liveBookmanning.com

What you will learn in Azure Security

by Bojan Magušić

Read it on liveBook Get the book at manning.com

Chapter by chapter

Concepts explained in this book

• Azure PolicyAzure Policy is an Azure governance service that evaluates resources against organizational rules and can enforce or audit compliance.
• Microsoft Defender for CloudMicrosoft Defender for Cloud is Microsoft's cloud security posture management and workload protection service for cloud and hybrid environments.
• Azure BastionAn Azure Bastion instance is a fully managed compute unit that runs the processes required to provide Azure Bastion connectivity and session capacity.
• Microsoft SentinelMicrosoft Sentinel is a cloud-native security information and event management and security orchestration, automation, and response service.
• Azure Firewall StandardAzure Firewall is a managed, stateful network firewall service that filters and controls traffic across Azure virtual networks and connected environments.
• Log AnalyticsA Log Analytics workspace is an Azure Monitor data store and query environment for collecting, retaining, and analyzing telemetry and security data.
• service principalA service principal is an application identity in Microsoft Entra ID that represents software and can authenticate to access Azure resources.
• Log Analytics agentThe Log Analytics agent, also known as the Microsoft Monitoring Agent, is a legacy Azure monitoring agent that collects data from virtual machines and sends it to a Log Analytics workspace.
• automated provisioningAuto-provisioning is the automatic deployment and configuration of required security agents or add-ons across existing and newly created resources.
• Azure Web Application FirewallAzure Web Application Firewall is an Azure-managed service that inspects web traffic and applies rules to protect HTTP applications from common exploits.
• Microsoft Security DevOpsMicrosoft Security DevOps is a Microsoft application that integrates security analysis tools into software development and continuous integration pipelines.
• recommendationA security recommendation is guidance that identifies a security weakness or misconfiguration and specifies how to improve the protection of a resource.
• policy definitionAn Azure Policy definition is a rule specification that evaluates a particular resource configuration and defines the effect applied to its evaluation.
• identityAn identity is a distinct representation of a user, application, service, or other entity that can be authenticated and authorized.
• Azure subscriptionAn Azure subscription is a billing and management container that provides access to Azure services and scopes resource organization and governance.
• Microsoft Cloud Security BenchmarkThe Microsoft Cloud Security Benchmark is Microsoft's collection of cloud security recommendations aligned with widely used security and compliance control frameworks.
• scopeA scope is the level and set of Azure resources to which a role assignment or governance configuration applies.
• policy initiativeA policy initiative is an Azure Policy grouping of policy definitions that represents a coordinated set of governance requirements.
• Azure DDoS Protection StandardAzure DDoS Protection is an Azure service family that defends public Azure resources against distributed denial-of-service attacks.
• Microsoft Defender for DevOpsMicrosoft Defender for DevOps is a Microsoft security service that provides security visibility and protection across DevOps environments and pipelines.
• managed identityA Microsoft Entra identity provisioned for an Azure resource or workload so it can authenticate to supported services without storing credentials such as passwords or certificates.
• infrastructure as codeInfrastructure as code is the practice of defining and managing infrastructure through machine-readable configuration files and automation rather than manual procedures.
• Azure Monitor agentAzure Monitor Agent is Microsoft's agent for collecting and routing monitoring data from Azure resources and connected machines to supported Azure monitoring services.
• data collection ruleA data collection rule is an Azure Monitor configuration that specifies which monitoring data to collect, how to transform it, and where to send it.
• connectorA data connector is an integration component that collects data from a source and makes it available to a monitoring or analytics system.
• role assignmentA role assignment is an Azure authorization object that binds a role definition to a security principal at a specified scope.
• regulatory compliance dashboardA Microsoft Defender for Cloud interface that evaluates Azure resources against regulatory and industry standards and presents compliance controls, assessments, and recommendations.
• scheduled query ruleA scheduled query rule is a detection rule that periodically runs a query and generates security alerts or incidents when its results meet defined criteria.
• Secure ScoreA secure score is a percentage-based metric that aggregates security findings and reflects an environment's adherence to security best practices and identified risk.
• security alertA security alert is a notification generated by a security monitoring system when observed activity meets criteria for a potential security incident or attack.
• detection modeDetection mode is a web application firewall operating mode that records rule matches without blocking the corresponding requests.
• prevention modePrevention mode is a web application firewall operating mode that blocks incoming requests matching firewall rules while logging requests.
