Whenever we talk about cloud, one of the main questions still comes from customers is “what about security?“. Azure cloud built by using SDL (Security Development Lifecycle) from initial planning to product launch. It’s continues uses different measurements, safeguards to protect the infrastructures and customer data. You can find details about azure security on https://www.microsoft.com/en-us/TrustCenter/Security/AzureSecurity
Microsoft releases Azure Security Center to allow you to prevent, detect and respond to the threats against you azure resources with more visibility. Based on your requirements, can use different policies with resources groups.
Azure security center capabilities focused on 3 areas (https://azure.microsoft.com/en-us/documentation/articles/security-center-intro/),
|
Capabilities |
Details |
|
Prevent |
· Monitors the security state of your Azure resources · Defines policies for your Azure subscriptions and resource groups based on your company’s security requirements, the types of applications that you use, and the sensitivity of your data · Uses policy-driven security recommendations to guide service owners through the process of implementing needed controls · Rapidly deploys security services and appliances from Microsoft and partners
|
|
Detect |
· Automatically collects and analyzes security data from your Azure resources, the network, and partner solutions like antimalware programs and firewalls · Leverages global threat intelligence from Microsoft products and services, the Microsoft Digital Crimes Unit (DCU), the Microsoft Security Response Center (MSRC), and external feeds · Applies advanced analytics, including machine learning and behavioral analysis
|
|
Respond |
· Provides prioritized security incidents/alerts · Offers insights into the source of the attack and impacted resources · Suggests ways to stop the current attack and help prevent future attacks |
Azure Security Center currently in Preview but it’s still worth to try and see its capabilities.
Let’s see how we can enable and start using it.
1) You need to have valid azure subscription and you need to log in as global administrator.
2) Then go to browse and type security. There you can see security center. Click on there to start.
3) Then we can see the main window.
4) If it’s red something not right 
5) As we can see the data collection off. We need data collect from VM to detect the problems. Let’s go ahead and enable data collection.
6) Click on Policy tile, and then it will load up the policy page. As can see data collection is off. Click on the policy.
7) Click on “On” and then click on Save
8) After that we can see the recommendations based on collected data and security policy. We can follow each recommendation and fix the security threats.
How to apply custom policy for the different resources?
1) By default the default prevention policy will be inherited to all the resources. But we can apply custom policy based on the requirement. To start with click on policy tile again, and click on the arrow next to policy to list the resources. As we can see security policy inherited.
2) To change, click on the resource to select, and in next tile, for the inherit policy click “unique” and click on “Save”
3) After save, click on prevention policy
4) There you can change the policy settings and click ok to apply the policy settings.
5) This new settings are unique for the resource now.
Enable Email Notifications
You can enable notifications in azure security center so if any issues detected you will get notifications. It’s currently runs with limited features.
Currently it can only enable on default prevention policy.
Hope this article helps and if you got any question feel free to contact me on rebeladm@live.com