Security (i) & Audits

Well-Architected Framework (WAF).

• BLUF: 5 guidelines to produce high-quality, stable, and efficient cloud architecture.

• Guidelines: (5)

  1. Reliability: The workload is resilient (withstand, recover quickly) and available. 

  2. Security: [Security Documentation, Policy & Controls] Throughout the Application Life Cycle (ALM), from design & development, [Security], and implementation, to deployment, and operations (DevSecOps). 

  3. Cost Factors & Cost Optimization: Focus on generating incremental (increase) value early using a “Build-Measure-Learn” feedback loop to gain measured customer reactions, learn, and adjust (Pivot) to improve customer interactions.

  4. Operational Excellence:  Keep Operations, Production, Processes, and Applications running. Do audits and QA/QC using a “Maturity Assessment Plan” (aka Checklist). 

  5. Performance Efficiency: The workload can scale (to increase or decrease) to meet user demands efficiently.

Secure & Audit the Cloud Architecture (for Impact Level 5-IL5 Data) -- using Azure.

• BLUF: Secure & Audit the cloud architecture in a government cloud environment, especially for Impact Level 5 (IL5) data, requires "A Multi-Layered Approach." 

• Steps to Ensure "Compliance" (to "Audit") with Industry Standards and Regulations: (5)

  1. Leverage Built-in Security Features:

     1. Azure Government Offerings: Azure Government (Environment) is a separate cloud environment specifically designed for US government agencies and their workloads. It adheres to stringent compliance regulations and physical isolation from the public cloud.

     2. Security Defaults: Utilize Azure Policy and Azure Security Center to enforce security best practices and configurations across your cloud resources. These tools can help automate security baselines and continuously monitor compliance.

     3. Identity and Access Management (IAM): Using Azure Entra ID (aka Azure AD) for centralized identity and access control. Enforce strong authentication protocols like Multi-Factor Authentication (MFA) for all access.

  2. Secure Network Design:

     1. Virtual Networks (VNets): Create logically isolated Azure VNets to segregate (isolate) resources based on security needs. Implement Azure Network Security Groups (NSGs) to control inbound and outbound traffic flow within the VNets.

     2. Private Endpoints: Restrict data exfiltration (a security breach) by using Azure Private Endpoints to allow your VNet resources to securely access Azure services without traversing the public internet.

     3. (EXTRA) Boundary Protection: Additional network layer protection at the entry point to your cloud environment. Consider deploying a DISA Secure Cloud Computing Architecture (SCCA) using a Boundary Cloud Access Point (BCAP).

  3. Data Protection and Encryption:

     1. Data Encryption: Encrypt all "DATA AT REST" and "DATA IN TRANSIT" using industry-standard encryption algorithms like Azure Key Vault to manage and control cryptographic keys.

     2. Data Loss Prevention (DLP): Implement Azure Information Protection (AIP) to classify and protect sensitive data by restricting unauthorized access and data exfiltration attempts.

     3. Activity Logging and Auditing: Enable comprehensive activity logging for all resources and user activity within your cloud environment. Utilize Azure Monitor for centralized log collection and analysis to detect anomalies and potential security threats.

  4. Compliance and Regulatory Framework:

     1. NIST Compliance. 

        • NIST Security Controls.

     2. CISA Compliance (Cloud Security Technical Reference Architecture).

        • ZTMM; PQC...

        • CISA's Cloud Security Reference Architecture v2 -- https://www.cisa.gov/sites/default/files/2023-02/cloud_security_technical_reference_architecture_2.pdf

     3. FedRAMP High Baseline: Ensure your cloud environment adheres to the FedRAMP High baseline for securing government data. Microsoft Azure Government is FedRAMP High compliant, but you'll still need to implement additional controls to meet specific agency requirements.

     4. DISA SCCA Compliance: For IL5 data, consider following the DISA's Secure Cloud Computing Architecture (SCCA) guidelines which provide a framework for securing sensitive workloads in commercial cloud environments. -- SCCA Guidelines (3): (1) Standardized Approach: SCCA offers a standard way to secure cloud environments for Impact Levels 4 and 5 data, the two highest classifications for sensitive DoD information. (2.0) Focus Areas: It addresses security at two levels: (2.1) Cloud Access Point (CAP): This acts as a secure gateway, controlling access to the cloud and protecting DoD networks from cloud-based threats. (2.2) Virtual Data Center Security Stack: This additional layer safeguards applications and data residing within the commercial cloud environment. (3) Cloud Agnostic: SCCA applies to Infrastructure-as-a-Service (IaaS), Platform-as-a-Service (PaaS), and Software-as-a-Service (SaaS) offerings from various cloud service providers (both on-premises and off-premises). 

  5. Continuous Monitoring and Improvement:

     1. Security Vulnerability Management: Regularly use Azure Security Center to scan your cloud resources for vulnerabilities or other vulnerability scanning tools. Patch identified vulnerabilities promptly to minimize the attack surface.

     2. Penetration Testing: Conduct periodic penetration testing to identify potential security weaknesses in your cloud environment and remediate them before they can be exploited by attackers.

     3. Security Awareness and Training: Regularly train your staff on cloud security best practices and procedures to ensure they are aware of potential threats and can contribute to a strong security posture.

• Authoritative Sources:

  1. Secure Azure Computing Architecture (SACA): https://learn.microsoft.com/en-us/azure/architecture/guide/security/security-start-here

  2. DISA Secure Cloud Computing Architecture (SCCA): https://www.disa.mil/~/media/Files/DISA/Fact-Sheets/Secure-Cloud-Computing.pdf

  3. Cloud Security Technical Reference Architecture (CISA): https://www.cisa.gov/sites/default/files/2023-02/cloud_security_technical_reference_architecture_2.pdf

Securing the Cloud using Azure (In General).

• BLUF: Involves implementing a variety of Azure tools and best practices to protect your data, applications, and infrastructure. Here are some key steps and Azure tools to help you achieve this:

• Azure Tools for Cloud Security: (9)

  1. Azure AD (aka Azure Enrra): For identity and access management.

  2. Azure Virtual Network (VNet): For network security.

  3. Azure Key Vault: For data protection and encryption key management.

  4. Microsoft Defender for Cloud: For threat protection.

  5. Azure Security Center: For security management and recommendations.

  6. Azure Application Gateway with Web Application Firewall (WAF): For application security.

  7. Azure Monitor & Azure Log Analytics: For monitoring and logging.

  8. Azure Policy: For compliance and governance.

  9. Azure Sentinel: For centralized security monitoring, threat detection, automated response, and compliance.

• STEPS: (8)

  1. Identity and Access Management (IAM): Use Azure AD to manage user identities and control access to resources. Implement multi-factor authentication (MFA) to add an extra layer of security.

  2. Network Security: Protect your network by using Azure VNet to create isolated network environments. Implement Network Security Groups (NSGs) to control inbound and outbound traffic to your resources.

  3. Data Protection: Encrypt your data at rest and in transit using Azure Key Vault to manage encryption keys and secrets. Use Azure Storage Service Encryption (SSE) for data stored in Azure Storage.

  4. Threat Protection: Utilize Microsoft Defender for Cloud to detect and respond to threats across your Azure environment. This tool provides advanced threat protection for your workloads and helps you maintain a strong security posture.

  5. Security Management: Implement Azure Security Center to gain visibility into your security posture and receive recommendations for improving security. Use Azure Policy to enforce organizational standards and assess compliance at scale.

  6. Application Security: Secure your applications by using Azure Application Gateway with Web Application Firewall (WAF) to protect against common web vulnerabilities. Implement Azure API Management to secure and manage your APIs.

  7. Monitoring and Logging: Use Azure Monitor and Azure Log Analytics to collect and analyze logs and metrics from your resources. Set up alerts to notify you of suspicious activities or potential security issues.

  8. Compliance and Governance: Ensure compliance with industry standards and regulations by using Azure Blueprints to define and deploy compliant environments. Use Azure Resource Manager (ARM) for automated templates to deploy secure and compliant resources.

  9. Advanced SIEM (SecInfoEventMgmt) & SOAR (Security Orchestration, Automation, and Response): Azure Sentinel fits into the overall cloud security strategy. -- Offering (5) -- 

     1. Centralized Security Monitoring: Azure Sentinel allows you to collect data at scale from all users, devices, applications, and infrastructure, both on-premises and in multiple clouds. This centralized approach helps in monitoring and detecting threats across your entire digital estate.

     2. Threat Detection and Investigation: With built-in AI and machine learning, Azure Sentinel can analyze large volumes of data to detect threats in real-time. It provides tools for investigating threats, including the ability to correlate alerts into incidents, making it easier to understand and respond to potential security issues.

     3. Automated Response: Azure Sentinel enables you to create automated playbooks using Azure Logic Apps. These playbooks can automate responses to security incidents, reducing the time it takes to mitigate threats and minimizing the impact on your organization.

     4. Integration with Other Azure Services: Azure Sentinel integrates seamlessly with other Azure services such as Azure Monitor, Azure Security Center, and Azure Active Directory. This integration enhances your ability to manage and secure your cloud environment effectively.

     5. Compliance and Governance: Azure Sentinel helps you maintain compliance with industry standards and regulations by providing comprehensive audit trails and reporting capabilities. It also supports Azure Lighthouse, allowing service providers to manage multiple customer environments securely 

Securing from Shadow Access to ZT (Threat).

• BLUF (3): (1) Shadow Access refers to unauthorized, unmonitored, and often excessive access to cloud resources like applications, data, and networks. (2) This lack of visibility creates security blind spots, making it easier for attackers to exploit these unintended access points. (3) It arises due to the increasing complexity of cloud environments with:

  1. Automated account creation: identities for users and applications are (accounts) created automatically, making it difficult to track permissions.

  2. DevOps practices: Faster development cycles can lead to temporary access becoming permanent or overly permissive.

  3. Cloud-native architectures: The interconnected nature of cloud services creates hidden access pathways.

• Shadow Access vs. Zero Trust.

  1. Zero Trust is a security model that assumes no user or device is inherently trustworthy. Every access attempt needs verification regardless of location or origin. 

  2. Shadow Access directly contradicts Zero Trust principles by granting unauthorized access that bypasses security controls.

• Steps to Mitigate Shadow Access Risks: (4)

  1. Identity and Access Management (IAM): Implement a strong IAM solution to centrally manage user and application access. This includes enforcing least privilege principles (granting only the minimum permissions needed).

  2. Regular Reviews: Conduct periodic reviews of user access and entitlements to identify and remove unused or excessive permissions.

  3. Multi-Factor Authentication (MFA): Enforce MFA for all access attempts, adding an extra layer of security beyond passwords.

  4. Cloud Monitoring: Utilize cloud provider monitoring tools to track access patterns and identify anomalies that might indicate Shadow Access.

• Azure Resources to help combat Shadow Access. (4)

  1. MS Entra ID (aka Azure AD): Centralized identity and access management (IAM) & MFA for Azure resources and other cloud applications.

  2. Azure Monitor: Provides comprehensive logging and monitoring capabilities to track user activity and identify suspicious access attempts.

  3. Azure Conditional Access: Enforces additional access restrictions based on factors like location, device, or time of day.

  4. Azure Sentinel: A cloud-native SIEM (Security Information and Event Management) tool that aggregates security data from various sources to detect and respond to threats, including Shadow Access attempts.

Before Zero Trust (ZT). 

• BLUF: The dominant security model relied on a castle and moat approach, often referred to as a perimeter-based security model. -- Here's how it worked (2): (1) Focus on the Outer Edge: Security design prioritizes the external perimeter of the network, typically protected by firewalls and intrusion detection systems. (2) Trust Once Inside: The assumption was that once someone gained access to the internal network (like an employee), they were considered "trusted" and had relatively unrestricted access to resources.

• Limitations (3): (1) Increased Attack Surface: With the rise of cloud computing and mobile devices, the traditional network perimeter became less well-defined. Attackers could target vulnerabilities outside the perimeter to gain access. (2) Insider Threats: Traditional models didn't adequately address the risk of insider threats, where authorized users misuse their access. (3) Data Breaches: Even with a strong perimeter, a successful breach could grant attackers access to a vast amount of data.

• Zero Trust (ZT): ZT assumes no user or device is inherently trustworthy and requires continuous verification for every access attempt. (my kids said, ZT is a computer that has amnesia).

Before Post-Quantum Cryptography (PQC).

• BLUF: The field of cryptography relied heavily on a set of well-established mathematical problems for securing communication and data. These problems were considered difficult, if not impossible, to solve with traditional computers within a reasonable timeframe. This traditional approach is often referred to as pre-quantum cryptography.