• WAF policyA WAF policy is a configuration resource that defines the rules, rule sets, and operating mode applied by a web application firewall.
• management groupAn Azure management group is a governance container that organizes subscriptions and provides a scope for applying access and policy controls.
• Azure tenantAn Azure tenant is a dedicated Microsoft Entra identity boundary that represents an organization and contains its directory and associated subscriptions.
• analytics ruleAn analytics rule is a Microsoft Sentinel detection configuration that evaluates data to identify potential threats or security incidents.
• complianceCompliance is the state of satisfying the requirements defined by an applicable policy or rule set.
• Azure Key VaultAzure Key Vault is an Azure service for securely storing and controlling access to secrets, keys, and certificates.
• Microsoft Entra IDMicrosoft Entra ID is Microsoft’s cloud identity and access management service for authenticating identities and controlling access to resources.
• managed bot protectionManaged bot protection is a provider-operated capability that classifies automated clients and applies different traffic-handling actions based on bot reputation.
• data planeThe Azure data plane is the layer through which applications and users access or manipulate the capabilities and data managed by Azure resources.
• Microsoft Entra Privileged Identity ManagementMicrosoft Entra Privileged Identity Management (PIM) is a capability for governing, activating, auditing, and limiting privileged access to resources and administrative roles.
• cloud security posture managementCloud security posture management is the continuous assessment of cloud workloads and configurations against security requirements, with guidance for correcting weaknesses and misconfigurations.
• identity governance and administrationThe management of identities, approvals, access assignments, and related operational processes.
• custom policyA custom policy definition is an Azure Policy rule authored by an organization to evaluate or enforce requirements not covered by built-in definitions.
• remediationRemediation is the process of correcting, removing, or containing a security weakness, threat, or incident impact.
• managed rule setA managed rule set is a provider-maintained collection of firewall rules that can be applied to inspect and filter requests.
• CI/CD serverA CI/CD platform is a software platform that automates continuous integration and continuous delivery activities such as building, testing, and deploying code.
• security postureSecurity posture is the overall state of an environment's security controls, configuration, exposure, and resilience to threats.
• kill chain modelAn attack model that represents the sequence of stages an attacker may follow from exposure and access through movement and actions to an objective and goal.
• automation ruleAn automation rule is a Microsoft Sentinel configuration that applies automated actions to security events or incidents when specified conditions are met.
• principalA security principal is an identity or identity-bearing entity, such as a user, group, service principal, or managed identity, that can receive permissions in an authorization system.
• access reviewA governance process that periodically evaluates whether identities should retain their assigned access to resources, applications, or roles.
• resource logA resource log is a record generated by an Azure service that describes operations performed within a specific Azure resource.
• customer-managed keyA customer-managed key is cryptographic key material whose lifecycle and access are controlled by the Azure customer rather than the service provider.
• severityAlert severity is a classification indicating the urgency and assessed likelihood or impact of a security alert.
• GitHub ActionsGitHub Actions is GitHub's automation platform for implementing software development workflows, including continuous integration and deployment.
• Azure Bastion Standard SKUAzure Bastion Standard SKU includes the Basic tier's connectivity capabilities plus advanced connection configuration options.
• shared-responsibility modelShared responsibility is a division of accountability among multiple parties for managing and resolving a security outcome.
• authenticationAuthentication is the process of verifying that an identity belongs to the person, application, or entity claiming it.
• securityCybersecurity is the practice of protecting digital systems, data, identities, applications, and networks from unauthorized access, disruption, or misuse.
• unified DevOps posture visibilityUnified DevOps posture visibility is the centralized observation of security insights across code, dependencies, secrets, and container images in DevOps source code systems.
• policy effectA policy effect is the outcome Azure Policy applies when evaluating a resource against a policy definition.
• cloud workload protectionCloud workload protection is the monitoring of cloud workloads for suspicious activity and indicators of compromise, with security alerts generated for potentially significant threats.
• Azure Logic AppsAzure Logic Apps is an Azure service for designing and running automated workflows that integrate applications, services, and data sources.
• threat landscapeThe overall set of vulnerabilities, malicious software, and adversary groups that shape an organization's cyber threat environment.
• cloud security explorerCloud security explorer is a Microsoft Defender for Cloud capability for querying and exploring security relationships and risks in a cloud environment.
