Module 9 Flashcards
(146 cards)
1
Q
Systems need to be designed with security in mind,
What service allows you to recieve and processes millions of events each second via dynamic data pipelines and intergrate with other Azure Services
A
Azure Event Hubs
2
Q
Whose responsibility is Security in the cloud
A
Cloud Security is a shared responsibility.
In cloud some security is baked into service whilst addressing others remains the customers responsibility
3
Q
What are some of the challenges involved with security in On-Prem data centers
A
Many tools and experts required to keep pace with volume and complexity of threats
4
Q
Moving from On prem to cloud shifts some of the security responsibility, Security of the operational environment is now shared by Customer and Cloud Service Provider. With a shift to the cloud what can organisations reduce there forcus on
A
Moving from On prem to cloud shifts some of the security responsibility
5
Q
Which model (IaaS, PaaS, SaaS) makes it the customers responsibility to patch and secure OS + Software. As well as configuring the network to be secure.
A
- With VMs/IaaS it is the customers responsibility to patch and secure OS + Software. As well as configuring the network to be secure.
- However you have outsourced the concern of physical security
6
Q
When using PaaS what elements of Security are removed from the customer
A
With PaaS…Azure takes care of OS + Foundational Software, everything is updated/patched and can be intergrated with Azure AD
7
Q
In terms of infrastructure, what benefits does PaaS bring?
A
- PaaS offers advantage of not needing to build infra’s and subnets
- You can point and click OR script complex secured systems that can be scaled as needed
8
Q
With SaaS, everything is more or less outsourced, Software is run on internet infrastructure and code is controlled by Vendor.
What is an example of SaaS
A
Office 365 is an example
You outsource nearly everything, S/W runs on internet infra, code controlled by vendor and only configured by the customer
9
Q
With all deployment types, what do you always own
A
With all deployment types you own data and identities
10
Q
With all deployment types you are responsible for helping secure data and identities, what else is it
always your responsibility to secure?
A
- Data
- Endpoints
- Accounts
- Access Management
11
Q
Defense In Depth is known as a “****” approach
A
Layered Approach
12
Q
As a Strategy what does defense in depth employ
A
- Defense in depth is a strategy that employs a series of mechanisms to slow advance of an attack.
- Each layer provides protection, if one layer is breached there is another to prevent further exposure.
- M/S applies a layered approach to physical security and across Azure services
13
Q
What is the objective of Defense in depth
A
- Objective of defense in depth is to protect and prevent data form being stolen by people not authorized to access it
14
Q
How can Defense in Depth be visualise, and how does it remove the reliance on a single layer of protection
A
- Defense in Depth can be visualised as concentric rings, with data secured at the centre, each ring adding an additional layer of security.
- Removes reliance on single layer of protection and acts to slow down an attack + provides alerts telemetry for auto or manual effort
15
Q
In almost all cases what is it that an attacked wants to get
A
- In almost all cases DATA is what the attacker wants whether that be Stored on
- Disk(VM) - DB - SaaS App - Cloud Storage
16
Q
Who’s responsibility is it to ensure data is secured?
What often dictates controls with processs to ensure HA, Confidentialty and Intergrity
A
It is the Responsibility of those who store and control access to ensure it’s secured.
- Often there are regulatory requirements that dictate controls with processes to ensure HA, Confidentiality and Intergrity
17
Q
What points should be implemented within an Application, with regards to security
A
- Ensure apps free of vunrabilites
- Store sensitive app secrets on secure medium
- Make security a design requirement for all in app development
- Intergrating security into app development life cycle will help reduce vunrabilities in code. Encourage all Dev teams to ensure apps are secure by default making security requirements non negotiable
18
Q
What points should be implemented within “Compute”, with regards to security
A
- Secure VM access
- Implement endpoint protection
- Keep systems patched
- Malware + Unpatched systems, improperly secured systems open environment to attacks
- Focus in this layer is to make sure you secure with proper controls to minimize security risks
19
Q
What points should be implemented within “Networking”, with regards to security
A
- Limit resource communication
- Deny by Default
- Restrict inbound traffic, limit outbound (where appropriate)
- Implement secure connectivity to on-prem network
- Focus on limiting network connectivity across all resources only allow what is required this reduces risk of lateral movement through the network.
