Speaker 1: Welcome to the deep dive. Today, we're diving into Microsoft
Speaker 1: Defender for Cloud. Think of it as this like central
Speaker 1: security hub. It watches over your Azure stuff, sure, but
Speaker 1: also your on premises gear and even other clouds aws, GCP,
Speaker 1: the whole lot.
Speaker 2: Yeah, it aims for that unified view exactly. Yeah.
Speaker 1: We've gone through the Microsoft Defender for Cloud book by
Speaker 1: Uri Diogenes and Tom Janichek. These guys really know their
Speaker 1: stuff and cybersecurity and the Microsoft.
Speaker 2: World definitely credible sources.
Speaker 1: Our mission here is to pull out the really critical
Speaker 1: insights for you.
Speaker 2: Right, what does Defender for Cloud actually do, Why do
Speaker 2: you need it? And how does it help secure things today?
Speaker 1: In the book, it's written for lots of different people, right, security,
Speaker 1: ab in support, pros.
Speaker 2: Developers, engineers. Yeah, it's broad, so we're filtering it down
Speaker 2: to the essentials for you fast.
Speaker 1: Perfect. So let's just jump in the threat landscape. It's
Speaker 1: always shifting, isn't it. Oh?
Speaker 2: Absolutely, it's not like the old attacks disappear, fishing, RDP,
Speaker 2: brute Force sister reports show they're still you know, very.
Speaker 1: Effective, still working.
Speaker 2: It's still working. But then you have this huge rise
Speaker 2: in sophistication especially with ransomware as a service ross Rise.
Speaker 1: Yeah, that sounds bad. It is.
Speaker 2: It's basically become this organized criminal business model. Developers create
Speaker 2: the ransomware, affiliates deploy it. It lowers the bar for attackers.
Speaker 1: So more attacks, maybe more targeted ones.
Speaker 2: Too, potentially. Yeah, And the book uses the Solar Winds
Speaker 2: attack as a big example.
Speaker 1: Right twenty twenty. That really puts supply chain attacks on
Speaker 1: the map.
Speaker 2: It really did injecting malicious code into trusted software. It
Speaker 2: showed how these advanced actors, maybe nation states can get
Speaker 2: deep persistent access very stuff. The book traces the kill chain.
Speaker 2: There recon compromise, staying hidden, moving laterally, and it makes
Speaker 2: you think, how can something like Defender for cloud spot
Speaker 2: this or break that chain?
Speaker 1: Okay, so how does it try to break that chain?
Speaker 1: Is there a framework it follows.
Speaker 2: Well, it aligns with the mid ATT and CK framework
Speaker 2: that gives a common language for tactics and techniques. Okay,
Speaker 2: So Defender uses that to structure its defenses and detections.
Speaker 2: And when you look at common threats, Microsoft's data points
Speaker 2: to RDP attacks still being a major gateway for ransomware.
Speaker 2: Still RDP well and verizons reports. Phishing is always up there,
Speaker 2: plus maybe surprisingly simple misconfigurations in the cloud, like leaving
Speaker 2: a storage bugget open exactly that kind of thing, which
Speaker 2: leads to what Microsoft calls cloud weaponization, attackers using your
Speaker 2: cloud resources against others.
Speaker 1: So you need to protect your stuff and make sure
Speaker 1: it's not being used maliciously.
Speaker 2: Precisely and beyond specific attacks. The book emphasizes core security
Speaker 2: areas for the cloud, like what compliance compliance Definitely, internal rules,
Speaker 2: external regulations, Risk management is key. Identity and access management
Speaker 2: that's huge. Now, identity is the new perimeter you.
Speaker 1: Know, heard that before makes sense.
Speaker 2: Then operational security monitoring, incident response, endpoint protections still fundamental.
Speaker 1: And data protection protecting data wherever it.
Speaker 2: Is right in use, in transit, at rest, and remembering
Speaker 2: even in the cloud, you are responsible for your data,
Speaker 2: especially any you keep on BREM.
Speaker 1: Shared responsibility, the shared responsibility model, Yeah, always important. Okay,
Speaker 1: let's zoom in on Azure itself. How is security built
Speaker 1: into the Azuro platform.
Speaker 2: Azure uses defense in depth layers. It starts with the
Speaker 2: physical security of the data.
Speaker 1: Centers, guards and gates basically cards and gates.
Speaker 2: Yeah, then hardware, software security, strong identity controls, network security
Speaker 2: and security baked into the services.
Speaker 1: And for users managing Azure, controlling who does what seems critical.
Speaker 2: Absolutely, that's Azure Role based Access control or RBAC. It's
Speaker 2: all about least privilege, only give the permissions needed.
Speaker 1: Got it. And networking, we hear about.
