>> Welcome to another episode of the Azure Enablement Show.
Today we're going to have a look how you can improve security for
your Azure environment using the Cloud adoption security review.
[MUSIC]
>> Welcome back. My name is Thomas and I'm
here with Daniel to talk about how you can
improve the security for your Azure or
Cloud environment using the Cloud adoption security review.
Daniel, great to have you here today.
Before we actually go in and you
show us a little bit more about that review,
can you explain to us what the Cloud adoption security review is?
>> Yeah, sure. To answer this question,
I need to explain first what the Cloud Adoption Framework is.
Security is an ongoing journey of
incremental progress and maturity and not in static destination.
The Cloud Adoption Framework provides security guidance for
this journey by providing clarity
for the processes, and best practices.
This guidance is based on real-world experiences of our customers,
of Microsoft's own security journey,
and lessons learned, and the work done with
other organizations like NIST and CIS.
This guidance is manifested in
the Cloud Adoption Framework secure methodology,
which provides a vision of
the complete end state of your security journey.
This assessment gives you the opportunity to self-assess
your security journey of
your Cloud adoption against the secure methodology over time.
>> This is fantastic. We're taking the security guidance from
the Cloud Adoption Framework and making sure that customer can
basically run an assessment against it to make sure
that they are building or perhaps created a secure environment.
This is fantastic.
Now, before we actually can start with this,
I have to ask, if it's okay,
are there any prerequisites?
Are there other requirements before
I can actually take that self-assessment?
>> Yes, indeed. As you see in this slide deck since we are
addressing security that's in the Cloud Adoption Framework,
customers should be in the CAF Ready stage.
At this phase or stage,
customer should already have designed their Azure landing zones.
They should know about their Cloud adoption model and
security is critical here so that you have a secure design
or plan before you're going to the next phases and deploy
your workload resources into
your landing zones because your
should deploy them with security in mind.
>> Now, fantastic. This assessment,
if I understand that correctly,
will really help our customers to identify if they have
the right security strategy in place
on their Cloud adoption a journey, is that correct?
>> Exactly. At the end of these assessments,
they receive actionable recommendations
to incrementally improve their security.
Actionable means, by the way,
that they can import those recommendations into
the Azure DevOps or GitHub project and they're
able to track the implementation progress for
standard project management processes or tasks.
>> Awesome. What are the areas we are actually
checking for security and best practices in this assessment?
>> That's important. We are using
the CAF secure methodology for this assessment.
This methodology provides guidance on
the integration of security with business processes,
also called business alignment and security disciplines.
Today, static security processes
cannot keep up with the pace of change in Cloud platforms,
the flat landscape,
and the evolution of security technology.
You need to transform into a dynamic portion to constantly change,
adapt, and improve your security.
>> You a couple of time now mentioned security mythology.
Can you tell me a little bit more about this?
>> Absolutely. To adapt this move or shift,
you should focus on your business alignment in three categories.
Number one: risk insights.
The goal of security is to expose and mitigate risks.
This requires insights into risks and deep security integration,
which is the second category.
Integrate security insights deeper into daily operations of
the business and IT environments
at all levels of the organization.
Security teams should work together and collaborate to
avoid increased business risks
resulting from operating in silence.
The third category, business resilience,
which means focusing on ensuring the organization is
resilient by being able to continue operations during an attack,
rapidly respond to incidents,
and to regain fully operational status after an attack.
>> I figured these processes we are building there,
they must have some impact or they require
some changes or investments for these organizations. Is that true?
>> You're right. This business transformation
will have an impact on
the whole organization and it
requires changes and investments, as you mentioned.
The secured methodology also provides guidance,
how to adapt to those changes,
and what you need to do in
the following security principles or disciplines.
Number one: access control,
which means embracing a zero-trust approach and creating
access boundaries and segmentation to
reduce the impact of security breaches.
Attackers are constantly looking to get into your environment.
The security operations discipline focuses on reducing
the time attackers have access to resources by detecting,
responding to, and helping recover from attacks.
