Azure Security Center can be a complicated service.
We're gonna take it apart, put it back together,
and tell you everything you need to know about what it is,
why you should use it, and of course, as always,
how we can make it work for you.
All that and more, coming up now.
Hello everybody, my name is Adam Gordon,
an edutainer here at ITPROTV, back with another fun
and exciting episode in our ongoing conversation around
‘What is Azure?’
We're gonna take a look at the Azure Security Center
in this conversation, and as always, we'll answer our three questions.
What is the Azure Security Center?
Why is it important for you?
What value does it hold for you in your organization?
And equally importantly,
how do we actually put this to work for you,
get it up and running and make sure
you understand how to use it?
Let's begin by talking about the concept of
what the Azure Security Center is,
what it represents for us in terms of functionality.
When we think about the Azure Security Center,
we're representing that with our cloud right here
with all the different elements inside of it,
what we represent and think about really,
is the idea of being able to monitor first and foremost.
Looking at and understanding what is going on
across our entire landscape both inside of Azure,
looking at all the Azure services, the capabilities,
and of course, all the things that go on there,
and thinking about integrating really leading-edge,
cutting-edge technology and functionality.
We bring in, potentially, the use of Windows Defender,
the advanced threat protection engine that Microsoft has
in the Microsoft Azure platform, as well as our ability
to link out to some other Azure services, one of which
we've already taken a look at and talked about
in our ‘What is Azure?’ conversations.
The Azure Sentinel solution.
Our ability to use a cloud-based SIEM solution
to be able to bring together all of the data, analysis of it,
and then telling us where threats may lie is directly integrated
and potentially available to us here
as a part of Security Center's functionality.
So, we see all of that, kind of, represented,
and then we want to think about the fact that this is
first and foremost an Azure-centric solution.
We monitor inside of Azure all the things going on,
but not just there, we can monitor out into potentially AWS,
and Google, and other clouds.
We can monitor on-premises capabilities,
in terms of our infrastructure that is hybrid
and deployed in those kinds of configurations.
And so, we can look at this as an Azure-only solution,
or an Azure plus cloud and plus on-premises solution,
bringing together our visibility of workloads,
of examination of events and capabilities
that may exist in one area but not potentially in others.
Bringing that all together so we can look at it, we can analyze it,
we can understand it, and we can report on it.
So, as we think about what Azure Security Center represents,
it represents an all-up holistic view of our platform-specific
and widely distributed capabilities across Azure
and any and all other IaS infrastructure, PaaS platform,
and SaaS software, as the solution areas.
We can then have visibility into all of them.
So, we liked the fact that we have what we refer to
as a single pane of glass, a single source of truth
that allows us to understand what's happening
and really bring in those flows from these different areas
and centrally be able to analyze them.
When we think about broadening our conversation
out into the why, why would a tool like this, a capability set
such as Azure Security Center provides,
why would it be important to us?
Well, the exact reasons that I already mentioned.
Visibility into multi-cloud areas where we are running,
most likely, additional workloads.
We want to know what's going on in AWS, for instance,
and we certainly can use AWS' own built-in security
and monitoring and SIEM capabilities.
Same with the Google Cloud.
They each individually provide similar services and capabilities.
The problem is they're platform-specific
and they may or may not extend out through this
bi-directional flow that we can represent here.
They may or may not extend out
and give us visibility into the Azure Cloud.
By Azure Security Center being able to connect out
and bring in this information and then show it to us,
reporting on it and telling us, ‘Hey, there's something going on.
Let's pay attention here. Let's be concerned about this!’
The little exclamation point there for an alert,
and make sure that we know that there's a problem in AWS
that we have to check on.
Or maybe in one of our on-prem solutions,
right over here, or even over here, or maybe this area
inside of our data center is experiencing an issue.
We want to be told about that and be alerted to what's going on.
All of these things are possible with Azure Security Center.
The ability to monitor far-flung infrastructure,
aggregating and centralizing all that information
is really the strength of this platform,
and really one of the key value propositions
that help us to understand why this would be
such a good investment for us.
Speaking of investments, this is built-in, this is free.
This service exists as part of the core Azure subscription
that you already have access to.
What we call the standard-tier
for Azure Security Center is already available to you.
No additional cost.
Simply just opting in and allowing it to be used
and understanding how to use it is all it takes.
So, we like the fact that the basic's already built-in,
we get recommendations on best practices,
assessment of environments, and opportunity to understand
how to mitigate risk and minimize threat, all out of the box.
We have what's known as an additional tier,
where we can-- Initially for 30 days free of charge,
bring in the Windows ATP,
the Windows Advanced Threat Protection with Defender.
Then we start to pay as we go monitoring workloads
and services on a monthly basis beyond that.
So, there is some additional up charging here,
but we can monitor virtual machines that are running,
services that are being provided, and capabilities
that extend into all these different areas
for essentially a pay-as-you-go solution.
So, we like the scalability, as well as the flexibility.
So we're gonna move out of talking about our ‘what’
and our ‘why’, and move into our ‘how’.
Showing you how you actually can spin up, deploy,
and ultimately use the solution we're focusing on.
In this case, the Azure Security Centre.
All right everybody, so we're going to take a look at
how we actually can get Security Center up and running.
We're in the Azure portal, what we're gonna do
is zoom in quickly, show you the several ways to search
for the Security Center, access,
and ultimately start using its functionality.
Really just a matter of what you're most comfortable with.
We can begin by looking at the fact that in the portal,
once we log into the home area, we usually see
a load of shortcut area tiles,
these individual icons we can click on right there,
and Security Center is usually one of those
Azure services that displays there.
We can grab it right from there,
it's the second icon over, moving left to right.
It's got the little Security Center shield.
We can go to All Services and search.
