hey friends did you know that according
to most studies security breaches often
occur due to a lack of security hygiene
URI is here to show me how to use
security center to monitor my system
detect threats on Azure VMs app services
all kinds of Azure resources I'm going
to learn all about that and my secure
score today on Azure Friday hey friends
I'm Scott Hanselman and it's a sure
Friday I'm here with URI Diogenes and
we're going to talk about some
interesting things happening the Azure
security center space but first sir may
I just compliment you on your bookshelf
how many of those books have you written
twenty-two so far and there's a book
that's prominently placed and facing the
audience did you write this that's the
second edition of the edge of the queue
since the book for Microsoft press the
azure security center book from
Microsoft press you heard it here first
fantastic that's another call to action
for our friends who are watching as your
Friday to go and check that out
so I've had a couple folks come on
before to talk about Azure security
center and the first time I heard about
it I had no idea that this existed but
there's so much good information in
there yeah though as your security
center is available for every single
subscription and there are a lot of
capabilities that are part of what we
call the feeds here so you can take
advantage right away you just need to
activate and then start following the
secure best practice to secure the
different workloads that I mean everyone
should be using the fruits here there is
no reason to not be using right because
you get a lot of insights about all the
workloads that you have in your address
subscription that's a great point
there's so much stuff that's available
for free there is no reason for you to
not be doing this right now and I
understand that according to many
studies breaches and security issues
usually happen due to what they call a
lack of hygiene what is hygiene in the
context of the cloud security space so
secure hygiene is basically let's step
back a little bit and talk about this
whole cloud migration I lost of customs
that are migrating to the cloud they are
using a lot of legacy security controls
to try to protect those cloud workloads
and
the reality is that the cloud threats
are not exactly the same as the on-prem
threats so you need some sort of tooling
capability that was built in the clouds
to be able to identify potential
vulnerabilities on your workloads and
suggest you how it should harden how'd
she remediates those vulnerabilities and
that's exactly what security center does
does this secure hygiene scanning your
subscription looking for secure best
practices you apply to those workloads
now is that what they call cloud
security posture management CSP emza is
that that that process that that's
correct
CSP M is 30 knowledge that comes from
Gartner Ryan Gartner has this
terminology about what are the key
attributes that a CSP M platform should
have and security center fits into that
CSP M scenario because we have
capabilities that will allow you to
improve your secure posture for your
card workloads okay
so you've got that aspect of things
you've also got threat detection being
able to proactively tell you that things
are happening
you've got cloud workload protection and
posture management so you're being when
it happens you catch it and then before
it happens you can catch it yeah I
always say that the CSP M platform is
more the proactive word yeah these are
the things that you do in order to
enhance your secure posture and reduce
the likelihood that you're gonna get
compromised right and then once you've
done all this homework of enhance your
security posture what you need to do now
is be sure that you are monitoring the
environment for threats in other words
if someone is trying to attack your
environment you want to know if there is
someone trying to do it for example or
RDP brute-force attack because it's very
common to provision vm's in Azure and
leave the RDP port open right and the
RDP boots forces one of the main attacks
that is happening so if you do not have
a tool such as as your secure center
monitoring you really do not know if
someone is trying to RDP brute-force
your system mm-hmm
now you mentioned at the beginning that
there's really no
reason that people should not be using
security center because there's a free
tier maybe you can show in a demo what I
would see if I go into that secure
security center and we're going to tell
me about my cloud security posture sure
I can - I can show you right now all
right let's do it yeah
so as soon as you open up Security
Center dashboard you have this very
comprehensive dashboard with the policy
and compliance which shows you the
secure and the secure score is something
extremely important because it helps you
to have the visibility of how you are
from the secured portion management
perspective at that at that point right
you always want to reach 100% which
means you address all the security
commendations you enhance your security
Porsche and you remediate all
recommendations that secure sensor is
providing so the recommendations are
located here when you click on this you
have a list of security controls where
each security control has a list of
recommendations as you start address in
each one of those recommendations and
you finish the entire secure control you
gain you're going to increase your
secure score in this amount of points
right so that's how you actually drive
this number to 100% by using the
top-down approach of remediating the
recommendations a base on the order that
we are surfacing here okay in this order
