Tailwind traders is broadening its use of Azure services.
It still has on-premises workloads
with current security-related configuration,
best practices, and business procedures.
How does the company ensure that all of its systems meet
a minimum level of security and that
its information is protected from attacks?
Many Azure services include built-in security features.
Tools on Azure can also help
Tailwind traders with this requirement.
Let's start by looking at Azure Security Center.
Azure Security Center is
a monitoring service that provides
visibility of your security posture
across all of your services,
both on Azure and on-premises.
The term security posture refers to
cybersecurity policies and controls,
as well as how well you can predict,
prevent, and respond to security threats.
Security center can monitor
security settings across on-premises and cloud workloads.
Automatically apply required security settings
to new resources as they come online.
Provide security recommendations that are based
on your current configurations, resources, and networks.
Continuously monitor your resources and
perform automatic security assessments
to identify potential vulnerabilities
before those vulnerabilities can be exploited.
Use machine learning to
detect and block Malware from being
installed on your virtual machines and other resources.
You can also use adaptive application controls
to define rules that
list allowed applications to ensure
that only applications you allow can run.
Detect, and analyze
potential inbound attacks and investigate
threats and any post-breach activity
that might have occurred,
and provide just-in-time access control
for network ports.
Doing so reduces your attack surface
by ensuring that the network
only allows traffic that you
require at the time that you need it to.
Tailwind traders can use Security Center to get
a detailed analysis of
different components in its environment.
Because the companies resources are analyzed against
the security controls of
any governance policies it has assigned,
it can view its overall regulatory compliance
from a security perspective all from one place.
Here's an example of what you might
see in Azure Security Center.
Let's say the Tailwind traders
must comply with the payment card,
industries data security standard.
This report shows that the company
has the resources that it needs to remediate.
In the resource security hygiene section,
Tailwind traders can see the health of
its resources from a security perspective.
To help prioritize remediation actions,
recommendations are categorized as low, medium, and high.
Let's now take a look at how secure score is implemented.
Secure score is a measurement of
an organization's security posture.
Secure score is based on security controls
or groups of related security recommendations.
Your score is based on the percentage
of security controls that you satisfy.
The more security controls you satisfy,
the higher the score you receive.
Your score improves when you remediate all of
the recommendations for
a single resource within a control.
In this example from the Azure portal,
we can see the portal showing a score of
57 percent or 34 out of 60 points.
Following the secure score,
recommendations can help protect
your organization from threats.
From a centralized dashboard and Azure Security Center,
organizations can monitor and work on
the security of their Azure resources like identities,
Data, apps, devices, and Infrastructure.
Secure score helps you report on
the current state of
your organization's security posture.
Improve your security posture by
providing discoverability, visibility, guidance,
and control, and compare
benchmarks and established key performance [inaudible].
Security Center also includes
Advanced Cloud defense capabilities for Virtual Machines,
network security, and file integrity.
Let's take a look at
how some of these capabilities apply to Tailwind
traders just in time VM access.
Tailwind traders will configure
just-in-time access to VMs.
This access blocks traffic by
default to specific network ports of
virtual machines but allows traffic for
a specified time when an
administrator requests and approves it.
Adaptive application controls.
Tailwind traders can control
which applications are allowed to
run on its virtual machines.
In the background, Security Center uses
machine learning to look at
the processes running on a virtual machine.
It creates exception rules for each resource group that
holds the virtual machines and provides recommendations.
This process provides alerts that inform the company
about unauthorized applications that
are running on its VMs.
Adaptive network hardening.
Security Center can monitor
the internet traffic patterns of the VMs and compare
those patterns with
the company's current network security group settings
or NSG settings.
From there security center
can make recommendations on whether
the NSGs should be locked down
further and provide remediation steps.
File integrity monitoring.
Tailwind traders can also configure the monitoring of
changes to important files on both Windows and Linux,
registry settings, applications, and
other aspects that might indicate a security attack.
As you can see, Tailwind traders can use Security Center
to get a centralized view of all of its security alerts.
From there, the company can dismiss
false alerts, investigate them further,
remediate alerts manually, or use
an automated response with a workflow automation.
This workflow automation uses
Azure Logic Apps and Security Center Connectors.
The Logic App can be triggered
by a threat detection alert or
biosecurity center recommendation filtered
by name or by severity.
You can then configure the logic App to run an action,
such as sending an email or posting
a message to a Microsoft Teams channel.