- Hello everyone, and thank you for joining us today.
Security has become part of everyone's job.
And great security outcomes
are delivered by the right combination of people,
process and technology.
People, of course, bring the skills, knowledge, creativity,
and an understanding of security and organizational goals.
The processes help people execute consistently
and with clarity.
And finally, the technology enables people
to execute these processes.
Just to give you some context
on the threat environment today,
Microsoft security researchers have tracked a 130% increase
in organizations that have encountered ransomware.
And when you consider the impact across downtime, people,
resources, networks, and more,
the average cost to rectify a ransomware attack
was $1.85 million.
This is but one example of why security
needs to be top of mind
throughout the entire life cycle of building
and hosting applications across different infrastructures.
Today, I will cover the security implications
of running hybrid and multi-cloud environments,
and how Microsoft can help you centralize
and control both security and the operational life cycle
of your infrastructure resources.
As Roan mentioned earlier,
the more you scale your applications
across different types of environments,
the broader the attack surface
and the potential for security risks.
At Microsoft, we've seen rapid adoption
and deployment of cloud services firsthand.
And this transition has been beneficial in so many ways,
including improvements in developer productivity
and business agility.
We also see that organization keeps large parts
of their infrastructure on-premises
while also choosing to work
across multiple different cloud providers.
This new hybrid reality
comes with its own set of challenges,
making it even more important to implement a comprehensive
and coordinated security strategy.
As the cloud footprint grows,
so does the risk surface,
and exposure to new and emerging threats.
In addition to the traditional on-premises attack vectors,
you now also need to secure everything you use in the cloud.
Not only infrastructure,
but identities, data, workloads, and apps.
But you simply can't do that
with the same traditional security tools
and methods that worked
for traditional on-premises environments.
We began our journey with Azure Security Center.
At the time we were the very first major cloud vendor
to provide a native cloud security posture management
and cloud security workload protection platform solution
for managing configuration
and prioritizing threats all through a single console.
Over the years,
we've added threat protection capabilities
to new cloud workloads,
and crucially we've expanded from being Azure only
to now cover AWS and GCP for a true multi-cloud solution.
And so, Azure Security Center
has now become Microsoft Defender for cloud.
These solution for cloud security posture management
and cloud workload protection
across your multi-cloud environments.
It helps find weak spots in cloud workload configurations;
it helps harden the overall security posture
of your cloud environment;
it helps protect workloads from evolving threats
across both multi-cloud and hybrid environments;
and it also integrates with the third-party solutions
that you already own,
it does that through our MESA program,
the Microsoft intelligence security association,
to enable response and automation workflows
for your security operations team.
So now when we talk about security posture,
there are four key concepts to think about.
Firstly, resource visibility.
To view and manage resource inventory.
Secure score, which is a top level view
of how an organization compares against the best practices
and recommendations that they need for improvement.
Compliance, to track alignment,
not only with industry standards,
but also your internal governance
and organizational policies.
And lastly, being able to classify the data
in cloud environments to prioritize security alerts
and actions based on the sensitivity of this data.
Now, once everything is running in production,
it's about protecting the workloads from advanced threats.
Defender for Cloud provides threat protection
for a broad range of resources across Azure, AWS,
and Google cloud platform.
And for on-premises resources as well,
including servers, containers,
even databases and service layer functions.
Detections are built for the unique attack vectors
of each resource built on powerful insights
from Microsoft threat intelligence,
which processes more than 24 trillion signals
every single day.
And while we support a wide range of workloads on Azure,
to be effective, it's critical to centralize
how you manage security across all these environments.
Key to this, is Azure Arc.
Azure Arc enables organizations
to seamlessly extend capabilities of Azure
to on-premises data centers, any public cloud provider
and to edge locations.
With Microsoft Defender for Cloud,
simply deploy the Azure Arc agent across workloads,
and then centrally secure and protect resources
no matter where they are hosted.
Beyond the security use cases,
Azure Arc also enables the central operation
and governance of diverse environments.
It functions as a single control plane to unify operations.
This makes it easier to adapt to changing requirements
through dynamic visibility, compliance and audit.
And by shifting these operations to Azure,
this can foster collaboration between teams
through shared tools for apps, data, and infrastructure.
