La sicurezza informatica è un tema complesso e articolato, se aggiungiamo ad esso le nuove sfide della cloud pubblica può essere percepita come magia nera. Azure Security Center prova a dare una risposta a questa complessità mettendo a fattor comune la conoscenza maturata da Microsoft nella gestione dei propri servizi, coniugandola con le moderne tecnologie di machine learning e big data. In questa sessione capiremo insieme l’approccio di Azure Security Center (ASC) alla sicurezza delle applicazioni e dei sistemi sia ospitati su Azure sia presso i data center locali. Come è possibile attivare ASC? Quanto mi costa? Quali informazioni sono valutate e come posso essere avvertito se viene rilevata una minaccia o un data breach? Può ASC aiutarmi con la compliance al GDPR? Quali nuove funzionalità verranno rilasciate nei prossimi mesi? Durante la presentazione proveremo a dare risposta a queste e ad altre domande con l’obiettivo di capire se ASC possa essere una soluzione idonea alle esigenze di sicurezza sia sulla cloud sia on-premises. By Daniele Grandini

2. SPONSOR

3. Who am I?
Daniele Grandini
Technology Director
Progel SpA
Daniele Grandini
daniele.grandini@progel.it
Twitter: @DanieleGrandini
Microsoft MVP Cloud and DataCenter

4. Azure Security Center – Stato dell’arte e
roadmap
Daniele Grandini

5. Agenda
Hybrid IT Security considerations
Using Azure Security Center to improve security posture
What’s next

6. Hybrid IT security considerations
It’s a tough world out there

7. IT Security in a
hybrid world
• Infrastructure increasingly distributed across
public clouds and on-premises datacenters
• Rapidly changing resources
• Old methods (firewall, waf, antimalware,
ids, …) are not enough
• Old practices are just “old” (see NIST 800-
63B on Digital Identity Guidelines)
• Too much noise in suggested remediation
(1000 page report on vulnerabilities but no
true risk analisys)
• Compliance needs and regulations are
increasing
• ISO 27001
• GDPR
• PCI DSS
• HIPAA
• …

8. Microsoft security proposition
A set of not well integrated
technologies (yet)
* ATP (Advanced Threat Protection)
* Information Protection
Azure AD Identity Protection (MFA, conditional
access, …)
Azure Security Center
Cloud App Security
Nevertheless a comprehensive and
advanced offer

9. Azure Security Services and Capabilities
Network Security
• Virtual Network Service Endpoints
• DDoS Protection
• Network Security Groups
• NSG Service Tags
• NSG Application Security Groups
• NSG Augmented Rules
• Global Virtual Network Peering
• Azure DNS Private Zones
• Site-to-Site VPN
• Point-to-Site VPN
• ExpressRoute
• Azure Virtual Networks
• Virtual Network Appliances
• Azure Load Balancer
• Azure Load Balancer HA Ports
• Azure Application Gateway
• Azure Firewall
• Azure Web Application Firewalls
• Service Endpoints

10. © Microsoft Corporation
Secure foundation
Physical assets
Datacenter operations
Cloud infrastructure
Microsoft provides built-in controls
Virtual machines and networks
Apps and workloads
Data
Cloud security is a shared responsibility

11. Responsibility zones
Data governance & rights management
Client endpoints
Account access & management
Identity & directory infrastructure
Application
Network controls
Virtual Operating System
Physical hosts
Physical network
Physical datacenter
PaaSIaaS SaaS
On-
prem

12. Using Azure Security Center to
improve your security posture
Trying to get rid of the mess we’re in

13. Common
scenarios
addressed
Security posture assessment
Threats prioritization and
protection
Compliance (GDPR, PCI DSS, SOX,
HIPAA, …)
Security Recommendations
exposure

14. Demo
Azure Security Center blade

15. Azure Security Center
Cross platform, cross cloud, modern security assessment and remediation solution
Or CWPP (Cloud Workload Protection Platform)
Protect against
threats
Get secure faster
Azure Security Center
Strengthen security
posture
Manage organizational security policy
and compliance
Continuously assess security state
Optimize and improve security by
configuring recommended controls
Detect and block advanced malware and
threats for servers
Reduce exposure to brute force attacks
Protect data services against malicious attacks
Automatically discover and onboard Azure
resources
Extend to server workloads running in other
clouds and on-premises datacenter
Integrate with existing workflows and tools
(SIEM, NG Firewall..)