20
Q
What points should be implemented within “Perimeter”, with regards to security
A
- Use DDoS protection to filter large scale attacks before denial of service to end users
- Use perimeter firewalls to identify and detect malicious attacks
- About protecting from network based attacks against resources - Identify these attacks, eliminating impact, alert when they happen Important to keeping network secure.
21
Q
What points should be implemented within “Identity and Access”, with regards to security
A
- Control access to infrastructure and use change control
- Use Single Sign On and Multi Factor Authentication
- Audit events and changes
- Ensure identities are secure and can only access what is needed (log changes made)
22
Q
What points should be implemented within “Physical Security”, with regards to security
A
- Building security, Controlling access with DC = 1st line of defense
- Provide physical safeguard against access to assets, this ensures other layers can’t be bypassed + loss is handled appropriately
23
Q
Azure Helps _______ security concerns but still ______ responsibility and how much depends on which model is used within Azure
Defense in ____ is used as a _____ for considering what protections are ______ for our environments.
A
Azure Helps alleviate security concerns but still shared responsibility and how much depends on which model is used within Azure
Defense in depth is used as a guideline for considering what protections are adequate for our environments.
24
Q
Azure Security Center is a good starting point for investigating security of Azure based solutions, it is a monitoring service providing threat protection across….?
A
Monitoring service providing threat protection across Azure Services + On prem
25
What are the key points/features of Azure Security Center
- Provides recommendations based on your configurations, resources and networks
- Monitor security settings on-prem + cloud, auto apply security to services coming online
- Continiously monitor security settings, perform auto assesments to identify vunrabilities before exploit
- Uses machine learning to detect/block the install of malware on VMs, can define a list of validated apps to ensure only those apps can be executed
- Analyse/Identify any potential inbound attacks + help investigate threats and carry out any post breach activity
- Provide JIT access control for ports, reducing attack surface ensuing network only allows required traffic
26
Azure Security Center is part of what recommendations
Azure Security Centre is part of CIS (center for Internet Security) recommendations
27
Which Tiers are Azure Security Center available in and what are the differnces
- Free - As part of Azure subscription, limited to assessments + recommendations for Azure resources only
- Standard - Full suite of security related services including continuous monitoring, threat detection, JIT access for ports and more
28
To access full suite of Azure security centre services you need to upgrade to standard tier, how long is the trial of Azure Security and where can it be activated
Access a 30 day trial of standard tier from within the Azure Security Centre dashboard
29
Once you have used the Free Trial how much is Azure Security Center Standard Tier?
Azure Security Center standard tier is $15 per node per month
30
Azure Security Center can interrogate your workflows in many ways and you can use Security Center for incident response.
How can you reduce cost/damage due to an incident?
To reduce cost/damage you should have incident response plan before an attack
31
When do most organisations learn how to respond to incidents
Many Organisations only learn to respond after suffering an attack.
32
What 3 stages of an incident can Azure Security Center be used in
Detect
Assess
Diagnose
33
What is meant by Detecting an incident with Azure Security Center
- Detect - Review 1st indication of an event investigation (e.g. use security center dashboard to review initial verification that high-priority security alert was raised)
34
What is meant by Assessing an incident with Azure Security Center
Access - Perform initial assessment to obtain more information re suspect activity (e.g. obtain more information about the alert)
35
What is meant by Diagnosing an incident with Azure Security Center
Diagnose - Conduct technical investigation and identify containment, mitigation, workround stratergies (e.g. follow remediation steps described by security centre for alert)
36
Azure Security Center can be used to enhance security - how can you do this
- Reduce chances of security event by configuring security policy then implement recommendations by security center
- Security policy defines a set of controls recommended for resources within subscription or resource group - define policies according to companies security requirements
- Security Centre analyzes state of Azure resources, when potential vulnerabilities are identified it creates recommendations based on controls set in security policy.
- Recommendations guide you through config of security controls (E.G. Workloads that do not require SQL to use TDE, recommendation turn of at subscription level and enable it on resources where it is required)
37
Traditionally Primary protection for corporate data was Network perimeters, Firewalls an Physical controls.
