Examining the Microsoft Cybersecurity Reference Architecture (MCRA)

0:00[AUDIO LOGO] All right. It's time for us to examine the Microsoft Cybersecurity Reference Architecture. Now, the first question out of your mouth is probably, what is it? Well, it is a tool for security architects and security professionals dealing with Microsoft products like Office, 365, Azure, and others. Well, it's a tool for us. Basically it kind of outlines what tools we have at our disposal that Microsoft provides to us.

0:32And yes, we might need to buy licensing for them, but it's there if we might want to use it. So it kind of outlines a toolbox that we can use to address problems to, as a security architect, to design a solution that would meet our goals or would help us to solve a problem. So that's what the Microsoft Cybersecurity Reference Architecture is. Wow, it's a mouthful. So now, let's jump in and take a look at it. All right, here we are in the Microsoft documentation. And we're just going to look at this really briefly before we look at the architecture itself, which is a PowerPoint by the way.

1:08So what is this? Well, basically, this describes, if we look at here, describes Microsoft Cybersecurity capabilities. So really, those capabilities are services that we could use, they are tools for us as security professionals and security architects to use to address problems and create solutions. So basically it outlines a toolbox for us. And it helps us to identify, in certain situations, which tools are best to use. So it's really nice. And you should be familiar with it.

1:38Download it. Man this is really cool. They put a lot of work into this. And it is pretty darn awesome. So what it does is it talks about different capabilities. And I'm not going to read through this, because we're actually going to look at it. But if you scroll down here, it's got lots of different diagrams in the architecture for us to look at for things like attack chain. So during the attack chain-- we're going to go over this, don't worry-- but during the attack chain there are different steps that occur. What tools can you use to address different steps?

2:09We're also going to outline all the capabilities, all those tools that we can use. And that's what we're going to cover in this set of Nuggets, it's all those different capabilities. Now, we're not going to dive deep into them because you should be familiar with most of them. But we are going to talk about what they're used for. And of course, when we might want to use them. Also going to look at People. How do you deal with People and the risk associated with them? And of course, Zero Trust. Now let's say Zero Trust is paramount when it comes to cloud security. You don't trust anyone or anything.

2:41And you always assume breach. That is our Zero Trust. And also, we're going to take a look at some native controls. Those are things that exist natively within Azure and the Microsoft Cloud, like the Azure firewall for instance. It's already there, we can use it. And then we're going to talk about security operations and operational technology, and IoT, all those cool things. But what do you say we jump in and take a look at the MCRA itself. And so what we're going to do here is bring it up. Here we go. And if I scroll to the top here, this is the first slide and that's what we just saw in that image.

3:13But as you see here on the left, I'm going to scroll all the way down, there are 65 slides in this deck. That's a lot of information. But what we're going to start focusing on, let's scroll back up here, is we're going to start focusing right here on slide 9, the Cybersecurity Reference Architecture. And here, we're looking at our tools. These are the different services and solutions that Microsoft provides to us so that we can use. So this is kind of like our inventory for our toolbox of security tools that we can use in the Microsoft environment.

3:46So you need to be familiar with all these tools. Know what they are and when we might want to use them. And that's what we're going to start talking about in the next Nugget. So I will see you there shortly. I hope this has been informative for you. And I'd like to thank you for viewing.

0:00[AUDIO LOGO] We're starting off with security operations in the Microsoft Cybersecurity Reference Architecture. Now, when it comes to security operations, we need to identify what tools do we have that Microsoft provides at our disposal that we can use as part of our security operations. Because the goal of security operations is to quickly identify and address any security incidents that might come up because we need to do this in order to minimize impact to our organization.

0:34So let's jump in and take a look at some of the tools that we have. All right, we're starting off here, of course, security operations, as I just mentioned. And this is the slide from the Microsoft Cybersecurity Reference Architecture that shows all the different tools that we have. And they're grouped according to their uses, where they belong. We're focusing here on security operations right there. That's what we're going to be discussing, those tools that we have at our disposal. So let's get started. Here we go, threat experts-- Now, threat experts is basically a managed hunting service.

1:12And by hunting, we mean threat hunting. That's right. They're looking at our organization. They're going through, and they're monitoring what's going on within our data, in our sign-ins, in our authentications. And they provide us with expert-level monitoring and analysis to help ensure that the critical threats in our environment don't get missed. Because again, when we're dealing with threats in our environment, all of our environments are different when it comes to different customers and such.

1:42But what threat experts do is, they come in, and they hunt in our environment. They look for those threats that are out there. And they help us identify them. So the idea here is, if we don't have skilled personnel that can do the hunting for us, if we don't have a team for this, well, guess what? We can outsource it to the Microsoft threat experts. Or maybe we have a small team, and we want to implement threat experts to help us be more robust. So just think about that.

2:12That's where those threat experts are and where they come to play. Next up, we have DART, Detection And Response Team. That is our DART. Now, that DART team provides assistance with incident response, recovery, and hunting. So if we run into a problem and we need assistance with incident response and/or recovery or even hunting, well, guess what? We can reach out to the DART team.

2:43And of course, it's not free. You have to pay for it just like you do with the threat experts. But they're out there. And this is basically incident response on retainer for customers with premium and unified support. So if you need assistance with your incident response recovery your hunting, reach out to the DART team. That's your detection and response team. Next up, Microsoft Sentinel. Now, Microsoft Sentinel is a SIEM or "seem" and SOAR solution.

