Mastering Azure Security: Keeping your Microsoft Azure workloads safe, 2nd Edition

Get to grips with artificial intelligence and cybersecurity techniques to respond to adversaries and incidents Key Features Learn how to secure your Azure cloud workloads across applications and networks Protect your Azure infrastructure from cyber attacks Discover tips and techniques for implementing, deploying, and maintaining secure cloud services using best practices Book Description Security is integrated into every cloud, but this makes users put their guard down as they take cloud security for granted. Although the cloud provides higher security, keeping their resources secure is one of the biggest challenges many organizations face as threats are constantly evolving. Microsoft Azure offers a shared responsibility model that can address any challenge with the right approach. Revised to cover product updates up to early 2022, this book will help you explore a variety of services and features from Microsoft Azure that can help you overcome challenges in cloud security. You'll start by learning the most important security concepts in Azure, their implementation, and then advance to understanding how to keep resources secure. The book will guide you through the tools available for monitoring Azure security and enforcing security and governance the right way. You'll also explore tools to detect threats before they can do any real damage and those that use machine learning and AI to analyze your security logs and detect anomalies. By the end of this cloud security book, you'll have understood cybersecurity in the cloud and be able to design secure solutions in Microsoft Azure. What you will learn Become well-versed with cloud security concepts Get the hang of managing cloud identities Understand the zero-trust approach Adopt the Azure security cloud infrastructure Protect and encrypt your data Grasp Azure network security concepts Discover how to keep cloud resources secure Implement cloud governance with security policies and rules Who this book is for This book is for Azure cloud professionals, Azure architects, and security professionals looking to implement secure cloud services using Azure Security Centre and other Azure security features. A solid understanding of fundamental security concepts and prior exposure to the Azure cloud will help you understand the key concepts covered in the book more effectively. Table of Contents An Introduction to Azure Security Governance and Security Managing Cloud Identities Azure Network Security Azure KeyVault Data Security Microsoft Defender for Cloud Microsoft Sentinel Security Best Practices Cover Title Page Copyright and Credits Contributors Table of Contents Preface Section 1: Identity and Governance Chapter 1: An Introduction to Azure Security Exploring the shared responsibility model On-premises IaaS PaaS SaaS Division of security in the shared responsibility model Physical security Azure network Azure infrastructure availability Azure infrastructure integrity Azure infrastructure monitoring Understanding Azure security foundations Summary Questions Chapter 2: Governance and Security Understanding governance in Azure Using common sense to avoid mistakes Using management locks Using management groups for governance Understanding Azure Policy Mode Parameters Policy assignments Initiative definitions Initiative assignments Policy exemptions Policy best practices Defining Azure blueprints Blueprint definitions Blueprint publishing Azure Resource Graph Querying Azure Resource Graph with PowerShell Querying Azure Resource Graph with the Azure CLI Advanced queries Summary Questions Chapter 3: Managing Cloud Identities Exploring passwords and passphrases Dictionary attacks and password protection Understanding MFA How to enable MFA in Azure AD MFA activation from a user's perspective Introducing security defaults Using Conditional Access Named locations Custom controls Terms of use Conditional Access policies Introducing Azure AD Identity Protection Azure AD Identity Protection at a glance Understanding role-based access control Creating custom RBAC roles Protecting admin accounts with Azure AD PIM Managing Azure AD roles in PIM Managing Azure resources with PIM Hybrid authentication and Single Sign-On Understanding passwordless authentication Global settings Licensing considerations Summary Questions Section 2: Cloud Infrastructure Security Chapter 4: Azure Network Security Understanding Azure Virtual Network Connecting on-premises networks with Azure Creating an S2S connection Connecting a VNet to another VNet VNet service endpoints Private endpoints Considering other VNet security options Azure Firewall deployment and configuration Azure DDoS protection Azure Bastion Hub-and-spoke network topology Hub VNet Understanding Azure Application Gateway Understanding Azure Front Door Summary Questions Chapter 5: Azure Key Vault Understanding Azure Key Vault Understanding access policies Understanding service-to-service authentication Understanding managed identities for Azure resources Using Azure Key Vault in