• threat detectionThreat detection is the process of identifying activity or conditions that may represent a security threat or attack, including during container workload execution.
• conditional accessA conditional access policy is a Microsoft Entra access rule that evaluates assignments and conditions to apply access controls.
• cloud securityThe discipline of protecting cloud-hosted infrastructure, services, data, identities, and workloads from unauthorized access and attacks.
• identity protectionIdentity protection is a Microsoft Entra capability that detects identity and sign-in compromise risk using behavioral analysis and supports protective responses.
• Azure Firewall PremiumAzure Firewall Premium is an advanced managed Azure network firewall tier that provides enhanced inspection, detection, prevention, and filtering capabilities.
• Azure MonitorAzure Monitor is Azure’s service for collecting, analyzing, visualizing, and acting on telemetry from cloud resources and applications.
• account access keyA storage account key is a long-lived Azure Storage credential that provides broad access to the resources and data in a storage account.
• Content hubContent hub is a Microsoft Sentinel content management feature for discovering and deploying security content such as data connectors, analytics rules, and playbooks.
• infinite gameA security perspective that treats the operating environment as continuously changing and without a final endpoint.
• active assignmentAn active assignment is a role assignment whose permissions are immediately available to the assigned identity for its configured duration.
• eligible assignmentAn eligible assignment is a role assignment that permits an identity to activate a role only after performing the required activation action.
• just-in-time accessJust-in-time privileged access grants elevated administrative permissions only when needed and for a limited period.
• Microsoft Defender for ContainersMicrosoft Defender for Containers is Microsoft's cloud security service for detecting threats, assessing vulnerabilities, and enforcing security policies across containerized workloads and Kubernetes environments.
• subscription scopeSubscription level is an Azure RBAC scope that applies permissions across resources in an Azure subscription.
• best practiceA security best practice is a generally accepted recommendation for reducing security risk through configuration, design, or operational controls.
• lateral movementLateral movement is an attack technique in which an adversary moves from one compromised resource or account to additional resources within an environment.
• multifactor authenticationMultifactor authentication is an authentication method that requires two or more independent factors to verify an identity.
• service endpointAn Azure service endpoint is a virtual-network configuration that enables a subnet to access a supported Azure service through the provider backbone.
• Microsoft Defender for ServersMicrosoft Defender for Servers is a Microsoft Defender for Cloud plan that provides security monitoring and workload protection for virtual machines and server workloads.
• role configurationA role definition is an authorization specification that groups permissions into a role assignable to identities.
• entity mappingA configuration that maps query results to recognized security entities such as accounts or hosts.
• incident settingsConfiguration that determines whether alerts from a detection rule generate Microsoft Sentinel incidents and how those alerts are grouped.
• near-real-time ruleA Microsoft Sentinel detection rule that runs at approximately one-minute intervals to provide more current detection results.
• rule logicThe query and evaluation settings that determine what activity an analytics rule detects and when it generates an alert or incident.
• interactive user sign-inA sign-in event in which a user interactively provides credentials to access an Azure environment or resource.
• Microsoft Entra ID audit logA Microsoft Entra ID dataset containing records of directory-related operations and administrative activities in an Azure tenant.
• Microsoft Entra ID sign-in logA Microsoft Entra ID dataset containing records of identities signing in to access resources and applications.
• iaasInfrastructure as a service is a cloud service model that provides virtualized compute, storage, and networking resources for customer-managed workloads.
• vault access policyA Key Vault access policy is a Key Vault authorization configuration that grants an identity permissions to perform specified operations on secrets, keys, or certificates.
• control plane operationA control plane operation changes or manages the configuration and lifecycle of a cloud resource.
• data plane operationA data plane operation accesses or manipulates the data managed by a cloud resource.
• operating systemAn operating system is system software running inside a virtual machine that manages its virtual hardware and provides services for applications.
• diagnostic settingA diagnostic setting is an Azure configuration that selects resource telemetry and routes it to a specified monitoring or storage destination.
• defense in depthA security strategy that combines multiple independent layers of protection so that each layer increases attack difficulty and compensates when another layer fails.
• Azure DDoS Protection BasicAzure DDoS Protection Basic is a basic Azure service tier that provides baseline protection for Azure resources against distributed denial-of-service attacks.
• Azure Policy add-on for KubernetesThe Azure Policy add-on for Kubernetes is a Kubernetes integration that evaluates workloads against Azure Policy rules and can audit or enforce them.