3:15Now SIEM, you should be familiar with. Basically, collects a bunch of logs from all over the place and analyzes them, looks for things that are out of the ordinary or threats and whatever it finds. And then SOAR provides us Orchestration and Automated Response to the alerts. So when SIEM sends off an alert saying, hey, there's something going on here-- warning. You know, what we can do is kick off an automated response via the SOAR capabilities of Microsoft Sentinel. So again, this is going to be collecting all of our logs from various locations to identify threats in our organization and also allows us to do hunting.

3:52So if we wanted to do threat hunting through our organization ourselves, our own team, well, we would most likely use Microsoft Sentinel to do that. Next up, is Microsoft Defender. Now, Microsoft Defender is a unified detection and response platform. And what it does, it provides us a dashboard or a portal. And within that portal, we have different things along the side here and things like hunting. So we can go in and do hunting through logs and such.

4:22We can also take a look at endpoints, and we have cloud applications, and other types of Defender products. But the idea behind Microsoft Defender is there are several products that we have. And we're going to touch on some of those here shortly, things like Defender for Endpoint, Defender for Cloud, Defender for Office 365, Defender for Identity, Defender for Cloud Apps. All of these things they're going to be lining up in here. And Microsoft Defender really is a unified detection and response platform.

4:54The idea being-- unified means it takes all of these different Defender products over here, and it helps us to kind of put them into one dashboard that we can begin working with. Now, this is still in the works, I want to say, because as I jump back in from time to time and work with it, I see that there are more of the Defender apps that are showing up in here. So the idea, though, is Microsoft Defender, as a whole, has a bunch of subapplications or services or tools. And the idea is, we want to put those into a single portal here. So let's talk about some of these individual Defender tools.

5:26First off, we have Defender for Cloud. I like that Defender. Defender. So Defender for Cloud provides us XDR capabilities. And XDR, this part here, the DR is Detection and Response. The idea is, we can use it to detect something and send off an alert. You know, something's going on here. And then response is, it allows us to use the portal to respond to things, to do certain actions. This X just means whatever you can come up with thing.

5:57So XDR. So that could be Cloud Detection response, Endpoint Detection and Response, Office Detection and Response. The list goes on and on and on. But the idea with Defender for Cloud is that it allows us to provide detection and response for Azure resources. So we're really focused on Azure here. That Azure resources, things like Azure Active Directory and Azure VMs, and other Azure services.

6:28So this could be Linux and Windows VMs, networks, Kubernetes, containers, SQL, storage, IoT. We're really focused on Azure services. So if you've got Azure services you're wanting to protect, take a look at Defender for Cloud. Next up, Defender for Endpoint. Now, when it comes to endpoints, of course, we're talking about our endpoints our users are using out there. This is formerly known as Defender ATP. So this provides Endpoint Detection and Response, which is EDR.

7:01So that's our detection and response again for endpoints. It provides us some threat and vulnerability management, automated incident investigation or remediation, which is really cool, and more for Windows, Linux, iOS, and Android. So there you go. So you've got your Windows, you've got your Linux, you've got Android, and, of course, iOS. So you can use Defender for Endpoint on all these operating systems. Next we have Defender for Office 365.

7:32So again, this is detection and response services for Office 365. So this includes capabilities such as sandbox detonation. So sandbox detonation-- if there is a suspicious file that comes in maybe, well, what it can do is it puts that file into a sandbox, detonates it, and analyzes to see if that file is malicious or not. It does that for us automatically. It also provides integrated threat intelligence, attack simulation and more. And this is across our email, our SharePoint-- so let's put up there email, SharePoint, OneDrive, all of those services there.

8:12So that's where that Defender for Office 365 really comes into play. So next we have Defender for Identity. So this is Microsoft Defender for Identity formerly Azure ATP. This detects on-premise identity attacks. So and, of course, not just on premise but in cloud as well. But either way, on-prem-- so I'm going to put that up here. That's really important because that's on prem and, of course, in cloud. But what we're looking for is identity attacks. Because we know that we have adopted the zero trust.

8:45And we know that the identity is the new edge of our networks and our services. Whether, it's on prem or in the cloud, when we want to protect our identities, we need to look at Defender for Identity. And it uses behavioral analysis and specific detections for things like pass the hash, Kerberos tickets attacks, password attacks, golden ticket skeleton key, all kind of different attacks. So that's what it's good for. So if you're looking to protect your identities, whether on prem or in the cloud, look at Defender for Identity.

9:19And then we have Defender for Cloud Apps. Now, cloud apps are apps that reside in the cloud, right? Of course but not only Azure. We're talking everywhere. So whether your cloud apps are Salesforce-- that's not Microsoft, right? Or maybe you got something that's out there that's an HR platform or another accounting platform somewhere in the cloud-- doesn't matter. If it's cloud-based, you can protect it with Defender for Cloud Apps. And Defender for Cloud Apps provides us that detection and response capabilities for all of our APPs that are out there, our SaaS applications.

9:56It also helps us to address shadow IT. Now, shadow IT is where the folks in our organization might try to sidestep IT and do their own thing-- sign up for applications, and use them outside of IT, management, and governance. Well, you know what? We can address that with Defender for Cloud Apps. And that's because Defender for Cloud Apps is actually a CASB. And that is a Cloud Access Security Broker which becomes kind of basically a proxy for all of our cloud apps.

10:26So the idea is we have users that are all over the world, possibly. But when they're using endpoints that have Microsoft Defender on them, then it actually sends that information through the proxy before it goes out to the various cloud apps so that we can see what's going on. And that's the kind of where the CASB becomes into play. But this way we can say, nope, you can't use that application. Absolutely not, that's not something we want to allow. That's how we address that shadow IT.