deployment scenarios Creating an Azure Key Vault and secret Azure VM deployment Summary Questions Chapter 6: Data Security Technical requirements Understanding Azure Storage Understanding Azure virtual machine disks Working on Azure SQL Database Summary Questions Section 3: Security Management Chapter 7: Microsoft Defender for Cloud Introducing Microsoft Defender for Cloud Enabling Microsoft Defender for Cloud Using auto-provisioning to deploy extensions Enabling Microsoft Defender for Cloud's enhanced security Cloud Security Posture Management with Defender for Cloud Working with recommendations How to prioritize remediation Working with resource exemptions Custom policies and (regulatory) compliance Using the regulatory compliance dashboard Working with regulatory compliance standards Cloud workload protection and multi-cloud capabilities Microsoft Defender for Servers Microsoft Defender for Containers Threat detection summary Automating security Continuous export Workflow automation REST APIs Multi-cloud capabilities in Microsoft Defender for Cloud Summary Questions Chapter 8: Microsoft Sentinel Introduction to SIEM Getting started with Microsoft Sentinel Configuring data connectors and retention Working with Microsoft Sentinel dashboards Setting up rules and alerts Microsoft Sentinel automation Creating workbooks Using threat hunting and notebooks Advanced threat detection Using community resources Summary Questions Chapter 9: Security Best Practices Log Analytics design considerations Understanding Azure SQL Database security features Security in Azure App Service Storage account access keys Summary Questions Assessments Index Other Books You May Enjoy Learn how to set up, configure, and use Microsoft Sentinel to provide security incident and event management services for your multi-cloud environment Key Features Collect, normalize, and analyze security information from multiple data sources Integrate AI, machine learning, built-in and custom threat analyses, and automation to build optimal security solutions Detect and investigate possible security breaches to tackle complex and advanced cyber threats Book Description Microsoft Sentinel is a security information and event management (SIEM) tool developed by Microsoft that helps you to integrate cloud security and artificial intelligence (AI). This book will enable you to implement Microsoft Sentinel and understand how it can help detect security incidents in your environment with integrated AI, threat analysis, and built-in and community-driven logic. The book begins by introducing you to Microsoft Sentinel and Log Analytics. You'll then get to grips with data collection and management, before learning how to create effective Microsoft Sentinel queries to detect anomalous behaviors and activity patterns. Moving ahead, you'll learn about useful features such as entity behavior analytics and Microsoft Sentinel playbooks along with exploring the new bi-directional connector for ServiceNow. As you progress, you'll find out how to develop solutions that automate responses needed to handle security incidents. Finally, you'll grasp the latest developments in security, discover techniques to enhance your cloud security architecture, and explore how you can contribute to the security community. By the end of this Microsoft Sentinel book, you'll have learned how to implement Microsoft Sentinel to fit your needs and be able to protect your environment from cyber threats and other security issues. What you will learn Implement Log Analytics and enable Microsoft Sentinel and data ingestion from multiple sources Get to grips with coding using the Kusto Query Language (KQL) Discover how to carry out threat hunting activities in Microsoft Sentinel Connect Microsoft Sentinel to ServiceNow for automated ticketing Find out how to detect threats and create automated responses for immediate resolution Use triggers and actions with Microsoft Sentinel playbooks to perform automations Who this book is for If you are an IT professional with prior experience in other Microsoft security products and Azure and are now looking to expand your knowledge to incorporate Microsoft Sentinel, then this book is for you. Security experts using an alternative SIEM tool who want to adopt Microsoft Sentinel as an additional service or as a replacement will also find this book useful Learn How To Implement Multi-layered Security Controls To Protect Against Rapidly Evolving Threats To Azure Environmentskey Features* Develop Practical Skills To Protect Your Organization From Constantly Evolving Security Threats* Become Well-versed With Real-world Azure Security Strategies And Az-500 Exam Objectives* Effectively Manage Security Governance, Policies, And Operations In Azurebook Descriptionsecurity Is A Key Part Of Any Well-architected Design. With The Help Of This Book, You'll Gain Both The Knowledge And The Practical Skills To Significantly Reduce The Attack Surface Of Your Azure Workloads And Protect Your Organization From Constantly Evolving Threats To Public Cloud Environments Like Azure.this Book Is A Comprehensive