Assets always change to keep the needs of the business.
Business processes are mapped to different assets like files,
Cloud services, identities, and so on.
Asset protection means maximizing the protection of
all assets to minimize
risks like data breaches or data exfiltration.
Security governance, which is the next discipline,
provides standards and guidance to drive consistent execution of
security best practices and controls and aligns to
your business priorities with technical implementations.
It provides free translation from
business requirements and tasks into the technical environment.
The last security discipline,
innovation security is the integration of security and
tools into the development and operational processes,
DevOps, which then creates a DevSecOps process.
The goal is to shift from
your organization from a waterfall development cycle to
an age DevSecOps lifecycle to address
security concerns early with processes,
for instance, like track modeling and tools
for automated credential scanning or governance scanning.
>> This is absolutely great.
I especially love the part or you just said,
hey, we need to implement security early.
All the benefits from having that in place,
that makes lot of sense.
Now, obviously, we talked a lot about it.
Can you show us the security assessment?
>> Yeah, absolutely. Let me show the assessment portal
and how to conduct some Cloud adoption security review.
On the web, you need to navigate
to aka.mslearn/assessment and then you will
see this assessment portal
and you can browse all available assessments.
In our case, we need to search for
Cloud adoption and hit "Search".
Then we see this Cloud adoption security review.
Let's select this one. Then you see this button, Start Assessment.
What you also see here below your sessions,
which means you can stop an assessment.
You can stop. Later on,
you can continue with this assessment.
You can create different versions of these assessments,
for instance, after three months,
six months, and then you can compare those results.
For this to be able to see your sessions,
you need to log in on this side.
In our case, let's start this assessment.
The first choices which you need to answer or which you need to
decide is on which domain area you want to do these assessments.
Remember, those are the Cloud adoption security methodology.
You see business alignments,
access control, security operations, and so on.
This is just what I explained,
which means you can select all of them or you can just focus on,
let's say asset protection like I do here.
Select your domain areas and then hit "Start".
Then you will see you're presenting
with the first questions, in our case,
in asset protection,
you need to go through each of those questions.
You need to think about your answers,
if you have implemented them,
if they are already implemented into landing zones or not,
if you need to do something,
and then just select
the corresponding checkboxes for
each particular questions and then hit "Next".
You need to do this for the remaining pages on this assessment.
At the end, when you're done,
it will look like this one.
You will present it with
your results and then you will get your scoring.
You see the number here and you also see
this blue box with "Export to CSV," which is important.
As I mentioned, these assessments,
the recommendations are actionable,
which means what you can do, you can export them,
the CSV file, and then you can import them into
a project management tracking tool like
Azure DevOps or GitHub and to track the progress.
If you scroll down, you'll see the different recommendations.
In our case, you've 26 recommendations for
asset protection and you see the individual recommendations.
If you select one of them,
it will navigate you through the documentation,
Cloud Adoption Framework,
Azure Architecture documentation that you will find
more information how to implement this particular recommendation.
>> Awesome. This is fantastic.
I love that we can do the assessment and that it can
obviously show us where we actually need to go,
that these items are actually actionable.
I see that I'm not doing well, for example,
in this case in encryption and it
directly brings me to the encryption page.
But I also like, and I want to amplify this,
what you said at the beginning,
it's great to actually do this review multiple times.
I do it at the beginning of
my Cloud journey and then during that time I
have different milestones where I can go on and
actually like if I'd done changes,
I can actually see how they work and how they
impact my security score.
This is fantastic, Daniel.
Where do people go if they want to learn more about this?
>> They need to go through the assessment portal site.
It's https://aka.ms/assessments.
This link is also available in the video description below,
and that's the entry point here.
>> Awesome. Fantastic. Thank you very much, Daniel.
I will definitely go and try to check how secure
my environment this and I
hope that a lot of others do that as well.
Also, thank you very much for everyone watching.
If you want to learn more about the Cloud Adoption Framework,
make sure you check out aka.ms/adopt.
[MUSIC]