10:58But we can also set up policies around various applications that are out there, various SaaS applications, that is. So when you're looking to address SaaS application security, wherever it might be, look to Defender for Cloud Apps. And lastly, I want to just do a quick security operations and what security operations is all about. It's all about fast detection and response. So we're using all of those Defender products, and we're using Sentinel, and we might end up using a threat experts and our DART detection and response teams.

11:35And we're going to use all of those tools in our operations toolbox in order to provide fast detection and response. So we can minimize the impact that an incident has on our organization. And that's where security operations shines. And these are the tools that we use to do that. I hope this has been informative for you. And I'd like to thank you for viewing.

0:00[AUDIO LOGO] Within our cloud environments, our identity is now the edge of our networks. And it's not just our Azure environments, but also our SaaS applications wherever they may reside. And that's why it's so important that we protect those SaaS applications and our identities. So let's jump in and take a look and see what the Microsoft Cybersecurity Reference Architecture says about SaaS and Identity Protection.

0:32All right, here we are taking a look at the Cybersecurity Reference Architecture. And what we're going to be focusing on here is our SaaS environment, as well as some of our identity protection. So let's get started. First off, protecting our SaaS Defender for Cloud Apps. We've talked about Defender for Cloud Apps before, but I want to bring it back up because it's very important. When you're looking to protect your Software as a Service application-- your SaaS apps-- then, you want to use Defender for Cloud Apps.

1:02So if you're charged with coming up with a solution to protect your SaaS applications, and you're in the Microsoft environment, you've already got a foothold in there, look to use Defender for Cloud Apps. And also, another thing I want to point out and bring up again about Defender for Cloud Apps is if you're looking to address shadow IT, well, guess what? This is going to help you do that when it comes to your application, specifically your cloud applications and controlling what applications your users can use.

1:35So Defender for Cloud Apps. Next up, identity and access. We need to protect our identities because they're the edge of our cloud environments. So how can we go about doing it? Well, when it comes to your Microsoft environments, we have a couple of options. Number one, conditional access policies. So we can use our conditional access because it provides centralized policy control for data and applications by enforcing conditions that we create based on account authentication, network location, device health, and compliance and various other risk factors.

2:10So we can use conditional access for the first part. The second part down here, well, we need to look at passwordless and MFA. So protecting identities, the first couple of things we want to address conditional access secondly passwordless and MFA. Now Azure MFA helps safeguard access to our data and our apps while making sure that it meets our user demand because it's simple sign on. So we can use the Azure application to provide that MFA.

2:45So it's just a button push, very simple. And of course, it delivers strong authentication because it provides us a range of verification methods like phone calls, text messages, and, of course, our mobile app that we discussed. All right, what about within Azure AD. So when we're wanting to protect our identity within Azure AD, so how can we go about doing this? Well, there's some tools that we can use. The first tool is Azure AD Privilege Identity Management, a.k.a.

3:18PIM. So we could use PIM, Privileged Identity Management. And this allows us to manage, control, and monitor privilege accessing using approval workflows. And those approval workflows allow us to provide that just-in-time access as well. So when we're using PIM, we can allow people to escalate their privileges. And it goes through a workflow, so a manager approves it. And that's only available for a certain amount of time, maybe two hours or something. That way, they don't have these elevated privileges at all times, very handy.

3:53Next up is identity governance. And Azure AD identity governance allows us to balance out our organizations need for security and productivity, which is really important because we cannot have security impacting productivity if we can help it. And what governance does, it helps us to make sure that the right people have the right access to the right resources. So identity governance, very important. And then we also have identity protection. And Azure IDs identity protection provides us with a consolidated view into risk events and potential vulnerabilities affecting our organization's identities.

4:34And this is how we go about protecting our identities within Azure AD. Now I do want to spend just a couple of minutes talking about Defender for Identity. Now we did discuss it earlier, but I just really want to hit home with the idea that when we're looking to protect our identity, whether it's on-prem or in the cloud-- it doesn't matter, either one-- basically, what happens is we have Defender for Identity over here. And we send those on-prem security event logs and our in cloud security event logs into Defender for Identity.

5:12And what it does is it actually analyzes that data. It takes a look at it, and it's looking for what's going on. It's looking for advanced threats. It's looking for compromised identities and malicious inside user actions. It's looking for all these things. And it uses threat intelligence and various other resources to find things that are threats in your organization associated with identities. And at that point, it can help you to address them and send off flags, alerts that something is going on and allows you to then investigate and address and respond to those events.

5:52So that's your Defender for Identity. So that covers our SaaS Protection with Defender cloud apps, and of course, identity and access protection with Defender for Identity, and then, also our conditional access, passwordless, and MFA, our Azure AD PIM, identity governance, and Identity Protection within Azure AD as some of those tools were. So just keep those in mind. And that's how we take care of our SaaS and Identity and access security protection using tools from the Microsoft Cybersecurity Reference Architecture. I hope this has been informative for you, and I'd like to thank you for viewing.

0:00[AUDIO LOGO] We're now on to endpoint and devices. So as we continue with our Microsoft cyber security reference architecture, we're going to take a look and see tools it says we have to use for Microsoft for our endpoints and our devices. So here we are, we're seeing the cybersecurity reference architecture here, and we're focusing on our endpoints and devices. So let's jump in. Here we go. So Microsoft Endpoint Manager or MEM.

