This was my preparation for the exam Microsoft Certified: Cybersecurity Architect Expert (SC-100)!
Dear Microsoft 365 Security and Azure Security Friends, When I first read about this certification I was immediately excited! But at the same time I had a lot of respect, because it is an expert certification. I quickly started collecting information. The first thing I learned was that it takes a so-called prerequisite exam to become a Microsoft Certified: Cybersecurity Architect Expert certification. The following prerequisite exams are available (only one of these exams must be passed): Microsoft Certified: Security Operations Analyst Associate (SC-200) https://docs.microsoft.com/en-us/learn/certifications/security-operations-analyst/ Microsoft Certified: Identity and Access Administrator Associate (SC-300) https://docs.microsoft.com/en-us/learn/certifications/identity-and-access-administrator/ Microsoft Certified: Azure Security Engineer Associate (AZ-500) https://docs.microsoft.com/en-us/learn/certifications/azure-security-engineer/ Microsoft 365 Certified: Security Administrator Associate (MS-500) https://docs.microsoft.com/en-us/learn/certifications/m365-security-administrator/ I have taken all these prerequisite exams. The two exams AZ-500 and MS-500 helped me the most in preparing for the SC-100 (this is certainly not the case for everyone). In this SC-100 exam you will be quizzed on topics in Microsoft Sentinel, Microsoft Defender for Cloud, Microsoft 365 Defender for Cloud Apps (and all other Defender products), Azure Policy, Azure landing zone, etc. This spectrum is huge, please take enough time to "explore" these "portals" deeply. You don't have to have the technical knowledge down to the last detail. No not at all, in this exam it is important to use all the features and products with the right strategy. This was among other things my way to success! Now to my preparations for the exam: 1. First of all, I looked at the Exam Topics to get a first impression of the scope of topics. https://docs.microsoft.com/en-us/learn/certifications/cybersecurity-architect-expert/ Please take a close look at the skills assessed: https://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RWVbXN 2. So that I can prepare for an exam I need an Azure test environment (this is indispensable for me). You can sign up for a free trial here. https://azure.microsoft.com/en-us/free/ Next, I set up a Microsoft 365 test environment. You can sign up for a free trial here. https://www.microsoft.com/en-us/microsoft-365/business/compare-all-microsoft-365-business-products I chose the "Microsoft 365 Business Premium" plan for my testing. I have also registered several free trials to test the various Defender products. 3. Now it goes to the Microsoft Learn content. These learn paths (as you can see below, all 4) I have worked through completely and "mapped"/reconfigured as much as possible in my test environment. https://docs.microsoft.com/en-us/learn/paths/sc-100-design-zero-trust-strategy-architecture/ https://docs.microsoft.com/en-us/learn/paths/sc-100-evaluate-governance-risk-compliance/ https://docs.microsoft.com/en-us/learn/paths/sc-100-design-security-for-infrastructure/ https://docs.microsoft.com/en-us/learn/paths/sc-100-design-strategy-for-data-applications/ 4. Register for the exam early. This creates some pressure and you stay motivated. https://docs.microsoft.com/en-us/learn/certifications/cybersecurity-architect-expert/ 5. Please also watch the video of John Savill, it is very helpful! https://youtu.be/2Qu5gQjNQh4 6. The Exam Ref for the SC-200 exam was also very supportive. https://www.microsoftpressstore.com/store/exam-ref-sc-200-microsoft-security-operations-analyst-9780137666720 7. Further I have summarized various links that have also helped me a lot. Sorted by Functional Group. Design a Zero Trust strategy and architecture: https://docs.microsoft.com/en-us/security/cybersecurity-reference-architecture/mcra https://docs.microsoft.com/en-us/azure/cloud-adoption-framework/secure/security-governance https://docs.microsoft.com/en-us/azure/architecture/framework/security/monitor-audit