Infrastructure as a service provides core compute, storage, and networking resources on demand. It lets organizations run customer-managed workloads while retaining responsibility for securing everything above the physical infrastructure. section 1.2
The shared-responsibility boundary divides protection between the cloud provider and the customer:
- The provider secures physical data centers, physical networking, and physical hosts. section 1.2
- The customer secures everything above those layers, including operating systems, network controls, applications, identities, endpoints, information, and data. section 1.2
- Compared with platform as a service and software as a service, IaaS leaves more security work with the customer. section 1.2
For Azure virtual machines, Microsoft Defender for Cloud uses an agent to collect data and identify weaknesses and misconfigurations. The generally available integration described here uses the Log Analytics agent, which sends VM data to a Log Analytics workspace. Azure Monitoring Agent is the newer direction, but its Defender for Cloud integration is identified as public preview. section 6.2.1
Onboarding IaaS subscriptions for assessment
Register the Microsoft.Security provider, assign the Microsoft Cloud Security Benchmark with Azure CLI, and review the resulting Defender for Cloud recommendations. Defender for Cloud automatically creates a default Log Analytics workspace per region for onboarded VM data. section 6.2.1
az policy assignment create #1 --name ‘policyAssignmentName’ #2 --policy-set-definition 1f3afdf9-d0c9-4c3d -847f-89da613e70a8 #3 #1 The Azure CLI command used to assign MCSB #2 The name of the policy assignment #3 The name or ID of the policy definition used in the policy assignment. To assign MCSB, the value here needs to be 1f3afdf9-d0c9-4c3d-847f-89da613e70a8.
Use the supplied Azure CLI listing to assign the Microsoft Cloud Security Benchmark, then inspect the representative policy-assignment output. section 6.2.1
