Azure Security Center provides security posture management and threat protection for your hybrid cloud workloads. Cloud Security Posture Management includes Policies, initiatives, recommendations, secure scores, and security controls. Cloud Workload Protection protects threats against servers, cloud-native workloads, databases, and storage security alerts and incidents.

1. Azure Security Center
Udaiappa Ramachandran ( Udai )
https://udai.io

2. About me
• Udaiappa Ramachandran ( Udai )
• CTO-Akumina, Inc.
• Cloud Expert
• Microsoft Azure, Amazon Web Services and Google
• New Hampshire Cloud User Group (http://www.meetup.com/nashuaug )
• https://udai.io

3. Agenda
• Introduction
• Azure Security Center
• Azure Defender
• Secure Score
• Security Policies
• Regulatory Compliance
• Security Alerts
• Cloud Connectors
• Resource Graph
• DEMO…DEMO…DEMO…
• References

4. Security/Data Breaches
• Adobe
• Adult Friend Finder
• Ashley Madison
• AWS S3 Bucket
• Canva
• Code Spaces (source code hosting)
• Dubsmash
• eBay
• Equifax
• Facebook
• Heartland Payment Systems
• LinkedIn
• Marriott International
• My Fitness Pal
• MySpace
• NetEase
• Podesta/Hillary Emails
• Sina Weibo
• Target
• Yahoo
• Zynga

5. Challenges
• Threats increasing in volume and sophistication
• Attacker business models evolve to maximize attacker return on investment (ROI)
• Attack automation and evasion techniques evolving along multiple dimensions
• Can’t Stop All Attacks
• Must balance investments across prevention, detection, and response
• Prevention investments must be focused on real world attacks
• Integration is required, but complex and costly
• Threat Detection requires context from a diverse signal sources and high volumes of data
• Efficient operations requires integration of tools and technology like machine learning
• Requires Blend of Human Expertise and Technology
• Need human expertise, adaptability, and creativity to combat human threat actors
• Difficult to hire people deep expertise, growing skillset takes a long time

6. Why use Security Center?
• Centralized policy management – Ensure compliance with company or regulatory security
requirements by centrally managing security policies across all your hybrid cloud
workloads.
• Continuous security assessment – Monitor the security posture of machines, networks,
storage and data services, and applications to discover potential security issues.
• Actionable recommendations – Remediate security vulnerabilities before they can be
exploited by attackers with prioritized and actionable security recommendations.
• Prioritized alerts and incidents - Focus on the most critical threats first with prioritized
security alerts and incidents.
• Advanced cloud defenses – Reduce threats with just in time access to management ports
and adaptive application controls running on your VMs.
• Integrated security solutions - Collect, search, and analyze security data from a variety of
sources, including connected partner solutions.

7. Azure Security Center (ASC)
• Cloud Security Posture Management
• Policies, initiatives and recommendations
• Secure Score and security controls
• Cloud Workload Protection
• Protect threats against Servers, Cloud native workloads, databases and storage
• Security alerts and incidents

8. Security HYGIENE
• Software
• Code
• Third party
• Compute & Apps
• Network
• Data & Storage
• Identity

9. Security Score
• Measurement of an
organization’s security
posture, higher the number
lower the risk
• Score may fluctuate if no
governance on new
resource provisioning

10. Security Policy
• Security Policy is the driver for Security Score
• Built in set of policies(security controls) automatically assigned on your subscription
• The resources are assessed continuously
• Each policy is in audit mode and checks for misconfigurations
• Customize or Disable policies not relevant to organization

11. Microsoft Defender (XDR)
• M365 Defender
• Identities
• Endpoints
• Apps
• E-mail
• Cloud Apps
• Docs
• Azure Defender
• SQL
• Virtual Machines
• Containers
• Network
• IoT
• PaaS Applications (Azure App Services)

12. Regulatory Compliances
• ISO 27001
• PCI DSS 3.2.1
• SOC TSP
• NIST SP 800-53
• NIST SP 800 171
• SWIFT CSP CSCF v2020
• UKO and UK NHS
• Canada Federal PBMM
• HIPAA HITRUST
• Azure CIS 1.3.0
• CMMC Level 3
• New Zealand ISM Restricted

13. Remediation
• Manual – Follow the remediation steps
• ARM Template
• PowerShell
• Workflow Automation

14. Security Alerts
• Security alerts
• Custom alerts
• Thread intelligence
• Detected threat types
• Threat origin
• Threat intelligence map

15. Continuous Export
• Export Types
• Security Recommendations
• Secure Score
• Security alerts
• Regulatory compliance
• Export frequency
• Streaming updates
• Snapshots
• Export Target
• Event Hub
• Log Analytics

16. Cloud Connectors
• AWS - Security Hub
• https://docs.microsoft.com/en-us/azure/security-center/quickstart-onboard-
aws?WT.mc_id=Portal-Microsoft_Azure_Security
• GCP - GCP Security Commands
• https://docs.microsoft.com/en-us/azure/security-center/quickstart-onboard-gcp

17. Azure Resource Graph(ARG) - Query
• Query ASC Data
• Export to CSV
• Create Azure Workbook
• ARG API

18. References
• http://docs.microsoft.com/en-us/azure/security-center
• https://www.youtube.com/playlist?list=PL3ZTgFEc7LysTt_FBVZ1Bw8CyyyPraHGr
• https://docs.microsoft.com/en-us/security/cybersecurity-reference-
architecture/mcra
• https://docs.microsoft.com/en-us/learn/browse
• https://azure.microsoft.com/en-us/pricing/details/azure-defender/
• https://docs.microsoft.com/en-us/security/ciso-workshop/ciso-workshop
• Git Resources
• https://github.com/Azure/Azure-Security-Center
• https://github.com/Azure/Azure-Security-Center/tree/main/Workflow%20automation/Notify-
ASCRecommendationsAzureResource
• https://github.com/Azure/Azure-Security-Center/tree/main/Workflow%20automation/Notify-
ResourceExemption