0:33That's what we're starting off with. And this enables us to manage and monitor various devices. So we've got mobile devices, that's number one, mobile devices. Number two, we have desktop devices. So we've got our desktops there. What about number three? Well, how about VMs? Absolutely. VMs we could also have embedded devices. And lastly, five, our servers. So we can use MEM or Microsoft Endpoint Manager to help us manage all of these devices.

1:07So really it covers all of our devices, right? Not just servers, and not just endpoints, not just desktops. So think about using MEM for management of all of these different devices. But there's also Intune. So our Microsoft Intune. Now this is a cloud-based service out there in our clouds. And it focuses on mobile device management. So mobile is key word here, mobile. So we're not looking at servers, we're not looking at embedded devices, we're looking at our mobile devices.

1:40But not just our devices. So devices, yes, but also applications. So it helps us to manage our devices. And what apps can be used on those devices. And Intune also integrates with Azure AD, which is very handy because it allows us to implement conditional access to provide device security health signals. So what that means is when we use conditional access policies, if a device is not healthy, meaning it doesn't have Defender for Endpoint installed or it doesn't have its updates installed, well, it might be considered not healthy.

2:22Or if it's accessing applications from outside the company network, all of those signals can be sent to conditional access, and can require users to provide additional security, such as MFA, in order to access these things, or maybe not be able to access them at all. But that's the idea behind Intune and its integration into Azure AD and conditional access. Then we have Configuration Manager. Now this is a little bit different. This is dealing with specifically configuration.

2:54So it provides security updates and other management capabilities for various endpoints. But the idea is we're dealing with specific configurations. And that's Configuration Manager. Then we come across Defender for Endpoint once again. And again, this is providing us that detection and response capability for our endpoints. And also provides us with threat and vulnerability management. And automated incident response and remediation for our endpoints.

3:30And again, this runs on Windows, Linux, Android, iOS, all of these here. So that's our Defender for Endpoint. And then lastly, I want to talk about one more thing, and that's when we're dealing with Windows 10 and Windows 11, they have some additional security features built into them that helps us to protect against known and emerging threats across the spectrum of attackers and their attack vectors. Now the idea is if you're using your Windows, you want to make sure, of course, they are up to date.

4:07So they've got all their updates on them. And just remember that security is built into Windows 10 and 11. So the idea is in your environment, if you're really wanting to make sure that your endpoints are staying secure and you're deploying your Defender for Endpoint and you're doing your updates, you want to make sure that you are on a recent version of the desktop operating system. And that is the Microsoft cyber security reference architecture, and how it relates to endpoints and devices. I hope this has been informative for you, and I'd like to thank you for viewing.

0:06Now we're on to Hybrid Infrastructure. So we're talking about our Infrastructure as a Service, our Platform as a Service, and/or our On-Premise all working together as one infrastructure. That being said, we need to understand what the Microsoft Cybersecurity Reference Architecture says about what tools and services we can use to protect our hybrid infrastructures. So let's take a look. All right, here we are. We're looking at the cybersecurity reference architecture diagram about all the services and tools we can use.

0:37And we're looking here at the hybrid infrastructure piece right there. So let's get started. Starting off, Defender for Cloud. Now, we had talked about this briefly before. And again, Defender for Cloud is about protecting your Azure resources. So this isn't for protecting on-premise. It's protecting your Azure resources. So we're talking here about our virtual machines that we're protecting and various other services, our networks, all kinds of things like our Kubernetes clusters.

1:10We're talking about SQL and storage services. All these things and then our IoT even. We're looking at protecting all of these services with Defender for Cloud. Now, something else we can take a look at is Secure Score. Now, Secure Score is a security center tool that continually assesses our resources, our subscriptions, and our organization for any security issues, and then it aggregates all of that into a single secure score.

1:42And by looking at that score, at a glance you can tell how you're doing in your current security situation. And the higher, the score, the better you're doing. So that's Secure Score. It's just a quick, down and dirty grade of how you're doing with security in your environment. Next up, our Compliance Dashboard. Now, when it comes to our Compliance Dashboard, we're talking about regulatory compliances. So these could be things like NIST and CMMC and PCI and HIPAA and SOX and all kinds of different regulatory compliances.

2:17But it helps provide insight into your security compliance posture, and it provides a set of supported standards and regulations based on a continuous assessment of Azure environment. So basically you go in there and you tell it which regulatory compliances you're working with, and then it can help you to see how you're doing as far as compliance towards a specific standard or standards. And next up, we have Azure Firewall, the Firewall Manager, and Azure WAF.

2:50And I group these together. Now, these are what we would call native resources because they reside in Azure. They're tools that are there that we can use. Now, we may have to pay subscription fees for them or licensing, but they are there. Now, Azure Firewall is a managed cloud-based network security service, and it protects our Azure virtual networks. So when we've got our Azure environment and we've got our VMs and we've got our networks and we've got our various services we're using, we can use the Azure Firewall to help protect those.

3:27Now, the thing is this is a stateful firewall, which is very important because it watches the state of communications between endpoints. So if it sees a connection come in and it's allowed, it's going to allow the response to go back out. And that's what the stateful part of that means. Now, one of the great things about this, it has built-in high availability so the service is running in multiple instances. So you have your high availability there, but you also have unrestricted cloud scalability.

4:00So as you have more traffic coming through the firewall, it's going to automatically scale to address your needs. And you don't have a bottleneck-- that's pretty darn cool. And that is also the Firewall Manager. That's how we manage the Azure Firewall. But then we have Azure WAF, and this is a Web Application Firewall. So that means it is a firewall specifically tuned to web applications, and that means the HTTP protocol and, of course, the secure version as well.

