Describe general security and network security features Flashcards
What’s Azure Security Center?
Is a monitoring service that provides visibility of your security posture across all of your services, both on Azure and on-premises.
What is a security posture?
Refers to cybersecurity policies and controls, as well as how well you can predict, prevent, and respond to security threats.
What can the Security Center do?
Monitor Security settings across on-premises and cloud workloads
Automatically apply required security settings to new resources as they come online.
Provide security recommendations that are based on your current configurations, resources, and networks.
Continuously monitor your resources and perform automatic security assessments to identify potential vulnerabilities before those vulnerabilities can be exploited.
Use machine learning to detect and block malware from being installed on your virtual machines (VMs) and other resources. You can also use adaptive application controls to define rules that list allowed applications to ensure that only applications you allow can run.
Detect and analyze potential inbound attacks and investigate threats and any post-breach activity that might have occurred.
Provide just-in-time access control for network ports. Doing so reduces your attack surface by ensuring that the network only allows traffic that you require at the time that you need it to.
What is Resource security hygiene?
Section of Azure Security Center that helps prioritize remediation actions. Recommendations are categorized as low, medium, and high.
What is the Secure Score?
Security score is based on security controls, or groups of related security recommendations. Your score is based on the percentage of security controls that you satisfy. Secures score helps you
-report on the current state of your organization’s security posture
Improve your security posture by providing discoverability, visibility, guidance and control.
Compare with benchmarks and establish key performance indicators (KPIs)
What are some cloud defense capabilities for VMs, network security, and file integrity?
Just-in-time VM Access
Adaptive application controls
Adaptive network hardening
File integrity monitoring
What is just-in-time VM access?
This access blocks traffic by default to specific network ports of VMs, but allows traffic for a specified time when an admin requests and approves it.
What is adaptive application controls?
In the background, Security Center uses machine learning to look at the processes running on a VM. It creates exception rules for each resource group that holds the VM and provides recommendations. This process provides alerts that inform the company about unauthorized applications that are running on its VMs.
What is Adaptive Network Hardening?
Security Center can monitor the internet traffic patterns of the VMs, and compare those patterns with the company’s current network security group NSG settings. From there, Security Center can make recommendations about whether the NSGs should be locked down further and provide remediation steps.
What is File Integrity Monitoring?
Can configure the monitoring of changes to important files on both Windows and Linux, registry settings, applications, and other aspects that might indicate a security attack.
What is workflow automation?
Workflow automation uses Azure Logic Apps and Security Center connectors. The logic app can be triggered by a threat detection alert or by a Security Center recommendation, filtered by name or by severity.
What is Azure Sentinel?
Is a Microsoft cloud based SIEM ( Security information and event management ) system. It uses intelligent security analytics and threat analysis.
What does Azure Sentinel enable you to do?
Collect cloud data at scale - Collect data across all users, devices, applications, and infrastructure, both on-premises and from multiple clouds.
Detect previously undetected threats - minimize false positives by using Microsoft’s comprehensive analytics and threat intelligence
Investigate threats with artificial intelligence - Examine suspicious activities at scale, tapping into years of cybersecurity experience from Microsoft.
Respond to incidents rapidly - Use built-in orchestration and automation of common tasks.
What Azure Sentinel connections are possible?
Connect Microsoft solutions - Connectors provide real-time integration for services like Microsoft Threat Protection solutions, Microsoft 365 sources, Azure Active Directory, and Windows Defender Firewall.
Connect other service and solutions - Connectors are available for common non-Microsoft services and solutions, including AWS CloudTrail, Citrix Analytics
Connect industry-standard data sources - Azure Sentinel supports data from other sources that use the Common Event Format CEF, messaging standard, Syslog, or REST API.
What are the Azure Sentinel Built in analytics?
Use templates designed by Microsoft’s team of security experts and analysts based on known threats, common attack vectors, and escalation chains for suspicious activity. These templates can be customized and search across the environment for any activity that looks suspicious. Some templates use machine learning behavioral analytics that are based on Microsoft proprietary algorithms.