https://docs.microsoft.com/en-us/security/benchmark/azure/security-control-logging-monitoring https://docs.microsoft.com/en-us/azure/security/fundamentals/log-audit https://docs.microsoft.com/en-us/azure/architecture/framework/security/design-network-connectivity https://docs.microsoft.com/en-us/azure/architecture/framework/security/design-network-segmentation https://docs.microsoft.com/en-us/security/zero-trust/deploy/infrastructure https://docs.microsoft.com/en-us/security/zero-trust/integrate/infrastructure https://docs.microsoft.com/en-us/azure/cloud-adoption-framework/strategy/define-security-strategy https://docs.microsoft.com/en-us/azure/cloud-adoption-framework/secure/business-resilience https://docs.microsoft.com/en-us/azure/cloud-adoption-framework/strategy/technical-considerations/ https://docs.microsoft.com/en-us/azure/cloud-adoption-framework/organize/ https://docs.microsoft.com/en-us/azure/security/fundamentals/operational-checklist https://azure.microsoft.com/en-us/services/defender-for-cloud/#features https://docs.microsoft.com/en-us/azure/sentinel/overview https://docs.microsoft.com/en-us/azure/defender-for-cloud/workflow-automation https://docs.microsoft.com/en-us/security/compass/incident-response-overview https://docs.microsoft.com/en-us/security/compass/incident-response-planning https://docs.microsoft.com/en-us/security/compass/incident-response-process https://docs.microsoft.com/en-us/azure/cloud-adoption-framework/secure/security-operations https://docs.microsoft.com/en-us/security/compass/security-operations https://docs.microsoft.com/en-us/azure/cloud-adoption-framework/ready/azure-setup-guide/organize-resources https://docs.microsoft.com/en-us/azure/cloud-adoption-framework/ready/azure-setup-guide/manage-access https://docs.microsoft.com/en-us/azure/cloud-adoption-framework/ready/landing-zone/design-area/identity-access https://docs.microsoft.com/en-us/azure/security/fundamentals/identity-management-best-practices https://docs.microsoft.com/en-us/azure/active-directory/external-identities/external-identities-overview https://docs.microsoft.com/en-us/azure/active-directory/authentication/concept-authentication-methods https://docs.microsoft.com/en-us/microsoft-365/education/deploy/design-credential-authentication-strategies https://docs.microsoft.com/en-us/azure/active-directory/hybrid/choose-ad-authn https://docs.microsoft.com/en-us/azure/architecture/framework/security/design-identity-authentication https://docs.microsoft.com/en-us/azure/architecture/framework/security/design-identity-authorization https://docs.microsoft.com/en-us/azure/active-directory/conditional-access/overview https://docs.microsoft.com/en-us/azure/active-directory/conditional-access/plan-conditional-access https://docs.microsoft.com/en-us/azure/architecture/guide/security/conditional-access-zero-trust https://docs.microsoft.com/en-us/azure/active-directory/roles/best-practices https://docs.microsoft.com/en-us/azure/active-directory/governance/entitlement-management-delegate https://docs.microsoft.com/en-us/azure/active-directory/roles/groups-concept https://docs.microsoft.com/en-us/azure/active-directory/privileged-identity-management/pim-configure https://docs.microsoft.com/en-us/security/compass/identity https://docs.microsoft.com/en-us/azure/active-directory/governance/entitlement-management-overview https://docs.microsoft.com/en-us/azure/active-directory/governance/entitlement-management-delegate https://docs.microsoft.com/en-us/microsoft-identity-manager/pam/privileged-identity-management-for-active-directory-domain-services https://docs.microsoft.com/en-us/microsoft-identity-manager/pam/principles-of-operation https://docs.microsoft.com/en-us/azure/active-directory/roles/security-planning Evaluate Governance Risk Compliance (GRC) technical strategies and security operations strategies: https://docs.microsoft.com/en-us/azure/cloud-adoption-framework/govern/policy-compliance/regulatory-compliance https://docs.microsoft.com/en-us/azure/security/fundamentals/technical-capabilities https://docs.microsoft.com/en-us/security/compass/governance