4:32[CHUCKLES] How about that? All right, so why would you want to use a WAF, or a Web Application Firewall? You want to protect a web application. And this provides centralized protection of your web apps for many of the common exploits, so we're talking like SQL injection, cross-site scripting attacks, and a whole bunch of other different types of attacks that are located in the OWASP set of rules. And so that's what that is for. So basically it's a firewall that speaks or understands HTTP protocol, and it will watch the different commands going back and forth between the application through the firewall.

5:13And if it sees something that's an attack, it's going to stop it. So there you go. That's your Azure Firewall and Azure WAF. Next up, we have DDoS Protection. Now, when it comes to DDoS Protection-- these are Distributed Denial of Service Protection-- well, the idea is we want to prevent it from happening because it's going to eat up our resources and cause us outages. Now, Azure natively provides basic DDoS Protection for all of its public IP. So there is basic protection by default, and you don't have to pay extra for it.

5:44It's already there. However, you can't do any kind of tuning. So if you want to increase your protection by using tuning and things like real-time and historical telemetry and alerting and cost guarantee and more-- so we'll say plus features because there's a lot of features-- well, then you're going to want to go ahead and purchase the standard version to get these additional features. The basic version is free, and it's just a very simple DDoS Protection.

6:17But if you're looking for advanced DDoS, you're going to need to purchase that standard protection. All right, next up, we have the Azure Key Vault. Now, Key Vault helps us to mitigate risk of compromised secrets. So those are when we have a secret that has, well, been compromised. It's been leaked or it's been figured out or found out where keys or secrets may have inadvertently been published to places like GitHub. And, well, what this does is it ensures that they're safeguarded by Hardware Security Modules, or HSMs, and readily available to various applications.

6:54So when you're looking to protect your secrets and your passwords and your certificates and keys, you're looking to protect them with Azure Key Vault. Next up, we have Azure Bastion. Now, Azure Bastion provides secure and seamless RDP/SSH connectivity-- so let's put that up there, RDP and SSH connectivity-- into Azure resources, specifically your Azure virtual machines. And it provides this RDP and SSH connectivity into your virtual machines directly from the Azure portal over TLS so it is encrypted communication.

7:32So when you connect to your Azure Bastion, your virtual machines don't have to have a public IP address on them or an agent or a special client or anything. So the idea is, in your virtual network in here, you may have an Azure Bastion host. And the idea is this Azure Bastion host allows you to connect from the outside. So you could be on-premise or something and you connect in via RDP or SSH into this Azure Bastion host. And then from there, you can connect to various other resources and virtual machines and such that you have running.

8:11And then you can RDP or SSH into those, whether they're Microsoft or Linux or whatever. But the idea is then your VMs do not need a public IP-- they only need that private IP-- and you're connecting through this bastion host. And, of course, you're going to set up some security group rules around which IPs can connect to this bastion host. You don't want to leave that open to the world, of course. That would be bad. So that's your Azure Bastion host. Next up, Azure Lighthouse. Now, Azure Lighthouse enables cross- and multi-tenant management.

8:46So this allows for higher automation, scalability, and enhanced governance across resources and tenants. So when you are working with multiple tenants-- maybe you are a service provider and you could provide, I don't know, security services, all kinds of services-- but the idea is you have your tenant up here and you actually are able to manage other tenant's resources, well, you could use Azure Lighthouse in order to do that. So keep that in mind. Next up, Azure Backup. So with Azure Backup, we're protecting against disasters and ransomware attacks with simple and reliable cloud-integrated Backup as a Service.

9:25And that's what Azure Backup is. Its Backup as a Service, and it provides us with site recovery that can protect Hyper-V, VMware, and physical servers so you can use Azure as your secondary data center for your recovery site. So this is helpful for not only cloud but on-prem for disaster recovery services as well. Next up is Azure AD App Proxy. So this is something that's also referred to as Beyond VPN.

9:57So when we're looking to go beyond simply using VPNs to access resources, well, Azure Active Directories Application Proxy provides a secure remote access to on-premise web apps. So the idea is you may have-- let's put on-prem down here-- on-prem and you've got a server that's running a web app on here. There we go. Excellent Now, what you can do is basically this app proxy lives up here in Azure, and you configure the app proxy to point to and connect to that web app on premise.

10:31So once you set all this up, then your users connect here to the cloud. So they can access it from anywhere, and you don't have to use a VPN. It's all done securely through the use of the Azure AD App Proxy. So again, if you're looking for security services to provide secure access to an on-premise web applications and you want it to be accessible from anywhere but you really want security-- you don't want to use VPNs-- you're looking to use Azure AD App Proxy. Next up, we have Express Route and Private Link.

11:03Now, these are two different solutions. Express Route is designed to connect your on-prem environment into your Azure resources. So that's how that works. Basically, you go through and configure it. We're not going to get into the details. But if you're wanting to connect on-prem into your Azure resources with something other than a VPN, you want to look at Express Route. Now, Private Link is a bit different. Now, the idea behind a Private Link is that you have your virtual network here.

11:38There we go. And you've got some VMs spun up in there. Excellent. And you've got some PaaS services over here, like you've got maybe some SQL services or some storage, whatever it might be. When you have these PaaS services, they have a public IP address that you use to connect to them. So you would connect via the public IP into here. Well, that's not always the best because then you have a public IP involved, and there could be some misconfigurations so it's opened up and exposed to the world.

