection for storage and data
And again, for web application, we can also do a similar threat detection capability and get recommendation
Now, I am still in Azure Security Center, dropping in just-in-time VM access control
Here, I can see the recommended virtual machine. We know that Azure Security Center has learned that RDP port or management port are open on both VMs
and it's recommending me to enable just-in-time access. So, I can quickly go into this virtual machine
I can enable just-in-time access, so I can see here that I can define port
I can define number and hours. These are the ports that will be closed down and only open when I make sure for that VM request access
So, if I want an admin, for example, and I want access to VM, I just can go here and select that VM in Azure Security Center
and I can request access. Once I request access, I can also consider which port I want to access, and I can define the time range
Now, we can see here the maximum time I'm allowed to consider is three hours
because that was set up by Azure Security Center, the security administrator
So, I can't change anything here. The policy is for three hours only
Once I do that, I can go into that virtual machine, and I can remote access that port
So, this is a way to minimize the source of area of attack. Again, you can minimize the attack by doing just-in-time access to virtual machines
You can also define adaptive application control to do white listing, so machine learning master will give you recommendations
Now, also what I wanted to show you about threat detection and advanced threat protection
that Microsoft provides. So, here my screen is showing you the security alerts, and I wanted to highlight that these security alerts
these alerts are based on advanced analytics. Typically, you will get alerts for individual events, individual attacks
Here what you see is security incident. That means it is following the entire key chain of all the events
It is combining all the events that are happening here. As you can see, here is a successful boot fork attack
Somebody did not pay attention and did not follow best practice of shutting down those ports
and the port was open. That was targeted and led to successful RDP attack
That RDP attack creates a suspicious process on a different machine, and looks like the main account seems to be compromised as well
I can see all of this correlation in this incident. You don't have to spend time going into individual alerts, spending time understanding what it is
You can get all the remediation here. For some of these alerts, Microsoft also gives you a downloadable report
so you don't have to spend time understanding the impact of that attack as well
This is a very simple but very effective tool. The investigation error is simple
As you can see graphically, in an interactive way, you can see the correlation here
and that is the machine that was targeted there, was a successful RDP attack
I can also see that the user, Abhi Bakker, here, who should not be using that machine
has logged into that machine, and that Abhi Bakker user has signed in from unfamiliar location
That seems suspicious. Let me see what else has that user done
And the moment I do that, look how easy it is to investigate
Now I can see that this is a suspicious process that was executed by this user
So here, there are two things. One, RDP attack was successful. It seems like this user has been compromised
And now I can go into that suspicious process. I can see exactly what has happened and what needs to be done
Microsoft makes it simple to respond as well. So with these built-in playbooks, you will be able to define and orchestrate the responses
the common responses. So, for example, you can either quarantine this user
you can segment the machine that was compromised. So all of these things you can do simply using Azure Security Center
So my high recommendation for you is that you should start using Azure Security Center
at the start only. And once you do that, you should also follow all the actionable recommendations
that Microsoft provides through Azure Security Center. So what I highly recommend for you to take action, and it's easy to get started
By default, Azure Security Center offers a free key. But it is automatically enabled on all Azure subscriptions
which provides your security policies, continuous security assessment, and actionable security recommendations to help you protect your Azure resources
However, if you need additional security features, such as just-in-time VM access
that we saw, and the network threat detection, including the VM threat detection
and the hybrid work with security, then you need the standard key
The standard key is offered free for the first 60 days. At the end of the 60 days, should you choose to continue using the service
Microsoft will automatically start charging for users. The price is $15 for each multi-machine per month
And with that, we are just an hour. I'll open it if you have a couple of minutes for questions and answers. Good
So with that, I would like to thank you for attending today our webcast
and hope to see you in another security webinar provided by Microsoft
Thank you so much. Microsoft Mechanics www.microsoft.com www.microsoft.com www.microsoft.com www.microsoft.com www.microsoft.com www.microsoft.com www.microsoft.com www.microsoft.com www.microsoft.com www.microsoft.com www.microsoft.com www.microsoft.com www.microsoft.com