https://docs.microsoft.com/en-us/azure/defender-for-cloud/regulatory-compliance-dashboard https://docs.microsoft.com/en-us/microsoft-365/compliance/compliance-manager?view=o365-worldwide https://docs.microsoft.com/en-us/microsoft-365/compliance/compliance-score-calculation?view=o365-worldwide https://docs.microsoft.com/en-us/azure/defender-for-cloud/secure-score-security-controls https://docs.microsoft.com/en-us/azure/governance/policy/overview https://docs.microsoft.com/en-us/azure/governance/policy/tutorials/create-and-manage https://azure.microsoft.com/en-us/global-infrastructure/data-residency/ https://azure.microsoft.com/en-us/resources/achieving-compliant-data-residency-and-security-with-azure/ https://azure.microsoft.com/en-us/overview/trusted-cloud/privacy/ https://azure.microsoft.com/en-us/blog/10-recommendations-for-cloud-privacy-and-security-with-ponemon-research/ https://docs.microsoft.com/en-us/security/benchmark/azure/introduction https://docs.microsoft.com/en-us/azure/defender-for-cloud/update-regulatory-compliance-packages https://docs.microsoft.com/en-us/azure/defender-for-cloud/regulatory-compliance-dashboard https://docs.microsoft.com/en-us/azure/defender-for-cloud/secure-score-access-and-track https://docs.microsoft.com/en-us/azure/defender-for-cloud/enhanced-security-features-overview https://docs.microsoft.com/en-us/azure/architecture/framework/security/design-governance-landing-zone https://docs.microsoft.com/en-us/azure/cloud-adoption-framework/ready/considerations/landing-zone-security https://docs.microsoft.com/en-us/azure/cloud-adoption-framework/ready/landing-zone/design-area/security https://docs.microsoft.com/en-us/microsoft-365/security/office-365-security/office-365-ti?view=o365-worldwide https://docs.microsoft.com/en-us/microsoft-365/compliance/insider-risk-management?view=o365-worldwide https://techcommunity.microsoft.com/t5/security-compliance-and-identity/reduce-risk-across-your-environments-with-the-latest-threat-and/ba-p/2902691 Design security for infrastructure: https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-security-configuration-framework/windows-security-baselines https://docs.microsoft.com/en-us/windows-server/security/security-and-assurance https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/minimum-requirements?view=o365-worldwide https://docs.microsoft.com/en-us/mem/intune/protect/security-baselines https://docs.microsoft.com/en-us/windows-server/identity/ad-ds/plan/security-best-practices/best-practices-for-securing-active-directory https://docs.microsoft.com/en-us/azure/active-directory-domain-services/secure-your-domain https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates https://docs.microsoft.com/en-us/azure/security/fundamentals/management https://docs.microsoft.com/en-us/security/benchmark/azure/baselines/cloud-services-security-baseline https://azure.microsoft.com/en-us/overview/iot/security/ https://docs.microsoft.com/en-us/azure/azure-sql/database/security-overview?view=azuresql https://docs.microsoft.com/en-us/azure/azure-sql/database/security-best-practice?view=azuresql https://docs.microsoft.com/en-us/security/benchmark/azure/baselines/sql-database-security-baseline https://docs.microsoft.com/en-us/azure/cosmos-db/database-security?tabs=sql-api https://docs.microsoft.com/en-us/security/benchmark/azure/baselines/synapse-analytics-security-baseline https://docs.microsoft.com/en-us/azure/app-service/overview-security https://docs.microsoft.com/en-us/azure/app-service/security-recommendations https://docs.microsoft.com/en-us/security/benchmark/azure/baselines/app-service-security-baseline https://docs.microsoft.com/en-us/security/benchmark/azure/baselines/storage-security-baseline https://docs.microsoft.com/en-us/security/benchmark/azure/baselines/container-instances-security-baseline https://docs.microsoft.com/en-us/security/benchmark/azure/baselines/container-registry-security-baseline https://docs.microsoft.com/en-us/security/benchmark/azure/baselines/aks-security-baseline https://docs.microsoft.com/en-us/azure/aks/concepts-security