This is Susan Bradley for CSO online. Today, I’m going to talk about Azure Security Benchmark V2. Recently at Microsoft Ignite, they announced the new V2 version of the Microsoft security benchmark. So what’s new in the V2, they’ve included controls for Nist, SP 853, and they’re going to be mapping that between the as their security benchmarks and the benchmarks. So what are these benchmarks, basically, it comes down to best practices, it’s things like network security. To control and secure their networks, virtual networks, private connections, its identity management in the cloud, the new security edge is the identity.
So this includes controls to establish a secure identity, including as your active directory and includes single sign on strong authentication, managed identities for applications, conditional access. Privileged access is a key item that you need to monitor, especially in any cloud service, the attackers want to go after global admin, so you want to make sure you understand and protect those roles. So privilege access is a key thing that you need to look at, investigate and make sure you understand how to protect data protection.
Are you doing enough to protect the raw data in your organization to make sure that they’re scanned and protected and identified as they travel across your network next to one of the areas that I think is underutilized is logging and threat detection.
Make sure that in your cloud storage that you identify where logging occurs, turn it on in cases where it’s not turned on, and make sure you have data going to either as a sentinel or a third party logging tool. Do you understand how to do incident investigation in a cloud scenario? Again, you want to look at the benchmark to give you ideas or workflow automation in the V2 version of the user controls, they map between CSI controls version seven point one and also Nist 853.
Soon they’ll also be documenting the mapping between these and also the PCI controls as well. Now, currently in my security center, I still only have the resources one point 1.0, but soon I’ll have the v2 in there as well. Now, what if I want to up my game a little bit and actually do some customized compliance policies? There’s a couple of ways I can do it. If I go in and click on manage compliance policies, I choose my subscription.
Then I come down here and I want to look at industry and regulatory standards. And as you can see, I’ve got several down here. I want to add even more. And you can see the custom ones that I can build. That builds on HIPAA as a security benchmark. Nist, UK, you get the idea that we can build on these benchmarks and build the information into our systems. There’s yet another way to build up security in your reserve, and that’s something called a landing page or I should say landing zones.
This gives you fully integrated governance, security and operations from the get go with preset values. So here in GitHub is the example of what they’re planning to do. A management group hierarchy is deployed along with a set of policies that will enable autonomy for the platform in landing zones. If you have an Azure subscription dedicated for management, you can do log analytics policies as your security monitoring, as your sentinel diagnostic settings, et cetera, et cetera. Now, if you plan to have these landing zones, you have to establish permissions in your as your tenant.
So you have to go to the Azure AD directory, click on Manage Properties. Under the access management for resources toggle it to yes, no, that’s default for no, if you’ve not come in here before, then you have to grant access to the user at the root scope. So what’s this about? You basically open up a PowerShell window and grant additional rights. So I have the Azure Cloud Shell opened up and I’m just going to do my commands in here to give myself rights.
Well, obviously I’ve already done it. So it gives me the error message that it already exists. But if you hadn’t given yourself rights, this would come back with a message indicating that the rights and permissions have been added. Now, you can come back and actually set up these settings, start here in the basics, pick the location of the region that you want to deploy this to. You’ll have to set up an enterprise scale company prefix. Now, I’m just going to do a test here, so I’ll just use the word test.
You’ll then go down your selections of what you want to do is your default. So here we’re setting up analytics workspace. We’re setting up data retention for 30 days. We’re picking our subscription. We’re going to deploy an agent health solution, change tracking, solution, update management, solution, activity, log solution, VM Inside Solution and similar solution service map skill assessment. We’re going to deploy is there a security center and enable security monitor monitoring. And last but not least, we’re going to deploy their sentences are defaults.
Now, you may not be able to do all of these. You’ll have to check the pricing. I have some links in the article about how to determine the pricing. So you may want to run some tests to see how much this is going to cost. But once you set this as default, this will be your framework for everything in the subscription. Landing zone configuration, again, picked the subscription, you determine which things are going to be impacted.
So do you want all of your VMS to be monitored? Do you want them, the ARC’s, to be monitored? Do you want to prevent inbound RDP from the Internet? And by the way, while I’m here, if you have not done that already or if you’re not devising some better way to access your machines, don’t do it with straight inbound RDP from the Internet, especially these days, attackers are using all sorts of means and methods to directly attack open RTP.
So if you do that currently where you allow open RDP from your Internet, think twice because attackers are using that as a key way they can get into systems and you get the idea that you can go through and set up a default for all of your subscriptions, click on review and create it runs the final validation. And if everything’s ready to go, it will actually say to create. And there you go, that’s the way to automatically by default.
Have yourself set up in a secure format from the get go. If you want to give any feedback to Microsoft regarding these benchmarks or any of these security settings, go ahead and send them an email benchmark feedback at Microsoft Dotcom until next time. This is Susan Bradley for CSO online. Everyone, stay safe. Stay secure.
