Azure Security Center

• Monitoring service that provides threat protection across all services
  • both in Azure, and on-premises.
• Gives security recommendations based on your configurations, resources, and networks.
  • Part of https://www.cisecurity.org/cis-benchmarks/
• Automatic security assessments through continuous monitoring to identify potential vulnerabilities before they can be exploited.
• Just-in-time access control for ports through Azure Defender
• Analyzes & identifies identify potential inbound attacks
  • then helps to investigate threats and any post-breach activity that might have occurred.
• Control apps
  • Only the apps you validate are allowed to execute.
  • Uses machine learning to detect and block malware from being installed on services
• Helps with compliance through continous assesments & recommendations.

Tiers

Free

• Available as part of any Azure subscription
• Limited to assessments and recommendations of Azure resources only.

Azure Defender

• Formerly known as Azure security center standard edition
• Provides a full suite of security-related services including
  • continuous monitoring
  • threat detection
  • just-in-time access control for ports
• $15 per node per month, 30-day free trial available
• ❗ To upgrade to the Standard tier, you must be assigned the role of Subscription Owner, Subscription Contributor, or Security Admin.

Use-cases

Incident response

• 💡Have an incident response plan in place before an attack occurs.

Incident response stages

• 
• You can use Security Center during the detect, assess, and diagnose stages.

Detect

• Review the first indication of an event investigation.
• E.g. you can use the Security Center dashboard to review the initial verification that a high-priority security alert was raised.

Assess

• Perform the initial assessment to obtain more information about the suspicious activity.
• E.g. obtain more information about the security alert.

Diagnose

• Conduct a technical investigation and identify containment, mitigation, and workaround strategies.
• E.g., follow the remediation steps described by Security Center in that particular security alert.

Recommendations to enhance security

Security policy

• Set of controls that are recommended for resources within that specified subscription or resource group
• You can reduce the chances of a significant security event by configuring a security policy

Recommendations

• Based on security policies for potential vulnerabilities.
• Guide you through the process of configuring the needed security controls.
• E.g. if you have workloads that do not require the Azure SQL Database Transparent Data Encryption (TDE) policy, turn off the policy at the subscription level and enable it only in the resources groups where SQL TDE is required.