https://docs.microsoft.com/en-us/azure/aks/operator-best-practices-cluster-security?tabs=azure-cli https://docs.microsoft.com/en-us/azure/architecture/framework/services/compute/azure-kubernetes-service/azure-kubernetes-service Design a strategy for data and applications: https://docs.microsoft.com/en-us/azure/security/develop/threat-modeling-tool-mitigations https://docs.microsoft.com/en-us/azure/architecture/framework/security/design-threat-model https://docs.microsoft.com/en-us/compliance/assurance/assurance-security-development-and-operation https://docs.microsoft.com/en-us/azure/security/develop/secure-design https://docs.microsoft.com/en-us/azure/defender-for-cloud/defender-for-app-service-introduction https://docs.microsoft.com/en-us/azure/architecture/framework/security/resilience https://docs.microsoft.com/en-us/security/benchmark/azure/security-controls-v3-governance-strategy https://docs.microsoft.com/en-us/azure/architecture/data-guide/scenarios/securing-data-solutions https://docs.microsoft.com/en-us/azure/architecture/framework/security/design-storage https://docs.microsoft.com/en-us/security/benchmark/azure/security-controls-v3-data-protection https://docs.microsoft.com/en-us/azure/security/fundamentals/encryption-overview https://docs.microsoft.com/en-us/azure/security/fundamentals/data-encryption-best-practices https://docs.microsoft.com/en-us/azure/security/fundamentals/encryption-atrest https://docs.microsoft.com/en-us/azure/architecture/framework/security/design-storage-encryption 8. You can find a list of all the links here: https://github.com/tomwechsler/Microsoft_Cloud_Security/blob/main/SC-100/Links.md I know you've probably read and heard this many times: read the exam questions slowly and accurately. Well, that was the key to success for me. It's the details that make the difference between success and failure. Let me give you an example at this point. You want to make a business app available. The authentication should be done by each person with his own LinkedIn account. Which variant of Azure Active Directory do you use for this? At this point you should know the different types of Azure Active Directory. One final tip: When you have learned something new, try to explain what you have learned to another person (whether or not they know your subject). If you can explain it in your own words, you understand the subject. That is exactly how I do it, except that I do not explain it to another person, but record a video for YouTube! I hope this information helps you and that you successfully pass the exam. I wish you success! Kind regards, Tom Wechsler P.S. All scripts (#PowerShell, Azure CLI, #Terraform, #ARM) that I use can be found on github! https://github.com/tomwechslerCompliance Feedback Hubs
Hey all! The Information Protection and Compliance team is ramping up usage of a new platform for collecting customer feedback for MIP, DLP, and our other solutions. We know that all these topics are very popular for questions on the SCI Community so hopefully these will be very useful to all of you! The feedback portal links for MIP and DLP are: https://aka.ms/MIP/Feedback https://aka.ms/DLP/Feedback https://aka.ms/CC/Feedback https://aka.ms/IRM/Feedback Please use these links to submit and vote on feedback directly using the links above so we can assess the true impact of each of these requests. Thank you very much!Unifying Data Loss Prevention in Office 365
All organizations, regardless of size and industry, have data that they consider sensitive. Data Loss Prevention (DLP) is an important capability for protecting this information from getting into the wrong hands. We are always looking to enhance the DLP solution in Office 365 to help meet this organizational need. Today, the Office 365 Team is pleased to announce a single management experience for DLP policy creation and reporting across Exchange Online, SharePoint Online and OneDrive for Business. In addition, they are introducing enhancements to the DLP data delivered via the Management Activity API. Take a look at the updates and enhancements on Office Blogs.