  1. ~ Note-1: The emergence of quantum computers poses a significant threat to pre-quantum cryptography. Shor's algorithm, a theoretical algorithm designed for quantum computers, can efficiently solve the problems that underpin these traditional algorithms, rendering them vulnerable.

  2. ~ Note-2: The development of PQC is a proactive response to this threat. PQC algorithms are designed to be resistant to attacks by both classical and quantum computers, ensuring continued secure communication and data protection in the age of quantum computing.

• Pre-Quantum Era:

  1. Public-Key Cryptography: This branch of cryptography uses algorithms like RSA, Diffie-Hellman, and Elliptic Curve Cryptography (ECC) which rely on the mathematical hardness of problems like integer factorization, the discrete logarithm problem, and the elliptic curve discrete logarithm problem.

  2. Security Assumption: The security of these algorithms stemmed from the assumption that solving these problems would take an infeasible amount of computing power with classical computers.

Azure Security Tools (for Configuration, Support & Management). (5)

• BLUF:

  1. Threat modeling

  2. Risk assessments 

• Tools/Solution: (5) -- [AI: https://gemini.google.com/app/f3858ac26203fbb5] 

  1. MS Defender for Cloud Apps (MDCA). -- BLUF: A Cloud Access Security Broker (CASB) helps organizations gain visibility into their cloud applications and services, protect sensitive data, and defend against cyber threats.

  2. MS Defender for Endpoint (MDE). -- BLUF: Helps organizations prevent, detect, investigate, and respond to advanced threats on various endpoints, including laptops, desktops, servers, and mobile devices across Windows, macOS, Linux, Android, and iOS.

  3. MS Defender for Identity (MDI) & MS Entra ID Protection. -- BLUF: Working together to protect identities in hybrid and the cloud. 

  4. MS Defender for Office 365 (MDO). -- BLUF: Focuses on protecting organizations from advanced threats stemming from email, links (URLs), and collaboration tools like MS Teams, SharePoint, and OneDrive.

  5. MS Azure Sentinel. -- BLUF: A Security Information and Event Management (SIEM) and Security Orchestration, Automation, and Response (SOAR) solutions. Its primary focus is to provide intelligent security analytics and threat intelligence across an enterprise.

  6. ~ NOTE: Other platform tools may be integrated, such as:

     • Crowdstrike.

     • Zscaler.

     • Other Cloud Service Providers (CSP): AWS...

     • Other Microsoft platforms: 

       1. MS Purview: Data Security;

       2. Azure Key Vault: Manage Crypto & Encryption Keys;

       3. Azure Firewall: DDoS, NSGs, WAF;

     • Etc.

Azure Resource Manager (ARM). -- I USE. I DO NOT USE AZURE CLI

• BLUF: (Uses templates) To manage and deploy your Azure resources in a declarative way (what is the end goal or the desired configuration). It uses JSON or Bicep files (a DSL for ARM templates) to define the infrastructure you want to create, including virtual machines (VMs), storage accounts, databases, and more.

• 3 Common Tasks: (3)

  1. Infrastructure Deployment: Use ARM templates to define your infrastructure configuration and deploy it to Azure. This ensures consistency and repeatability in your deployments.

  2. Resource Management: Manage individual resources within your Azure environment. This includes tasks like starting, stopping, deleting, and updating resources.

  3. Resource Group Management: Organize related Azure resources into logical groups for easier management and access control.

• Key Difference between Azure ARM and Azure CLI:

  1. Azure ARM uses templates to define the infrastructure configuration, while Azure CLI provides commands to interact with Azure services.

  2. Azure ARM templates are declarative (state what you want), while Azure CLI commands are imperative (specify the actions to take).

  3. Azure ARM templates are typically used for deployment automation, while Azure CLI can be used for both interactive management and scripting.

Azure CLI (Command-Line Interface) -- I DO NOT USE. I USE AZURE ARM

• BLUF: (Uses scripts) Azure CLI is a command-line tool that allows you to interact with Azure services from your terminal. It provides a powerful way to automate tasks, script deployments, and manage your Azure resources efficiently.

• 3 Common Tasks: (3)

  1. Resource Management: Similar to ARM, you can use Azure CLI commands to manage individual resources. This includes creating, reading, updating, and deleting resources.

  2. Subscription Management: Manage your Azure subscriptions, including viewing details, creating new subscriptions, and switching between subscriptions.

  3. Deployment with ARM Templates: Use Azure CLI commands to deploy your infrastructure defined in ARM templates. This allows for scripted and automated deployments.

Azure Digital Twin (Simulation).

• Azure offers several tools that can help create digital twins and simulate various scenarios, including traffic and security attacks, across a company's cloud architecture.

• From your company Azure Digital Twins is a comprehensive platform that allows you to create digital models of physical environments. It can be used to simulate IoT data and interactions within a digital twin graph, representing physical spaces like buildings, floors, and rooms

• 1. Additionally, Azure provides various security tools and services to simulate and protect against cyber threats. For example, Azure Security Center and Microsoft Defender for Cloud offer advanced threat protection and security management across your cloud and on-premises environments2.

• From the Web Azure Digital Twins is a powerful tool for creating digital representations of physical environments. It allows you to model and simulate IoT data, providing insights that can drive better products, optimize operations, and enhance customer experiences

• 34. You can use Azure Digital Twins to create models of smart places, view and control products, systems, environments, and experiences5.

• 
  

Azure Firewall:

• BLUF: Azure Firewall acts as a managed, stateful firewall service that secures inbound and outbound internet traffic for your Azure virtual networks (VNETs).

• Features / Value:

  • Network security groups (NSGs): Define rules to allow or deny specific traffic flows based on source, destination, port, and other criteria.

  • Web Application Firewall (WAF): Protects web applications from common attacks like SQL injection and Cross-Site Scripting (XSS).

  • Distributed Denial-of-Service (DDoS) Protection: Mitigates DDoS attacks that attempt to overwhelm your resources with excessive traffic.

• Benefits:

  • Provides centralized control and management of network security policies for your Azure resources.

  • Protects against various network threats and vulnerabilities.

  • Offers scalability and flexibility to adapt to changing security needs.

Common Tasks: (3)

• 1. Role: Security Administrator / Analyst: 

     • Task: Monitor Firewall Logs: (4)

       1. Open the Azure portal and navigate to your Azure Firewall.

       2. Go to the Overview section and check the Firewall logs tile for any critical alerts or warnings.

       3. Alternatively, navigate to the Logs section for more detailed log analysis.

       4. Analyze firewall logs to identify potential security threats, suspicious activities, or rule violations.

  2. Role: Network Administrator / Engineer:

     • Task: Review and Update Network Security Groups (NSGs): (4)

       1. Navigate to your Azure Firewall in the Azure portal.

       2. Go to the Network Security Groups (NSGs) section.

       3. Review existing NSG rules for any necessary adjustments or updates based on evolving network needs or security policies.

       4. Implement changes to NSGs by adding, modifying, or removing rules as required.

  3. Role: Application Developer / Owner:

     • Task: Verify Application Access Through Firewall:

       1. Collaborate with security or network administrators to understand the firewall rules configured for the application.

       2. Utilize tools or APIs provided by Azure Firewall to test application access and ensure necessary ports and protocols are allowed.

       3. If access is restricted, work with the appropriate teams to request adjustments to firewall rules while maintaining security best practices.

Azure IAM & ICAM:

• BLUF: Manages access to Azure resources via MS Entra ID (aka Azure AD) for centralized identity management

• Features / Value: (3)

  1. Control who can access Azure resources: This includes users, groups, service principals (applications or services), and managed identities (identities automatically managed by Azure).

  2. Define what level of access each entity has: IAM offers various built-in roles with predefined permissions for different resource types. You can also create custom roles with granular control over specific actions users can perform.

  3. Enforce access policies: Azure IAM allows you to define conditions or restrictions on access, like MFA or limiting access based on geographical location or time of day.

  4. ICAM (Identity, Credential, & Access Management) to ZT. It's a set of processes focused on securing access to resources by managing user identities, their credentials, and the access permissions they hold. 

     • Anology: ICAM means, once you pass the castle's moat, one has access permissions. In Zero Trust, you're never trusted and always verified, no matter where you are in and around the castle. -- As my daughter explained, the system has amnesia.  

     • Offers an initial step to Zero Trust.

     • Offers ZT & Advanced features: Like Privileged Access Management and Identity Governance.

     • Strong identity verification and access controls.

     • Tracks Identities: In a Zero Trust environment, user identities need to be tracked across the network. ICAM helps manage and verify these identities.

     • Limits Data Access: ICAM allows for granular control over access permissions. Only authorized users can access specific data, following Zero Trust principles. 

• Benefits of IAM: (3)

  1. Identity Management:

     • Create and manage users and groups for your Azure subscription.

     • Integrate with MS Entra ID (aka Azure AD) for centralized identity management.

     • Leverage managed identities for simplifying access management for Azure services.

  2. Access Control:

     • Assign roles to define permissions for users, groups, and other entities on Azure resources.

     • Control access at various levels, including subscriptions, resource groups, and individual resources.

     • Create custom roles to meet specific access needs not covered by built-in roles.

  3. Monitoring and Auditing:

     • Track access attempts and resource usage for security and compliance purposes.

     • Gain insights into who is accessing your resources, what they are doing, and when they are doing it.

     • Use this information for troubleshooting, security investigations, and access control optimization.

Common Tasks: (3)

1. Role: Security Administrators or Resource Owners.

   • Task: Granting Access to Azure Resources: (6)

     1. Navigate to the Azure portal and locate the desired Azure resource.

     2. Go to the "Access control (IAM)" section.

     3. Click on the "+ Add" button and choose the relevant entity (e.g., user, group, service principal) you want to grant access to.

     4. Assign the desired role that defines the permissions the user will have on the resource (e.g., Reader, Contributor, Owner).

     5. Optionally, you can define specific conditions or restrictions further limiting the access granted.

     6. Click "Save" to finalize the assignment.

2. Role: Security Administrators or Managers.

   • Task: Reviewing and Updating User Access: (6)

     1. Navigate to the "Azure Active Directory" section in the Azure portal.

     2. Go to the "Users" or "Groups" section depending on the type of access you want to review.

     3. Select the specific user or group.

     4. Review the assigned roles and access permissions for the user/group across different Azure resources.

     5. Make any necessary changes, such as adding, removing, or modifying roles based on current needs and security best practices.

     6. Click "Save" to confirm the changes.

3. Role: Individual Users or Enforced by Security Policies.

   • Task: Managing Multi-Factor Authentication (MFA): (4)

     1. Access the Azure portal and navigate to the/your profile settings.

     2. Search for "Security info" or "Multi-factor authentication" settings.

     3. Follow the on-screen prompts to choose and configure your preferred MFA method, such as phone call, SMS verification, or authenticator app.

     4. Once configured, one will be prompted for the additional verification code during login attempts, enhancing security.

Azure Key Vault:

• BLUF: Key Vault provides a secure store for managing cryptographic keys and secrets used for various security purposes.

• Value:

  • Encryption keys for "Data at Rest" and "Data in Transit."

  • Connection strings for accessing databases and other resources.

  • API keys used for third-party integrations.

• Benefits:

  • Centralized management and access control for sensitive keys and secrets.

  • Improved security posture by reducing the risk of unauthorized access to sensitive information.

  • Facilitates compliance with regulations that require secure storage of encryption keys.

Common Tasks. (3)

• Rotate a Secret: (5) -- Benefits (6) -- (1) Mitigates the impact of stolen secrets (2) Adherence to security best practices (3) Proactive security posture (4) Reduced attacks (5) Strengthens future defenses (6) Improve Security audits.

• Steps: (5)

  1. Open the Azure portal and navigate to your Azure Key Vault.

  2. Go to the Secrets section and select the secret you want to rotate.

  3. Click on the Rotate button.

  4. Optionally, you can provide a new version note for the rotated secret.

  5. Confirm the rotation by clicking Yes.

• Grant Access to a Secret: (5)

  1. Navigate to your Azure Key Vault in the Azure portal.

  2. Go to the Secrets section and select the secret you want to grant access to.

  3. Click on the Access Control (IAM) tab.

  4. Click on the + Add button and choose the appropriate entity (e.g., user, group, service principal) you want to grant access to.

  5. Assign the desired access level (e.g., Get, List, Set) and click Save.

• Retrieve a Secret: (5) 

  2. 1. Open the Azure portal and navigate to your Azure Key Vault.

     2. Go to the Secrets section and select the secret you want to retrieve.

     3. Click on the Version you want to access.

     4. Click on the Show button.

     5. Azure Key Vault will display the secret value. Remember to handle this sensitive information with the utmost care!

Azure Sentinel (SIEM-SecInfoEventMgmt)):  

• BLUF: Azure's SIEM (Security Information Event Management) Offers a comprehensive solution for organizations to improve their security posture by centralizing visibility, automating responses, and streamlining security operations.

