(upbeat music)
Hello, I'm Ellie Cohen.
I'm a PM on the Azure Stack HCI PM team.
Today, I'm excited to share
about Azure Stack HCI Security Management At-scale
with Microsoft Defender for Cloud.
Let's get into it.
During the next few minutes,
I'll start with a brief introduction
on what Microsoft Defender for Cloud or MDC is
and some of its offerings.
I'll walk you through
how to onboard Azure Stack HCI to MDC.
Next, I'll share a demo of MDC in the Azure portal
and then highlight some of its benefits.
Finally, I'll wrap up with some resources
about HCI's key security features
and how to get started with Microsoft Defender for Cloud.
I'll also share a little bit about our future vision
for HCI security management from Azure.
Microsoft Defender for Cloud is Microsoft's big bet
for Cloud security management.
Starting off with some background,
what exactly does MDC offer?
MDC empowers customers to secure all their Azure resources
with a single platform.
Microsoft Defender for Cloud is a multi-cloud solution
that consists of DevOps security management,
Cloud security posture management,
and Cloud workload protection.
Cloud security posture management or CSPM,
consists of features you might already be familiar with
such as a Cloud secure score,
recommendations about how to harden the security posture
of your resources,
and security alerts that identify real-time incidents.
Workload protections include the paid resource plans
such as defender for servers, defender for containers,
defender for storage, and others.
These plans include enhanced security features
such as Microsoft Defender for Endpoint
as well as attack path analysis, vulnerability scanning,
regulatory compliance, and more.
Onboarding Azure Stack HCI host to MDC is super easy.
When you register your cluster with Azure,
each cluster node automatically gets Arc enabled.
This means you can manage your cluster nodes
as Arc enabled servers directly from the Azure portal.
Microsoft Defender for Cloud is enabled
at the subscription level
rather than the individual resource level.
This makes it extra simple
because if you already have Defender for Servers
plans one or two enabled,
your Arc enabled HCI nodes will automatically
get enrolled too.
If this is your first time
enabling Microsoft Defender for Cloud,
you can choose to turn on the free plan only
or go ahead and select the paid Defender for Servers
option one or two.
Features included are recommendations,
security alerts, extended detection
and response or XDR capabilities,
Microsoft Defender for endpoint or MDE, which is a big win,
and many more enhanced security features.
Now for a demo, we're going to explore the security posture
of a 22H2 HCI cluster
that has the supplemental package already installed.
Let's navigate to the Azure Stack HCI cluster resource
in the Azure portal.
By clicking on the nodes tab,
I can access the two HCI cluster nodes represented
as Arc enabled servers.
Let's click on the first one to drill down further.
Reviewing the capabilities tile,
I find the security tile.
Clicking on this tile brings me to the security blade.
Here, I can confirm the defender
for servers has already been enabled.
By navigating to the extensions blade,
I can verify that MDE
or the Microsoft Defender for Endpoint extension
is also already installed.
The MDE license is included in defender for servers.
Going back to the security blade,
let's review some of the MDC recommendations
that are provided for this HCI server.
The third recommendation reads,
vulnerabilities in security configuration
on your Windows machine should be remediated,
powered by Guest Configuration.
Let's click on it to learn more.
Click on view policy definition at the top
to learn more about the Azure policy
that supports this recommendation.
The policy definition consists
of the Azure compute security baseline.
Switching to the machine configuration blade,
we can better understand compliance
with the Azure Security Baseline
also known as the Azure Windows Baseline.
The security settings of this cluster
have not been modified at all since deployment
and it's already 90% compliant with the baseline.
This is because Azure Stack HCI is secure out of the box.
Returning to the security blade,
I can explore all the MDC info
for this server such as recommendations
and any realtime security alerts.
By clicking on view additional recommendations,
I'm taken to the at-scale view for MDC.
Here I can view the recommendations
for all my Azure resources.
Let's filter by virtual machines for example.
This shows me only the recommendations applicable to my VMs.
I can also review my overall Cloud secure score
in this view.
I can click on All Recommendations to see a FlatList view.
There are several benefits
to the at-scale security management story
for Azure Stack HCI..
HCI version 22H2 plus the lifecycle manager
that's included in the supplemental package
is secure out of the box.
As seen in the demo,
the HCI cluster nodes are automatically 90% compliant
with the Azure security baseline.
A new feature known as Drift Control acts
like an automated refresher to maintain this secure state.
Every hour or so, it checks the values
of all the security settings against the desired state
and autocorrects any settings that might have drifted.
So you can feel confident that your fleet of HCI clusters
always remains secured.
Leveraging the power of Azure Arc,
Azures Stack HCI is seamlessly integrated
with Microsoft Defender for Cloud.
It provides at-scale security management
for all Azure resources
whether they're on-prem or Cloud native.
The MDC platform in the Azure portal provides a single pane
of glass to make it faster and easier
to assess the security posture of your entire HCI fleet
plus respond to realtime security alerts.
You can do all of this without leaving the Azure portal.
Looking ahead, we're aiming to reach 100% compliance
with the Azure security baseline.
We're also planning to add Azure Stack HCI
specific security settings
that can be managed directly through MDC.
To learn more about the security baseline
and the HCI supplemental package,
refer to the public documentation on Microsoft Learn.
You can also find deployment guides
to get started with Defender for Servers
for on-prem and hybrid Cloud resources like Azure Stack HCI.
Thank you so much for listening.
If you're looking to manage the security posture
of your entire fleet of HCI clusters,
harnessing the power of Microsoft Defender for Cloud
is the way to go.
(upbeat music)