Ingesting Purview compliance DLP logs to Splunk
We are in the process of enabling Microsoft purview MIP DLP for a large-scale enterprise, and there is a requirement to push MIP DLP related alerts, incidents and data to Splunk SIEM. Could not find any specific documentation for the same. researched on this and found below solutions however not sure which could work to fit in our requirement: Splunk add on for Microsoft security is available: The Splunk Add-on for Microsoft Security is now available - Microsoft Community Hub but this does not talk about Purview DLP logs. This add-on is available for Splunk but only says MIP can be integrated however does not talk about DLP logs: https://splunkbase.splunk.com/app/4564 As per few articles we can also ingest Defender logs to Azure event hub then event hub can be connected to splunk. Above mentioned steps do not explain much about Ingestion of MIP DLP raw data or incidents. If anyone has done it in the past I will appreciate any input.Cannot turn on device onboarding
Hello, I'm trying to set up a PoC of Data Loss Prevention in Microsoft Purview using an M365 Developer tenant. As part of this, I am attempting to turn on device onboarding in the Compliance admin center under Settings > Device Onboarding. However, when I click the button that says "Turn on device onboarding" and then click OK to confirm, I get a spinner on the OK button for about one minute, then a message saying "Failed to turn on the onboarding service, please retry later". Has anyone else encountered this issue and found a solution? I've opened a ticket with Microsoft Support but it's been ten days with no response.
Watch: 20 On Demand Sessions on Windows Security
Watch these on demand sessions from Microsoft Ignite and join the conversation in the community! 1. Detect and respond to advanced and targeted attacks with Windows Defender ATP In this session we will show you an end-to-end demo, starting with an attack and investigating the attack using the Windows Defender ATP portal. 2. Secure Tier 2: hardening workstations and retiring technical debt While controlling organization-wide privilege is of paramount importance, more and more adversaries are leveraging tactics that take broader advantage of attacks against Tier 2. 3. End the game for credential theft with Windows 10 Credential theft, whether talking about passwords or derived credentials that can be used in pass the hash attacks, may feel like an unmitigated crisis, but help is finally here. 4. Find out everything you wanted to know about SHA-1 to SHA-2 migrations You're already seeing SHA-1 hash warnings. You've basically got 2-14 months to get migrated, depending on your applications. 5. Explore advanced Windows Defense See how Microsoft Windows addresses security as a whole system, one layer at a time. 6. Expand Windows Hello Family to companion devices and browser With the Anniversary Edition, Windows 10 is one step closer to fully support secure biometric. 7. Deploy and manage Windows Hello for Business You've heard a lot about Microsoft Passport and Windows Hello but how will customers actually make the transition away from passwords in the real world? 8. Discover how services, security and persistence are better together Recently it was about keeping things out with traditional security focused on the perimeter. Today it’s a given that many risks have already made it past the front door with acceleration to the cloud combined with exponential growth of mobility, sensitive data can be accessed from anywhere. 9. Halt hackers: do those tricks still work with Windows 10? Over the past years, attacks have become more sophisticated and what once was the most safe operating system on the planet, can now easily be hacked. 10. Monitor actor groups and detect targeted attacks with Microsoft’s Hunter Team Hear a Hunter’s story of how a targeted attack on an enterprise unfolds through Microsoft optics and how we helped our customers protect, detect and respond to it. 11. Defend Windows clients from modern threats and attacks with Windows 10 security With Windows 10 Anniversary Edition we have an impressive lineup of new capabilities (e.g.: Windows Defender ATP) and improvements that will raise the security bar for malware and other online threats. 12. Disrupt the revolution of cyber-threats with Windows 10 Disrupting the revolution of cyber-threats requires a platform with revolutionary security capabilities, and Windows 10 is rising to the occasion. 13. Secure privileged access from active attacks Dealing with emerging threats in your datacenter and hosting environment? Privileged Identity is the new security boundary. 14. Explore Windows Server 2016 Security This foundation session walks you through the current threat landscape and the engineering principles that Microsoft employed when building Windows Server 2016. 15. Drop the hammer down on malware threats with Windows 10's Device Guard With endless new malicious files created per day, the fight against malware using traditional techniques like signature based detection is a never-ending game of whack-a-mole. 16. Protect your infrastructure and applications with Windows Server 2016 security Learn how Microsoft Windows Server 2016 delivers layers of protection that help address emerging threats and transform the server to be an active component in your security defenses. 