An Azure security service protects Azure identities, data, applications, infrastructure, or networks. Correct configuration helps prevent business disruption as attacks grow more sophisticated and frequent. Security is managed continuously rather than solved once. section 1.3 section 1.8.3
Manage Azure security as an iterative cycle:
- Secure workloads by applying security best practices. section 1.3
- Monitor the environment for compromise and suspicious activity, including lateral movement. section 1.3
- Investigate potential compromise and respond when necessary. section 1.3
Use layered controls instead of relying on one service. Azure Policy provides guardrails for security practices and business rules; Microsoft Defender for Cloud detects and can sometimes remediate misconfigurations; Microsoft Sentinel and Defender for Cloud help detect and respond to suspicious activity. section 1.8.3
Responsibility varies by IaaS, PaaS, and SaaS, but securing accounts, identities, clients, endpoints, information, and data remains the customer’s responsibility and can use Azure security services. section 1.2
Figure 1.1 Improving an organization’s security posture can be seen as an ever-evolving and ever-changing cyclical process.
Use the cyclical-process figure to connect workload protection, monitoring, investigation, response, and continual improvement. section 1.3
Figure 1.7 Azure security services that can be used to secure data and applications in your Azure environment
Use the service-and-threat figure to map defense-in-depth controls to identities, data, applications, infrastructure, and networks. section 1.8.3