12:12We want to try to avoid that. So what can we do? Well, let's remove these here, we could use a private link. What that does, it gets rid of the public IP that provides a connection from your virtual network to your PaaS service over private IP addresses in the Microsoft backbone so that way there is no public IP addresses involved, keeping it more secure. And that's what Private Link does for us.

12:42Next up is Azure ARC. Now we're talking about hybrid infrastructure. So what if I have on-prem servers? There we go. This is my on-prem-- hey, maybe I've got some AWS resources over here, maybe I've got some VM spun up, or over in GCP I got some VM spun up over there-- and I want to integrate those into my management. Well, how can I do that? The answer is Azure ARC. That allows you to extend your management to resources in other cloud and your on-premise data centers, enabling consistent management and security across all these different platforms.

13:17And Azure ARC brings these resources into ARM so that you can use it to manage these various resources. So it connects everything in using Azure ARC. So if you're looking for hybrid infrastructure connectivity to manage with ARM, then you're going to want to use Azure ARC. Next up, Azure Stack. This is pretty cool. Now, the Microsoft Azure Stack is a hybrid cloud platform that lets you provide Azure services from your own data center.

13:48So if you have your own on-prem data center, or a data center that you have leased out space in so it's a "colo," then you can actually implement Azure services from within that data center using the Azure Stack. Pretty interesting. Next up is our Privileged Access Workstation, or PAWS. And PAWS is integral part of Privileged Access Security Strategy.

14:18Now, what is a PAWS? Well, it's a workstation that can be used by those with privileged access, so like admins, and these workstations do not allow for email-- nope, no email-- or web access-- nope, no web access. So basically it's like an internal-only workstation. It's very locked down, and it can only access your internal resources. So the idea is when you sign in here as an admin and do your work on the internal organizational asset, the idea is that we have greatly reduced the risk of this device being breached so that someone couldn't be sitting on there collecting credentials from admin.

15:05So the idea here is we're just really trying to reduce the risk of admin access being compromised. OK, next up, Microsoft Secure Score. And we have talked about secure score before. Again, this is a measurement of your organization's security posture. And it's designed to help you quickly see just how well you're doing within your Microsoft environment and security. It also provides recommendations on how to improve your score.

15:36And then lastly, Microsoft Compliance Score. Again, this is another way to help you quickly see how you're doing with compliance within your Microsoft environment. And this is done through the Compliance Manager, and you go in and you define which compliance you're dealing with. Is it something like NIST or CMMC or SOX or HIPAA or PCI or something else. Whatever it might be, define what it is that you're trying to comply with, and it will then help you assess your compliance.

16:09So it's pretty darn cool. So these have all been tools and services that we can use to help design security solutions as a security architect for our hybrid infrastructures according to the Microsoft Cybersecurity Reference Architecture. I hope this has been informative for you, and I'd like to thank you for viewing.

0:06As a security professional, one of the things we're always trying to do is protect information. And we can't protect it if we don't know that it's there. So oftentimes, we have to perform discovery to identify where certain types of information is located. And then, sometimes, we'll label that information with some type of classification or something to help us identify what type of data it is so we know how to treat it. Well, guess what? Microsoft's cybersecurity reference architecture covers information protection, and that's what we're going to look at right now.

0:37All right, here we are in the architecture. And we're looking at Information Protection, this area right here. So with no further ado, let's jump in and get started with Microsoft Purview Information Protection. Now Purview is a unified data governance service, and it provides us with some great features that help us manage and govern our on-prem, multicloud, and SaaS data. That is important. So we're talking on-prem, we're talking multicloud-- so GCP, AWS, doesn't matter-- and, of course, our SaaS services as well.

1:20So it protects all of those, which is really cool. And the idea is it's a tool for governance. That's what it is. So governance is our management of our information and it's protection. So the way it does it is it uses MIP. That's our Management Information Protection, which is a built-in intelligent solution to protect sensitive data in documents and emails across our organization. So it uses MIP.

1:50It also uses data governance, which really is what it is a tool for. It provides us with that data governance capabilities that allows us to manage the lifecycle of our data. So from data creation to discovery to labeling to destruction-- the whole life cycle-- it allows us to manage that through Purview. And then, it also provides us with some eDiscovery features that helps us simplify that eDiscovery process and help us to analyze unstructured data within Office 365 and review documents and to find those documents whenever we need to go out and identify what we have in our organization.

2:37So it will go out there and it will scan your organization and look for documents that contain certain types of sensitive data. And it will show you where it lives, and it will let you manage its life cycle. So that's what Purview is used for. Really, the idea is if you're wanting to implement some type of governance solution that protects on-prem, multicloud, and your SaaS applications' data, you're wanting to implement Purview.

3:09Next up is the Azure Information Protection-- that's the AIP-- Unified Labeling Scanner. Now what this scanner does it helps you to discover, classify, and protect files on UNC paths for network shares over SMB and on SharePoint servers for on-premise data. So what we do-- in our on-prem network, we can deploy this Unified Labeling Scanner.

3:39And once we do that, it can go out over UNC paths and SharePoint servers and look at the data. And it scans the data and it looks for sensitive information. And then it provides you with a list of where this sensitive information resides in on-premise network. So that's really cool. And that actually feeds into Purview, which we just discussed was a governance solution. And this is how it helps identify where your sensitive data is located in your on-prem environments.