Why is this less so the case now and what has become the new primary security boundary
Network perimeters have become increasingly porous with BYOD, mobile Apps and Cloud Apps.
Identity has become new primary security boundary
38
With Identity being the new primary security boundary what is now more important to maintain control of your data
*Identity has become new primary security boundary so proper authentication, assignment of privileges is critical to maintaining control of your data.*
**Authentication and Authorization - Two fundamental concepts**
39
What is Authentication (AuthN)
- Process of establishing the identity of person or service
- Involves challenging for legitimate credentials, provides the basis for creating a security principal for identity and access control.
- *Establishes if they are who they say they are.*
40
What is Authorization (AuthZ)
- Process of establishing level of access for a person or service
- Specifies what data they can access and what they can do with it.
41
What Azure Service provides services to manage both Authorization and Authentication
Azure Active Directory
42
What is Azure AD?
- Cloud based identity service, supports syncing to on-prem AD or can act standalone
- All Apps - Onprem, cloud and mobile can use same credentials
- Admins/Devs control data to internal and external data/apps using centralized roles and policies configured in Azure AD
43
Azure AD provides various Services what are some these?
```
Authentication
SSO
App Management
B2B Identity Services
B2C Identity Services
Device Management
```
44
What is meant by Authentication in relation to Azure AD
- Verifying ID to access apps and resources
- Provides SSO, MFA and Custom banned password list
- Smart lockout devices - functionality.
45
What is meant by SSO in relation to Azure AD
- Enables user to remember one ID and password
- Simplifies security model
- As users change roles/leave modifications are only made to one identity, reducing effort to change or disable accounts
46
What is meant by App Management with regards to Azure AD
Manage cloud and on prem apps using Azure AD application proxy, SSO, the MyApps portal (AKA Access Panel) and SaaS apps
47
What is meant by B2B Identity services in relation to Azure AD
Manage Guest/External partners maintaining control over data
48
What is meant by B2C Identity Services with regards to Azure AD
Customize/control users signup/sign in + manage profile within Apps and Services
49
What is meant by Device Management with regards to Azure AD
Manage how cloud/on prem devices access your corporate data
50
What are the benefits of Single Sign On
- More Ids to manage means a greater risk of security related incident
- More IDs = More passwords and more password policies, increasing difficult for user
- Harder logistics to manage passwords and more strain on help desks
- Challenging to track down all accounts when someone leaves
- Single sign on reduces all this, only remember ine ID and Password, modifications need only be made to One ID
51
What are the features of using Azure AD for single Sign on
- Using Azure Ad for SSO, able to combine multiple data sources into intelligent security graph, enabling threat analysis and real time identity protection to all Azure AD accounts including those sync'd from Azure AD
- Centralised ID provider gives centralised Security Controls, Reporting, alerting and admin of identity infrastructure.
52
What is Multi Factor Authentication, and what are the benefits of using it with relation to Azure AD
- Provides additional security by requiring 2 or more elements for full authentication.
- *Something you...Know(P/WD or Security Question), Posess (Mobile App or Token) and Are (Biometric).*
- Increases security by limiting impact of credential exposure, an attacker would need to possess multiple factors of AuthN to authenitcate - Benefits are huge
- Azure AD has MFA capabilities and will intergrate with 3rd party MFA providers
- MFA should be used for global admin accounts and can be used for all accounts.
53
It is valuable to Services to have ID's Why is this?
- Valuable for services to have ID's, often credentials are embedded into config files which is against best practice, with no security around config files - anyone with system access can get credentials
- Azure AD addresses this problem with 2 methods (Service Principals and Managed Identities)
54
What is the difference between and Identity and a Principal
- **Identitiy - thing that can be Authenticated (i.e a user with username and password)**
- **Principal - Identity acting with certain roles or claims.**
- **Usually not helpful to consider identity and principal seperately - think of SUDO or "Run as Administrator" - where you are still logged in as the same person but with a role change**
N.B. Groups are often considered principals.
55
What is a service principal
Identity used by service or application?