Speaker 2: V nets Azure virtual networks. Yeah, think of a v
Speaker 2: net as your own private slice of the Azure network,
Speaker 2: logically isolated.
Speaker 1: Like your own land, but in the cloud kind of.
Speaker 2: Yeah. You define your private eype space, deploy resources like
Speaker 2: vms into it, and to control traffic flow. That's Network
Speaker 2: Security Groups NSG.
Speaker 1: N SGZ. Okay, so those are the gatekeepers for network.
Speaker 2: Traffic exactly like stateful packet filters. You apply them to
Speaker 2: subnets or individual network interfaces.
Speaker 1: The book mentions using multiple v nets for segmentation. Why
Speaker 1: do that?
Speaker 2: It's a core security practice. Isolate workloads. Maybe put your
Speaker 2: web servers in one v net, databases in another. Stricter
Speaker 2: rules between them.
Speaker 1: Makes sense, create zones, right.
Speaker 2: And NSG rules are based on priority and that classic
Speaker 2: five couple.
Speaker 1: Source of destination IP, Source of destination Port protocol standard stuff,
Speaker 1: standard stuff.
Speaker 2: Yeah, that's how you define what traffic is allowed or denied.
Speaker 1: Okay, what about big network attacks like VTOS does as your.
Speaker 2: Health there, Yes, Azure d'dos protection. There's a basic tier
Speaker 2: automatically on for infrastructure.
Speaker 1: Protection, so some protection by default some yes.
Speaker 2: But for more serious application level protection there's the standard tier.
Speaker 2: And what a standard AD it adds active traffic monitoring, mitigation,
Speaker 2: tune to your specific app, traffic alerts, metrics, cost protection, guarantees.
Speaker 2: It's much more comprehensive.
Speaker 1: Good to know their options. Switching gears a bit data encryption?
Speaker 1: How do we protect data on Azure discs?
Speaker 2: Azure disc Encryption or AD. It encrypts OS and data
Speaker 2: discs for VMS.
Speaker 1: Using what technology BitLocker.
Speaker 2: It uses BitLocker for Windows and dmcrypt for Linux. But
Speaker 2: there are dependencies like what well. Often it needs Azure
Speaker 2: AD for authentication, and it relies on azule key vault
Speaker 2: to securely store the encryption keys. The VM needs network
Speaker 2: access to those services too.
Speaker 1: So networking and identity play a role even in disc encryption.
Speaker 2: They do, and the book warns about batential conflicts with
Speaker 2: on prem group policies if they also manage. BitLocker needs planning.
Speaker 1: Right, not just a simple switch. Okay, for investigations, audits.
Speaker 1: Logging is everything. What logs does Azure provide crucial?
Speaker 2: Yeah, Azure has different log types. Think control plane versus
Speaker 2: data plane.
Speaker 1: Control plane is managing Azure resources, data plane is using them.
Speaker 2: You got it. Creating a VM is control plane. Reading
Speaker 2: data from a database is data plane.
Speaker 1: Okay.
Speaker 2: The Azura activity log captures those control plane actions. Who
Speaker 2: did what when?
Speaker 1: Very important? Cracking changes, yeah.
Speaker 2: And diagnostic logs capture the data plane activity within a resource.
Speaker 2: The book gives a good example using the activity log
Speaker 2: to see who changed a defender for cloud.
Speaker 1: Setting practical okay. Containers are everywhere now Kubernetes aks. How
Speaker 1: does networking work there in Azure?
Speaker 2: Right? With Azure Kubernetes service AKS pods typically get IP
Speaker 2: addresses from your v net.
Speaker 1: So they can talk to other things on the network directly.
Speaker 2: Yeah, other vnet resources, even on prem stuff via gateways.
Speaker 2: You can use nsgs on the underlying.
Speaker 1: Nodes vms running the containers right, But for.
Speaker 2: More granular control between pods. Kubernetes has network policies ah.
Speaker 1: So policy within Kubernetes itself exactly.
Speaker 2: The book mentions two AKS network models, kubernet and Azure CNI.
Speaker 2: CNI generally gives pods direct v net IPS and network
Speaker 2: policies are kind of the Kubernetes native way to segment
Speaker 2: traffic inside the cluster.
Speaker 1: Interesting, So NSG's for the infrastructure network policies for the pods.
Speaker 2: That's a good way to think about it.
Speaker 1: Yeah, right, solid foundation on Azure security. Let's finally pivot
Speaker 1: fully to Microsoft Defender for Cloud itself. What is it
Speaker 1: in an ushell?
Speaker 2: Okay? So Defender for Cloud is positioned as this unified
Speaker 2: security management system and advance threat protection.
Speaker 1: Unified meaning across different environments.