We see that organizations using Azure Arc
for a variety of governance scenarios including:
standardizing their IT inventory management
through Azure organizational tools
like role based access control, resource groups, tags,
and search;
building out a governance and compliance strategy
that leverages Azure policy, Azure monitor
and Azure update management
to provide critical patches to their servers;
and empowering their developers with self-service access
to compute resources on-premises from VMware vSphere
or Azure without switching any tools or processes.
So with that,
I'm gonna hand over to Megan now to show you a demo
of how Azure Arc is at the center
of centralizing operations,
and how Microsoft Defender for Cloud
can help you deliver security
across your multi-cloud and hybrid environments.
- [Megan] Thanks Andrew.
So here I am in the Azure portal
and I browse through the Microsoft Defender for Cloud blade.
Microsoft Defender for Cloud is an excellent resource,
especially for the central IT team at Kentoso
for managing security across their entire estate.
Microsoft Defender for Cloud protects workloads in Azure,
and also expands its coverage to on-prem
and other clouds like AWS and GCP leveraging Azure Arc.
This dashboard view provides a high level status overview
and insights in the unhealthy resources,
regulatory compliance, security alerts,
and more for all of your resources,
even those that are in a different cloud.
The central IT admins at Kentoso
can also view the secure score,
which continuously assesses security vulnerabilities
and misconfigurations
so it makes it easy for the team to understand
their current security situation for all of its assets
in all cloud environments.
They can drill down to see the prioritized recommendations
on what they can improve
to maximize the impact of their work.
Recommendations with a lightning bolt,
under the insights column,
indicates that there is a quick fix, allowing the IT team
to quickly remediate their subscriptions at scale.
Microsoft Defender for Cloud
can help you find weak spots in your cloud configuration,
strengthen the overall security posture of your environment
and protect workloads across multi-cloud
and hybrid environments from evolving threats.
I am now gonna switch over to the automanage blade
in the portal.
Recently, Kentoso acquired a manufacturing company
and the central IT team managing acquisitions
needs to ensure all servers are taking advantage
of best practices.
The automanage service helps onboard configure,
monitor and remediate Azure best practice services
defined in the cloud adoption framework.
When navigating through the enablement experience,
the team can easily view the best practice profiles,
which describes a set of services that will be configured.
The team can also create their own custom profile
if they'd like to pick and choose
the set of services that fit their own IT requirements.
However, Kentoso already has an existing custom profile
that we should use.
So let's go ahead and select that.
We can view these profile details
to see all of the services and settings that are configured.
Next, let's go ahead and select the machines.
Here are all of the machines inside of the subscription
that I would like to assign this configuration profile to.
Notice you can assign it to Azure virtual machines
or Arc enabled servers.
This is really useful, especially for Arc servers
because Azure Arc enables you to take advantage
of Azure management services no matter
where your machine is running,
while automanage can automatically onboard
and configure those services for you.
Let's go ahead and select all of the machines
within the subscription,
and go ahead and review and create.
Next, I can hit create to assign the Kentoso profile
to all of the machines that I just selected.
This greatly reduces the OpEx burden on the Kentoso team
as they can apply this profile at scale
without having to configure each service one by one.
Furthermore, there is a built in policy
that the team can assign
so that all existing and future machines
will be onboarded with this custom profile,
guaranteeing all machines within the scope
will be configured with the best practice services
that the Kentoso team has configured.
Let's go ahead and check back
to see how our machines are doing.
As you can see, some have already moved
to the conformant state,
indicating that they are configured correctly;
while others are still in progress.
What is great about automanage
is that it will actually continuously monitor
the configuration of these services
to ensure they are configured properly.
For instance, if the monitoring extension
is accidentally uninstalled from the machine,
automanage will detect this and reinstall the extension,
allowing monitoring insight service to operate end to end.
The IT team at Kentoso can now focus
their efforts elsewhere,
as automanage will continuously check the configuration
of these best practice services
and auto remediate when needed.
- Thank you so much, Megan.
I hope you saw how easy it can be
to streamline your security and operational workflows
even when you're running across a multitude
of different environments.
If you want to know how our customers are using Azure Arc
and Microsoft Defender for Cloud,
check out some of these stories.
Next, to get started,
go to a free trial to get hands on directly.
And be sure to check out aka.ms/defendforcloud
to get started.