• Defender profileThe Defender profile is a Microsoft-developed Kubernetes agent deployed on cluster nodes to collect security signals for Microsoft Defender for Containers.
• built-in roleA built-in role is a predefined Azure RBAC role containing a set of permissions supplied by Azure.
• user-assigned managed identityA user-assigned managed identity is a standalone Azure resource that can be assigned to one or more Azure resources.
• continuous exportContinuous export is the ongoing transfer of selected security data from a source service to a configured destination as changes or scheduled snapshots occur.
• containerA software container is an isolated executable environment that packages an application and its runtime requirements while sharing the host operating system.
• Azure Kubernetes ServiceAKS, or Azure Kubernetes Service, is Microsoft's managed Kubernetes service for deploying and operating Kubernetes clusters in Azure.
• virtual machineA Windows virtual machine is a virtual machine running a Windows operating system.
• baselineA baseline is a reference representation of expected security or compliance requirements against which observed resource configurations can be evaluated.
• tactics, techniques, and proceduresA structured description of adversary behavior spanning objectives, approaches, methods, and concrete execution details.
• custom roleA custom role is an authorization configuration that grants a specifically selected set of permissions to users or other identities.
• authorization decisionAuthorization is the process of determining whether an authenticated identity has permission to perform a requested action on a system or resource.
• cloud security graphThe cloud security graph is a contextual model of an environment's resources, connections, exposures, lateral-movement possibilities, and vulnerabilities used to identify security risks and attack paths.
• identity directoryAn identity directory is a store of identity-related information for users, groups, applications, and other entities.
• distributed denial of service attackA distributed denial-of-service attack is an attack that overwhelms a target with traffic or requests from multiple sources to disrupt availability.
• control planeA control plane action operates on the configuration or management of an Azure resource rather than on data stored within it.
• Azure roleAn Azure role is a defined set of permissions that controls what an identity can do to Azure resources.
• privileged role activationPrivileged role activation is the process of temporarily enabling an eligible privileged role for an identity.
• multihomingMultihoming is the configuration of a monitoring agent to send collected data to multiple destinations or workspaces.
• Azure DDoS Protection planAn Azure configuration resource that enables and associates Azure DDoS Protection Standard with protected resources.
• code-to-cloud contextualizationCode-to-cloud contextualization is the correlation of software code and development findings with the cloud resources and runtime context they affect.
• principle of least privilegeLeast privilege is an access-control principle that grants only the permissions necessary for a task and only for the required duration.
• workbookAn Azure Monitor workbook is an interactive report that combines data queries, visualizations, and text to present operational or security information.
• adaptive application controlAdaptive application control uses observed application execution and machine learning to define and enforce an allow list of permitted applications.
• adaptive network hardeningAdaptive network hardening analyzes traffic and threat indicators to recommend stricter network security group rules that reduce attack surface.
• Azure Arc agentThe Azure Arc agent is software that connects servers and other resources outside Azure to Azure management and security services.
• file integrity monitoringFile integrity monitoring observes selected files and registry entries for changes that may indicate tampering or compromise.
• just-in-time VM accessJust-in-time VM access is a control that restricts inbound access to virtual machines until access is explicitly needed.
• Microsoft Defender for EndpointMicrosoft Defender for Endpoint is an endpoint security platform that provides endpoint detection and response, antivirus protection, vulnerability management, and related capabilities.
• vulnerability assessmentA vulnerability assessment is a systematic examination of systems and installed software to identify security weaknesses.
• Microsoft 365 Defender data connectorThe Microsoft 365 Defender data connector is a Sentinel integration that unifies data collection from Microsoft Defender SaaS security solutions.
• procedureA highly detailed description of the specific steps and implementation details of a bad actor's technique.
• RDP brute-force attackAn RDP brute-force attack repeatedly tries credentials against Remote Desktop Protocol access to gain unauthorized entry.
• techniqueA detailed method a bad actor uses to carry out a tactic.
• threat actor tacticA high-level behavior or approach a bad actor uses to achieve a goal.
• vulnerabilityA vulnerability is a weakness or gap in a system or its security controls that can be exploited by a bad actor.
• data sourceA data source is an application, service, or system that produces data available for collection and analysis.
• shared access signatureA shared access signature is a signed Azure Storage authorization token that grants specified permissions to specified resources for a defined period.