• Refer to Microsoft Sentinel doc: https://learn.microsoft.com/en-us/azure/sentinel/best-practices 

• Benefits & Value:

  1. 1. Value: (3)

        • Security information aggregation (Combine/Collect): Combine/Collect security data from various sources like Azure resources, on-premises systems, and third-party security tools.

        • Threat detection and analytics: Utilizes machine learning and advanced analytics to identify potential security threats and anomalies.

        • Incident response: (see ITIL Incident Management below) Provides tools to investigate incidents, automate security workflows, and take corrective actions.

     2. Benefits: (3)

        • Improves visibility into the overall security posture of an organization by centralizing security data and logs.

        • Enables proactive threat detection and response capabilities.

        • Streamlines incident investigation and response processes.

ITIL Incident Management (9): 

• 9 Steps -- (1) Incident Identification - Identify and log incidents as soon as possible after they occur. (2) Incident Logging - Record all relevant information about the incident, including date, time, affected service, and any other relevant details. (3) Incident Categorization - Categorize incidents based on their impact, urgency, and priority. (4) Incident Prioritization - Prioritize incidents based on their impact and urgency, ensuring that the most critical incidents are addressed first. (5) Incident Diagnosis - Investigate and diagnose the root cause of the incident to determine the best course of action. (6) Incident Resolution - Take the necessary steps to resolve the incident, either restoring service to its normal state or implementing a workaround. (7) Incident Closure - Once the incident has been resolved, document the resolution, close the incident record, and notify any stakeholders affected by the incident. (8) Incident Review - Conduct a review of the incident to identify any lessons learned (KBA) and determine if any improvements can be made to prevent similar incidents in the future. (9) Incident Reporting - Prepare and distribute incident reports summarizing the details of the incident, its resolution, and any steps taken to prevent future occurrences.

Daily Common Tasks & Solutions : (3)

1. Triage (Level of severity) and Investigate Incidents: (6)

   • 1. Open the Incidents page in your workspace.

     2. Review new incidents identified by the analytics rules.

     3. Prioritize incidents based on severity, potential impact, and urgency.

     4. Investigate prioritized incidents by:

        • Reviewing relevant logs and data associated with the incident.

        • Analyzing the incident timeline and identifying potential indicators of compromise (IOCs).

        • Utilizing hunting queries to search for additional evidence.

     5. Classify the incident as True Positive, False Positive, or Unable to Determine.

     6. Take appropriate action based on the classification, such as containment, eradication, and recovery (CER).

2. Explore Hunting Queries and Bookmarks: (5)

   • 1. Navigate to the Hunting page in your workspace.

     2. Review and explore the available built-in hunting queries covering various threat scenarios.

        • 3 Threat Scenarios (Common):

          1. Unauthorized Access Attempts. -- Threats (5) -- (1) Brute-force attacks; (2) Exploiting known vulnerabilities; (3) Phishing emails; (4) Tricking users into revealing credentials; and (5) Clicking malicious links. -- Solutions (4) -- (1) Monitor login attempts; (2) identify suspicious activities; (3) Detect anomalous access patterns; and (4) identify compromised credentials or known malicious IP addresses

          2. Lateral Movement and Privilege Escalation. -- Threats (3) -- (1) An attacker gains access to a low-privileged account; (2) Moves laterally across the network to access more sensitive systems & data; and (3) Escalate privileges to gain administrative control over critical systems. -- Solutions (4) -- (1) Monitor user activities; (2) Identify suspicious lateral movement patterns; (3) Detect attempts to exploit vulnerabilities that allow privilege escalation, like exploiting misconfigurations or outdated software; and (4) Analyze logs for signs of privilege escalation attempts, like changes in user permissions or access control lists. 

          3. Data Exfiltration (Tranfer). -- Threats (3) -- (1) An attacker has infiltrated your network and attempts to steal sensitive data, like (2) Downloading confidential files or customer information. (3) Exfiltrating data through unauthorized channels, such as cloud storage or email. -- Solutions (4) -- (1) Monitors data access and transfer activities, (2) identify unusual data movement patterns or attempts to access sensitive data. (3) Detects anomalies in network traffic indicative of data exfiltration (transfer) attempts, such as large file transfers to external locations outside of business hours. (4) Integrates with threat intelligence to identify malicious tools or techniques commonly used for data exfiltration (transfer).

     3. Run relevant queries to proactively search for potential threats in your data.

     4. Update existing hunting queries and bookmarks based on your findings and ongoing investigations.

     5. Create custom hunting queries to address specific security concerns tailored to your environment.

3. Check Data Ingestion and Playbook Failures: (6)

   • 1. Go to the Data Connectors page in your workspace.

     2. Review the list of data connectors and ensure all expected data sources are actively sending logs.

     3. Check for any warnings or errors regarding data ingestion failures.

     4. Navigate to the Automation page and review the Playbooks section.

     5. Check the status of recent playbook runs.

     6. Investigate and troubleshoot any failed playbooks to ensure proper automation functionality.

(1o5) -- Microsoft Defender for Cloud Apps (MDCA).

• BLUF: MDCA is a cloud-based security solution that helps organizations secure their use of SaaS applications. It goes beyond traditional Cloud Access Security Brokers (CASBs).

• Functionalities:

  1. SaaS Security Posture Management (SSPM): Identifies misconfigurations in connected SaaS apps and recommends actions to strengthen their security.

  2. Data Loss Prevention (DLP): Protects sensitive information by controlling how it's accessed and shared within SaaS apps.

  3. Threat Protection: Monitors user activity for suspicious behavior that might indicate potential threats.

• Common Tasks. (3) -- BLUF: This scenario focuses on gaining visibility into all cloud applications used within an organization and categorizing them as sanctioned (approved) or unsanctioned (unapproved) apps to manage risks.

  1. Enable Cloud Discovery:

  2. Identify and Tag Apps:

  3. Govern Unsanctioned Apps (Unapproved Apps):

• Implementation Steps. (3) -- BLUF: This scenario focuses on gaining visibility into all cloud applications used within an organization and categorizing them as sanctioned (approved) or unsanctioned (unapproved) apps to manage risks.

  1. Enable Cloud Discovery:

     1. Prerequisite: Ensure you have the necessary MDCA licenses and administrative roles (Security Administrator or Microsoft 365 administrator).

     2. Navigate to the Microsoft Defender Portal (security.microsoft.com).

     3. Go to Settings > Cloud Apps > Cloud Discovery.

     4. Under Automatic log upload, choose the Data sources tab.

     5. Add your data sources: MDCA can ingest logs from various sources, including:

        • Microsoft Defender for Endpoint (MDE) integration: This is often the easiest as it leverages your existing MDE deployment to collect cloud discovery data.

          1. In MDE, go to Settings > Endpoints > Advanced features and enable Microsoft Cloud App Security.

          2. In MDCA, ensure the integration with MDE is enabled under Settings > Cloud Apps > Microsoft Defender for Endpoint.

        • Log collectors: For network devices like firewalls and proxies, you can configure log collectors to upload traffic logs to MDCA.

          1. On the Log collectors tab, follow the instructions to download and configure a log collector on a server within your network. This collector parses your traffic logs and sends them to MDCA.

     6. Configure continuous reports: Under Cloud Discovery > Continuous reports, create reports to analyze discovered data based on your preferences (e.g., by business units, IP ranges).

  2. Identify and Tag Apps:

     1. Once logs are ingested, MDCA will start populating the Cloud Discovery Dashboard and Discovered apps page.

     2. In the Microsoft Defender Portal, go to Cloud Apps > Cloud Discovery > Discovered apps

     3. Review the list of discovered apps. For each app, you'll see a risk score and other details.

     4. Tag apps:

        • To Sanction an approved app: Select the app, click the three dots (...), and choose Sanctioned.

        • To Unsanction an unapproved app: Select the app, click the three dots (...), and choose Unsanctioned. This doesn't block the app but flags it for monitoring and potential action.

        • You can also use the Monitored tag for apps you want to observe without immediate blocking.

  3. Govern Unsanctioned Apps (Unapproved Apps):

     1. Generate block scripts: For unsanctioned apps, MDCA can generate block scripts for your existing on-premises security appliances (e.g., firewalls, proxies).

        • In the Discovered apps page, filter for Unsanctioned apps.

        • Select Actions > Generate block script...

        • Choose your appliance type and generate the script. Import this script into your appliance to block access to these unsanctioned applications.

     2. Integrate with Microsoft Defender for Endpoint (MDE) for blocking: If you have MDE, marking an app as unsanctioned in MDCA will automatically block it on MDE-managed devices.

        • Ensure the integration between MDCA and MDE is fully enabled, including "Enforce app access" in MDCA's MDE settings.

(2o5) -- Microsoft Defender for Endpoint (MDE).

• BLUF: Establishes a robust endpoint security posture. Helps organizations prevent, detect, investigate, and respond to advanced threats on various endpoints, including laptops, desktops, servers, and mobile devices across Windows, macOS, Linux, Android, and iOS..

• Common Tasks. (3-Large Steps)

  1. Onboarding Devices and Enabling Next-Gen Protection (Antivirus/Anti-malware).

  2. Utilizing Endpoint Detection and Response (EDR) for Incident Response. -- BLUF: This scenario focuses on leveraging MDE's EDR capabilities to detect, investigate, and respond to advanced threats that might have bypassed initial prevention mechanisms.

  3. Implementing Automated Investigation and Remediation (AIR) -- BLUF: This scenario focuses on automating the investigation and remediation of common threats, reducing the manual workload for your security operations center (SOC).

• Implementation Steps. (3-Large Steps)

  1. Onboarding Devices and Enabling Next-Gen Protection (Antivirus/Anti-malware). (3)

     • 1. Prepare your environment:

          1. Verify licenses: Ensure you have the necessary MDE licenses (e.g., Microsoft 365 E5, Defender for Endpoint Plan 1 or 2).

          2. Network and proxy settings: Configure your network and proxy settings to allow communication with MDE cloud services (e.g., *.security.microsoft.com, login.microsoftonline.com).

          3. Permissions: You'll need Global Administrator or Security Administrator roles in Microsoft Entra ID (formerly Azure AD).

       2. Choose an onboarding method: MDE offers several methods to onboard devices, depending on your environment and existing management tools. The most common are:

          1. Microsoft Intune (recommended for modern device management):

             1. In the MS Intune admin center (intune.microsoft.com), navigate to Endpoint security > MS Defender for Endpoint.

             2. Ensure the "Connect Microsoft Defender for Endpoint to Microsoft Intune" toggle is set to On.

             3. Once connected, you can create Endpoint security policies in Intune under Endpoint security > Antivirus or Endpoint security > Attack surface reduction to configure MDE settings like real-time protection, cloud-delivered protection, and attack surface reduction rules. Assign these policies to your device groups.

          2. Group Policy (for on-premises Active Directory environments):

             1. Download the MDE onboarding package from the Microsoft Defender Portal (security.microsoft.com) by going to Settings > Endpoints > Onboarding.

             2. Select your operating system and deployment method (Group Policy).

             3. Follow the instructions to deploy the onboarding script via Group Policy to your devices.

             4. Use Group Policy Objects (GPOs) to configure Microsoft Defender Antivirus settings (e.g., real-time protection, cloud protection, exclusions) under Computer Configuration > Administrative Templates > Windows Components > Microsoft Defender Antivirus.

          3. Configuration Manager (formerly SCCM):

             1. Integrate Configuration Manager with MDE by enabling the "Microsoft Defender for Endpoint" connector in your Configuration Manager console.

             2. Use Configuration Manager's Endpoint Protection features to deploy the MDE client and manage its settings.

          4. Local Script (for a few devices or testing):

             1. Download the onboarding package (PowerShell script) from the Microsoft Defender Portal as described for Group Policy.

             2. Run the script manually on individual devices.

       3. Verify onboarding and next-generation protection:

          1. In the Microsoft Defender Portal, go to Endpoints > Device inventory. You should see your onboarded devices appearing here.

          2. Check the "Health state" and "Antivirus status" columns to confirm that devices are onboarded and running the Defender Antivirus effectively.

          3. Simulate a test detection (e.g., by downloading the EICAR test file) to confirm that real-time protection is working.

  2. Utilizing Endpoint Detection and Response (EDR) for Incident Response. -- BLUF: This scenario focuses on leveraging MDE's EDR capabilities to detect, investigate, and respond to advanced threats that might have bypassed initial prevention mechanisms.