4:13And lastly, we have Compliance Manager, and this is another part of Microsoft Purview. And it provides a Compliance Manager dashboard that helps you to achieve your compliance goals. And it helps you to evaluate cloud workloads against your compliance requirements, whatever they might be, as well as protection standards. It allows you to assign, track, and record compliance and assessment-related activities. So if you have an assessment that's coming up, you can assign the assessment, and then the person can upload the information, and basically, you can track that process of the assessment or any other type of activities that you want to create towards compliance.

4:58So that is your Compliance Manager. So those are some of the tools we can use for information protection. And we really focused on governance with Microsoft Purview and its AIP Unified Labeling Scanner for identifying on-prem sensitive information and using Compliance Manager to help you maintain your compliance. I hope this has been informative for you, and I'd like to thank you for viewing.

0:00[AUDIO LOGO] Now we're on to IoT and operational technology, which includes industrial control systems. Now, how can Microsoft help us protect these things? Well, that's what the Microsoft Cybersecurity Reference Architecture is going to help us figure out. So let's get started. All right. Here we are. We're in our architecture, and what we're doing is we're looking down here at IoT in this area right here, IoT and OT, which includes our Industrial Control Systems, or ICS.

0:40So let's see what we can do. First off, Azure Sphere. Pretty interesting here. Now, what this does, it provides us an end-to-end solution to secure new IoT devices. So we're really looking to secure IoT devices with Azure Sphere. And it does this with a special hardened Linux operating system. And that is the first part of the Azure Sphere.

1:10Now, the second part is certified microcontrollers. So let's put that over here. And these microcontrollers have been certified as to basically being securely built. And then Azure Sphere provides us with a security service because we have to have some type of service to communicate. So we have a secure service that will allow the communications between devices, and it provides us the seven properties of highly secure devices as a whole.

1:43So when you combine these three things, which are the Azure Sphere, or hardened Linux OS, and that's running on a certified secure microcontroller connecting to a secure service provided by Azure, then you have a secure IoT environment. And that's what we're looking to achieve. Next up, we have Azure defender for IoT. Now, this offers agentless. And that's pretty important here. Agentless, so we don't have to deploy agents to all of our IoT devices.

2:16And it provides an agentless network layer security service that is rapidly deploy, and it works in various industrial environments, and it interoperates with the Azure Sentinel and other SOC tools. So this is a network layer security service that runs and basically watches the communications that's taking place. And it's looking for oddities. And it's sending those events that it sees, it's sending those into other security services, such as Azure Sentinel and other SOC tools that you can use, to feed into your normal, everyday security operations.

2:59And that's what Azure Defender provides for us. It allows us to feed the IoT security information into our SOC tools. Pretty darn handy for protecting IoT. And lastly, Defender for Cloud, which we've talked about multiple times. And again, that is used to protect what? Think about it. Think about it. And that's right, Azure Resources. So we're talking about our Azure VMs, our networks, Kubernetes, containers, SQL storage, IoT.

3:30That's right. That's where it feeds into, our IoT, and helps us to protect it. So there you go. That's how we can protect our IoT and operational technology devices, according to the Microsoft Cybersecurity Reference Architecture. Hope it's been informative for you, and I'd like to thank you for viewing.

0:00[AUDIO LOGO] It's time for people security in the Microsoft cybersecurity reference architecture. Now, what could people security be? Well, it's security dealing with people. People are something we deal with every day in security. So we're talking about security training, maybe some phish testing, also insider risk is a big problem these days. So let's take a look and see what the Microsoft cybersecurity reference architecture has to say about people security.

0:35All right. Here we are in our architecture. What we're looking at down here in the bottom right. Down here. We're looking at people security. So let's get started. There's just a couple in here. So first off, Attack Simulator. This is really cool. And it is a tool within the Security and Compliance Center that helps us to run realistic attack scenarios against our users to see how they do. And oftentimes, this is done through phishing campaigns.

1:08So we do like to run phishing campaigns, and that's one of the tools that we can run when we're running these attack scenarios using the Attack Simulator. Pretty darn cool because we provide security training to our folks. Well, this is a way that we can then see how well that they absorb that training and we can provide additional learning through these simulated attacks. Next up, insider risk management. Now, this is within Microsoft 365.

1:39And what it does, it helps to minimize internal risks by enabling us to detect, investigate, and act on malicious and inadvertent activities in our organization. So what we can do, we can go into the Insider Risk Management, and we can set up rules to watch for certain types of things happening. Maybe, we create a rule that says, if anybody uploads more than 2 gigs of data within a 24-hour period, send off an alert.

2:10Raise the flag and say something's going on. So it's rules similar to that. So it just helps us to identify insider risks by certain types of activities that are happening. And it reports on them so that we can then investigate. And then lastly, we have communications compliance. Now, this is a little different. This is an insider risk solution within Microsoft 365, and it helps us to minimize communication risk. And it helps us to detect, capture, and act on inappropriate messages within the organization.

2:45Now, a lot of times, this comes down to dealing with HR because this is more about inappropriate communications between internal users. Such things as harassment and things like that. But it does feed into security as well because we can use it to help identify insider risk. So those are three tools according to the Microsoft cybersecurity reference architecture that Microsoft provides us with when working with people security.

3:18I hope this has been informative for you, and I'd like to Thank you for viewing.

0:00[AUDIO LOGO] All right, it's time to wrap up the Microsoft cyber security reference architecture series here that we're working with. And what we're doing is we're going to look at some of the other tools that are out there and available that don't really fall into a specific category. So let's get started. All right, we're starting off here with the GitHub Advanced Security. Now what this is, this is for your DevSecOps and application development security.