• Azure Key Vault firewallThe Azure Key Vault firewall is a network access control feature that restricts requests to a key vault by IP address, subnet, or trusted Azure service.
• security perimeterThe boundary that separates resources and users considered inside a security domain from those considered outside it.
• resource group scopeResource group level is an Azure RBAC scope that applies permissions to resources within a resource group.
• resource scopeResource level is the narrowest Azure RBAC scope, applying permissions to one Azure resource.
• entitlement managementA Microsoft Entra capability that automates lifecycle-based access to groups, applications, teams, and SharePoint sites.
• Azure Activity LogAzure Activity Log is an Azure dataset containing records of subscription-level operations and administrative activities.
• Azure CLIAzure CLI is a cross-platform command-line tool for creating and managing Azure resources and services.
• graph queryA graph-based query retrieves information by evaluating nodes and relationships in a graph-structured representation of resources and security context.
• data ingestionData ingestion is the process of gathering and importing data from one or more sources into a system for storage and processing.
• IP-based access restriction ruleAn IP-based access restriction rule matches an incoming request against specified IP address blocks and allows or denies access accordingly.
• service endpoint-based access restriction ruleA service endpoint-based access restriction rule limits inbound access to requests originating from a specified virtual network subnet through a service endpoint.
• service tagAn Azure service tag is a managed identifier representing the IP address prefixes used by a category of Azure services.
• service tag-based access restriction ruleA service tag-based access restriction rule limits inbound access according to the IP address prefixes represented by a specified Azure service tag.
• repository onboardingRepository onboarding is the process of connecting source code repositories to a security service for assessment and monitoring.
• security connectorA security connector is an integration resource that stores source-control connection settings and enables Defender for Cloud to connect to a source code management system.
• subdomain takeoverA subdomain takeover is an attack in which an abandoned or deleted resource referenced by a subdomain is claimed and used to control traffic for that subdomain.
• Azure Application GatewayAzure Application Gateway v2 is the second-generation deployment version of Azure Application Gateway that supports WAF policies.
• anomaly scoreAnomaly scoring is a web application firewall evaluation method that assigns a cumulative score to detected request anomalies to determine whether traffic is blocked.
• Azure Key Vault admin roleKey Vault Administrator is an Azure built-in role that permits all data plane operations on a key vault and its objects.
• attack pathAn attack path is a sequence of exploitable conditions and connections through which an attacker could reach a target resource or achieve an objective.
• Azure Front DoorAzure Front Door is a global Azure service for accelerating, routing, and load-balancing web application traffic across regions and origins.
• Azure WAF tuningAzure WAF tuning is the process of adjusting web application firewall rules and settings to reduce false positives while preserving attack detection.
• security policyA security policy is an Azure Front Door configuration that associates a web application firewall policy with a Front Door profile.
• Azure securityThe collection of Azure-native capabilities and practices for protecting resources and environments hosted on Microsoft Azure.
• Azure security serviceAn Azure security service is a Microsoft Azure service that provides capabilities for protecting Azure identities, data, applications, infrastructure, or networks.
• system-assigned managed identityA system-assigned managed identity is a managed identity whose lifecycle is tied to a single Azure resource.
• Kubernetes worker nodeA Kubernetes worker node is a machine that runs containerized workloads scheduled by the cluster control plane.
• control plane nodeA Kubernetes control plane is the set of components that manages cluster resources and enforces the desired state of worker nodes.
• application ruleAn application rule is an Azure Firewall rule that controls outbound traffic from a network to internet destinations at the application level.
• destination network address translationDestination network address translation is a network translation technique that maps traffic addressed to a public endpoint to an internal destination.
• forced tunnelingForced tunneling is a routing configuration that sends outbound traffic through a specified network destination instead of directly to the internet.
• rule collectionA rule collection is a grouping of one or more Azure Firewall rules managed as a unit.
• Azure BlueprintsAzure Blueprints is an Azure service for defining and orchestrating repeatable environment setups that include resource deployments, policy assignments, and role assignments.
• Azure Cloud ShellAzure Cloud Shell is a browser-accessible interactive shell environment for managing Azure resources without local tool installation.
• Azure Storage firewallAzure Storage firewall is a network access-control feature that restricts requests to Azure Storage accounts based on network locations and resource sources.

These guides are generated from the text of Manning books by Manning's knowledge graph and link to the sections they draw on. The full books are available on liveBook and at manning.com.