Security Guide For Those Looking To Take The Azure Security Engineer Certification Exam As Well As For Those Interested In Securing Their Azure Infrastructure. Beyond Preparing You For The Azure Security (az-500) Exam, This Book Will Guide You In Securing Your Azure Environments And Workloads Using Native Azure Security Capabilities.complete With Hands-on Tutorials, Projects, And Self-assessment Questions, This Easy-to-follow Guide Builds A Solid Foundation Of Azure Security. You'll Not Only Learn About Security Technologies In Azure But Also Be Able To Configure And Manage Them. Moreover, You'll Develop A Clear Understanding Of How To Identify Different Attack Vectors And Mitigate Risks.by The End Of This Book, You'll Be Well-versed With Implementing Multi-layered Security To Protect Identities, Networks, Hosts, Containers, Databases, And Storage In Azure.what You Will Learn* Manage Users, Groups, Service Principals, And Roles Effectively In Azure Ad* Explore Azure Ad Identity Security And Governance Capabilities* Understand How Platform Perimeter Protection Secures Azure Workloads* Implement Network Security Best Practices For Iaas And Paas* Discover Various Options To Protect Against Ddos Attacks* Secure Hosts And Containers Against Evolving Security Threats* Configure Platform Governance With Cloud-native Tools* Monitor Security Operations With Azure Security Center And Azure Sentinelwho This Book Is Forif You Are A Newly Qualified Or Experienced Security Professional, Cloud Administrator, Architect, Or Developer Who Wants To Understand How To Secure Your Azure Environment And Workloads, This Book Is For You. The Book Is A Handy Resource For Anyone Preparing To Take The Azure Security Engineer (az-500) Certification Exam. Foundational Knowledge Of The Azure Cloud Platform Will Be Helpful But Not Necessary To Understand The Concepts Covered In This Book. Get to grips with artificial intelligence and cybersecurity techniques to respond to adversaries and incidents Key Features* Learn how to secure your Azure cloud workloads across applications and networks * Protect your Azure infrastructure from cyber attacks * Discover tips and techniques for implementing, deploying, and maintaining secure cloud services using best practices Book DescriptionSecurity is integrated into every cloud, but this makes users put their guard down as they take cloud security for granted. Although the cloud provides higher security, keeping their resources secure is one of the biggest challenges many organizations face as threats are constantly evolving. Microsoft Azure offers a shared responsibility model that can address any challenge with the right approach. Revised to cover product updates up to early 2022, this book will help you explore a variety of services and features from Microsoft Azure that can help you overcome challenges in cloud security. You'll start by learning the most important security concepts in Azure, their implementation, and then advance to understanding how to keep resources secure. The book will guide you through the tools available for monitoring Azure security and enforcing security and governance the right way. You'll also explore tools to detect threats before they can do any real damage and those that use machine learning and AI to analyze your security logs and detect anomalies. By the end of this cloud security book, you'll have understood cybersecurity in the cloud and be able to design secure solutions in Microsoft Azure. What you will learn* Become well-versed with cloud security concepts * Get the hang of managing cloud identities * Understand the zero-trust approach * Adopt the Azure security cloud infrastructure * Protect and encrypt your data * Grasp Azure network security concepts * Discover how to keep cloud resources secure * Implement cloud governance with security policies and rules Who this book is forThis book is for Azure cloud professionals, Azure architects, and security professionals looking to implement secure cloud services using Azure Security Centre and other Azure security features. A solid understanding of fundamental security concepts and prior exposure to the Azure cloud will help you understand the key concepts covered in the book more effectively. Table of Contents1. An Introduction to Azure Security 2. Governance and Security 3. Managing Cloud Identities 4. Azure Network Security 5. Azure KeyVault 6. Data Security 7. Microsoft Defender for Cloud 8. Microsoft Sentinel 9. Security Best Practices Learn how to set up, configure, and use Microsoft Sentinel to provide security incident and event management services for your multi-cloud environmentKey FeaturesCollect, normalize, and analyze security information from multiple data sourcesIntegrate AI, machine learning, built-in and custom threat analyses, and automation to build optimal security solutionsDetect and investigate possible security breaches to tackle complex and advanced cyber threatsBook DescriptionMicrosoft Sentinel is a security information and event management (SIEM) tool developed by Microsoft that helps you integrate cloud