56
What is the purpose and benefits of managed identities for Azure Services
- Creation of service principals can be tedious, lots of touch points making maintaining difficult
- Managed Identities for Azure Services is much easier and does much of work for you
- A managed ID can be instantly created for any azure service supporting it
- When you create, you create account on your Orgs AD (a specific Orgs AD instance is known as an AD tenant)
- Azure Infrastructure will take care of AuthN for the Service + managing the account
- Use account like any other Azure AD account incl; allowing AuthN service secure access of other Azure Services
57
In terms of RBAC what are roles?
Roles are sets of permissions (read-only, contributor etc) that users can be granted access on Azure Service instance
58
How are IDs mapped to roles
IDs mapped to roles directly, through group membership, separate security principals, access permissions and resources provides simple access management and fine grained control.
59
RBAC allows admins to ensure that minimum necessary permissions are granted but at what level can roles be granted
Roles can be granted at individual service instance level, but also flow down Azure Resource Manager Hierarchy - i.e. Roles at higher scope(s) are inherited by child scopes.
- Management Group
- Subscription
- Resource Group
- Resource
60
What is does Privileged ID Management provide
Privileged ID Management provides overview of role assignments, self service and JIT role activation
Azure AD and Azure Resource Access reviews
61
In addition to managing Azure resource access with RBAC a comprehensive approach should consider including ongoing audit of role memebers;
Privileged ID Management can help with this - is Privileged ID Management a Paid for OR Free offering
Azure AD Privileged Identity management (PIM) is additional paid for offering
62
What is the most valuable and irreplaceable asset
Data is the most valuable and irreplaceable asset
63
What is the last and strongest line of defence in layered security stratergy
Encryption
64
What is Encryption
- Process of making data unreadable/unusable to un AuthZ users
- To use of read encrypted data it must be decrypted requiring a secret kep
- Two top level types of encryption → Symmetric and Asymmetric
65
What are Symmetric and Asymmetric Encryption
**Symmetric Encryption → Uses same key to encrypt and decrypt data**
**Asymmetric Encryption → Uses Public and Private Key pair, either key can encrypt but a single key can't decrypt it's own encrypted data.**
To decrypt you need the paired key, used for things like TLS (Transport Layer Security) used in HTTPs + Data signing
66
What 2 ways is Encryption usually approached
Encryption at Rest
| Encryption in Transit
67
Define Encryption at rest
- Data at rest has been stored on physical medium, could be disk of server, or in DB or in a storage account.
- Regardless of storage method encryption ensures the data at rest is in unreadable when stored without the keys and secrets need to decrypt
- If attacker got HDD of encrypted data the attacker could not compromise without great effort.
68
Define Encryption in Transit
- Data in transit is actively moving from one location to another, such as across internet or private network
- Secure transmission can be handled by different layers, it could be done via the App layer prior to sending over the network (e.g. HTTPs is app layer encryption in transit encryption) you could also setup a secure channel like a VPN at the network layer to transmit data between 2 systems
- Encrypting data in transit protects from outside observers and privdes a mechanism to transmit data while limiting the risk of exposure.
69
- Azure storage service encryption for data at rest helps protect data to meet security and compliance standards.
How does it do this, and what is the process?
- Azure storage service Encryption - Auto Encrypts data before persisting it to Azure Managed disks, blob storage, Azure files, Azure Queue storage and decrypts before retrieval.
- This whole process **(Encrypting - Encrypted - Decyption - Key management)** is transparent to Apps.
70
When Encrypting VM disks, Storage service encryption provides low level encryption of data written to disk, to help encrypt both Windows and Linux IaaS VM disks.
What is leveraged to do this
Leverages bitlocker or dm-crypt to provide volume encryption for OS and data disks
71
What in Azure Disk Encryption intergrated into, to help control keys and secrets
Integrated into Azure key vault to help control and manage encryption keys and secrets (and you can use managed service identities for access to key vault)
72
What helps protect Azure SQL DB and Azure Data Warehouse, in terms of Encryption and How does it do this?
- TDE helps protect Azure SQL DB and AZure Data warehouse
| - Performs real time encryption/decryption of database, backups and log files at rest with no app changes.
73
Is TDE on by default for newly deployed Azure SQL DB
Yes, TDE is auto enabled
74
What points are there around Key's for TDE within Azure SQL DB
- Encrypts storage of entire DB using symmetric key (DEK)
- Azure provides unique encryption key per logical SQL Server instance
- BYOK is supported with keys stored in Azure Key vault.