We can even go to our shortcut menu down below
and more often than not it will be in the list towards the bottom.
You can see it right there as I hover over it.
We can click right on the link,
we can see useful documentation,
including the pricing information about the standard
versus the upscale tier that I mentioned, and the 30 free days,
and then the pay-as-you-go information
if you want to check all that out.
Let's assume we're gonna click on one of those links
to launch the Security Center, and when we do,
we do see that we have our overview area,
which really just shows us the ability to see what subscription,
or subscriptions if we have more than one, will be monitored.
We can link and add and filter additional subscriptions right there.
We will begin to see recommendations as the tool is working.
Since we add infrastructure and things are happening,
we'll see this will change and update over time.
We do see our recommendations as well as potential alerts.
And we can see our secure score and dashboard card there
along with clickable links around the score.
And we can see insights that are offered
around recommendations that Microsoft is making
based on looking at our infrastructure,
all the things we're doing in Azure, and recommending
that perhaps we approach doing some things a certain way.
Perhaps changing a configuration, maybe adding a service,
or modifying some sort of setting.
Because across the platform globally,
as Microsoft examines and manages millions of data points every day.
Looking at threat analysis deeply, but also looking at security,
configuration, and optimization of resources.
They begin to develop this best practice guidance
and they extend it and share with all of us
through the Security Center.
It's one of the key value adds that we get here.
Now, depending on where you wind up clicking,
you may wind up on the getting started area.
This is just a link right below overview.
And this is going to allow us to do two really important things.
Upgrade our subscription if we're using the free-tier,
where we have just basic coverage
and we're not implementing the advanced features,
using Windows Defender, the advanced threat detection capabilities
in the per workload monitoring, that we can pay for and use.
We may want to take advantage of that.
We can do that with upgrade.
We do see information here about our
30-day free trial that I've mentioned.
We get the ability to then look at upgrading,
and we read up a little bit more about
some of the additional capabilities,
like just in time administration, what's called JIT, J-I-T.
Adaptive application controls.
And a whole bunch of really cool additional technology
and features that Microsoft does offer us.
Remember, this is a pay-as-you-go solution,
we can see the subscriptions that are available to use to add.
The Windows Defender and ATP capabilities too.
We check those off and select them,
and then we're able to see what the pricing, the menu is,
on the workload protection capabilities we pay
for on a per-instance, per-month basis as we go.
Things like Kubernetes, so we can look at, for instance,
our container solutions and our hosted workloads.
We can look at our key vaults and protect those.
We can look at storage accounts, sequel server
and additional database instances,
web application server instances, and of course virtual machines.
And you can see what those pricing points are.
They do change over time, so obviously, just pay attention to that.
But we can see all of that here,
and then we can simply upgrade once we make appropriate selections.
Keep in mind, Microsoft has modified these offerings over time.
There may be a 30-day free option when you go to look at this,
there may be something different.
Don't be put off by that or worry about that
but do pay attention to the kinds of workloads
you want to protect and enable them accordingly.
The good news is you can turn on and off these features
on a rolling basis, so if you have new databases
you're bringing online and want to protect them,
enable that for that period of time, but then simply go in
and deselect it when you're done, and you don't pay
for those things unless you actually consume them.
So, we like that capability as well.
Then if we look over here, just in terms of our navigation area,
we can easily see that we can move
into the recommendation area,
looking at those recommendations.
Many of them are clickable and have actions associated with them
that we can be taking directly to that area and potentially engage in.
See the same thing for alerts.
We can see inventory information.
We can delve into specific areas like cloud security,
bringing in that Azure-Defender integration if we upgrade,
as well as looking at management.
We can look at, not just pricing and settings
like we're looking at on the overview page,
but we can look at our workflow automation.
We can look at policy.
We can look at all the different elements that exist here.
Let's take a look at a high level, quickly,
at what recommendations may look like.
What do we see from this tool?
We like the fact that we can get this information
provided in the interface, but notice we can download this
and work with it offline as well.
Sharing it with others and broadly communicating this
to get buy-in from additional stakeholders
and then be able to leverage that mineshare, right?
Going back in here.
Making choices and taking actions as a result.
We can see we have an overall secure score.
This gives us a percentage rating based
on the overall number of things that are being assessed.
We're roughly at one-third of that,
meaning about 17 out of 55 points
have been assessed as okay or not okay.
You can look at that either way.
We then have to go in and take some action.
We can drill through there.
We do have recommendations
and we can see the status of them,
and we can see that we're invited to learn more about various things.
We also see overall resource health and indicators of that as well.
Any and all of this is going to be very helpful
if I drill through here.
Let me just highlight and scroll down.
We can see what recommendations may look like;
we have guidance up underneath each one.
Enabling multi-factor authentication,
and it tells us that right now we're not doing that,
but we can easily go in if we choose to.
We can open this up,
we can look at these sub recommendations, broken down by area.
One of which I apparently have taken advantage of,
the other I have not.
I can drill through these, taking step-by-step guidance,
and really actionable information and outcomes
that Microsoft recommends, holds our hand
and shows us exactly what to do.
So, when we look at implementing the Security Center,
in terms of our how, the answer's really simple.
It's already there.
We just have to start using it effectively,
maybe upgrading our capabilities,
bringing on more functionality, and paying for it as we go.
If you want to see me go through this in more depth,
really understand end-to-end how you can leverage
the Security Center to the benefit for your organization.
I go through this in much more detail over on ITPROTV
where I run several different courses that focus on this
and a lot of other Azure security solutions.
I invite you to come over and take a look, spend time with me there.
Always glad to spend more time telling you about how things work.
Until I come back with another
exciting ‘What is Azure?’ conversation,
I'm going to wish you happy Azuring, and I'll see you soon.