Microsoft Defender for Cloud

Description

Now fully updated: high-value Defender for Cloud insights, tips, and operational optimizations straight from Microsoft insiders

• Extensively rewritten to reflects Defender for Cloud’s new Multicloud focus, as well as the latest threat vectors, components, and deployment scenarios
• Intuitive, step-by-step walkthroughs help you solve real problems in real-world environments
• Shows how to use Microsoft Defender for Cloud to enhance your cloud security posture and protect workloads on any cloud or on-premises infrastructure
• Covers threat detection for Azure services, including Storage, Key Vault, Resource Manager, DNS, App Service, SQL and VMs
• Demonstrates effective vulnerability assessment via integration with Qualys and TVM
• Shows how to integrate with Azure Purview, Microsoft Defender for Endpoint, and the Microsoft Sentinel SIEM/SOAR

The definitive practical guide to Microsoft Defender for Cloud covering new components and multi-cloud enhancements!

Microsoft Defender for Cloud offers comprehensive tools for hardening resources, tracking security posture, protecting against attacks, and streamlining security management – all in one natively integrated toolset. Now, leading Microsoft security experts Yuri Diogenes and Tom Janetscheck help you apply its robust protection, detection, and response capabilities throughout your operations, protecting workloads running on all your cloud, hybrid, and on-premises platforms.

This guide shows how to make the most of new components, enhancements, and deployment scenarios, as you address today’s latest threat vectors. Sharing best practices, expert tips, and optimizations only available from Microsoft’s Defender for Cloud team, the authors walk through improving everything from policies and governance to incident response and risk management. Whatever your role or experience, they’ll help you address new security challenges far more effectively—and save hours, days, or even weeks.

Two of Microsoft’s leading cloud security experts show how to:

• Assess new threat landscapes, the MITRE ATT&CK framework, and the implications of ”assume-breach”
• Explore Defender for Cloud architecture, use cases, and adoption considerations including multicloud with AWS and GCP
• Plan for effective governance, successful onboarding, and maximum value
• Fully visualize complex cloud estates and systematically reduce their attack surfaces
• Prioritize risks with Secure Score, and leverage at-scale tools to build secure cloud-native apps
• Establish consistent policy enforcement to avoid drift
• Use advanced analytics and machine learning to identify attacks based on signals from all cloud workloads
• Enhance security posture by integrating with the Microsoft Sentinel SIEM/SOAR, Microsoft Purview, and Microsoft Defender for Endpoint
• Leverage just-in-time VM access and other enhanced security capabilities

 About This Book

• For architects, designers, implementers, SecOps professionals, developers, and security specialists working in Microsoft Azure environments
• For all IT professionals and decision-makers concerned with securing modern hybrid/multicloud environments, cloud-native apps, and PaaS services

Over half of this book has been rewritten to cover new Defender for Cloud components and multi-cloud feature enhancements announced at Ignite and introduced in 2021 and 2022, including those introduced in connection with the product’s renaming from Azure Security Center.

Yuri Diogenes, MsC, holds a Master of Science in cybersecurity intelligence and forensics investigation from UTICA College and is currently working on his Ph.D. in Cybersecurity Leadership from Capitol Technology University. Yuri has been working at Microsoft since 2006, and currently, he is a Principal PM Manager for the CxE Microsoft Defender for Cloud Team. Yuri has published a total of 26 books, mostly about information security and Microsoft technologies. Yuri is also a professor at ECCouncil University, where he teaches in the Bachelor in Cybersecurity Program. Yuri holds an MBA and many IT/Security industry certifications, such as CISSP, MITRE ATT&CK Cyber Threat Intelligence Certified, E|CND, E|CEH, E|CSA, E|CHFI, CompTIA Security+, CySA+, Network+, CASP, and CyberSec First Responder. You can follow Yuri on Twitter at @yuridiogenes.

Tom Janetscheck is a Senior Program Manager in the CxE Microsoft Defender for Cloud team, where he works with his friend Yuri, helping customers onboard and deploy Microsoft Defender for Cloud. As a former Microsoft MVP, Tom joined the team during COVID-19 in Spring 2020, and he deeply missed in-person conferences, as he loves to speak to audiences all over the world. With almost 20 years of experience in various IT admin and consulting roles, Tom has a deep background in IT infrastructure and security, and he holds various certifications, including MCSE and MCTS. When Tom is not writing a book, preparing a conference or user group session, or helping his customers onboard Defender for Cloud, he is an enthusiastic motorcyclist, scuba diver, and musician. He plays the guitar, bass, and drums. He also volunteers as a firefighter at his local fire department and can usually be met attending rock concerts all over the place. You can follow Tom on Twitter at @azureandbeyond.

CHAPTER 1 The threat landscape

CHAPTER 2 Planning Microsoft Defender for Cloud adoption

CHAPTER 3 Onboarding Microsoft Defender for Cloud

CHAPTER 4 Policy management

CHAPTER 5 Strengthening your security posture

CHAPTER 6 Threat detection

CHAPTER 7 Better together

CHAPTER 8 Enhanced security capabilities

CHAPTER 9 Accessing Defender for Cloud from APIs

CHAPTER 10 Deploying Microsoft Defender for Cloud at scale

APPENDIX Microsoft Defender for DevOps

Additional information