     • 1. Ensure EDR is configured and devices are onboarded: (2)

          1. Confirm that devices are successfully onboarded to MDE (as per the previous section). EDR capabilities are automatically enabled when devices are onboarded to MDE Plan 2.

          2. Ensure Endpoint Detection and Response (EDR) in block mode is enabled in the Microsoft Defender Portal (Settings > Endpoints > Advanced features). This allows MDE to block malicious activities even if Microsoft Defender Antivirus is running in passive mode (e.g., if a third-party antivirus is active).

       2. Monitor incidents and alerts: (3)

          1. In the Microsoft Defender Portal, navigate to Incidents & alerts > Incidents.

          2. Review the list of incidents. An incident groups related alerts from different devices and sensors to provide a holistic view of an attack.

          3. Select an incident to view its details, including the affected devices, users, evidence, and attack story (a visual representation of the attack chain).

       3. Investigate and respond to threats: (4)

          1. Analyze the attack story: Understand the sequence of events, what processes were launched, files created, and network connections made.

          2. Examine evidence and entities: Review the files, processes, IP addresses, and users involved in the incident. MDES provides rich context and threat intelligence for each entity.

          3. Take response actions (7): From the incident or device page, you can perform various response actions:

             1. Isolate device: Disconnects the device from the network (except for MDE communication) to contain the threat.

             2. Run antivirus scan: Initiates a full antivirus scan on the device.

             3. Collect investigation package: Gathers forensic data from the device for deeper analysis.

             4. Consult a threat expert (if licensed): Engage Microsoft's security experts for guidance.

             5. Initiate live response session: Establish a remote shell session to the device for manual investigation and remediation.

             6. Contain/block files: Mark malicious files as blocked to prevent their execution across your organization.

             7. Suspend user: Suspend the compromised user account in Azure AD (if integrated with Defender for Identity).

          4. Utilize Advanced Hunting (for proactive threat hunting):

             1. Go to Hunting > Advanced hunting.

             2. Use Kusto Query Language (KQL) to write custom queries to search for specific threat indicators, behaviors, or vulnerabilities across your endpoint data. This allows you to proactively identify threats that haven't triggered an alert.

             3. Save custom detection rules based on your queries to get alerted on future occurrences.

  3. Implementing Automated Investigation and Remediation (AIR) -- BLUF: This scenario focuses on automating the investigation and remediation of common threats, reducing the manual workload for your security operations center (SOC).

     • 1. Configure automation levels for device groups:

          1. In the Microsoft Defender Portal, go to Settings > Endpoints > Permissions > Device groups.

          2. Create or edit device groups based on your organizational structure or risk levels (e.g., "High-risk servers," "Executive laptops").

          3. For each device group, set the Automation level.

             1. Full - remediate threats automatically (recommended for most environments): MDE will automatically investigate alerts and take remediation actions (e.g., quarantine files, stop services) without requiring manual approval.

             2. Semi-Full - require approval for certain actions: MDE will perform some automated actions but require approval for more impactful ones.

             3. Partial - require approval for all actions: Automated investigations will run, but all remediation actions require manual approval.

          4. ~ Note: Automated investigation is enabled by default. The "Automated investigation" setting in advanced features has been deprecated as it's now always on.

       2. Review and manage remediation actions in the Action Center:

          1. Once AIR is configured and alerts are triggered, MDE will generate automated investigations.

          2. In the Microsoft Defender Portal, go to Action Center.

          3. Pending actions: This tab lists remediation actions that require approval (if your automation level isn't "Full"). Review the details of each action, the associated evidence, and decide whether to approve or reject it.

          4. History: This tab shows all completed remediation actions, whether they were automatic or manually approved. You can also undo completed actions if necessary (e.g., if a legitimate file was mistakenly quarantined).

       3. Monitor automated investigation progress and results:

          1. When an alert triggers an automated investigation, you can see its progress on the Incident page.

          2. The investigation graph visually represents the entities investigated, verdicts reached (malicious, suspicious, no threats found), and remediation actions taken.

          3. Review the investigation details to understand how the threat was neutralized and what remaining actions (if any) are required.

(3o5) -- MS Defender for Identity (MDI) -- & -- MS Entra ID Protection.

• BLUF: Working together to protect identities in hybrid and cloud environments.

• Common Tasks. (Using 2 Tools: (1) MS Defender for Identity (MDI), (2) MS Entra ID Protection).

  1. Detecting and Responding to Suspicious Activity with MS Defender for Identity (MDI). -- BLUF: This scenario focuses on setting up MDI to monitor your on-premises Active Directory for signs of compromise and enable security teams to investigate and respond.

  2. Implementing Risky Sign-in and User Policies with Azure AD Identity Protection. -- BLUF: This scenario focuses on configuring Azure AD Identity Protection to automatically respond to risky sign-ins and compromised user accounts in your cloud environment. 

  3. Leveraging Unified Incidents and Advanced Hunting in MS Defender XDR. -- BLUF: This scenario focuses on how MDI and Azure AD Identity Protection contribute to a broader security posture within the unified MS Defender XDR (Extended Detection, Investigation & Response) platform, allowing for holistic investigation and proactive threat hunting.

• Implementation Steps. (Using 2 Tools)

  1. MS Defender for Identity (MDI): -- BLUF: Leverages on-premises Active Directory signals to identify, detect, and investigate advanced threats and compromised identities.

  2. MS Entra ID Protection: -- BLUF: Focuses on detecting and remediating identity-based risks associated with cloud identities and sign-ins.

     • 1. Detecting and Responding to Suspicious Activity with MS Defender for Identity (MDI). -- BLUF: This scenario focuses on setting up MDI to monitor your on-premises Active Directory for signs of compromise and enable security teams to investigate and respond. -- Prerequisites: (1) Microsoft 365 E5, Enterprise Mobility + Security E5 (EMS E5), or a standalone Defender for Identity license. (2) Access to the Microsoft Defender Portal (security.microsoft.com) with Security Administrator or Global Administrator roles. (3) Domain Controllers running Windows Server 2012 R2 or newer.

          1. Deploy Microsoft Defender for Identity Sensors:

             1. Sign in to the Microsoft Defender Portal: Go to security.microsoft.com.

             2. Navigate to Settings > Identities > Sensors.

             3. Click Add sensor. This will provide you with a sensor setup package and an access key.

             4. Install the sensor: On each of your domain controllers (and optionally on AD FS/AD CS servers for enhanced visibility), run the downloaded sensor installer with elevated privileges. During the installation, you'll provide the access key obtained from the portal. The sensor silently monitors network traffic and Windows events.

             5. Verify sensor health: After installation, return to Settings > Identities > Sensors in the Defender Portal to ensure your sensors are showing a "Healthy" status and are connected.

          2. Configure Event Collection (if needed):

             1. MDI primarily uses network traffic deep packet inspection. However, for enhanced detection capabilities, it's recommended to configure Windows Event collection from your domain controllers.

             2. You can do this using Group Policy Objects (GPOs) to enable specific audit policies (e.g., Audit Kerberos Authentication Service, Audit Security Group Management, Audit Account Management) on your domain controllers.

             3. For example, to configure audit policies, go to Computer Configuration > Policies > Windows Settings > Security Settings > Advanced Audit Policy Configuration > Audit Policies in a GPO linked to your domain controllers.

          3. Monitor and Investigate Alerts/Incidents:

             1. In the Microsoft Defender Portal, go to Incidents & alerts > Incidents.

             2. MDI alerts will be automatically correlated into incidents, providing a holistic view of an attack across identities, endpoints, and other domains.

             3. When an MDI-generated alert (e.g., "Suspicious service creation," "Potential NTLM relay attack," "Suspicious Kerberos ticket request") appears:

                1. Select the alert/incident to view details, including the affected accounts, devices, and the attack timeline.

                2. Investigate lateral movement paths (LMPs): MDI is excellent at visualizing how an attacker could move laterally. Go to Identities > Lateral movement paths or view them on a user's details page to identify and remediate these potential attack vectors.

                3. Take remediation actions: From the alert/incident page, you can initiate actions like disabling a compromised user account in Active Directory, forcing a password reset, or investigating the associated device using Microsoft Defender for Endpoint.

       2. Implementing Risky Sign-in and User Policies with Azure AD Identity Protection. -- BLUF: This scenario focuses on configuring Azure AD Identity Protection to automatically respond to risky sign-ins and compromised user accounts in your cloud environment. -- Prerequisites: (1) Microsoft Entra ID P2 license (included with Microsoft 365 E5, EMS E5). (2) Access to the Microsoft Entra admin center (entra.microsoft.com) with Security Administrator or Conditional Access Administrator roles.

          1. Configure Risky Sign-in Policy: (7)

             1. Sign in to the Microsoft Entra admin center: Go to entra.microsoft.com.

             2. Navigate to Protection > Identity Protection > Sign-in risk policy.

             3. Assignments:

                1. Users: Select All users (recommended for broad coverage) or specific groups for pilot.

                2. Exclusions: Exclude your emergency access/break-glass accounts to prevent lockout.

             4. Conditions > Sign-in risk: Set the risk level you want to protect against (e.g., Medium and high).

             5. Controls > Access:

                1. Select Grant access.

                2. Choose Require multi-factor authentication.

             6. Enable policy: Set to Report-only initially to monitor impact without enforcing. After review, change to On.

             7. Save the policy.

          2. Configure User Risk Policy: (6)

             1. In the Microsoft Entra admin center, navigate to Protection > Identity Protection > User risk policy.

             2. Assignments: (1) Users: Select All users or specific groups. (2) Exclusions: Exclude emergency access/break-glass accounts.

             3. Conditions > User risk: Set the risk level (e.g., High). This policy acts on the cumulative risk of a user account over time.

             4. Controls > Access:

                1. Select Grant access.

                2. Choose Require password change. This is often the strongest remediation for a compromised user account.

             5. Enable policy: Set to Report-only initially. After review, change to On.

             6. Save the policy.

          3. Implement MFA Registration Policy: (5)

             1. This policy ensures users are prompted to register for MFA if they haven't already, when a risky sign-in occurs or when required by another policy.

             2. In the Microsoft Entra admin center, navigate to Protection > Identity Protection > MFA registration policy.

             3. Assignments: Select All users or specific groups.

             4. Enforce Policy: Set to On.

             5. Save the policy.

             6. ~ Note: While this is a standalone policy, it often works in conjunction with the risky sign-in policy. If a risky sign-in occurs and the user isn't MFA registered, the risky sign-in policy can prompt for MFA registration as part of the access control.

       3. Leveraging Unified Incidents and Advanced Hunting in MS Defender XDR. -- BLUF: This scenario focuses on how MDI and Azure AD Identity Protection contribute to a broader security posture within the unified MD Defender XDR (Extended Detection, Investigation & Response) platform, allowing for holistic investigation and proactive threat hunting. -- Prerequisites: (1) MDI and Azure AD Identity Protection deployed and configured (as per previous sections). (2) Other Microsoft Defender XDR components (like Defender for Endpoint, Defender for Office 365, Defender for Cloud Apps) are also deployed and integrated. (3) Security Analyst or Security Reader roles in Microsoft Defender XDR.

          1. Monitor Unified Incidents:

             1. Sign in to the Microsoft Defender Portal: Go to security.microsoft.com.

             2. Navigate to Incidents & alerts > Incidents.

             3. Observe how alerts from MDI (e.g., "Suspicious LDAP reconnaissance") and Azure AD Identity Protection (e.g., "Impossible travel from a user") are automatically correlated with alerts from Defender for Endpoint (e.g., "Malicious file detected") or Defender for Cloud Apps (e.g., "Mass download from unsanctioned app").

             4. Investigate Incidents: Select an incident to view the full attack story, including all affected assets (users, devices, mailboxes, apps) and a correlated timeline of events across the different Defender services. This provides a rich context that isolated alerts would miss.

             5. Use remediation actions: Within the incident, initiate automated or manual response actions that can span across various security domains (e.g., isolating a device, suspending a user account, blocking a malicious IP address).

          2. Proactive Threat Hunting with Advanced Hunting:

             1. In the MS Defender Portal, go to Hunting > Advanced hunting.

             2. Explore Identity-related tables: Familiarize yourself with tables like IdentityInfo, IdentityLogonEvents, IdentityQueryEvents, IdentityDirectoryEvents, and AadSignInEventsV2. These tables contain rich data from MDI and Azure AD Identity Protection.

             3. Write custom queries:

                1. Example 1 (MDI - Lateral Movement Path): Identify accounts with a highly sensitive path to a high-value target that has been observed recently.