Speaker 2: Exactly Azure on premises servers via Azure Arc, even AWS
Speaker 2: and GCP. It pulls it all together.
Speaker 1: What's the main benefit? Why use it?
Speaker 2: Visibility is huge seeing your security posture across everything. Then
Speaker 2: control enforcing policies. It gives recommendations to.
Speaker 1: Improve security like hardening advice.
Speaker 2: Yeah, actionable recommendations based on security benchmarks and critically threat
Speaker 2: detection using Microsoft's threat intelligence plus centralized policy management.
Speaker 1: So posture management and threat detection. The book mentioned a
Speaker 1: free tier and enhanced options.
Speaker 2: Right. The free tier gives you that foundational cloud security
Speaker 2: posture management CSPM policy assessment recommendations, Secure score.
Speaker 1: Cure score Okay, good baseline, very good baseline. The enhanced
Speaker 1: security options those are the Cloud Workload Protection Platform or
Speaker 1: CWPP features. That's where the advanced threat detection comes in
Speaker 1: for specific resources.
Speaker 2: And these enhanced options are broken down by workload. Yes,
Speaker 2: there are specific defender plans Defender for servers, Defender for storage,
Speaker 2: Defender for SQL, Defender for containers, key Vault, DNS, app service, Cosmos, dB,
Speaker 2: open relational Databases, resource manager, even DevOps.
Speaker 1: Now, wow, that's comprehensive, covering a lot of Azure services.
Speaker 2: It really is. And the book notes you get a
Speaker 2: thirty day free trial for these enhanced plans.
Speaker 1: Good way to test the waters. Yeah, so how does
Speaker 1: it actually collect all the info needed for assessments and
Speaker 1: threat detection?
Speaker 2: On Linux, it often uses the Audit framework collects Audit logs.
Speaker 2: The log Analytics agent sends that up even.
Speaker 1: If Audit isn't running as a service.
Speaker 2: Yeah, it can tap into the kernel module directly, which
Speaker 2: is clever. On Windows. Again, the lag analytics agent is key.
Speaker 2: It pulls security events, etw traces, process info, OS logs,
Speaker 2: lots of telemetry.
Speaker 1: So agents are pretty central to the data collection on servers.
Speaker 2: For the deep workload protection, Yes, the agent is usually involved.
Speaker 1: And who uses Defender for Cloud inside an organization? Seems
Speaker 1: like multiple teams would touch it definitely.
Speaker 2: The book calls out a few cloud security teams for
Speaker 2: the CSPM side, governance teams for policy enforcement makes sense,
Speaker 2: the SoC Security Operations Center. They consume the alerts, often
Speaker 2: piping them into a some like Microsoft Sentinel like Sentinel exactly. Yeah,
Speaker 2: and compliance teams use it to check against regulations.
Speaker 1: So it serves quite a few different roles. If an
Speaker 1: organization is just starting with it, what's the recommended path?
Speaker 1: Seems like a lot.
Speaker 2: The advice is usually start with visibility, enable that free
Speaker 2: tier everywhere, get.
Speaker 1: The secure score. See the initial recommendations right.
Speaker 2: Understand your baseline posture. Address the big red flags first.
Speaker 2: Then you start layering on the enhanced workload protection, the
Speaker 2: CWPP stuff for your critical assets HAZEDE.
Speaker 1: Approach, build the foundation, then add thread detection.
Speaker 2: Exactly. Don't try to boil the ocean on day one.
Speaker 1: The book mentioned at GitHub repo too. What's useful there?
Speaker 2: Yeah, the Defender for Cloud. GitHub Repo has some handy
Speaker 2: tools workbooks like a workbook to estimate the cost of
Speaker 2: Defender for storage based on your transaction volume community scripts too.
Speaker 1: Oh cost estimation. That's practical, helpful for planning definitely and
Speaker 1: sim integration. We mentioned Sentinel. That's a common pattern.
Speaker 2: Very common for mature security teams. Sending Defender alerts to
Speaker 2: Sentinel allows correlation with other security signals endpoint identity network
Speaker 2: for a much richer investigation context.
Speaker 1: Makes sense. Connect the dots. What about vulnerability assessment? Does
Speaker 1: Defender do that itself?
Speaker 2: It integrates VA capable abilities, You've got choices. It bundles
Speaker 2: a Qualis scanner.
Speaker 1: Qualis okay, big name MVA right, or you.
Speaker 2: Can use Microsoft's own Threat Vulnerability Management TVM.
Speaker 1: What's the difference there?
Speaker 2: Well, the built in Qualist scanner uses an agent or extension.
Speaker 2: TVM is actually part of Microsoft Defender for endpoint, So
Speaker 2: if you're using MD, TVM is essentially agentless from a Defender.
