Azure Security Center provides a unified view of security across hybrid cloud workloads. It automatically discovers resources, assesses vulnerabilities, and detects threats using integrated monitoring and advanced analytics. Security Center helps protect workloads by providing prioritized alerts and recommendations, enabling automated response actions, and gaining insights into attackers through integrated intelligence.

1. TRACK:
Introduction
to the Azure
Cloud
An IT Operations perspective
Introduction to Microsoft Azure Security
TRACK:
Introduction
to the Azure
Cloud @CloudPowerUs
er

2. TRACK:
Introduction
to the Azure
Cloud
Thank you to our Sponsors!
Power of the Cloud
Microsoft Cloud Power User Conference
@CloudPowerUs
er

3. TRACK:
Introduction
to the Azure
Cloud
Who we are
Adin Ermie
• Manager, Cloud Infrastructure Consulting @ Avanade
• Cloud Solutions Architect (Datacenter/Azure)
• Azure (IaaS, PaaS, Recovery Services)
• Operations Management Suite (OMS), Azure Monitor,
Azure Security Center (ASC)
• 3x MVP - Cloud and Datacenter Management (CDM)
Adin.Ermie@outlook.com
@AdinErmie
https://AdinErmie.com
https://www.linkedin.com/in/adinermie

4. TRACK:
Introduction
to the Azure
Cloud
S.E.C.U.R.I.T.Y
What do you think of when you hear this word?
IDENTITY & ACCESS DATA ENCRYPTION
ENCRYPTION KEY
MANAGEMENT
NETWORK SECURITY
THREAT
PROTECTION &
SECURITY MGMT
ENVIRONMENT
PROTECTION

5. TRACK:
Introduction
to the Azure
Cloud
Security Topics
Vague and nebulous
TRACK:
Introduction
to the Azure
Cloud
IDENTITY &
ACCESS
• Azure Active
Directory (AAD)
• Azure Information
Protection (AIP)
• Identity and
Access
Management
(IAM)
• Privileged Identity
Management
(PIM)
• Business-to-
Business (B2B)
• Business-to-
Consumer (B2C)
DATA
ENCRYPTION
• Azure Storage
Encryption (ASE)
• Azure Disk
Encryption (ADE)
• SSL / TLS
ENCRYPTION KEY
MANAGEMENT
• Azure Key Vault
• Certificates
• Secrets /
Passphrases
• Secure Credentials
NETWORK
SECURITY
• Azure Advanced
Threat Protection
(ATP)
• Network Security
Groups (NSGs)
• Application
Security Groups
(ASGs)
• DDos Protection
Plans
• Azure Service
Endpoints
• Site-to-Site VPNs
/ Express Route
THREAT
PROTECTION &
SECURITY MGMT
• Azure Security
Center (ASC)
• Threat Intelligence
• Log Analytics (LA)
/ Operation
Management
Suite (OMS)
ENVIRONMENT
PROTECTION
• Azure Policy
• Resource Group
Locks
• Azure Backup
• Cloud App
Security (CAS)
• Enterprise
Mobility and
Security (EMS)
• Intune
• Internet of Things
(IOT)

6. TRACK:
Introduction
to the Azure
Cloud
Security Fundaments
Design, Code, Environment, Operations
Secure
by design
Secure
the code
Secure the
environment
Secure the
operations

7. TRACK:
Introduction
to the Azure
Cloud
• Security Perspectives:
• IT Operations
• Identity
• Data
• Network
• Resources
What we will cover…
©2017 Avanade Inc. All Rights Reserved.

8. Secure your IT resources with Azure
Security Center

9. TRACK:
Introduction
to the Azure
Cloud
Hybrid cloud
requires a new
approach for
security
Distributed
infrastructure
Rapidly changing
cloud resources
Increasingly
sophisticated threats

10. TRACK:
Introduction
to the Azure
Cloud
Microsoft Azure Security Center
Unify security management and enable advanced threat protection for hybrid cloud workloads

11. Dynamically discover and manage the
security of your hybrid cloud workloads
in a single cloud-based console

12. TRACK:
Introduction
to the Azure
Cloud
Understand security state across
hybrid workloads
Built-in Azure, no setup required
Automatically discover
and monitor security of
Azure resources
Gain insights for hybrid resources
Easily onboard resources running
in other clouds and on-premises