                   • Code snippet:

                     1. IdentityInfo

                     2. | where AccountRiskScore > 0.5 // High risk score

                     3. | join kind=inner (

                     4.      IdentityDirectoryEvents

                     5.      | where ActionType == "LmpPath"

                     6.      | where AdditionalFields contains "SensitiveTarget"

                     7. ) on AccountObjectId

                     8. | project AccountDisplayName, AccountUPN, AccountRiskScore, Timestamp, AdditionalFields

                     9. | sort by Timestamp desc

                2. Example 2 (Azure AD Identity Protection - Risky Sign-ins): Find sign-ins from Tor exit nodes that were allowed due to Conditional Access policies.

                   • Code snippet:

                     1. AadSignInEventsV2

                     2. | where RiskDetail == "TorExitNode"

                     3. | where ConditionalAccessPolicyApplied == true

                     4. | where ResultType == "0" // Sign-in successful

                     5. | project Timestamp, AccountDisplayName, IPAddress, RiskDetail, ConditionalAccessPolicyResult

                     6. | sort by Timestamp desc

             4. Create custom detection rules: If you discover a specific threat pattern, you can turn your Advanced Hunting query into a custom detection rule to receive automated alerts when that pattern is observed in the future.

          3. Review Identity Secure Score and Security Assessments:

             1. In the MS Defender Portal, go to Identities > Dashboard.

             2. This dashboard provides a consolidated view of your identity security posture, including insights from MDI and Azure AD Identity Protection.

             3. Review the Identity Secure Score to track your progress in improving identity security.

             4. Examine Security assessments (e.g., "Exposed sensitive accounts," "Unsecure domain configurations") to identify vulnerabilities in your on-premises Active Directory detected by MDI, and receive remediation recommendations.

             5. Use the "Active risky users in Microsoft Entra ID" and "High privileged identities" sections to proactively manage and reduce risk.

(4o5) -- MS Defender for O365 (MDO).

• BLUF:  Focuses on protecting organizations from advanced threats stemming from email, links (URLs), and collaboration tools like MS Teams, SharePoint, and OneDrive.

• Common Tasks. (3 Large)

  1. Enabling Safe Attachments to Protect Against (Zero-Day) Malware -- BLUF: This scenario focuses on configuring MDO to automatically detonate and analyze email attachments in a virtual environment to detect and block zero-day malware before it reaches user inboxes. 

  2. Implementing Safe Links for (Time-of-Click) URL Protection. -- BLUF: This scenario focuses on configuring MDO to protect users from malicious URLs in emails, Microsoft Teams, and supported Office apps by rewriting and scanning them at the time of click.

  3. Configuring Anti-Phishing Policies (Impersonation Protection). -- BLUF: Focuses on enhancing protection against phishing attacks, especially those involving impersonation (e.g., someone pretending to be your CEO, a trusted vendor, or even your own domain).

• Implementation Steps. (3 Large)

  1. Enabling Safe Attachments to Protect Against (Zero-Day) Malware -- BLUF: This scenario focuses on configuring MDO to automatically detonate and analyze email attachments in a virtual environment to detect and block zero-day malware before it reaches user inboxes. -- Prerequisites: (1) MS Defender for O365 Plan 1 or Plan 2 license. (2) Access to the MS Defender Portal (security.microsoft.com) with Security Administrator or Organization Management roles.

     1. 1.  Create a Safe Attachments Policy: (6)

           1. Sign in to the Microsoft Defender Portal (security.microsoft.com).

           2. Navigate to Email & collaboration > Policies & rules > Threat policies.

           3. Under the "Policies" section, select Safe Attachments.

           4. On the Safe Attachments page, click Create to start the new policy wizard.

           5. Name your policy: Provide a descriptive name (e.g., "Safe Attachments for All Users") and an optional description. Click Next.

           6. Users, groups, and domains: Define who the policy applies to. For broad protection, select All recipients or choose specific users, groups, or domains for a phased rollout or specific needs. Click Next.

        2. Settings:

           1. Safe Attachments unknown malware response:

              1. Select Block (recommended): This is the most secure option. It prevents the email with the malicious attachment from being delivered.

              2. Alternatively, you can choose 'Dynamic Delivery (Preview messages)' for a better user experience where the email body is delivered first, and the attachment is replaced by a placeholder until it's scanned. If clean, the original attachment is re-inserted; if malicious, the message is quarantined.

           2. Quarantine policy: Choose a quarantine policy that dictates what users can do with quarantined messages and if they receive notifications. The default AdminOnlyAccessPolicy is often used for malware, meaning only admins can release it. You can create a custom quarantine policy to allow user notifications if desired.

           3. Redirect messages with detected attachments: (Optional) If you select Enable redirect, you can specify an email address to send copies of messages with detected malware attachments for further analysis. This is primarily useful for the 'Monitor' action, but can provide insights even with 'Block'.

           4. Click Next. Review: Review your settings. You can click Edit in any section to make changes.

           5. Click Submit to create the policy.

     2. Verify Policy Application and Test:

        1. Allow some time for the policy to propagate (usually a few minutes).

        2. Send a test email with a benign EICAR test file: You can generate a harmless EICAR test file (e.g., paste X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H* into a text file and save it as eicar.com.txt).

        3. Send this file as an attachment to a user covered by the Safe Attachments policy.

        4. Expected outcome: The email should be quarantined, or if Dynamic Delivery was chosen, the attachment should be blocked/replaced.

        5. Check the MS Defender Portal: Go to Email & collaboration > Explorer (or Threat Explorer) to search for the test email. You should see it classified as malware and delivered to quarantine.

  2. Implementing Safe Links for (Time-of-Click) URL Protection. -- BLUF: This scenario focuses on configuring MDO to protect users from malicious URLs in emails, Microsoft Teams, and supported Office apps by rewriting and scanning them at the time of click, -- Prerequisites: (1) MS Defender for Office 365 (MDO) Plan 1 or Plan 2 license. (2) Access to the Microsoft Defender Portal (security.microsoft.com) with Security Administrator or Organization Management roles.

     2. 1. Create a Safe Links Policy: (11)

           1. Sign in to the MS Defender Portal (security.microsoft.com).

           2. Navigate to Email & collaboration > Policies & rules > Threat policies.

           3. Under the "Policies" section, select Safe Links.

           4. On the Safe Links page, click Create to start the new policy wizard.

           5. Name your policy: Provide a descriptive name (e.g., "Safe Links for All Users") and an optional description. Click Next.

           6. Users, groups, and domains: Define who the policy applies to. Select All recipients or specific users, groups, or domains. Click Next.

           7. URL & click protection settings:

              1. Select actions for Safe Links on email messages:

                 • On: Safe Links checks a list of known, malicious links when users click links in email. (Highly Recommended)

                 • Apply Safe Links to email messages sent within the organization. (Recommended for internal threat protection)

                 • Apply Safe Links to URLs in Microsoft Teams. (Recommended)

                 • Apply Safe Links to URLs in supported Office 365 apps. (Recommended, protects links in Word, Excel, PowerPoint, etc.)

              2. Do not track user clicks: (Leave unchecked unless you have a specific reason to not track clicks for reporting/investigation).

              3. Do not allow users to click through to the original URL: (Highly Recommended. If a link is malicious, you generally don't want users bypassing the warning).

              4. Do not rewrite the following URLs in email: (Optional) Add specific, trusted URLs here that you know are safe and don't want rewritten (e.g., internal SharePoint sites, trusted business partners).

           8. Click Next.

           9. Notification: (Optional) Customize the notification text users see when a malicious link is blocked.

           10. Click Next. Review: Review your settings.

           11. Click Submit to create the policy.

        2. Verify Policy Application and Test: (5)

           1. Allow some time for the policy to propagate.

           2. Send a test email with a known malicious URL: You can find safe test URLs (e.g., a "safe" phishing URL that will be flagged by security solutions, not a real malicious one) or simply use a legitimate website URL and observe if it's rewritten.

           3. Send the email to a user covered by the Safe Links policy.

           4. Expected outcome: When the user hovers over the link in the email, they should see that the URL has been rewritten to start with https://safelinks.protection.outlook.com/. If they click a malicious link, they should be redirected to a warning page.

           5. Check the Microsoft Defender Portal: Go to Email & collaboration > Explorer to view URL click events and see if any malicious clicks were blocked.

  3. Configuring Anti-Phishing Policies (Impersonation Protection). -- BLUF: Focuses on enhancing protection against phishing attacks, especially those involving impersonation (e.g., someone pretending to be your CEO, a trusted vendor, or even your own domain). -- Prerequisites: (1) MS Defender for Office 365 (MDO) Plan 1 or Plan 2 license. (2) Access to the MS Defender Portal (security.microsoft.com) with Security Administrator or Organization Management roles.

     2. 1. Create an Anti-Phishing Policy: (6)

           1. Sign in to the MS Defender Portal (security.microsoft.com).

           2. Navigate to Email & collaboration > Policies & rules > Threat policies.

           3. Under the "Policies" section, select Anti-phishing.

           4. On the Anti-phishing page, click Create to start the new policy wizard.

           5. Name your policy: Provide a descriptive name (e.g., "Executive Impersonation Protection") and an optional description. Click Next.

           6. Users, groups, and domains: Define who the policy applies to. You might target specific highly-impersonated users (e.g., your CEO, CFO) or groups for a more granular policy. Click Next.

        2. Configure Phishing Threshold & Protection: (7)

           1. Phishing threshold: Set the sensitivity. Standard is the default. You can choose Aggressive, More aggressive, or Most aggressive for increased detection, but be mindful of potential false positives.

           2. Spoof intelligence: Keep this enabled (default) to detect when senders are spoofing domains that aren't owned by your organization or are external but attempting to spoof your internal users.

           3. Impersonation: This is key for targeted phishing.

              1. Users to protect: Click Manage (0) user(s) and add the email addresses of key individuals (e.g., CEO, CFO, HR Director) who are frequently impersonated.

              2. Domains to protect:

                 • Include the domains I own: (Recommended) This protects your own organization's domains from being impersonated by external senders.

                 • Include custom domains: (Optional) Add domains of frequently used vendors or partners that might be impersonated.

              3. Add trusted senders and domains: (Use sparingly) These are exceptions where you know a sender is legitimate but might trigger an impersonation alert.

           4. Mailbox intelligence: Enable this to use AI to learn user communication patterns and detect unusual sender-recipient relationships.

           5. Add "First contact safety tip": (Recommended) This shows a warning to users when they receive an email from a sender they don't frequently interact with, helping them identify potential phishing attempts.

           6. Show (?) for unauthenticated senders for SPF/DKIM failures: (Recommended) Adds a question mark to the sender's photo in Outlook for emails that fail authentication.

           7. Show "Via" tag: (Recommended) Adds a "via" tag when the sender's domain doesn't match the original sending domain. Click Next.

        3. Define Actions for Impersonation Detections: (4)

           1. For User impersonation detections and Domain impersonation detections, choose the action:

              2. • Redirect message to other email address: Send the suspicious email to a security mailbox for review.

                 • Move message to Junk Email folder: Less impactful, but still flags it.

                 • Quarantine the message (recommended): This moves the email to quarantine and requires admin or user action (depending on quarantine policy).

                 • Deliver the message and add other actions: Deliver to inbox but add a custom header, prepend a subject, or add a safety tip.

                 • Do not apply any action: (Not recommended for most impersonation detections).

           2. For each action, you might also specify a Quarantine policy as in Safe Attachments.

           3. For Spoof intelligence detections, choose an action (e.g., Quarantine the message). -- Click Next.

           4. Review: Review your settings. -- Click Submit to create the policy.

(5o5) -- MS Azure Sentinel (a SIEM & SOAR solution).

• BLUF:  A Security Information and Event Management (SIEM) and Security Orchestration, Automation, and Response (SOAR) solution. Its primary focus is to provide intelligent security analytics and threat intelligence across an enterprise.

• Common Tasks. (3 Large)

  1. Connecting Data Sources and Ingesting Security Logs. -- BLUF: Feed your security logs into MS Sentinel to gain visibility and enable detection.

  2. Creating and Customizing Analytics Rules for Threat Detection. -- BLUF: Implement rules to detect suspicious activities and generate alerts/incidents. 

  3. Automating Incident Response with Playbooks (SOAR Capabilities). -- BLUF: Use Playbooks in MS Sentinel, powered by Azure Logic Apps, to automate security tasks, enrich incidents, and respond to threats automatically or semi-automatically. 

• Implementation Steps. (3 Large)

  1. Connecting Data Sources and Ingesting Security Logs. -- BLUF: Feed your security logs into MS Sentinel to gain visibility and enable detection. -- Prerequisites: (1) An Azure subscription. (2) A Log Analytics workspace where Microsoft Sentinel is deployed. (3) Permissions: Microsoft Sentinel Contributor role on the Log Analytics workspace.