we may vary according to the
subscription because not every single
subscription has the same amount of
resources in the same amount of
workloads so this lists that you see on
my screen the order may vary from what
you are seeing on your asking at that
point but we ours organize the controls
based on the impact on this acute score
so just go on each one and remediate and
the good thing that we also do as part
of this is some of those recommendations
we have what we call the quick fix which
allows you to click on the
recommendation in assuming that you have
privileges on the workload you can just
select the workload and click on the
remediate so
what you're doing at that point is you
are implementing those these steps that
are here so you are automating the
remediation of this workload okay so
very powerful capability that allows you
to not only visualize but remediate from
the same dashboard mm-hmm interesting
and those remediations you can do them
manually if you feel paranoid or you
need extra control or you right use the
quick fix which would be like a run book
of some kind that'll do that for you
yeah and if in what we do to be
extremely transparent because of this
paranoia and some people really need to
know so you remediate what are you doing
well we provide you the code here if you
click on remedy view remediate logic you
provide here exactly what we're doing so
in order for you to say I really need to
know what are you changing in my
environment so we are very transparent
on that and we shall hear that's a
really amazing feature that's huge
because sometimes I think that we always
are afraid in the cloud that it's gonna
be push a button and then magic happens
and I'll never know what really is going
on you actually give them the code you
show them the arm template that's gonna
be run against their resources exactly
yeah we are extreme and trust me at that
point in and this also helps them if
they don't want to use the quick fix
they can just get that code and deploy
their own templates right that's another
alternative that's fantastic and I see
also the regulatory and compliance as
well that's a really interesting and
powerful control right what we do here
we have a specific dashboard just for
the regulatory in compliance and we map
with a lot of industry standards and
this helps organization that needs to be
for example PCI compliant to identify
what are the workloads that needs
remediation notice that some of those
items they are grayed out which means
that securin does not have an assessment
for that control for example one point
one we don't have an assessment for that
that's why it's gray out but one point
two we do have and then when you start
drill down it shows you the items that
you can that you need to take care in
order to be compliant with this item one
point two point one okay so that's
another way to visualize
in other ways she continues improving
your security Porsche via the regulatory
compliance okay
so this really gives me a sense of my
cloud security posture right that's your
posture management let's assume that I
do have a poor score cuz your example
here has not a great score at 45% let's
move to the threat detection side and
see what if someone got in what kind of
alerts could we potentially hear about
now here is something that I want to
clarify while the the CSP M
recommendations are part of the freights
here the threat detection are part of
the standards here in order sure you
have tread detection you have to upgrade
so you go here on the prices and
settings select your subscription okay
and then you upgrade to standard there's
between free and standard that makes a
lot of sense right so you upgrade from
field to standard and the good thing is
that we are extremely granular which
means that we provide threat detection
for different paths services so if you
have app service you can enable that
detection for the observes for sequel
database physical database we have that
as well so you can enable specifically
for the workloads that you have on that
subscription for example if I don't have
kubernetes here I can disable that if I
don't have Kibo I can disable that right
so I can be extremely granular on that
matter
those things are separate threat
detection because remember what I was
talking previously about using legacy
controls you cannot really use threat
intelligence and security controls that
were created for a on-premise
environment into the cloud because the
analytics are different right so if I
want to monitor potential attacks again
my against my key vote I need to be
explicitly I need to have analytics for
keyboard and we do have that's why we
offer the tread detection for keyboards
right that's great
I like that how transparent it is and
the granularity that makes it very clear
but as you point out here everyone on
the free tier gets to see that secure
score which will help them make an
educated decision
yeah because the the assumption is that
even if you do not want or you don't
have budget to utilize the threat
detection capability standards here you
want to make sure that at least you've
been diligent if you address all your
security commendations and that's what
we are pushing a lot make sure to use
this accused court to continue to drive
your enhancement for the secured portion
I take it I take it ok so then if you've
upgraded to the above the free tier what
does that look like on threat detection
so the trade detection is this tile here
if you do not have standards here this
it will be grayed out right and so in my
case I have sent it to you when I click
here I have the security alerts
dashboard and the secured dashboard is