13. TRACK:
Introduction
to the Azure
Cloud
Central policy management
Define a security policy for each
subscription in Security Center
Apply across multiple subscriptions
using Azure Management Groups
Ensure compliance with
policy management

14. TRACK:
Introduction
to the Azure
Cloud
Gain deeper insights with
integrated log analytics
Quickly identify list of notable
events that require your attention
Out of the box notable events in
dashboard or create custom
queries
Search and analyze security data
using a flexible query language
Use built-in or custom queries with
Log Analytics search

15. TRACK:
Introduction
to the Azure
Cloud
Integrated partners
Connected security solutions
running in Azure, e.g. firewalls
and antimalware solutions
Microsoft security
Azure Active Directory
Information Protection
Advanced Threat Analytics
Many others
Any security solution that
supports Common Event Format
(CEF)
Analyze security information
from variety of sources

16. Enable actionable, adaptive protections
that identify and mitigate risk to reduce
exposure to attacks

17. TRACK:
Introduction
to the Azure
Cloud
Identify and remediate
vulnerabilities quickly
Continuous assessment of
machines, networks, and
Azure services
Hundreds of built-in security
assessments, or create your
own
Fix vulnerabilities quickly
Prioritized, actionable security
recommendations

18. TRACK:
Introduction
to the Azure
Cloud
Limit exposure to brute-force
attacks
Lock down ports on virtual machines
Enable just-in-time access
to virtual machines
Access automatically granted
for limited time

19. TRACK:
Introduction
to the Azure
Cloud
Block malware and other
unwanted applications
Allow safe applications only
Adaptive whitelisting learns
application patterns
Simplified management with
recommended whitelists

20. Use advanced analytics and Microsoft
Intelligent Security Graph to rapidly detect and
respond to evolving cyber threats

21. TRACK:
Introduction
to the Azure
Cloud
Built-in Intelligence and
advanced analytics
Partners
Integrates alerts from partner
solutions, like firewalls and
antimalware Fusion
Combines events and alerts from across
the kill chain to map the attack timeline
Behavioral analytics
Looks for known patterns
and malicious behaviours
Threat intelligence
Looks for known malicious
actors using Microsoft
global threat intelligence
Anomaly detection
Uses statistical profiling to build
historical baselines
Alerts on deviations that conform to
a potential attack vector

22. TRACK:
Introduction
to the Azure
Cloud
Detect threats across the
kill chain
Target and attack
Inbound brute-force RDP,
SSH,
SQL attacks and more
Application and DDoS attacks
(WAF partners)
Intrusion detection
(NG Firewall partners)
Install and exploit
In-memory malware and
exploit attempts
Suspicious process execution
Lateral movement
Internal reconnaissance
Communication to a known
malicious IP (data exfiltration or
command and control)
Using compromised resources to
mount additional attacks (outbound
port scanning, brute-force RDP/SSH
attacks, DDoS, and spam)
Post breach

23. TRACK:
Introduction
to the Azure
Cloud
Get prioritized security alerts
Details about detected threats
and recommendations
Detect threats across the kill chain
Alerts that conform to kill
chain patterns are fused into
a single incident
Focus on the most
critical threats

24. TRACK:
Introduction
to the Azure
Cloud
Gain valuable insights
about attackers
Visualize source of attacks with
interactive map
Analyzes data from your
computers and firewalls logs
Gain insights through threat
reports
Attacker’s known objectives,
tactics, and techniques

25. TRACK:
Introduction
to the Azure
Cloud
Simplify security operations
and investigation
Quickly assess the scope and
impact of an attack
Interactive experience to
explore links across alerts,
computers and users
Use predefined or ad hoc
queries for deeper
examination

26. TRACK:
Introduction
to the Azure
Cloud
Respond quickly to threats
Automate and orchestrate common
security workflows
Create playbooks with integration
of Azure Logic Apps
Trigger workflows from any alert
to enable conditional actions

27. TRACK:
Introduction
to the Azure
Cloud
Thank you
Adin Ermie
Adin.Ermie@outlook.com
@AdinErmie
https://AdinErmie.com
https://www.linkedin.com/in/adinermie

28. Thank you