Cloud security graph

As explained in Azure Security

The cloud security graph is a contextual model of an environment's resources, connections, exposures, lateral-movement possibilities, and vulnerabilities used to identify security risks and attack paths.

A cloud security graph models an environment’s resources, relationships, exposures, lateral-movement possibilities, and vulnerabilities. Defender for Cloud uses this contextual graph to identify risks according to both exploitability and business effect, helping teams prioritize remediation instead of treating every recommendation equally. section 6.3

Use the graph to connect technical weaknesses with their potential business impact:

• Assess exploitability, such as an internet-exposed VM containing high-severity vulnerabilities. section 6.3
• Assess business effect, such as that VM having access to a storage account containing sensitive customer data. section 6.3
• Prioritize attack paths that bad actors could use to breach the environment, then apply the associated recommendations. section 6.3.1

Investigating an attack path

In the Azure portal, open Microsoft Defender for Cloud, choose Recommendations, and select Attack Path. Choose a path such as an internet-exposed VM with high-severity vulnerabilities and read permission to a Key Vault. Expand the graphical path, inspect entity insights, and review recommendations for each contributing security problem. section 6.3.1

az security pricing create -n CloudPosture –tier 'standard'   #1
#1 A command used to enable Defender CSPM plan on your Azure subscription

Enable the Defender CSPM plan before using advanced capabilities such as the cloud security graph. section 6.2.4

Figure 6.6 An attack path shown for an internet-exposed VM that has high-severity vulnerabilities and read permission to a key vault

Use the attack-path visualization to inspect connected entities and understand how an exposure, vulnerability, and permission combine into a risk. section 6.3.1

How Azure Security covers it

How deep it goes

Builds a contextual graph from connections, exposure, lateral movement, and vulnerabilities, then analyzes possible attack paths.

Examples

Uses an internet-exposed vulnerable VM with read access to a Key Vault as a representative attack path.

What it assumes

Requires Azure subscriptions and Defender CSPM enabled across as much of the environment as possible for meaningful graph coverage.

What you can do after

Diagnose attack paths in Microsoft Defender for Cloud and apply recommendations to address the highest-impact security problems.

How it connects

Connects Microsoft Defender for Cloud, Defender CSPM, attack paths, cloud security explorer, vulnerabilities, and security recommendations.

liveBookmanning.com

Read Azure Security on liveBook Get the book at manning.com

Related concepts

• cloud security explorerused by · Cloud security explorer is a Microsoft Defender for Cloud capability for querying and exploring security relationships and risks in a cloud environment.
• attack pathused by · An attack path is a sequence of exploitable conditions or actions through which an attacker can reach a target or achieve an objective.
• lateral movementuses · Lateral movement is an attacker's progression from a compromised system, account, or resource to additional systems, accounts, or resources within an environment.
• Microsoft Defender for Cloudpart of · Microsoft Defender for Cloud is a cloud security service that assesses security posture, detects threats, and provides security recommendations for cloud and hybrid workloads.

This explainer was generated by Manning's knowledge graph from the text of Azure Security. The section links point to the parts of the book it draws on.