where I see attempts to compromise my
system basically someone just did a
sequin Jackson attack so when I click on
the stick you injection here
it opened apt the resource that was
attacked when I click on the resource it
gives me the details about the attack it
tells me what the secure injection was
ok it tells me the server the database
the IP address even tells me the
vulnerable statement here the with
details explanation ok Wow our every
single alert an actionable thing that I
should freak out about and and and panic
about or some of them are just people
poking around are these attacks that I
have that are really bad or some of
these things that have been detected and
that aren't something I need to take
action on notice that each alert has a
severity so if you receive a sequin
Jackson with a high severity alert you
better take a look at what it is so look
into this severe e is how you're gonna
prioritize if this is something that you
should really take care of not if it is
for example a medium or a low then you
might want to reveal you know in three
eyes first but you definitely need to
take care everything that is high
severity yeah and where there are new
things that were announced it build
around the threat detection feature
right what we announced at Build is
something called the suppression
capability because one thing that our
customers told us is that nowadays is
very common that organization they have
their own Red Team gleam pen test
against servers in the cloud so they
said look I have a team that is doing
pen test against my service in Azure
insecure center is freaking out it's
sending a lot of alerts which is
expected because those are legitimate
attacks securin does not know that it's
a pen test so we we are going to raise
those alerts and he said but this is
coming from machines that I we know are
doing the pen test so like it should
suppress those alerts there is any way
for me to suppress alert to flag that as
a false positive - for my for my
environment and the answer is now is yes
you can select for example this one
suspicious as SVC hostess execution I
can click on these three dots and click
on create suppression rule and from here
I can customize my suppression of rule I
can say the this is the alert I can
customize the entities I can say if the
host dns domain is equals to and then I
might type I want you to suppress this
this rule
Ryan I can select a reason here of why
I'm suppressing this and I could even go
and put an expiration and say the red
team is here for the next week right
exactly because sometimes you say
sometimes you want to suppress just for
a month or or two weeks you know because
this is a temporary condition so you can
do that that's pretty slick now the good
thing is people ask well what happened
with those alerts I'm not gonna be able
to see anymore because I suppress so
they go to a special place well what we
are changing behind the scenes actually
is just a state of the alert so if you
look at this column called state those
others are active so if I click on
filter here you see that there is all
the one of the state is dismissed so if
I look to alerts that are just missed is
going to list only the
that I dismiss so everything that was
dismissed by those rules will show up
here into the dashboard when I select
this filter right if I might make a
mistake and suppress something important
I don't write like I've thrown it in the
trash it's not even in the trash or
recycle bin it's just in a different
state that is easily found with just one
place that way exactly that's fantastic
so I feel like even as a small little
business I should go right away and I
should take a look at my secure score
absolutely absolutely as I said take
advantage of the security standards here
I mean the Fried's here because you have
all the secured portion capabilities
there you have the capability to
visualize what are the areas that you
can improve in your as your deployment
and remediate those recommendations make
sure to use your secure score as your
KPI because you can show management
progress you can say look when I started
this journey we were in 40% now we are
80% so that means that we have been
diligent you improve your hours that you
Porsche is a great way to show the
commitment to continuous improvement
that is fantastic so folks can get
involved right now you check out the
free tier that gives you all the
security recommendations and then you
can even try standard four for 30 days
and give that a try as well right so
that's that's a great thing about here
is that you can do a proof of concept
project and this is what I always taught
you to customers go ahead and enable
send it to you is not gonna be charged
for the first 30 days on your
subscription so I wrote an article I can
share this on the link for the show but
I wrote an article for you to do a POC I
specify all the scenarios that you
should validate we have play books for
you to simulate alerts and and and how
to validate different scenarios validate
for 20 days and then have a meeting in
discuss is it worth to upgrade to keep
it rolling or should I downgrade go back
to free tier right at least you have a
chance to validate those scenarios
if they are important for you if the
others your needs fantastic we're gonna
include all the things that we talked
about in the show notes so check those
out below I am learning all about cloud
security posture management and workload
protection with Azure security center
today on Azure Friday
hey thanks for watching this episode of
azure friday now I need you to like it
comment on it tell your friends retweet
it watch more as your Friday
[Music]