- Welcome to Azure Essentials.
In the next few minutes, we'll explore
the defense in-depth design of Azure services
and capabilities to help you secure, manage,
and monitor your cloud data and infrastructure.
As a managed service, Microsoft designs and operates
its cloud services with security at the core
and provides you built-in controls and tools
to meet your security needs.
In addition, with machine learning
and Microsoft's significant investments in cyber defense,
you can benefit from unique intelligence
and proactive measures to protect you from threats.
Azure offers unified security management
and advanced threat protection for your resources,
whether they're in the cloud, or your data center, or both.
Services in Azure are built with security
in mind from the ground up
to host your infrastructure, apps, and data.
All services are designed and operated
to support multiple layers of defense,
spanning your data, apps, virtual machines,
network, perimeter, related policies,
and of course physical security within our data centers.
This includes how the data centers and systems
that run Azure are architected and operated
to the controls you can leverage
as part of your defense in depth security management.
Everything starts with identity and access control.
All Azure resources we'll mention are governed
by Azure Active Directory.
You can learn more about this topic on Azure Essentials.
Next, one of the most important built in services
to get familiar with is the Azure Security Center.
Across Azure services, it provides unified visibility
and control, adaptive threat protection,
as well as intelligent threat detection and response.
This gives you centralized and real-time monitoring
into the security state of your Azure work loads
with actionable recommendations and controls.
Let's start with data,
which is what you'll wanna protect the most
and is often the core of your apps and services.
Data protections are built
for both structured and unstructured data.
For structured data, all data is encrypted at rest,
and machine learning can be used to proactively look for
and alert you on potential security vulnerabilities.
These can be related to data encryption,
enabling security telemetry, and extend to capabilities
in data services themselves to recommend and enable
sensitive information discovery and classification,
dynamic data masks to obscure data fields, and more.
Database services in Azure can be configured
to run these checks automatically,
and Azure's security center will alert you
on any potential issues it finds
to keep your data protected.
For unstructured data, storage accounts span
in blobs, files, tables and queues
are also encrypted at rest, by default,
and each account is geo-redundant.
You can also apply further protection using access keys
to control authentication,
shared access signatures for secure delegated access,
and granular network firewall controls.
Azure Security Center will report its findings
when security's at risk,
or when protections have been disabled by an admin.
Now apps are the front end for accessing and presenting data
and their security's generally governed through data, VMs,
or computer platform services in Azure.
Your web apps can be configured to use
Azure managed service identities
to streamline secure communication
with other services connected to Azure AD.
You can manage SSL certificates for your apps
and even require the clients connecting to your apps
have valid certificates for inbound requests.
Now as you move into VMs and compute,
the Azure Security Center uses machine learning
to continuously access security and vulnerability levels
of your VMs, networks and service configuration.
It also gives your actionable recommendations
to prevent exploits before they occur
and dynamically applies allow and block lists
to keep out unwanted traffic.
As you hope for visibility and control,
one thing to know is that many of these capabilities
we give you also extend to your VMs and other clouds
in your data center.
You can also benefit from
intelligent threat detection and response.
The Security Center leverages
a Microsoft Intelligent Security Graph to discover
and take actions against attacks.
The graph combines a cyber intelligence
Microsoft collects across all of its services
and industry data to block known attack patterns.
We also give you the controls that you need
to prioritize alerts and incidents
that are important to you.
In addition, we give you a unified view
for forensics analysis and the ability to search across
all of your compute resources.
You can even visualize threat intelligence down to
the trending attack techniques
and the geographic regions affected.
For network security, the Azure Security Center will assess
and report on potential network and security issues
related to open ports and firewall settings,
and network security groups.
Azure provides additional security
when designing and architecting your apps
to enforce logical network boundaries
and limit permissions to network security groups.
You can also control network and other resources, like VMs,
just in time controls for opening
management and internet ports,
with intelligent recommendations to reduce exposure
to brute force attacks.
Beyond your network controls, the perimeter security,
Azure's DDoS Protection for protection against
Distributed Denial of Service attacks is available
at a basic level by default.
Azure's DDoS Protection Standard Version
adds additional protection
and mitigations against volumetric attacks,
where the attacker's goal is to flood the network
with traffic, in efforts to disable your services.
Protocol Attacks where the attackers tries to find
and exploit weaknesses in layer three
and layer four protocol stacks.
Application Layer Attacks, where the web application packets
are used to disrupt transmission of data between hosts,
like cross-site scripting or HTTP protocol violations.
For security policies and access management,
Azure has a comprehensive set of services to securely
manage security policies and access to resources,
whether accessed by people or programatically by your code.
These controls are more than just your front door
to who or which processes can access your apps files
or data and extends how granular access is delegated
to your IT and development team,
using role-based access controls
to ensure your team members only have access
to what they need.
Again, for more information, check out the Azure Essentials
on identity and access management.
To automate the response to specific security events,
you can also use a security playbook.
Powered by Logic App, which is used in Azure
to automate workflows, this orchestrates the set of actions
that need to happen when a predefined event is detected
by the Azure Security Center.
Now as I mentioned earlier,
beyond the policies that you can set,
security's infused in everything we do
as we develop Azure's services.
From the planning and design phase,
all the way to development delivery,
using the Secure Development Lifecycle process.
Fabric admins operate Azure's services
with zero standing privilege,
and use just in time approval processes
to gain temporary access to sensitive data
or controls when needed.
Azure services compile with both international
and industry specific compliance standards
and are subject to rigorous third party audits that verify
Azure Security Controls.
So you've got peace of mind,
especially in answering regulator requirements,
such as GDPR.
Finally we extend our layered approach to physical security.
Data centers managed by Microsoft
have extensive layers of protection.
Access approval of the facility's perimeter,
the building's perimeter,
inside the building, and on the data center floor.
This layered approach reduces the risk of unauthorized users
getting physical access to data
on the data center resources.
So that was a quick run through of the primary defense
and security considerations in Azure,
at every defense in-depth layer.
These controls are all part of a shared responsibility model
in Azure, comprising the security Microsoft manages
as the service provider,
built in controls for you
to protect your data and infrastructure,
and the intelligence Microsoft can provide you
from its global scale cyber defense operations.
You can continue your learning at the link shown,
and thanks for watching.
(electronic tones)