Coming up.
We look at Azure Security Center.
A new service that helps you tap into Microsoft's real-time intelligence
on the threat landscape.
Including how it can help you get centralized security monitoring
set policy and deploy security controls for your Azure resources
and get advanced threat detection with machine learning.
Microsoft Mechanics
I'm joined by Product Manager Ryan McGee
Welcome!
Thank you.
So from IT and information security perspective
what are we trying to solve for?
Well, if your organization has a lot of resources deployed in Azure
you probably have a list that looks like mine here but a little bit longer.
And if you're not the operational owner of all those resources
it can be difficult to get the visibility you need into
the security state of them
and if you're the security administrator, well, you're definitely going to be accountable
for the security state of all these resources.
And so first and foremost Azure Security Center is here to help give you that visibility.
Now I have it pinned here to my start board
but you can actually open it up for the first time by hitting the browse button here.
And if you just start typing 'security'
you can get into it here.
And you'll see immediately this centralized view of all the security health
of your resources across all your Azure subscriptions.
But the first thing you want to do when you come into it
is turn on information collection.
Ok, so I see that you have that one turned on already
I'm assuming, it's not on as default though.
Yeah, that's right. You make the decision to turn this on.
And when you do, we start collecting a bunch of information
from the configuration and behavior of the virtual machines.
Windows and Linux in your subscriptions
in addition to the things we already know about your
networking and your your other types of resources databases and applications.
But if you're a security administrator
and your organization has deployed some resource to the cloud
you're going to want to define some policies
for how these resources get protected against attack
and how data is secured.
Yeah, so you see these policies here
are going to drive what recommendations I'm going to get.
So I can set all kinds of policies for
systems, for networks, for applications and so forth.
What about different types of resources?
What if you have some resources that are for
dev and test and also ones for production?
You don't want to have the same policies going across both of those.
Right, so we do separate these policies my subscriptions.
So, I can set one policy for my production resources
maybe that was my Pay As You Go subscription that we just looked at.
Then I could have a different policy
if all my development test resources were here in this Visual Studio subscription
I could set a different policy here.
Now once you've set all of those
you can go back and you're ready to look at resource security health.
So this is pulling from all those policies and giving you some recommendations
based on the policy you've set.
So I'm going to see here like...
Do I have on my virtual machines updated?
Do they have the right baseline rules configured?
Are they running malware? Anti-malware I should say.
I can see whether my databases are encrypted and auditable.
I can look at my web applications make sure they have without firewalls in front of them.
Or let's look at networking specifically.
I can see here that I have some network interfaces
that don't have network security groups enabled.
Or I also have a few endpoints without access control list.
So these are the types of recommendations that I get.
And on any one of them I could drill in and get some more information.
We also collect them all in one spot here in this recommendations down
for easy access.
So now let's look at this one
for example.
I have one that says I have a
web application that is not protected by a web application firewall.
And as I look at that it's going to give me a recommendation about what to do about it.
I'm assuming this is where you're going to click on one of those
it will take up to the marketplace to have to go off and purchase it and get all configured.
No actually, it's going to take me right through the process
right here in context.
So I can click on this
and it will walk me through the installation process
it also does a bunch of the configuration for me.
And once that thing is installed
that partner solution will start feeding data back into Azure Security Center.
So that's even feeding more into the central security view of your Azure resources.
Ok. So now that you have all these right controls and policies in place
across different subscriptions vulnerabilities
attackers are still going to be innovating with different ways
to try to go in and attack your accounts.
How do we take into account for all these different types of threats?
Where this is where Microsoft Intelligence kicks in.
We actually have a bunch of security alerts down here
where we're going to start to notify you about things that you might not otherwise catch.
By virtue of having huge presence on the Internet and watching everything that goes on
in other Azure subscribers deployments
we can learn a lot about the global landscape of threats.
And so those alert show up here.
And you can see for example I have one at the top here
that says RDP brute force attempt, right?
Maybe I'm protected but i want to know about the
fact that somebody's trying to get into this machine.
And what we're doing here is we're actually applying advanced analysis
and machine learning to all of that global threat intelligence that we've gathered
so that we can know what is abnormal for this machine?
You know not just in the global sense
but what's an abnormal amount of RDP traffic for that particular machine?
So that's one type of alert.
You'll also get alerts about behavioral analysis on virtual machines
abnormal network communications
and communication with known malicious IP's on the internet.
We know about those because of our global threat intelligence as well.
So we've seen standardized policies we've seen alerts
and how you can stay protected across multiple different types subscriptions.
So I know that Satya has been talking a lot about security intelligence.
This goes way beyond simple VM policies.
How does this fit into the overall big picture?
Well this is one great example of the direction that Microsoft is taking security.
We're really working on building that intelligence
and continuing to build it.
And so as we continue to collect and analyze security signals
across Azure and from our other products devices and applications
you'll see even more automated section of new threats and vulnerabilities added to Security Center
without you having to turn anything new on.
I'm bought in. How do I go ahead and started man?
Well it's really easy.
You just start it up the way that we showed earlier.
It's available in preview now for every Azure subscriber.
Is it free to go off and use this right now?
For the most part, yes.
We looked at policy-setting resource security health recommendations
that's all free with every Azure subscription.
There's a couple of cost to be aware of.
One is, when we turn on information collection as we did in that first step
we have to store that information somewhere.
So there's a slight costs you incur in terms of storage.
And the other is
when we do all of that machine learning and advanced analytics
to give you those security alerts that continue to advance and grow over time
there's an additional fee per resource associated with that capability.
Hopefully this will help you protect your resources in Azure.
Keep watching Microsoft Mechanics for the latest updates
By for now!
Microsoft Mechanics
www.microsoft.com/mechanics