0:36And it integrates natively in the developer's workflow, including things like code scanning to make sure that there are not vulnerable code being used or vulnerable plugins or something being used within the code. It also provides secret scanning. So it's looking for any secrets or passwords or keys that might be left in the code left over from testing. It also provides alerting if it finds these things. So it didn't just record it, not notify. It also allows you to create security policies and much more.

1:10But the idea is it allows you to-- within your DevSecOps pipeline, introduce all of these additional features when you're integrating within GitHub's advanced security. So that's pretty handy for your development folks. Next up, threat intelligence. And of course, threat intelligence is intelligence about things that are going on out there in the cybersecurity world. And it provides things known as IOCs or Indicators of Compromise. These might be IP addresses, URLs, email addresses, file signatures, all these different things that have been known to be part of attacks.

1:48And Microsoft processes, believe it or not, over 8 trillion. I'm going to write that down. It's really impressive, 8 trillion signals every day. And it offers insight into what is a normal baseline of activity. And then potentially anomalous behaviors and verified attacks. And it help us provide high quality detection by filtering out those false positives, which take up too much of our time. And that's what threat intelligence does, provides us with all that intel, and it feeds into the Microsoft security services.

2:23So when you're using those security services, they are receiving this threat intelligence. Next up is a Service Trust Portal. Now what is this? Well, what it is, it allows you to go in and look at audit reports that were done against the Microsoft services and environments. And this way, you can see the audits that are taking place within the Microsoft environment to see just how secure they are within their environment and their practices.

2:54So when you're looking to select a cloud vendor, oftentimes you're looking at certain types of audits. Maybe it's a SOC 2 audit, or maybe it's some type of missed audit. Well, you go to the Service Trust Portal, and you're going to have access to all of those audit reports. Next up, SDLC. And this really isn't necessarily just Microsoft. It's within development everywhere. But the idea is you need to be aware of what the SDLC is. It's a security development lifecycle.

3:24And this is a development process. And it helps developers build more secure applications. That's the idea behind it. And within the SDLC, the whole life cycle, as you can see, it is a cycle here. And you go through various steps within the cycle to make sure that your development is following standards. And it helps us to address security compliance requirements while reducing development costs. So just be aware of the SDLC, and that you should be using it in your development lifecycle.

3:58Next up, Azure Confidential Computing. Now this service here, this feature is when data is processed in a hardware-based trust execution environment. So the unauthorized individuals cannot access the data during the processing. So this all takes place within the processor. It's really just a way to further guarantee confidentiality in a shared hardware environment. So that's what Azure confidential computing provides for us.

4:32All right, next up is Graph Security API. And this is really nice. And what this is, it's a unified interface and schema across all the Microsoft security products. So this allows you to build your own applications that directly integrate into your security efforts. So really, it just says that within all of those Microsoft security products, they all speak the same language. Just put it, it's kind of a generalized example of this.

5:04But the idea is they all speak the same language. So if you write your own app over here and you tell it how to speak this language, then you can integrate it. And you can access the data from various Microsoft tools that you're using. And that's what that Graph Security API does for us. Next up, we have shielded VMs. Now a shielded VM uses a virtual TPM-- and a TPM is a Trusted Platform Module, and it's encrypted using BitLocker.

5:36And can run only on healthy and approved hypervisor hosts within the fabric. So really it's an extra layer of protection to ensure that your VMs cannot be run outside the environment. So if you have a VM that you've created within the Azure environment, and somehow it's compromised, and somebody tries to exfiltrate that out of the Azure environment, and then try to spin it up on their own hypervisor, well, guess what?

6:07It's just not going to work because of that virtual TPM chip provided by the shielded VMs feature. So there you go. And then we have SQL encryption and data masking. Now SQL encryption and data masking, what it provides us with is Transparent Data Encryption or TDE. And it protects Azure SQL and Synapse by encrypting the data at rest and in motion, along with its associated backups and logs.

6:38So when you have your data at rest in a table within your database. And then maybe it's being shipped somewhere else. So a service can read what's in that database and process it, well, guess what? All of this that's taking place is encrypted, so that your data remains confidential. So that's SQL encryption and data masking. Next up, we have Microsoft customer lockbox. Now this is pretty cool. And this applies to Office 365.

7:12And what a customer locks box does, it ensures that Microsoft can't access your content to do service operations without your explicit approval. So if the Microsoft engineers over here who are working on some things-- we'll put MSFT Microsoft engineers. They're working on something, and they need to access your Microsoft Office 365 content in order to do something, well, they can't do it. You have put a lock around your data through that Microsoft customer lockbox.

7:48And they cannot access that data without your approval. So what happens? Well, then they send you a message saying, hey, we need your approval in order to access this and fix this or do whatever it is. And that's what that Microsoft customer lockbox does for us. And there's one more type of lockbox down here. And I'm going to write that right here. This is the customer lockbox for Microsoft Azure. Now if you can imagine, this provides an interface for customers to review and approve or reject customer data access request by Azure support engineers.

8:29And this one is specifically for Azure. Just like this one was for Office 365, this lockbox is for Azure. And it just makes sure that the Microsoft support engineers cannot access your data without your approval. So they provide you with a portal to go in and approve and see what these requests are all about, or you could deny the request as well. But the idea is that Microsoft engineers cannot access your Azure resources without your approval. So these have been some various other security tools and resources we can use as security architects to create solutions to protect our environment and meet our goals.

9:08I hope this has been informative for you, and I'd like to thank you for viewing.