Speaker 1: For cloud perspective, ah leverage is the existing MD sensor.
Speaker 2: Correct. You can also bring your own Qualis license if
Speaker 2: you already have one. The results from either Qualities or
Speaker 2: TVM show up as recommendations right inside Defender for cloud
Speaker 2: flexible options.
Speaker 1: Then what about larger organizations with many Azure subscriptions, how
Speaker 1: do they manage Defender consistently? Good question.
Speaker 2: Defender is enabled per subscription, but as your management groups.
Speaker 1: Are key here. Management groups let you group subscriptions.
Speaker 2: Right and you can apply as your policy including policies
Speaker 2: that enable Defender plans at the management group level that
Speaker 2: enforces consuncy across all the subs underneath it.
Speaker 1: Centralized control is essential for scale absolutely so final planning
Speaker 1: stage setting up Azure with Defender in mind, what are
Speaker 1: the key prerequisites or considerations?
Speaker 2: Well, remember it's subscription based coverage for supported resources and
Speaker 2: for servers. Getting that log analytics agent deployed is fundamental
Speaker 2: for the deeper insights and the guest configuration extension too
Speaker 2: for certain policy checks.
Speaker 1: How do you get those agents out reliably manually?
Speaker 2: You can, but Defender has auto provisioning features. You can
Speaker 2: configure it to automatically deploy the log Analytics agent to
Speaker 2: Azure VMS and Azure ARC enabled servers, ARC.
Speaker 1: Enabled so on prem and other clouds too.
Speaker 2: Oh, exactly same for the components needed for Defender for
Speaker 2: containers on AKS and ARC enabled kubernates. You can choose
Speaker 2: default or custom log analytics workspaces for the data.
Speaker 1: And there are Azure policies to help enforce this.
Speaker 2: Yes, there are built in policies you can assign to
Speaker 2: ensure auto provisioning is turned on where you want. It
Speaker 2: helps maintain coverage.
Speaker 1: Automation is your friends there?
Speaker 2: Yeah?
Speaker 1: And onboarding AWS or GCP. How does that work?
Speaker 2: There are connectors. You set up a connection to your
Speaker 2: AWS account or GCP project within Defender for Cloud okay.
Speaker 2: Once connected, you can deploy the necessary agents or configurations,
Speaker 2: often using Azure arc again and then enable the Defender
Speaker 2: plans like Defender for Servers on those non Azure machines.
Speaker 1: Truly multi cloud. Then one last thing, the Azure Security Benchmark.
Speaker 1: What is that role?
Speaker 2: The ASHER Security Benchmark is Microsoft's collection of security best
Speaker 2: practices for Azure. It's implemented as an Azure Policy initiative,
Speaker 2: a group of.
Speaker 1: Policies okay, a baseline standard pretty much.
Speaker 2: Defender for Cloud actually assigns this benchmark automatically to a
Speaker 2: subscription the first time you access the Defender.
Speaker 1: Portal for that sub Oh convenient.
Speaker 2: It is, but for full coverage, especially across many subs,
Speaker 2: or ensuring new ones get it manually Assigning it at
Speaker 2: a management group level is often recommended. It ensures that
Speaker 2: baseline is applied everywhere.
Speaker 1: Got it establishes that foundational security posture. Wow, Okay, we've
Speaker 1: definitely covered a lot.
Speaker 2: Of ground here, we really have. I think the key
Speaker 2: takeaway is that Defender for Cloud provides this really comprehensive,
Speaker 2: layered security approach. It spans different.
Speaker 1: Environments hybrid, multi cloud, right.
Speaker 2: And it gives you insights all the way from high
Speaker 2: level threat intelligence down to specific configuration recommendations, proactive posture management, and.
Speaker 1: Hopefully for you listening, this deep dive gives you that
Speaker 1: solid foundation understanding what Defender for Cloud offers, how it
Speaker 1: can boost your security without drowning in every single feature
Speaker 1: immediately exactly.
Speaker 2: And it leads to that thinking point, doesn't it? With
Speaker 2: threats getting smarter, environments getting more complex, how do you
Speaker 2: really weave a tool like Defender for Cloud into your
Speaker 2: existing security strategy?
Speaker 1: Yeah? How do you make it work seamlessly with what
Speaker 1: you already have?
Speaker 2: To achieve that truly resilient posture, It probably means digging
Speaker 2: into the specific Defender plans that matter most for your workloads,
Speaker 2: your risks.
Speaker 1: Definitely requires ongoing effort. Cloud security isn't static.
Speaker 2: Not at all, constant evolution. Staying informed is key.
Speaker 1: Well, we'll be back with more deep dines into cloud
Speaker 1: security topics, maybe even drilling down into some specific defender
Speaker 1: plans in the future. For now, thanks for tuning in.