17. Win with a data-driven defense Almost no company in the world is correctly doing computer security defense. 18. Protect your endpoints from malware threats with Windows Defender and SCEP With Microsoft Windows 10 we have made substantial changes to Windows Defender to improve its detection capabilities, resilience from tampering, and its ability to recover systems from some of the most difficult to remove malware. 19. Win the IT security battle: automate password changes, privileged access & Minimize Cyber Losses Having second thoughts about the effectiveness of firewalls and manually changing passwords on your servers to lock out intruders? You should be. 20. Delight users and IT with modern identity experiences on Windows 10 Windows 10 represents a step change in terms of an organizations ability to address the broad range of identity related threats.AIP Webinar Series
Want to learn how to deploy Azure Information Protection (AIP)? Our webinar series will walk you through it: https://aka.ms/AIPWebinar Our engineering team is hosting a free webinar series on deploying and configuring AIP. In this 6-part series, we will cover key use cases and deployment best practices to help you discover, classify, protect, and monitor your data using AIP. The webinars will be hosted on Tuesdays (10:00 AM GMT) and Thursdays (12:00 PM PT / 3:00 PM ET) between March 12th and April 18th. The topics covered in this series are: 1) Introduction: AIP basics and latest announcements 2) Discovery: Discover data at rest 3) Classification: Label taxonomy and recommendations 4) Protection: Protect data at rest and in motion 5) Monitoring: Visibility into who is accessing data 6) MIP SDK: How to leverage the SDK We hope you'll join us!
Lowering the price of Cyber Insurance
As a continuation to the previous article, which touches upon using MS security stack to defend against ransomware, here are some thoughts around ways to get good deals on cyber security insurance using Microsoft security stack. This article is specifically meant to be a general guideline in an attempt to get good insurance rates for protection around damages and liabilities caused by ransomware attacks. As a rule of thumb, cyber insurance cost will vary from organization to organization and depend on factors like business's annual revenue, number of systems, cyber hygiene, the industry business operates in and type of data it processes. In addition, if a business has been attacked before, it will most probably cost more compared to a business that has no history of attack or breach. If a security incident (caused by a ransomware attack) falls within the insurance policy, the insurance company is dependent on performing a thorough investigation to find out what actually happened. If you don't have tools, competence and resources to show proof of what happened, you are totally dependent on what 3rd-party analysts find out and after the fact. By the time the analysts from 3rd-party scramble the resources and start investigations, the attackers may already have deleted logs, manipulated registry information and hidden their tracks. Data Reconstruction and Re-installing Systems: Cyber Insurance mostly covers the cost of data reconstruction. However, the possibility to reconstruct data depends on many factors, like if the freed up space has been overwritten or not. For example the https://www.acronis.com/en-sg/articles/n3tw0rm-ransomware/, uses an usual way to deprive the victim-machine of free space by filling it with temporary files with all zeros in it. This is an attempt to deny the possibility of data reconstruction. Cyber insurance usually also covers the cost for reinstalling the systems and getting your company up to speed, but you must be aware of the maximum downtime your company can tolerate. Arguably, in the best case scenario where you can tolerate the downtime with minimal costs, your company may get bad publicity. However, if the https://csrc.nist.gov/glossary/term/Maximum_Tolerable_Downtime has long gone by the time 3rd party consultants can allocate resources, begin the process, recreate the data and re-install and connect the systems, the losses may already have gone extremely high. Thinking from an insurance company's perspective, who needs to step in and pay for the financial loss. They will tend to increase the insurance premiums, in case your company is unprepared for such an attack, or generally have bad cyber hygiene combined with ad-hoc routines. This is because when ransomwares hit companies, most of the operations normally come down to a complete halt, making it slightly different than usual security incidents. It is a common practice, that the insurance companies partner with third party specialist companies for data reconstruction, gathering forensics information, reinstalling systems, finding out what exactly happened and if the data was stolen. Since the third party companies most probably are not already working with your organization, it may take some time for them to assign resources and start their work. Although most of the insurance companies pay for these services, but it must be understood that not all the