security and artificial intelligence (AI). This book will teach you how to implement Microsoft Sentinel and understand how it can help detect security incidents in your environment with integrated AI, threat analysis, and built-in and community-driven logic.The first part of this book will introduce you to Microsoft Sentinel and Log Analytics, then move on to understanding data collection and management, as well as how to create effective Microsoft Sentinel queries to detect anomalous behaviors and activity patterns. The next part will focus on useful features, such as entity behavior analytics and Microsoft Sentinel playbooks, along with exploring the new bi-directional connector for ServiceNow. In the next part, you'll be learning how to develop solutions that automate responses needed to handle security incidents and find out more about the latest developments in security, techniques to enhance your cloud security architecture, and explore how you can contribute to the security community.By the end of this book, you'll have learned how to implement Microsoft Sentinel to fit your needs and protect your environment from cyber threats and other security issues.What you will learnImplement Log Analytics and enable Microsoft Sentinel and data ingestion from multiple sourcesTackle Kusto Query Language (KQL) codingDiscover how to carry out threat hunting activities in Microsoft SentinelConnect Microsoft Sentinel to ServiceNow for automated ticketingFind out how to detect threats and create automated responses for immediate resolutionUse triggers and actions with Microsoft Sentinel playbooks to perform automationsWho this book is forYou'll get the most out of this book if you have a good grasp on other Microsoft security products and Azure, and are now looking to expand your knowledge to incorporate Microsoft Sentinel. Security experts who use an alternative SIEM tool and want to adopt Microsoft Sentinel as an additional or a replacement service will also find this book useful. Learn how to implement multi-layered security controls to protect against rapidly evolving threats to Azure environments Key Features Develop practical skills to protect your organization from constantly evolving security threats Become well-versed with real-world Azure security strategies and AZ-500 exam objectives Effectively manage security governance, policies, and operations in Azure Book Description Security is a key part of any well-architected design. With the help of this book, you'll gain both the knowledge and the practical skills to significantly reduce the attack surface of your Azure workloads and protect your organization from constantly evolving threats to public cloud environments like Azure. This book is a comprehensive security guide for those looking to take the Azure Security Engineer certification exam as well as for those interested in securing their Azure infrastructure. Beyond preparing you for the Azure Security (AZ-500) exam, this book will guide you in securing your Azure environments and workloads using native Azure security capabilities. Complete with hands-on tutorials, projects, and self-assessment questions, this easy-to-follow guide builds a solid foundation of Azure security. You'll not only learn about security technologies in Azure but also be able to configure and manage them. Moreover, you'll develop a clear understanding of how to identify different attack vectors and mitigate risks. By the end of this book, you'll be well-versed with implementing multi-layered security to protect identities, networks, hosts, containers, databases, and storage in Azure. What you will learn Manage users, groups, service principals, and roles effectively in Azure AD Explore Azure AD identity security and governance capabilities Understand how platform perimeter protection secures Azure workloads Implement network security best practices for IaaS and PaaS Discover various options to protect against DDoS attacks Secure hosts and containers against evolving security threats Configure platform governance with cloud-native tools Monitor security operations with Azure Security Center and Azure Sentinel Who this book is for If you are a newly qualified or experienced security professional, cloud administrator, architect, or developer who wants to understand how to secure your Azure environment and workloads, this book is for you. The book is a handy resource for anyone preparing to take the Azure Security Engineer (AZ-500) certif .. Security is integrated into every cloud, but most users take cloud security for granted. Revised to cover product updates up to early 2022, this book will help you understand Microsoft Azure's shared responsibility model that can address any challenge, cybersecurity in the cloud, and how to design secure solutions in Microsoft Azure. Use Microsoft's own intelligent security service that brings together cloud security and AI to protect your organization. Microsoft Sentinel in Action will help you to gain enough understanding to make the most of Azure services and secure your environment against modern cybersecurity threats.