16. “Per Gartner”
• Agent-based
• Server workload protection
• Hybrid data center architectures
• Physical and virtual machines (VMs)
• Multiple public cloud infrastructure as a service
(IaaS)
• Ideally, container-based too

17. Export to Excel
and Power BI
Security Center Architecture
IP Geotagging, …
Netflow, SQL DB
and Storage Logs, …
Windows Events, Syslog,
CEF, Configurations
Threat Detections, Prescriptive
Recommendations
Security Dashboards
Deliver Rapid Insights into
Security State Across All
Workloads
Actionable Security
Recommendations
Investigation Tools
and Log Search
Curated, Prioritized
Security Alerts
Security Dashboards Deliver
Rapid Insights into Security
State Across All Workloads
REST APIs NotificationsAutomation

18. Securing Compute workloads
Data governance & rights management
Client endpoints
Account access & management
Identity & directory infrastructure
Application
Network controls
Virtual Operating System
IaaS
DATP for Servers, EPP, Updates, config checks, JIT VM access, AAC
NSG active & configured, WAF & NGFW, Network map, !SSL usage
>>Not covered by Security Center<<
Identity recommendations, integration with AAD Identity protection
MFA and Access hygiene recommendations
Not in scope for Security Center (use WDATP)
File Integrity Monitoring, Data classification, Encrypted @ rest

20. Demo
Onboarding, configuring and custom alerts

21. How to get Azure Security Center
Pricing Tiers
Basic (Free)
Standard
Billing
Per node / artifacts (~12€ per node per month)
Ingested data is included
Data is retained for 1 month (up to 2 years with
surcharge)
FEATURES FREE TIER STANDARD
TIER
Security policy, assessment, and recommendations
Connected partner solutions
Security event collection and search
Just in time VM Access
Adaptive application controls
Advanced threat detection
Built-in and custom alerts
Threat intelligence

22. What’s next

23. GA
New releases and roadmap
 Server EDR with WDATP
 Linux threat detection
 Organization wide security policies &
management groups
 Programmatic automation:
 Powershell cmdlets
 REST APIs
 JIT VM Access
 Dynamic rule priorities
 Adaptive application controls (Windows)
 Alerts
 Support for “groups for review”
 File integrity monitoring
 Process investigator- detection of fileless attacks
 Azure App services threat detection
 Azure Gov
 Alerts map
 Limited public preview:
 Adaptive network hardening
 PCI/CIS/ISO/SOC compliance reports
 Public preview:
 Network map
 Secure score IAAS/PAAS
 Docker containers on Linux servers
 UEBA for Azure resources and identities with
Microsoft Cloud App Security
 Threat detection for Azure blob storage
 Threat detection for Azure PostGresSQL
 Threat detection for Azure MySQL
Preview

24. Azure Security Center
Cross platform, cross cloud, modern security assessment and remediation solution
Or CWPP (Cloud Workload Protection Platform)
Protect against
threats
Get secure faster
Azure Security Center
Strengthen security
posture
Manage organizational security policy
and compliance
Continuously assess security state
Optimize and improve security by
configuring recommended controls
Detect and block advanced malware and
threats for servers
Reduce exposure to brute force attacks
Protect data services against malicious attacks
Automatically discover and onboard Azure
resources
Extend to server workloads running in other
clouds and on-premises datacenter
Integrate with existing workflows and tools
(SIEM, NG Firewall..)

25. Let the past go and step off into the future