75
Encryption services all uses keys to encrypt/decrypt data.
As well as this organisations may have other passwords and connection strings.
What Azure Service can be used for protect the above
Azure Key Vault
76
What is Azure Key Vault
Azure Key Vault is a centralised cloud service for storing app secrets
77
How does Azure Key Vault help control secrets?
Helps control by keeping secrest in a single, central location, providing secure access, permission control and access logging capabilitites
78
What are some usage scenerios for Azure Key Vault
- USAGE: Secrets Management - Securely store tightly controlled secrets
- USAGE: Key Management - Makes it easier to create/control encryption keys
- USAGE: Certificate Management - Provision, manage, deploy public and private keys (SSL/TLS) for your Azure and internally connected resources more easily.
79
What can stored secrets be protected/backed by
Store Secrets backed by Hardware security modules (HSMs), Secrets and keys can be protected either by Software or FIPS 140.2 Level 2 validated HSMs
80
What are some of the benefits of using Azure Key vault
- Centralised application secrets, controlled distribution with less chance of being leaked
- Securely stored secrets/keys using industry standard algorithms
- Monitor Access and Use - you can monitor and control access to secrets
- Simplified admin - easier to enroll and renew certs from CAs, you can scale up and replicate in content within regions and use standard management tools
- Integrate with other Azure Services, i.e. Storage accounts, container registries, event hubs and more
- Because Azure ADs can be granted access to azure key vault secrets, application with managed service IDs enabled can Auto/seamlessly get the secrets they need.
81
Certificates have a lifecycle that requires Admin, a common problem is expired certificates opening security vunrabilites.
With Azure what format are Azure Certificates and where can they originate from?
- Certificates in Azure are "x.509 v3" - signed by Trusted CA or Self Signed
- Self Signed= Signed by creator, should only be used for Test and Dev, not trusted by default but most browsers can ignore this problem
82
What do certificates contain
Public or Private Key and Thumbprint
83
What is the purpose of a Thumbprint in a certificate
Thumbprint to identify certificate in unambiguous way, Thumbprint used in Azure config file to Identify which certificate a cloud service should use.
84
What are the primary purposes of certificates in Azyre
- In Azure certificates are for two primary purposes and are given a specific designation based on their intended use.
- These are Service (Used for cloud services) and Management Certificates (used for AuthN with management API)
85
Where a Service certificates attached and what do they enable
Attached to cloud services and enable secure comms to and from that service (i.e. if you deploy a website you would supply a certficate that can AuthN an exposed HTTPs endpoint)
N.B. Service certs defined in service definition, are auto deployed to VM running an instance of your role.
86
How can Service Certs be deployed
Upload via Azure Portal or classic deployment model
87
Service Certificates are associated with a specific cloud service, and assigned to a deployment in service definition file.
How can service certificates be managed separately from services by different people.
- Can be managed separately from services by different people (e.g. a developer could upload a service package that refers to a certificate that an IT Manager has previously uploaded to Azure.)
- Updating without service package is possible - store name and location of cert is in service definition file, whilst thumbprint is in service configuration file. So it is only necessary to upload new cert and change the thumbprint value.
88
What do management certificates allow and what do programs and tools such as (Visual Studio and Azure SDK) use these certificates for?
- Allow you to AuthN with classic deployment model
- Many programs and tools (Visual Studio/Azure SDK) use these certs to automate the config/deployment of various Azure services, however these certs are not related to cloud services
89
When using Azure Key Vault with certificates you get some additional features over typical certificate management.
What features of Azure Key Vault are there
- Create certificates in key vault or import existing.
- Securely store/manage certs without interaction of private key material.
- Create policy directly in key vault to manage lifecycle of cert
- Provide contact into for notification of lifecycle events (expiry, renewal)
- Auto renew with selected issuers, key vault partner x509 certificate providers/authority
90
What is the benefit of Automating Certificate management
Automating certificate management helps reduce or eliminate the error prone task of manual certificate management.
91
Securing network from unauthorised access is important, what does it mean to use a layered approach to network security and why is this a good thing?
