Security posture is the overall strength of an Azure environment against compromise. It is not a security problem that is permanently solved; it is managed continuously as workloads, threats, and organizational requirements change. A stronger posture makes successful attacks harder, but attackers adapt their tactics, techniques, and procedures over time. section 1.3 section 1.4
Improve posture as a repeating three-phase cycle. First, secure Azure workloads against security best practices. Next, monitor for suspicious activity and signs of compromise, including lateral movement. Finally, investigate suspected incidents and respond when necessary. Feed investigation results and lessons from external breaches back into future security practices. section 1.3
Figure 1.1 Improving an organization’s security posture can be seen as an ever-evolving and ever-changing cyclical process.
The cycle emphasizes that securing, monitoring, investigating, responding, and learning reinforce one another rather than occurring once. section 1.3
Use layered controls to improve posture across Azure resources:
- Apply Azure Policy guardrails so deployed resources follow security best practices and organizational business rules. section 1.8.3
- Use Microsoft Defender for Cloud to identify resources that do not meet security best practices and, in some scenarios, automatically remediate misconfigurations. section 1.8.3
- Use Microsoft Defender for Cloud and Microsoft Sentinel to detect and respond to suspicious activity involving compromised resources and sensitive data. section 1.8.3
- Protect identities, data, applications, infrastructure, and networking with more than one security service, reducing the chance that a single failed control enables a breach. section 1.9
Defense in depth treats no control as sufficient on its own. Combining services and controls limits attackers’ opportunities across resource types, while ongoing assessment identifies where the next improvement is needed. section 1.9 section 1.8.3