     1. 1. Create a Microsoft Sentinel Workspace (if you don't have one):

           1. Sign in to the Azure portal (portal.azure.com).

           2. Search for "Microsoft Sentinel" and select it.

           3. Click Create and select an existing Log Analytics workspace or create a new one. Follow the prompts to complete the workspace creation.

        2. Connect Data Sources:

           1. In the Microsoft Defender Portal (security.microsoft.com), navigate to Microsoft Sentinel > Configurations > Data connectors (or in the Azure portal, navigate to your Sentinel workspace and select Data connectors under "Configuration").

           2. Search for the data connector you want to configure (e.g., "Azure Active Directory," "Microsoft Defender for Endpoint," "Azure Activity," "AWS CloudTrail," "Syslog," "Common Event Format (CEF)").

           3. Select the connector and click Open connector page.

           4. Review prerequisites: Each connector has specific requirements (e.g., enabling specific logs, installing agents, configuring permissions). Ensure these are met.

           5. Follow the configuration instructions:

              1. For Microsoft services (e.g., Azure AD, Microsoft 365, Defender for Endpoint): Often, this is a simple toggle or a few clicks to connect the service directly. For example, for Azure Active Directory, you'll enable specific log types (Sign-in logs, Audit logs) to be sent to Sentinel.

              2. For external services (e.g., AWS CloudTrail, Google Cloud Platform): You'll typically follow instructions to configure API access, deploy a function app, or set up a cloud-to-cloud connection.

              3. For on-premises servers (e.g., Syslog, CEF): You'll need to deploy a Log Analytics agent (or Azure Monitor Agent) on a dedicated Linux or Windows server. This agent collects logs from your devices (e.g., firewalls, routers, Linux servers) and forwards them to your Log Analytics workspace. The connector page will provide detailed setup for the agent and forwarding rules.

           6. Verify data ingestion: After configuring, wait a few minutes. On the connector page, you should see data flowing in the "Data received" graph. You can also go to Logs in your Sentinel workspace and run a simple Kusto Query Language (KQL) query (e.g., SigninLogs | take 10) to see if data is being ingested.

  2. Creating and Customizing Analytics Rules for Threat Detection. -- BLUF: Implement rules to detect suspicious activities and generate alerts/incidents. -- Prerequisites: (1) Data sources connected and ingesting data into Microsoft Sentinel. (2) Permissions: Microsoft Sentinel Contributor role. (3) Familiarity with Kusto Query Language (KQL) for custom rules.

     1. 1. Explore and Enable Built-in Templates: (6)

           1. In the MS Defender Portal, navigate to MS Sentinel > Configuration > Analytics (or in the Azure portal, navigate to your Sentinel workspace and select Analytics).

           2. Go to the Rule templates tab. Microsoft provides hundreds of built-in templates based on common threat scenarios and MITRE ATT&CK tactics.

           3. Filter and review templates: Search for templates relevant to your connected data sources (e.g., filter by "Data sources" or "MITRE ATT&CK tactics").

           4. Create rule from template: Select a template and click Create rule on the details pane.

           5. Customize settings: The wizard will pre-populate details. You can adjust:

              2. 1. General: Name, description, severity, MITRE ATT&CK tactics.

                 2. Set rule logic: Review the KQL query, adjust query scheduling (how often it runs) and lookback duration (how far back it looks in logs).

                 3. Incident settings: Decide if and how alerts generated by this rule should create incidents (e.g., group alerts into a single incident).

                 4. Automated response: (Optional) Link a playbook to run automatically when this rule triggers an alert or incident (covered in the next section).

           6. Click Review and create, then Create. The new rule will appear in the Active rules tab.

        2. Create Custom Analytics Rules from Scratch:

           1. In the Analytics page, click +Create > Scheduled query rule.

           2. General: Provide a unique name, description, severity, and map to relevant MITRE ATT&CK tactics. Set the status to Enabled.

           3. Set rule logic: (7)

              2. 1. Rule query: Write your KQL query to identify suspicious activities. This is where you leverage your ingested data. -- Example (detecting multiple failed sign-ins from a new IP):

                    • Code snippet:

                      1. SigninLogs

                      2. | where ResultType == "50126" // Failed sign-in

                      3. | summarize LoginAttempts = count() by IPAddress, UserPrincipalName

                      4. | where LoginAttempts > 5

                      5. | join kind=leftanti (

                      6.     SigninLogs

                      7.      | where ResultType == "0" // Successful sign-in

                      8.      | summarize by IPAddress

                      9. ) on IPAddress // Filter out IPs that have ever had a successful login

                      10. | project IPAddress, UserPrincipalName, LoginAttempts

                 2. Entity mapping: Map relevant entities (e.g., Account, Host, IPAddress) from your query results. This enriches alerts and helps in investigations.

                 3. Query scheduling: Define how often the query runs (e.g., every 5 minutes) and the lookback data (e.g., look back 1 hour).

                 4. Alert threshold: Set the number of results that must be returned by the query to trigger an alert (e.g., "Greater than 0").

                 5. Incident settings: Configure whether to create incidents from these alerts and how to group them.

                 6. Automated response: (Optional) Attach playbooks.

                 7. Click Review and create, then Create.

        3. Refine Rules and Reduce False Positives: (5)

           1. Regularly review alerts generated by your rules in Incidents.

           2. For high-volume or false-positive-prone rules, go back to Analytics > Active rules, select the rule, and click Edit.

           3. Adjust query logic: Add where clauses to filter out known benign activities, or use union with other tables for more context.

           4. Tune thresholds: Increase the alert threshold if too many low-severity events are triggering.

           5. Use suppressions: For specific, recurring false positives, you can create suppression rules to prevent alerts for a defined period or based on specific criteria.

  3. Automating Incident Response with Playbooks (SOAR Capabilities). -- BLUF: Use Playbooks in MS Sentinel, powered by Azure Logic Apps, to automate security tasks, enrich incidents, and respond to threats automatically or semi-automatically. -- Prerequisites: (1) A Log Analytics workspace with Microsoft Sentinel deployed. (2) Permissions: Logic App Contributor role on the resource group where playbooks are stored, and Microsoft Sentinel Automation Contributor role on the Log Analytics workspace. (3) Familiarity with Azure Logic Apps (basic understanding of triggers and actions).

     1. 1. Deploy or Create a Playbook:

           1. In the MS Defender Portal, navigate to MS Sentinel > Configuration > Automation (or in the Azure portal, navigate to your Sentinel workspace and select Automation).

           2. Go to the Playbook templates tab. You'll find many pre-built templates for common scenarios (e.g., "Block IP," "Get user info," "Send Teams message").

           3. Deploy from template: Select a template and click Create playbook. Follow the wizard to configure connections for the Logic App (e.g., Microsoft Entra ID, Microsoft Defender for Endpoint). This creates an Azure Logic App.

           4. Create a custom playbook: Click Create > Playbook with incident trigger (or alert trigger). This opens the Logic App Designer.

              1. The first step will be the Sentinel Incident/Alert trigger.

              2. Add actions: Add steps to your playbook (e.g., "Get incident entities," "Search Microsoft Defender for Endpoint for device," "Block IP address in firewall," "Send email to SOC team," "Create a ServiceNow ticket"). Configure the parameters for each action.

              3. Save your Logic App.

        2. Grant Permissions for Playbook Execution:

           1. For Microsoft Sentinel to run playbooks, it needs specific permissions on the resource group where your playbooks are located.

           2. In the Automation page in Sentinel, go to the Active playbooks tab.

           3. Click Manage playbook permissions.

           4. In the "Manage permissions" panel, select the resource groups containing your playbooks and click Apply. This grants the Microsoft Sentinel Automation Contributor role to the Sentinel service principal.

        3. Attach Playbooks to Analytics Rules or Automation Rules:

           1. Option A: Attach to an Analytics Rule (for automated response to specific alerts):

              1. Go to Analytics > Active rules.

              2. Select the analytics rule you want to automate, and click Edit.

              3. Go to the Automated response tab.

              4. Under "Alert automation," select your playbook from the dropdown list.

              5. Update the rule. Now, every time this rule generates an alert, the playbook will run.

           2. Option B: Create an Automation Rule (for more flexible incident response or to trigger on incident creation/update):

              1. Go to Automation > Automation rules.

              2. Click +Create > Automation rule.

              3. Trigger: Choose when the rule should run (e.g., "When incident is created," "When incident is updated").

              4. Conditions: Define specific conditions for the incident (e.g., Severity is "High," contains specific entities).

              5. Actions: Select Run playbook and choose your playbook from the list. You can also add other actions like "Change status," "Assign owner," "Add tags."

              6. Set the Rule expiration and Order (if multiple rules apply).

              7. Create the automation rule. This provides a more powerful way to orchestrate responses based on the full incident context, not just individual alerts.

           3. Option C: Manual execution: You can also run playbooks manually from an incident's details page or an entity's page within Sentinel for ad-hoc response.

MS Defender XDR (Extend, Detection, Investigation, and Response).

• BLUF: Microsoft Defender XDR is a security operations platform that uses AI and automation to help organizations extend detection, investigation, and response (XDR) capabilities across their digital estate.

• Common Tasks: (3)

  1. Investigate security incidents. Microsoft Defender XDR collects data from a variety of sources, including endpoints, identities, email, collaboration tools, SaaS apps, data loss prevention, and cloud workloads. This data can be used to investigate security incidents and identify the root cause of the problem.

  2. Automate security tasks (like Terraform). Microsoft Defender XDR can automate a variety of security tasks, such as isolating infected devices, blocking malicious URLs, and resetting passwords. This can help security teams save time and improve their efficiency.

  3. Hunt for threats. Microsoft Defender XDR can be used to hunt for threats within an organization's network. Security teams can use XDR to identify malicious activity that may not have been detected by traditional security tools.

Microsoft Entra ID IAM (Formerly Azure AD):  

• BLUF (2): (1) Formerly known as Azure AD, manages user identities and access control. It acts as a digital gatekeeper for your organization's various apps and resources. (2) Provides a secure and centralized platform for managing user access within your organization, offering a balance between security and user convenience.

• Functions: (3) 

  1. Manages user accounts and groups within your organization.

  2. Controls access to various resources like Microsoft 365, Azure Portal, and other cloud app (SaaS).

  3. Provides functionalities like single sign-on (SSO) for seamless access across different platforms.

• Benefits: (3)

  1. Enhanced Security:

     • Implements multi-factor authentication (MFA) to add an extra layer of security during logins.

     • Enforces conditional access rules, granting access under specific conditions like trusted devices or locations.

  2. Simplified Administration:

     • Streamlines user provisioning and access management across various applications.

     • Offers role-based access control, ensuring users only have access to the resources they need.

  3. Improved User Experience:

     • Enables SSO, allowing users to sign in once for multiple applications.

     • Provides self-service password management for increased user control.

• Value:

  1. Centralized Identity Management: Consolidates user identities across different applications, simplifying administration and reducing the risk of unauthorized access.

  2. Security: Mitigates security threats like phishing and unauthorized access attempts.

  3. Increased Productivity: Simplifies user access and reduces help desk tickets related to login issues.

Common Tasks : (3)

1. Task: Signing in with Single Sign-On (SSO):

• Steps:

  • Access any participating cloud application (e.g., Microsoft Office 365, Azure portal).

  • Enter your organizational username and password.

  • Note: If Multi-Factor Authentication (MFA) is enabled, an additional verification step might be required (e.g., entering a code received on your phone).

2. Task: Accessing Resources Based on Permissions:

• Steps:

  2. Navigate to the desired resource within the application (e.g., a specific file in SharePoint).

  3. Microsoft Entra ID: Behind the scenes, verifies your permissions to access the resource based on your assigned role or group memberships.

  4. If authorized, you will be granted access to the resource.

3. Task 3: Self-Service Password Management:

• Steps:

  • Access the Entra ID password management portal (URL might vary depending on your organization's setup).

  • Enter your current credentials and follow the prompts to reset your password.

  • Note: Specific steps for password reset might require additional security measures like verification through email or security questions.

Microsoft Entra ID IAM (Formerly Azure AD):  

• BLUF (2): (1) Formerly known as Azure AD. It acts as a digital gatekeeper for your organization's various apps and resources. (2) Provides a secure and centralized platform for managing user access within your organization, offering a balance between security and user convenience.

• Functions: (3) 

  1. Manages user accounts and groups within your organization.

  2. Controls access to various resources like Microsoft 365, Azure Portal, and other cloud app (SaaS).

  3. Provides functionalities like single sign-on (SSO) for seamless access across different platforms.

• Benefits: (3)

  1. Enhanced Security:

     • Implements multi-factor authentication (MFA) to add an extra layer of security during logins.

