In cloud environments, management is increasingly distributed, attackers continue to innovate, and thus, cloud security management looks like mission impossible. Join this session for a deep-dive into Azure Security Center, witness on-stage live attacks against an Azure environment and learn what you need to know in order to secure an Azure environment.

1. Azure Security Center
unleashed
Tom Janetscheck
Principal Consultant & Microsoft Azure MVP
Devoteam Alegri
@azureandbeyond

2. About me
Tom Janetscheck
Principal Consultant @ Devoteam Alegri
Focused on Enterprise Security, Azure Infrastructure and Governance
Microsoft Azure MVP & P-CSA
@azureandbeyond
https://azureandbeyond.com

3. Cloud momentum continues to accelerate
“The question is no longer:
‘How do I move to the cloud?’
Instead, it’s ‘Now that I’m in the
cloud, how do I make sure I’ve
optimized my investment and
risk exposure?”1
“By 2020 clouds will stop being
referred to as ‘public’ and
‘private’. It will simply be the
way business is done and IT is
provisioned.”²
1KPMG: 2014 Cloud Survey Report, Elevating business in the cloud, December 10, 2014
2IDC: IDC Market Spotlight, Cloud Definitions and Opportunity, April 2015

4. But cloud security concerns persist
Management is
increasingly distributed
Cloud environments
are more dynamic
Attackers continue to
innovate

5. Cloud Security is a Shared Responsibility
Securing and managing the cloud foundation
JOINT RESPONSIBILITYMICROSOFT COMMITMENT
Physical assets
Datacenter operations
Cloud infrastructure
Securing and managing your cloud resources
Virtual machines
Applications & workloads
Data

6. Cloud Security is…
"…challenging?"
“…security by design?"
"How do I figure out
what I don‘t know?"
"Who actually owns
security?"
"Not knowing where
to start is my top
AzSec challenge"
"Are you ever
done?"

7. Cloud Security is…
"…challenging?"
“…security by design?"
"How do I figure out
what I don‘t know?"
"Who actually owns
security?"
"Not knowing where
to start is my top
AzSec challenge"
"Are you ever
done?"

8. Identity protection is essential
uuuuuuu
uu$$$$$$$$$$$uu
uu$$$$$$$$$$$$$$$$$uu
u$$$$$$$$$$$$$$$$$$$$$u
u$$$$$$$$$$$$$$$$$$$$$$$u
u$$$$$$$$$$$$$$$$$$$$$$$$$u
u$$$$$$$$$$$$$$$$$$$$$$$$$u
u$$$$$$" "$$$" "$$$$$$u
"$$$$" u$u $$$$"
$$$u u$u u$$$
$$$u u$$$u u$$$
"$$$$uu$$$ $$$uu$$$$"
"$$$$$$$" "$$$$$$$"
u$$$$$$$u$$$$$$$u
u$"$"$"$"$"$"$u
uuu $$u$ $ $ $ $u$$ uuu
u$$$$ $$$$$u$u$u$$$ u$$$$
$$$$$uu "$$$$$$$$$" uu$$$$$$
u$$$$$$$$$$$uu """"" uuuu$$$$$$$$$$
$$$$"""$$$$$$$$$$uuu uu$$$$$$$$$"""$$$"
""" ""$$$$$$$$$$$uu ""$"""
uuuu ""$$$$$$$$$$uuu
u$$$uuu$$$$$$$$$uu ""$$$$$$$$$$$uuu$$$
$$$$$$$$$$"""" ""$$$$$$$$$$$"
"$$$$$" ""$$$$""
$$$" $$$$"
88 88 88
88 88 88
88 88 88
88,dPPYba, ,adPPYYba, ,adPPYba, 88 ,d8 ,adPPYba, ,adPPYb,88
88P' "8a "" `Y8 a8" "" 88 ,a8" a8P_____88 a8" `Y88
88 88 ,adPPPPP88 8b 8888[ 8PP""""""" 8b 88
88 88 88, ,88 "8a, ,aa 88`"Yba, "8b, ,aa "8a, ,d88
88 88 `"8bbdP"Y8 `"Ybbd8"' 88 `Y8a `"Ybbd8"' `"8bbdP"Y8
Implement multi-
factor authentication
Adhere to the
principle of least
privilege
Establish privileged
identity/access
management
(PIM/PAM)
Enable conditional
access policies
Use complex
passwords

9. Identity protection is essential
oooo$$$$$$$$$$$$oooo
oo$$$$$$$$$$$$$$$$$$$$$$$$o
oo$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$o o$ $$ o$
o $ oo o$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$o $$ $$ $$o$
oo $ $ "$ o$$$$$$$$$ $$$$$$$$$$$$$ $$$$$$$$$o $$$o$$o$
"$$$$$$o$ o$$$$$$$$$ $$$$$$$$$$$ $$$$$$$$$$o $$$$$$$$
$$$$$$$ $$$$$$$$$$$ $$$$$$$$$$$ $$$$$$$$$$$$$$$$$$$$$$$
$$$$$$$$$$$$$$$$$$$$$$$ $$$$$$$$$$$$$ $$$$$$$$$$$$$$ """$$$
"$$$""""$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$ "$$$
$$$ o$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$ "$$$o
o$$" $$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$ $$$o
$$$ $$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$" "$$$$$$ooooo$$$$o
o$$$oooo$$$$$ $$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$ o$$$$$$$$$$$$$$$$$
$$$$$$$$"$$$$ $$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$ $$$$""""""""
"""" $$$$ "$$$$$$$$$$$$$$$$$$$$$$$$$$$$" o$$$
"$$$o """$$$$$$$$$$$$$$$$$$"$$" $$$
$$$o "$$""$$$$$$"""" o$$$
$$$$o oo o$$$"
"$$$$o o$$$$$$o"$$$$o o$$$$
"$$$$$oo ""$$$$o$$$$$o o$$$$""
""$$$$$oooo "$$$o$$$$$$$$$"""
""$$$$$$$oo $$$$$$$$$$
""""$$$$$$$$$$$
$$$$$$$$$$$$
$$$$$$$$$$"
"$$$""""

10. Hybrid network risks

11. Infrastructure as code
https://github.com/azureandbeyond/AzureSecurity

12. •
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
Azure Security Services and Capabilities

13. •
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
• Azure Log Analytics
• Azure Monitor
•
•
• Azure Active Directory MFA
• Conditional Access
• Azure Active Directory Identity
Protection
• Azure RBAC
• Azure Security Center
• Azure Sentinel
• Azure Policy
Azure Security Services and Capabilities

14. Dynamically discover and manage the
security of your hybrid cloud
workloads in a single cloud-based
console
Enable actionable, adaptive
protections that identify and mitigate
risk to reduce exposure to attacks
Use advanced analytics and Microsoft
Intelligent Security Graph to rapidly
detect and respond to evolving cyber
threats
Microsoft Azure Security Center

15. DETECT RESPOND
Custom Alert Rules
Investigation Automation &
Orchestration
Enrichment
Prioritization
Threat Intelligence
Fusion
Alert Exploration
Built-in Analytics &
Machine Learning
Search
Computers
Security Data
& Alerts
REST APIs
Azure Services
Azure Security Center Pipeline

16. Detect threats across the kill chain

17. Detect threats across the kill chain

18. Demo
Demo
Azure Security Center and Azure Sentinel

19. Thank you!
@azureandbeyond
Thank you!
@azureandbeyond