A layered approach to network security
- Not enough to secure network preimeter or focus on network security between services inside network
- Layered approach brings multiple levels of protection - if attacker gets through core layer further protections are in place.
92
With regards to internet protection, we start at the perimeter of the network and focus on limiting/eliminating attacks from the internet.
How can this be done
Start by assessing internet facing resoirces, only allows inbound/outbound comms where necessary.
- Identify all resources that allow inbound network traffic of any type and ensure they are restricted to only ports and protocals required
93
What Azure service is a good starting point to identify internet facing resources without necessary precautions (and what are these precautions)?
Azure Sercurity center is a good starting point, it will Identify any internet facing resources that don't have associated NSGs and resources not secured behind a firewall
94
What is a firewall
- Service that grants server access based on originating IP of request
- Create firewall rules that specify ranges of IP addresses, also generally include a specific network protocol or port info
95
What "Firewall" Choices are there within Azure
Azure Firewall
| Azure Application Gateway
96
What are some of the features of Azure Firewall
- Managed, cloud based, network security service to protect Azure vNet resources
- Fully stateful firewall as a Service, built in HA and unrestricted cloud scalability.
- Provides inbound protection for non HTTP/S protocols (RDP, SSH, FTP) and outbound network level protection for all ports and protocols. And application level protection for outbound HTTP/S.
97
What are some of the features of Azure Application Gateway
- Load balancer that includes a Web application Firewall (WAF)
- Providing protection from common known vunrabilities in websites, designed to protect HTTP traffic
98
What are Network Virtual Appliances (NVAs)
Ideal for non-http services or advanced configs - similar to H/W firewall applicances
99
Any internet resource risks DDos Attacks, what is this?
Attempt to overwhelm resource by sending many requests to make resource slow or unresponsive
100
What can help defend against DDoS attacks
Combining Azure DDoS protection with application best practices can help defend against DDoS attack.
101
What/How does Azure DDoS Protection work?
- DDoS protection leverages scales and elasticity of MS global network to bring DDoS mitigation capacity to every azure region.
- Azure DDoS protection protects apps by monitoring traffic at azure network edge before it can impact service availability.
- Notifies you within minutes of attack using Azure Monitor metrics
102
What levels of Azure DDoS protection are there?
Basic
| Standard
103
What are the features of Basic Azure DDoS protection
- Auto Enabled
- Always on traffic monitor + real time mitigation of common network level attacks
- Same defenses MS services use.
- Azure Global network used to distribute and mitigate attack traffic acrros regions
104
What additional features of Standard Azure DDoS Protection?
- Additional mitigation capability tuned for MS azure vNet resources.
- Simple to enable - no app changes required.
- Protection policies tuned through dedicated traffic monitoring and ML algorithms
- Policies are applied to public IPs associated with resources deployed in vNets, such as Azure Load balancer and Application gateway.
105
What can Azure Standard DDoS protection mitigate against
- Volumetric Attack - flood network layer with substantial amount of seemingly genuine traffic
- Protocol Attack - Render targer inaccessible bu exploiting weakness in layer 3 and 4 of protocol stack
- Resource (App) layer attack - Attacks target web application packets to disrupt transmission of data between hosts.
106
It is critical to limit comms between resources to only what is required.
What service does this within the realm of comms with VMs
Network Security Groups (NSGs)
107
What can/do NSGs allow
- NSGs allow filter of network traffic to and from Azure resources in Azure vNet
- NSG can contain multiple inbound and outbound security rules, enable filtration of traffic to and from resources by source and destination IP address, port, protocol, provide list of allows and denies comms to and from network interfaces.
- Subnets are fully customizable
- Can completely remove public internet access by restricting access to services endpoints
- With service endpoints, Azure service access can be limited to your vNet.
108
You can intergrate your on Prem network with Azure.
What methods does Azure have for this
VPN Connection
| Express Route
109
What does Azure VPN Gateway allow
Connecting between Azure vNet and on-prem VPN is a great way to achieve secure comms between your network and Azure vNet.
110
What does Azure Express route allow (and require)
And what benefits does this bring?
Lets you extend your network into MS cloud with a private connection facilitated by a connectivity provider
- Can establish connection to MS cloud services (Azure, Office 365, Dynamics 365)
- Improve Security by sending over private circuit instead of public internet.