     • Enforces conditional access rules, granting access under specific conditions like trusted devices or locations.

  2. Simplified Administration:

     • Streamlines user provisioning and access management across various applications.

     • Offers role-based access control, ensuring users only have access to the resources they need.

  3. Improved User Experience (UX):

     • Enables SSO, allowing users to sign in once for multiple applications.

     • Provides self-service password management for increased user control.

• Value:

  1. Centralized Identity Management: Consolidates user identities across different applications, simplifying administration and reducing the risk of unauthorized access.

  2. Security: Mitigates security threats like phishing and unauthorized access attempts.

  3. Increased Productivity: Simplifies user access and reduces help desk tickets related to login issues.

• Common Tasks: (3)

  1. Signing in with Single Sign-On (SSO):

     • Steps:

       1. Access any participating cloud application (e.g., Microsoft Office 365, Azure portal).

       2. Enter your organizational username and password.

       3. ~ Note: If Multi-Factor Authentication (MFA) is enabled, an additional verification step might be required (e.g., entering a code received on your phone).

  2. Accessing Resources Based on Permissions:

     • Steps:

       1. Navigate to the desired resource within the application (e.g., a specific file in SharePoint).

       2. Microsoft Entra ID: Behind the scenes, verifies your permissions to access the resource based on your assigned role or group memberships.

       3. If authorized, you will be granted access to the resource.

  3. Self-Service Password Management:

     • Steps:

       1. Access the Entra ID password management portal (URL might vary depending on your organization's setup).

       2. Enter your current credentials and follow the prompts to reset your password.

       3. ~ Note: Specific steps for password reset might require additional security measures like verification through email or security questions.

Microsoft Entra ID IAM (Formerly Azure AD):  

• BLUF (2): (1) Formerly known as Azure AD, manages user identities and access control. It acts as a digital gatekeeper for your organization's various apps and resources. (2) Provides a secure and centralized platform for managing user access within your organization, offering a balance between security and user convenience.

• Functions: (3) 

  1. Manages user accounts and groups within your organization.

  2. Controls access to various resources like Microsoft 365, Azure portal, and other cloud app (SaaS).

  3. Provides functionalities like single sign-on (SSO) for seamless access across different platforms.

• Benefits: (3)

  1. Enhanced Security:

     • Implements multi-factor authentication (MFA) to add an extra layer of security during logins.

     • Enforces conditional access rules, granting access under specific conditions like trusted devices or locations.

  2. Simplified Administration:

     • Streamlines user provisioning and access management across various applications.

     • Offers role-based access control, ensuring users only have access to the resources they need.

  3. Improved User Experience:

     • Enables SSO, allowing users to sign in once for multiple applications.

     • Provides self-service password management for increased user control.

• Value:

  1. Centralized Identity Management: Consolidates user identities across different applications, simplifying administration and reducing the risk of unauthorized access.

  2. Security: Mitigates security threats like phishing and unauthorized access attempts.

  3. Increased Productivity: Simplifies user access and reduces help desk tickets related to login issues.

Common Tasks & Solutions : (3)

Signing in with Single Sign-On (SSO):

• Steps:

  • Access any participating cloud application (e.g., Microsoft Office 365, Azure portal).

  • Enter your organizational username and password.

  • Note: If Multi-Factor Authentication (MFA) is enabled, an additional verification step might be required (e.g., entering a code received on your phone).

2. Accessing Resources Based on Permissions:

• Steps:

  2. Navigate to the desired resource within the application (e.g., a specific file in SharePoint).

  3. Microsoft Entra ID: Behind the scenes, verifies your permissions to access the resource based on your assigned role or group memberships.

  4. If authorized, you will be granted access to the resource.

3. Self-Service Password Management:

• Steps:

  • Access the Entra ID password management portal (URL might vary depending on your organization's setup).

  • Enter your current credentials and follow the prompts to reset your password.

  • Note: Specific steps for password reset might require additional security measures like verification through email or security questions.

crosoft Entra ID IAM (Formerly Azure AD):  

• BLUF (2): (1) Formerly known as Azure AD, manages user identities and access control. It acts as a digital gatekeeper for your organization's various apps and resources. (2) Provides a secure and centralized platform for managing user access within your organization, offering a balance between security and user convenience.

• Functions: (3) 

  1. Manages user accounts and groups within your organization.

  2. Controls access to various resources like Microsoft 365, Azure portal, and other cloud app (SaaS).

  3. Provides functionalities like single sign-on (SSO) for seamless access across different platforms.

• Benefits: (3)

  1. Enhanced Security:

     • Implements multi-factor authentication (MFA) to add an extra layer of security during logins.

     • Enforces conditional access rules, granting access under specific conditions like trusted devices or locations.

  2. Simplified Administration:

     • Streamlines user provisioning and access management across various applications.

     • Offers role-based access control, ensuring users only have access to the resources they need.

  3. Improved User Experience:

     • Enables SSO, allowing users to sign in once for multiple applications.

     • Provides self-service password management for increased user control.

• Value:

  1. Centralized Identity Management: Consolidates user identities across different applications, simplifying administration and reducing the risk of unauthorized access.

  2. Security: Mitigates security threats like phishing and unauthorized access attempts.

  3. Increased Productivity: Simplifies user access and reduces help desk tickets related to login issues.

3 Daily Common Tasks & Solutions : (3)

Signing in with Single Sign-On (SSO):

• Steps:

  • Access any participating cloud application (e.g., Microsoft Office 365, Azure portal).

  • Enter your organizational username and password.

  • Note: If Multi-Factor Authentication (MFA) is enabled, an additional verification step might be required (e.g., entering a code received on your phone).

2. Accessing Resources Based on Permissions:

• Steps:

  2. Navigate to the desired resource within the application (e.g., a specific file in SharePoint).

  3. Microsoft Entra ID: Behind the scenes, verifies your permissions to access the resource based on your assigned role or group memberships.

  4. If authorized, you will be granted access to the resource.

3. Self-Service Password Management:

• Steps:

  • Access the Entra ID password management portal (URL might vary depending on your organization's setup).

  • Enter your current credentials and follow the prompts to reset your password.

  • Note: Specific steps for password reset might require additional security measures like verification through email or security questions.

Azure PKI -- (Public Key Infrastructure)

• BLUF (4): (1) PKI is a framework for managing digital certificates and encryption keys. It provides a way to securely establish trust between different entities through these certificates. (2) Authentication: PKI issues digital certificates that verify the identity of users and devices trying to access a network. This aligns with Zero Trust's "never trust, always verify" principle. (3) Encryption: PKI enables secure communication between users, devices, and applications. This strengthens Zero Trust by protecting data integrity and confidentiality. (4) While PKI offers strong authentication and encryption, it's one piece of the ZT puzzle. A ZTA might also include MFA and other tools for access control. 

• Azure Resouces (How PKI works in Azure): (2*)

  1. Microsoft PKI foundation: Azure relies on Microsoft PKI for core functionalities. This PKI system underpins authentication processes within Azure.

  2. Azure Key Vault: This service securely stores and manages cryptographic keys and certificates used for Azure resources. It integrates with external CAs for certificate issuance and lifecycle management.

  3. (*) Third-party PKI solutions that work w/ Azure: You can deploy third-party certificate authorities like Keyfactor or EZCA within Azure. These solutions provide full-fledged PKI functionality, including certificate issuance, renewal, and revocation, all managed from the Azure platform.

Asymmetric Key Encryption (Public Key Cryptography).

• BLUF: Asymmetric Key Encryption (aka Public Key Cryptography), uses a pair of mathematically linked keys: (1) a public key and (2) a private key. This differs from symmetric encryption, which uses a single key for both encryption and decryption.

  1. Public Key: Widely distributed and accessible to anyone. Used for Encryption: The data is encrypted with the recipient's public key. Only the corresponding private key can decrypt it. This ensures secure transmission as anyone can encrypt data for the recipient, but only they can decrypt it.

  2. Private Key: Closely guarded and kept secret by the owner. Used for Decryption: The recipient uses their private key to decrypt the message, revealing the original data.

• Value-Benefits to ZT (2+3): (1) Strong Authentication: Public key certificates, based on asymmetric cryptography, can be used to digitally verify the identity of users, devices, and services. This aligns with Zero Trust's "never trust, always verify" approach. (2) Secure Communication Channels: Encrypted communication channels established using asymmetric keys ensure data confidentiality and integrity, protecting data from unauthorized access even within a compromised network (a core Zero Trust tenet). -- Combined with -- (3) Multi-Factor Authentication (MFA): Adds an extra layer of security beyond just public key authentication. (4) Least Privilege Access: Grants users only the minimum permissions required to perform their tasks. (5) Continuous Monitoring: Tracks user activity and system behavior to identify potential threats.

• Azure Tools for Asymmetric Key Encryption (Public Key Cryptography). -- BLUF: Azure doesn't offer a dedicated service solely for asymmetric key encryption, several tools support its implementation, they are:

  1. Azure Key Vault: This service securely stores and manages cryptographic keys, including public and private key pairs. You can generate key pairs within Key Vault or import existing ones.

  2. Azure Key Encryption libraries: Azure SDKs (.NET, Java, Python, etc.) provide libraries for encryption and decryption using asymmetric keys stored in Key Vault.

• Steps to Implement Asymmetric Key Encryption in Azure.

  1. Generate a Key Pair: Using Create a public-private key pair using tools like Azure Key Vault or external key generation utilities (e.g., OpenSSL).

  2. Store the Private Key: Securely store the private key in Azure Key Vault or another trusted key management solution.

  3. Distribute the Public Key: Make the public key readily available to authorized parties who need to encrypt data for you. This may involve publishing it on a public key server or sharing it directly.

  4. Encryption: The sender encrypts data with the recipient's public key obtained from a trusted source.

  5. Decryption: The recipient uses their private key stored in Azure Key Vault (or another secure location) to decrypt the message.

Does Azure support Zero Trust (ZT)?

• Yes, Azure can support ZT. Microsoft offers guidance and resources to help organizations apply Zero Trust principles to Azure environments.

• Azure supports ZT doing: (3)

  1. Explicit Verification: Via MS Entra ID (aka Azure AD) can be used to centrally manage IAM and enforce MFA to verify users before granting access.

  2. Least Privilege Access: MS Entra ID (aka Azure AD) can be configured to grant users access to only the specific resources they need, based on their role and device.

  3. Assume Breach: Azure security services like Azure Sentinel (SIEM) and MS Defender can be used to continuously monitor for threats and suspicious activity.

Crowdstrike Falson Horizon (CSF).

1. • BLUF: Provide SIEM & CSPM security endpoint monitoring capability on systems deployed in the cloud. 

   • 101:

     1. CSF offers Dashboards, Pie & Bar Charts, and a Semantic Web based on search capabilities (threat triggers) that have the same look and feel as ServiceNow, SharePoint, and Excel BI services.

     2. URL: https://www.crowdstrike.com/compare/crowdstrike-vs-splunk/

     3. LogScale: https://github.com/CrowdStrike/logscale-community-content/tree/main/Queries-Only/Helpful-CQL-Queries 

   • Value / Security Layered Approach: Leveraging both Crowdstrike and Azure tools can have (1) Deeper Security Coverage: More threat detection (2) Defense in Depth: Reduced gaps and (3) Improved Threat Detection: Threat intelligence.

   • Azure Offers Similar Functions: (2)

     1. Focus: Azure offers its cloud security products, with a focus on MS Defender for Cloud for Cloud Security Posture Management (CSPM) functionalities.

     2. Functionality: Both MS Defender for Cloud and CrowdStrike Falcon provide similar functionalities like identifying misconfigurations, assessing security posture, and offering recommendations for improvement. However, there might be differences in features and how they handle specific aspects of cloud security.

   • Azure tools (3):

     1.  Microsoft Defender for Cloud: A cloud security posture management (CSPM) solution offers a holistic view of your security posture across your entire Azure environment and on-premises assets. It includes features like:

        • Vulnerability management identifies vulnerabilities in your cloud resources and recommends remediation steps.

        • Threat detection and response: continuously monitors for suspicious activities and provides alerts to help you investigate and respond to potential threats.

        • Regulatory compliance: To assess your compliance with various security regulations and standards.

     2. Microsoft Defender for Endpoint: This endpoint protection platform (EPP) is deployed directly on your cloud VMs and provides real-time protection against malware, viruses, and other threats. It offers features like:

        • Next-generation antivirus (NGAV): Detects and blocks both known and unknown threats.

        • Endpoint detection and response (EDR): Provides advanced investigation and remediation capabilities for security incidents.

        • Tamper protection: Protects critical system settings from unauthorized modifications.