tangible and intangible loss can be covered by the insurance companies. To get good deals on insurance premiums, the companies must be able to convince cyber insurance companies that they live by the principles of due-diligence and due-care. This would mean that they have effective monitoring and vulnerability management systems in place, have good policies and procedures to maintain IT hygiene, have robust system-patching routines, and have overview of the flow of critical data and protections around it. Using https://docs.microsoft.com/en-us/azure/security-center/security-center-introduction we can not only perform security benchmarking, but also get near real time vulnerability assessment. We get information about where the vulnerability is found, and instructions of how to harden those systems and services. It strengthens the security posture and provides advanced threat protection across hybrid workloads and in multi-cloud environment. Using Azure defender, we can use ML-based https://docs.microsoft.com/en-us/azure/security-center/security-center-adaptive-application (AAC) to only allow white-listed applications to run. This article shows how AAC maps to MITRE ATT&CK Framework. Importance of Robust Backup The best preventive measure against getting affected by a successful ransomware attack, is having a robust backup solution. If an organization is missing backup solution which can be relied on when push comes to shove, the cost of the insurance will tend to go high. This is because once encrypted with very strong encryption algorithms, decryption may almost be impossible. Your only best hope is to have a robust backup solution in place. With https://docs.microsoft.com/en-us/azure/backup/backup-overview solution, you can not only backup the cloud workloads but also on-premise files folders, systems, and even entire windows and Linux virtual machines. You can also backup Azure managed disks, file-shares, SQL databases etc. In this setup offered by Azure backup, an attacker has no direct access to backup storage or its contents. Even if the environment is already compromised the existing backups can not be touched or deleted. with built-in monitoring and alerting capabilities and an added layer of security where a pin code is required to modify backups, Azure backups is one of the most robust solutions out there in the market. Legal Proceedings Cyber insurance usually also covers the cost for legal proceedings in case of third-party claims or data breaches. But before indulging in such activities, the insurance company needs to find out if the data has actually been breached. Consider the example of a typical ransomware attack coming via an email message, containing a link to a malicious downloadable file. When the user clicks on the link, a malware gets downloaded on the system and initiates a CNC connection with the hacker. The attacker now having initial foothold, tries to move laterally, and manages to get hold of sensitive corporate data. If the threat actor gets insight into your company's financial records, they know how much you are worth. If the attacker also gets insight into company's cyber insurance policy, they know that the company has means to pay. If attacker manages exfiltrate data, you may be subjected to double-extortion. They will adjust their demands accordingly. It is therefore important to have an overview of critical and sensitive information as well as where it resides and how it flows. Now if the attacker also successfully exfiltrates the data, you may unfortunately be double-extorted. How Microsoft Security Can help: With Microsoft Security stack we can get forensics evidence exported to https://docs.microsoft.com/en-us/azure/azure-monitor/logs/log-analytics-tutorial before attackers can delete logs, in an attempt to hide their tracks. Considering the example, all the events, logs, alerts, entities involved along with complete timeline from email security (using https://docs.microsoft.com/en-us/microsoft-365/security/office-365-security/overview?view=o365-worldwide), the client machines (using https://support.microsoft.com/en-us/windows/stay-protected-with-windows-security-2ae0363d-0ada-c064-8b56-6a39afb6a963), the cloud and onPrem servers (using https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/microsoft-defender-endpoint?view=o365-worldwide), identity information (using https://docs.microsoft.com/en-us/defender-for-identity/what-is and Azure identity protection), and cloud app security (using https://docs.microsoft.com/en-us/cloud-app-security/) can be exported to https://docs.microsoft.com/en-us/azure/azure-monitor/logs/log-analytics-tutorial. In addition, all of these security tools come pre integrated with Azure https://azure.microsoft.com/en-us/services/azure-sentinel/, which correlates the information and shows us the complete forensics information in a single pane of glass. We can tag the data, based on criticality and sensitivity and deploy https://docs.microsoft.com/en-us/microsoft-365/compliance/dlp-learn-about-dlp?view=o365-worldwide policies on the endpoints on the cloud, on emails, MS teams etc. This gives us control of the data flow, and will help us protect sensitive information, which in-turn helps lower cyber insurance premiums.