- Dont need allow access to these services for end users over public internet.
- Send this traffic through appliances for further inspection
111
Azure has a cloud based solution to classify and protect documents and emails, what is this called?
Microsoft Azure Information Protection
112
What is Microsoft Azure Information Protection?
Microsoft Azure Information Protection (AIP) = Cloud based solution to:
- Classify and optionally protect documents and emails by applying labels
- Labels can be applied Automatically based on rules/conditions or can be applied manually
- Guide users to choose labels with a combination of Automatic and manual stpes.
113
Once content is classified with AIP how can you track/control how it is used
- Analyse data flows to gain business insight
- Detect risky behaviour and take corrective measures
- Track access to documents
- Prevent data leakage or misuse of confidential info
114
What purchase options are there for AIP
- Analyse data flows to gain business insight
- Detect risky behaviour and take corrective measures
- Track access to documents
- Prevent data leakage or misuse of confidential info
115
What is Azure Advanced Threat Protection
Azure Advanced Threat Protection (ATP) is a cloud based solution to identify, detect and help investigate: Advanced Threats, Compromised IDs and Malicious Insider actions
116
What are the capabilities of ATP
- ATP is capable of detecting known malicious attacks, techniques + security issues and risks against your network.
117
What components is ATP made up of
ATP Portal
ATP Sensor
ATP Cloud Service
118
What is the ATP portal and how is it accessed
- Own portal to monitor and respond to suspicious activity
- Create ATP instance, view data from ATP sensors
- Monitor/Manage/Investigate threats in your network environment
- Use → portal.atp.azure.com
- User accounts must be assigned to Azure AD Security group with access to azure atp portal.
119
What are ATP Sensors and where are they installed?
- Installed directly on your domain controllers
| - Monitors domain controller traffic without requirement for dedicate server or configuration of port monitoring
120
Where does the Azure ATP Cloud service run and where is it deployed
- Runs on Azure Infrastructure
- Currently deployed in US, Europe and Asia
- Connected to MS intelligent security graph.
121
How can Azure ATP be purchased?
- Azure ATP part of Enterprise Mobility + Security E5 Suite (EMS E5)
- Also available as stand alone license
- Acquire license from Enterprise Mobiltiy + Security pricing options page, or through cloud solution provider licensing model.
- Not available to purchase via Azure Portal
122
What does SDL stand for and what does it aim to do?
- SDL (MS Security Development Lifecycle) introduces security and privacy considerations throughout all phases of developement process.
- Helps developers build highly secure software, address security compliance requirements and reduce development costs.
- The guidance, tools, best practices, processes in the SDL are used internal at Microsoft
123
When was SDL first shared, and how has it be modernised to ensure it is still relevant
- SDL first shared in 2008 and have been continiously updated to cover new scenarios such as Cloud, IOT and ML.
124
Security is everyone's job, what should everyone know re - security
- All must know how to build security into software, services, whilst still addressing business needs + delivering user value.
- Training will complement + reinforce security policies
- Whilst security is everyones job, not everyone needs to be an expert, but ensuring everyone understands the attackers perspective, goals and the art of the possible will raise the collective knowledge bar.
125
Security + Privacy is fundamental aspect of developing secure apps and systems.
When should security requirements be updated
- Regardless of development methodology, security requirements must be updated continuously to address functionality changes + changes in threat landscape.
126
When is the optimal time to define security requirements
- Optimal time to define security requirements is during initial design/planning stage, early planning allows dev team to intergrate security in ways that minimize disruption.
127
What factors influence security requirements?
- Legal and Industry requirements, Internal standards and coding practices, review of previous incidents, known threats.
128
How should requirements be tracked
- Requirements should be tracked through a system or telemetry derived from the engineering pipeline.
129
It is Essential to define minimal levels of acceptable security quality and to hold relevant teams accountable for meeting that criteria.
What does defining early expectations aid with?
- Defining expectations early helps team understand risks and identify/fix security defects during development + apply standards through out project
- Setting a meaningful bar involves clearly defining severity thresholds of security vulnerabilities and helps establish plan of action when vulnerabilities encountered (e.g all known vunrabilities with critical/important severity must be fixed within a certain time frame)
130
What is required to track these KPIs to ensure security risks are completed?
