book

Mastering Azure Security - Second Edition

Name: Mastering Azure Security - Second Edition
ISBN: 9781803238555

by Mustafa Toroman, Tom Janetscheck

April 2022

Intermediate to advanced

320 pages

6h 33m

English

Packt Publishing

Read now

Unlock full access

Mastering Azure Security
Second EditionContributorsAbout the authorsAbout the reviewer
Preface
Who this book is forWhat this book coversTo get the most out of this bookDownload the color imagesDownload the example code filesConventions usedGet in touchShare Your Thoughts
Section 1: Identity and Governance
Chapter 1: An Introduction to Azure Security
Exploring the shared responsibility modelOn-premisesIaaSPaaSSaaSDivision of security in the shared responsibility modelPhysical securityAzure networkAzure infrastructure availabilityAzure infrastructure integrityAzure infrastructure monitoring Understanding Azure security foundationsSummaryQuestions
Chapter 2: Governance and Security
Understanding governance in AzureUsing common sense to avoid mistakesUsing management locksUsing management groups for governanceUnderstanding Azure PolicyModeParametersPolicy assignmentsInitiative definitionsInitiative assignmentsPolicy exemptionsPolicy best practicesDefining Azure blueprintsBlueprint definitionsBlueprint publishingAzure Resource GraphQuerying Azure Resource Graph with PowerShellQuerying Azure Resource Graph with the Azure CLIAdvanced queriesSummaryQuestions
Chapter 3: Managing Cloud Identities
Exploring passwords and passphrasesDictionary attacks and password protectionUnderstanding MFAHow to enable MFA in Azure ADMFA activation from a user's perspectiveIntroducing security defaultsUsing Conditional AccessNamed locationsCustom controlsTerms of useConditional Access policiesIntroducing Azure AD Identity ProtectionAzure AD Identity Protection at a glanceUnderstanding role-based access controlCreating custom RBAC rolesProtecting admin accounts with Azure AD PIMManaging Azure AD roles in PIMManaging Azure resources with PIMHybrid authentication and Single Sign-OnUnderstanding passwordless authenticationGlobal settingsLicensing considerationsSummaryQuestions
Section 2: Cloud Infrastructure Security
Chapter 4: Azure Network Security
Understanding Azure Virtual NetworkConnecting on-premises networks with AzureCreating an S2S connectionConnecting a VNet to another VNetVNet service endpointsPrivate endpointsConsidering other VNet security optionsAzure Firewall deployment and configurationAzure DDoS protectionAzure BastionHub-and-spoke network topologyHub VNetUnderstanding Azure Application GatewayUnderstanding Azure Front DoorSummaryQuestions
Chapter 5: Azure Key Vault
Understanding Azure Key VaultUnderstanding access policiesUnderstanding service-to-service authenticationUnderstanding managed identities for Azure resourcesUsing Azure Key Vault in deployment scenariosCreating an Azure Key Vault and secretAzure VM deploymentSummaryQuestions
Chapter 6: Data Security
Technical requirementsUnderstanding Azure StorageUnderstanding Azure virtual machine disksWorking on Azure SQL DatabaseSummaryQuestions

Section 3: Security Management
Chapter 7: Microsoft Defender for Cloud
Introducing Microsoft Defender for CloudEnabling Microsoft Defender for CloudUsing auto-provisioning to deploy extensionsEnabling Microsoft Defender for Cloud's enhanced securityCloud Security Posture Management with Defender for CloudWorking with recommendationsHow to prioritize remediationWorking with resource exemptionsCustom policies and (regulatory) complianceUsing the regulatory compliance dashboardWorking with regulatory compliance standardsCloud workload protection and multi-cloud capabilitiesMicrosoft Defender for ServersMicrosoft Defender for ContainersThreat detection summaryAutomating securityContinuous exportWorkflow automationREST APIsMulti-cloud capabilities in Microsoft Defender for CloudSummaryQuestions
Chapter 8: Microsoft Sentinel
Introduction to SIEMGetting started with Microsoft SentinelConfiguring data connectors and retentionWorking with Microsoft Sentinel dashboardsSetting up rules and alertsMicrosoft Sentinel automationCreating workbooksUsing threat hunting and notebooksAdvanced threat detectionUsing community resourcesSummaryQuestions
Chapter 9: Security Best Practices
Log Analytics design considerationsUnderstanding Azure SQL Database security featuresSecurity in Azure App ServiceStorage account access keysSummaryQuestions
Assessments
Chapter 1 – An Introduction to Azure SecurityChapter 2 – Governance and SecurityChapter 3 – Managing Cloud IdentitiesChapter 4 – Azure Network SecurityChapter 5 – Azure Key VaultChapter 6 – Data SecurityChapter 7 – Microsoft Defender for CloudChapter 8 – Microsoft SentinelChapter 9 – Security Best Practices
Why subscribe?
Other Books You May EnjoyPackt is searching for authors like youShare Your Thoughts

Content preview from Mastering Azure Security - Second Edition

Chapter 8: Microsoft Sentinel

Security Information and Event Management (SIEM) combines two solutions that were previously separate, Security Information Management (SIM) and Security Event Management (SEM).

We have already mentioned that large organizations rely on SIEM solutions. And Microsoft's SIEM solution for the cloud is Microsoft Sentinel. But let's first take a step back and discuss what SIEM is and what functionalities it should have.

We will be covering the following topics in this chapter:

Introduction to SIEM
Getting started with Microsoft Sentinel
Creating workbooks
Using threat hunting and notebooks

Introduction to SIEM

Many security compliance standards require long-term storage, where security-related logs should be kept ...

Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.

Read now

Unlock full access

More than 5,000 organizations count on O’Reilly

O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.

Julian F.

Head of Cybersecurity

I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.

Addison B.

Field Engineer

I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.

Amir M.

Data Platform Tech Lead

I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.

Mark W.

Embedded Software Engineer

Publisher Resources

ISBN: 9781803238555

Cloud Computing

Data Engineering

Data Science

AI & ML

Programming Languages

Software Architecture

IT/Ops

Security

Design

Business

Soft Skills

Mastering Azure Security - Second Edition

by Mustafa Toroman, Tom Janetscheck

Chapter 8: Microsoft Sentinel

Introduction to SIEM

Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.