     3. Azure Security Center: This free service provides basic security monitoring and recommendations for your Azure resources. It offers features like: 

        • Security recommendations: Identifies potential security misconfigurations and recommends best practices.

        • Just-in-time (JIT) access: Grants temporary access to resources based on specific needs, reducing the attack surface.

        • Log analytics: Provides insights into security events happening across your Azure resources

   • Similarities w/ Different Approaches:

     1. CrowdStrike Falcon Horizon: Offers a multi-cloud solution for CSPM & SIEM.

     2. MS Defender for Cloud: Provides a native, integrated solution for Azure security with CSPM functionalities.

     3. Azure Sentinal (SIEM). Security Information & Event Management.

   • Resources:

     1. CrowdStrike Falcon Horizon: https://www.crowdstrike.com/blog/tech-center/falcon-horizon-notification-workflows/

     2. Microsoft Defender for Cloud: https://azure.microsoft.com/en-us/pricing/details/defender-for-cloud/

     3. Comparison on Reddit (be aware it might not be the most official source): https://www.reddit.com/r/crowdstrike/comments/12jkk2p/falcon_horizon_vs_ms_defe

Zscaler  (Zero Trust Integration) -- Integrating with Azure Front Door.

• Question: How do you ensure seamless integration between Zscaler and other Zero Trust components in a complex security architecture?

• Answer: To ensure seamless integration, focus on:

  1. API-driven automation: Using APIs to automate workflows and reduce manual errors.

  2. Single pane of glass: Integrating Zscaler with other security tools (like Azure Front Door) to provide a centralized view of security posture.

  3. Data sharing: Sharing relevant data between Zscaler and other components/tools (like Azure Front Door) to enable effective threat detection and response.

  4. Policy harmonization: Aligning security policies across different components/tools (like Azure Front Door) to avoid inconsistencies.

• Azure Front Door: -- BLUF: A powerful Azure tool that can be seamlessly integrated with Zscaler to provide a comprehensive security and performance solution. -- VALUE: By integrating Azure Front Door with Zscaler, benefits are improved security, performance, and scalability to protect their applications and data from cyber threats. -- It does:

  1. Traffic Routing: Azure Front Door can route traffic to Zscaler for inspection and filtering before it reaches your backend applications. This helps protect your applications from malicious attacks and ensures that only authorized traffic is allowed through.

  2. WAN Optimization: Zscaler's WAN optimization features can be leveraged in conjunction with Azure Front Door to improve network performance and reduce latency, especially for users located in remote locations.

  3. Global CDN: Global Content Delivery Network (CDN) can cache static content closer to users, reducing load on your backend servers and improving website performance. This can be particularly beneficial for organizations with a global user base.

  4. Security Integration: Azure Front Door can integrate with other Azure security services, such as Azure Firewall and Azure Security Center, to provide a comprehensive security solution. This helps protect your applications and data from a variety of threats.

Incident Management (ITIL) (9): 

• 9 Steps -- (1) Incident Identification - Identify and log incidents as soon as possible after they occur. (2) Incident Logging - Record all relevant information about the incident, including date, time, affected service, and any other relevant details. (3) Incident Categorization - Categorize incidents based on their impact, urgency, and priority. (4) Incident Prioritization - Prioritize incidents based on their impact and urgency, ensuring that the most critical incidents are addressed first. (5) Incident Diagnosis - Investigate and diagnose the root cause of the incident to determine the best course of action. (6) Incident Resolution - Take the necessary steps to resolve the incident, either restoring service to its normal state or implementing a workaround. (7) Incident Closure - Once the incident has been resolved, document the resolution, close the incident record, and notify any stakeholders affected by the incident. (8) Incident Review - Conduct a review of the incident to identify any lessons learned (KBA) and determine if any improvements can be made to prevent similar incidents in the future. (9) Incident Reporting - Prepare and distribute incident reports summarizing the details of the incident, its resolution, and any steps taken to prevent future occurrences.

Cyber Incident Management (NIST & CISA):

NIST and CISA provide a collaborative framework for handling cyber incidents. 

1. • NIST Process (4): -- NIST SP 800-61 Rev. 2: [NIST SP 800-61: Computer Security Incident Handling Guide ON National Institute of Standards and Technology (NIST).  

     1. Preparation:

        • NIST Special Publication 800-61 Rev. 2 (SP 800-61r2) lays the foundation, outlining steps for developing an incident response plan. This plan should define roles, procedures, and communication channels for handling cyber incidents.

        • Reporting potential incidents to CISA is crucial. CISA offers a reporting form on their website to report incidents as defined by SP 800-61r2.

     2. Detection and Analysis:

        • When a suspected incident is identified, the incident response plan kicks in.

        • The focus is on gathering evidence and understanding the scope of the incident. This might involve analyzing logs, identifying affected systems, and determining the potential impact.

     3. Containment and Eradication:

        • The goal is to stop the ongoing attack and prevent further damage. This could involve isolating infected systems, patching vulnerabilities, and containing the threat.

     4. Recovery and Post-Incident Activities:

        • Restoring affected systems and data to functionality is the priority.

        • This might involve backups, data restoration procedures, and system rebuilds.

        • Reviewing the incident and updating the response plan to improve future preparedness is crucial.

   • CISA's Process (2):

     1. CISA provides assistance and resources to organizations dealing with cyber incidents, particularly critical infrastructure sectors and government entities. They offer:

        • Technical expertise and guidance

        • Assistance in determining incident severity

        • Collaboration on threat analysis and information sharing

     2. Reporting:

        • Federal civilian agencies (FCEBs) must report all cyber incidents to CISA, regardless of severity.

        • Major incidents are reported to both CISA and the Office of Management and Budget (OMB).

     3. >> Resources:

        • CISA National Cyber Incident Scoring System (NCISS): [CISA National Cyber Incident Scoring System (.gov) cisa.gov]

        • Federal Government Cybersecurity Incident & Vulnerability Response Playbooks: [Federal Government Cybersecurity Incident & Vulnerability Response Playbooks (.gov) cisa.gov]

        • Report to CISA: https://www.cisa.gov/report

Remediation Processes & Procedures are the actions taken to address security issues and restore your Azure environment to a secure state. 

• Remediation Process/Procedures: (4)

  1. Identifying the Issue: The first step is to understand the security issue you're facing. This could involve analyzing alerts from Azure Security Center, Microsoft Defender for Endpoint, or other security tools.

  2. Analysis and Planning: Once the issue is identified, you must assess its severity and potential impact. This helps determine the appropriate remediation steps and prioritize them based on urgency.

  3. Taking Action (5): The specific actions will vary depending on the issue. Common examples: (1) Patching vulnerabilities in your Azure resources; (2) Rebooting infected systems (3) Restoring data from backups (4) Reconfiguring security settings (5) Removing compromised accounts or access

  4. Verification and Validation: After taking action, verifying that the remediation was successful and the security issue has been resolved is crucial. This might involve re-running vulnerability scans or confirming that suspicious activity has stopped.

• Azure Tool for Remediation: (1)

  1. Azure Policy is the primary tool used for automating remediation procedures in Azure. It allows you to define policies that enforce specific security configurations for your Azure resources. Here's how it works:

     • Benefits: (3)

       1. Automation: Azure Policy automates the remediation process, saving time and effort for security teams.

       2. Consistency: It ensures consistent security configurations across all your Azure resources.

       3. Reduced Risk: By proactively enforcing security policies, you can significantly reduce the risk of security incidents.

     • Value: (3)

       1. Policy Definition: You define a policy that specifies the desired security state for your resources. This could involve things like requiring specific security software to be installed, enforcing encryption for data storage, or restricting access to certain resources.

       2. Assignment (Assign): You assign the policy to a specific scope, such as a subscription, resource group, or individual resource. This determines which resources the policy applies to.

       3. Remediation: When Azure Policy detects a resource that violates the defined policy, it takes action to remediate the issue. 2-Main Remediation Options:

          • DeployIfNotExists: This option allows the policy to deploy the missing security configuration (CI) to the non-compliant resource automatically. For example, if a policy requires antivirus software to be installed, the policy could automatically deploy and install the software on non-compliant machines.

          • Modify: This option allows the policy to modify existing configurations to bring them into compliance. For instance, a policy might enforce specific password complexity requirements and automatically modify non-compliant passwords to meet those requirements.

AI Security Governance (Guidance):

• BLUF: Refers to the establishment of frameworks and procedures to ensure the responsible and secure development, deployment, and use of Artificial Intelligence (AI) systems.

• Value:

1. Mitigates Risks: By implementing proper governance practices, organizations can minimize the potential risks associated with AI, such as biased decision-making, data privacy breaches, and security vulnerabilities in AI models.

2. Ensures Compliance: AI governance helps organizations adhere to relevant regulations and ethical guidelines surrounding AI development and deployment.

3. Builds Trust: Effective AI governance fosters trust and transparency in the use of AI systems, which is crucial for stakeholders and the public.

Azure Resources for AI Security Governance: (6)

1. Azure Security Center for AI: Addresses security in AI models. It offers functionalities like:

   • Model risk assessment: Identifies potential vulnerabilities and biases within AI models.

   • Threat detection: Monitors for suspicious activities related to AI models.

   • Compliance checks: Ensures adherence to security best practices.

2. Azure Data Governance: This service empowers organizations to manage and govern their data effectively. This is essential for ensuring the security and privacy of data used to train and operate AI models.

3. Azure DevOps Security: This set of tools integrates security practices into the entire development lifecycle, including the development and deployment of AI models.

4. Azure Purview: As mentioned earlier, Azure Purview plays a vital role in data discovery and classification, which is crucial for governing the data used in AI systems.

5. Azure Functions: To build custom solutions tailored to their specific AI security governance needs. 

6. Azure Logic Apps: To build custom solutions tailored to their specific AI security governance needs.

CNAPP (Cloud-Native Application Protection Platform), offers several valuable functionalities: (3)

1. Security Posture Management: CNAPP assists in continuously monitoring and assessing the security posture of cloud-native applications. This enables organizations to identify and address potential security weaknesses proactively.

2. Workload Protection: CNAPP safeguards cloud-native applications throughout their lifecycle, encompassing development, deployment, and runtime. This involves shielding them against various threats such as malware injection, code vulnerabilities, and unauthorized access attempts.

3. Threat Detection and Response: CNAPP facilitates the identification and mitigation of security threats targeting cloud-native applications. Security teams can leverage CNAPP to investigate suspicious activities and swiftly respond to security incidents.

Azure Resources Utilized in CNAPP: (3)

Microsoft Azure offers a comprehensive set of services that can be integrated into a CNAPP solution. Some of the commonly used resources include:

1. Azure Monitor: Azure Monitor empowers continuous monitoring of cloud resources, including cloud-native applications. It centralizes log data and metrics, enabling security teams to gain insights into application health and potential security issues.

2. Azure Sentinel (SIEM): Azure Sentinel serves as an SIEM (Security Information and Event Management) tool that aggregates security data from various sources. This allows for centralized threat detection, investigation, and response within the Azure environment.

3. Azure Kubernetes Service (AKS): AKS is a managed Kubernetes service that streamlines the deployment and management of containerized applications. CNAPP solutions can be integrated with AKS to secure containerized workloads.

Data Security Platform (DSP) isn't a singular, specific service offering but a comprehensive set of services that collectively contribute to a data security posture, forming a data security ecosystem or environment.

• Value: (4)

  1. Data Discovery and Classification: Azure Purview empowers organizations to find and categorize sensitive data across cloud environments. This enables them to understand the data they possess and apply appropriate security measures.

  2. Data Loss Prevention (DLP): Azure Information Protection (AIP) and Azure Defender for Cloud prevent sensitive data exfiltration by offering data classification labeling, encryption, and monitoring data movement.

  3. Threat Detection and Response: Azure Sentinel (SIEM) acts as a central hub for security information and event management (SIEM), allowing organizations to collect data from various sources, identify threats targeting sensitive data, and initiate prompt responses.

  4. Data Governance: Azure Purview and Azure Data Catalog facilitate data governance by establishing data ownership, access controls, and usage guidelines.

Key Azure Resources: (7)

1. Azure Purview: Provides data discovery, classification, and lineage (tracking) capabilities.

2. Azure Information Protection (AIP): Offers data classification labeling and encryption.

3. Azure Defender for Cloud: Provides threat detection and protection across Azure resources & data stores.

4. Azure Sentinel (SIEM): For centralized security information aggregation and threat management.

5. Azure Data Catalog: Registers data assets within the organization and facilitates data discovery.

6. Microsoft Defender for Cloud Apps: Safeguards data across cloud apps like M365, Salesforce, and Dropbox.

7. Azure Key Vault: Securely stores cryptographic keys and secrets used for data encryption and access control.