To track these KPIs and ensure security risks are completed, bug and/or work tracking mechanisms (such as Azure DevOps) should allow for security defects/work to be clearly labelled as such.
131
Threat Modelling should be performed where there is meaningful risk.
What does threat modelling allow for?
- Allows team to consider, document, discuss the security implication of designs in context of planned ops environment.
- Applying this structured approach to threat scenerios allows more effective less expsensive identifications of security vunrabilities.
- Determine risk from those threats to make security feature recommendations + establish appropriate mitigations
- Apply at component/app/system level.
132
SDL typically thought of as assurance activity, helping engineers implement more secure features, meaning features are well engineered for security.
To achieve this assurances what technologies are used typically
To achieve this assurance, technologies such as "cryptography" and "AuthN" and "logging" are typically used
133
Selecting/Implementing security features can be complex and lead to further vunrabilities.
What is therefore required
- In some cases selecting/implementing security features has proven to be complex and thus leading to further vunrabilities, therefore it is vital security features are applied consistantly with a consisten understanding of the protection they provide.
134
A rise in cloud/mobile computing makes it more important to ensure data is protected from disclousure/alterations.
What is usually used for this
Encryption
135
Why is it best to develop clear encyrption standards
- Making an incorrect choice when using any aspect of cryptography can be catastrophic - Best to develop clear encryption standads that provide specifics on every element of encryption implementation.
- Encryption should be left to experts so only use industry vetted encryption libraries.
- Implement encryption that allows for easy replacement.
136
- Vast majority of projects use 3rd party components (commercial or open source)
How can you understand the impact of a security vulnerability in a 3rd party tool could have to the security of your system and mitigate as much risk as possible
- Have an accurate inventory of these components + a plan to respond t new vunrabilites
- Consider additional validation depending on organisations risk tollerance + type of component being used + potential impact of security vulnerability.
Use Approved Tools
- Define and Publish a list of approved tools
- Engineers should strive to use the latest version of these tools (such as compiler versions)
137
What is Static Analysis Security Testing?
- Analysing source code prior to compilation provides highly scalable method of security code review, also enables source code polices to be followed
- Static Analysis Security Testing (SAST) is typically integrated into commit pipeline to identify vulnerabilities each time the software is built or packaged.
- Some offerings intergrate development environment to spot flaws such as banned or unsafe functions and replicae whilst the developer is coding
- No one size fits all approach.
138
What is dynamic Analysis Testing
- Performing runtime verification of your fully complied or packaged software, checks functionality that is only apparent when all components are intergrated and running
- Typically achieved using a tool, a suite of pre-built attacks or tools that specifically monitor app behaviour for memory corruption, user privacy issues and other critical security problems
- Again no one size fits all aproach
139
What is PEN testing and what is it's objective
- Security Analysis of software system by skilled professional who simulates tha action of a hacker
- Objective to uncover potential threats from code errors, sys config faults or other deployment weaknessess
- Typically pen testing finds broadest variety of vulnerabilities and is used in conjunction with auto/manual code reviews.
140
What is an incident response plan crucial for?
- Incident response plan is crucial for addressing new threats that can emerge over time
141
What should an incident response plan detail
- Who to contact in case of security emergency
- Establish protocol for security servicing
- Be tested before it's needed
142
Standardising security and compliance throughout all phases of the development process will...
...reduce likelihood of vunerabilities in products and services and avoid making some security mistakes
143
Operational security assurance practices align with development practices, this results in...
...less time and cost spent on triage after the fact.
144
- Think about security as multi ____ and multi _____ concern.
- Think about security as multi ____ and multi _____ concern.
145
- Azure has out the box help, first steps is ______ how much help we can used based on what we are using (i.e. ____, ____, ____)
- Azure has out the box help, first steps is assess how much help we can used based on what we are using (i.e. PaaS, SaaS, IaaS)
146
Azure _____ ______ centralises much help that Azure can offer, providing _____ ______ with view into many of your services, it helps make sure you are following ___ _______
Azure Security center centralises much help that Azure can offer, providing single dashboard with view into many of your services, it helps make sure you are following best practices.
